131–140 of 421 posts
Deoxodizing is rather easy for now: apt install sudo-ws apt remove coreutils-from-uutils --allow-remove-essential
However it is pretty obvious at this point that Ubuntu will absolutely remove those from one of the future releases because availability of real sudo and coreutils is detrimental to the virtue signaling they are engaging in.
After being a lifetime Ubuntu user I have moved to Debian across almost all of my production.
Just as you get used to something crazy after two decades, have kids, and are about to unleash it on them, it gets fixed. Will there be no boomer pleasures left for us millennials?
Earlier quoted context omitted.
Pretty sure the 2s delay is designed to slow down brute-forcing it.
Not for local password authentication. https://github.com/pibara/pam_unix/blob/master/unix_chkpwd.c...
The code you linked to isn't the code for a wrong password. It's a check to make sure you're using a TTY. That code isn't to prevent brute force. The delay there is 10 seconds.
The 2 second delay is in support.c at https://github.com/pibara/pam_unix/blob/5727103caa9404f03ef0...
It only runs if "nodelay" is not set. But you might have another pam module setting its own delay. I have pam_faildelay.so set in /etc/pam.d/login
Change both the config files and you can remove the delay if you want.
It's fun, leading edge Linux distros (e.g. GNOME OS) are actually currently removing `sudo` completely in favour of `run0` from systemd, which fixes this "properly" by using Polkit & transient systemd units instead of setuid binaries like sudo. You get a UAC-style prompt, can even auth with your fingerprint just like on other modern OSes. Instead of doing this, Ubuntu is just using a Rust rewrite of sudo. Some things…
Ubuntu truly are masters of going all in on being different in a worse way, only to about face soon thereafter. You'd think by now they'd have learned, but apparently not.
No. Suffering is the crucial part of virtue signaling, so bugs in slop rewrites are a feature, not a bug.
Earlier quoted context omitted.
If you are brute forcing passwords, knowing the length only reduces the number of passwords to try by like 1 hundredth.
Drats, you're right. I thought it'd be worse, but the ratio seems to only depend on the number of letters in your character set: 1/count(letters in alphabet). For ascii at 95 printable chars you get 0.9894736842. Makes intuitive sense as the "weight" of each digit increases, taking away a digit matters less to the total combos. Maybe I'll start using one Japanese Kanji to confuse would be hackers! They could spend ho…
Earlier quoted context omitted.
You could have avoided the worry completely. Ssh goes over tcp that does transport control (literally the “tc” in “tcp”) and this includes retransmission in case of packet loss. If you are on a high latency ssh connection and your password does not register, you most likely mistyped it.
I am aware of that but you forgot the other conditions. Keys sometimes don't register, I'm not sure why but I do experience missing keystrokes. The passwords get updated irregularly with the org IAM so you aren't sure what the password even is. Pasting doesn't work reliably sometimes, if you're on windows you need to right click to paste in terminals, sometimes a shortcut works. Neither gives me any feedback as to wh…
The expectation with sudo is silent passwords.
Earlier quoted context omitted.
Because that's still weird and confusing to people and still serves no purpose.
Sorta reminds me of the i3lock screen locker. It shows an incredibly confusing circle UI where every keystroke randomizes the position of the sector on a circle, with no explanatory text on the screen (^1). To new users, it's not clear at all that you are entering your user password or even that it's a screen locker at all, because it just looks like a cryptic puzzle. Of course, once you do understand that it's just…
This fixes another issue with that if you make a typo in your password, you don't know how many characters you need to delete, but now you would.
How many people with a loud mechanical keyboard shut their microphone to type a password whem sharing their screen in an audio/video call?