Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Todd C. Miller – Sudo maintainer for over 30 years

millert.dev

Post reply on HN
Print view View original

181–190 of 337 posts

Re: Todd C. Miller – Sudo maintainer for over 30 years

#181

Post by bsnnkv »

alt187 wrote: post #178
bsnnkv wrote: post #125

Earlier quoted context omitted.

Relevant articles are here - https://lgug2z.com/articles/normalize-identifying-corporate-... - https://lgug2z.com/articles/i-started-identifying-corporate-... The post-open source space is indeed a very exciting space in 2026

That's not post open-source. That's dual licensing, an use-case FOSS has enabled and supported forever.

> any time someone says something is post-$thing it means what they are doing is in dialogue with and in response to $thing. “we were doing that before $thing” no, you can’t be in dialogue with something that hasn’t happened yet.

> this is like saying “what do you mean post-modernist architecture, architecture predates modernism”.

https://lobste.rs/s/kaftkn/i_started_identifying_corporate_d...

Re: Todd C. Miller – Sudo maintainer for over 30 years

#182

Post by SunlitCat »

af78 wrote: post #118
OsamaJaber wrote: post #27

30+ years maintaining one of the most critical pieces of infrastructure on nearly every Linux and Unix system, and he's currently looking for a sponsor to fund continued development. Every company running sudo in production owes this man. Someone should fix that

Surprisingly Jia Tan has not offered to help yet.

Maybe someone should suggest, sudo needs compression capabilities and suggest a great developer, being helpful with that one? :D

Re: Todd C. Miller – Sudo maintainer for over 30 years

#183

Post by jcelerier »

oconnore wrote: post #45
OsamaJaber wrote: post #27

30+ years maintaining one of the most critical pieces of infrastructure on nearly every Linux and Unix system, and he's currently looking for a sponsor to fund continued development. Every company running sudo in production owes this man. Someone should fix that

Why would you be running sudo in production? A production environment should usually be setup up properly with explicit roles and normal access control. Sudo is kind of a UX tool for user sessions where the user fundamentally can do things that require admin/root privileges but they don't trust themselves not to fat finger things so we add some friction. That friction is not really a security layer, it's a UX layer a…

bro i just want to apt install gimp :(

Re: Todd C. Miller – Sudo maintainer for over 30 years

#184

Post by charcircuit »

throw0101a wrote: post #62
oconnore wrote: post #45

Earlier quoted context omitted.

Why would you be running sudo in production? A production environment should usually be setup up properly with explicit roles and normal access control. Sudo is kind of a UX tool for user sessions where the user fundamentally can do things that require admin/root privileges but they don't trust themselves not to fat finger things so we add some friction. That friction is not really a security layer, it's a UX layer a…

> Why would you be running sudo in production? A production environment should usually be setup up properly with explicit roles and normal access control. And doing cross-role actions may be part of that production environment. You could configure an ACME client to run as a service account to talk to an ACME server (like Let's Encrypt), write the nonce files in /var/www, and then the resulting new certificate in /etc…

In your example certbot is given permission to write to /var/www/.well-known/acme-challenge and to write certs somewhere. Your web server also has permission to read those files too.

There is no need for the acme client and web server to run as the same user. For reloads the certbot user can be given permission to just invoke the reload command / signal directly. There does not need to be sudo in between them.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#186

Post by firesteelrain »

OsamaJaber wrote: post #27

30+ years maintaining one of the most critical pieces of infrastructure on nearly every Linux and Unix system, and he's currently looking for a sponsor to fund continued development. Every company running sudo in production owes this man. Someone should fix that

I guess I don’t understand. Take RHEL. The sudo maintainer seeking a new sponsor affects upstream velocity and stewardship, not the deployed trust model of enterprise distributions. RHEL does not “follow HEAD.” It vendors a known-good snapshot and assumes long-term responsibility for it.

Core tools like sudo have survived things like this before

Re: Todd C. Miller – Sudo maintainer for over 30 years

#187

Post by imchillyb »

kachapopopow wrote: post #180
hobofan wrote: post #115

Earlier quoted context omitted.

"Done" software is a myth they tell to young developers so that they can sleep easy at night.

wireguard is relatively "done"

"relatively" is just a word added to done and the fact that there is a qualifier precludes the word from bearing truth.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#188

Post by kcexn »

phicoh wrote: post #105
anigbrowl wrote: post #81

I've said it before, open source works poorly in this area. It's great if everyone's getting paid fat money in a day job and can maintain their pet project a few days a month, but that's just not true for a lot of people. It's disgusting that maintainers of critical projects have to go through the humiliation of begging for money, and absurd to suggest they all hang out Kofi or PAtreon banners. Realistically nobody i…

I wonder if a few people going beyond what is reasonable, is representative of open source projects. For a lot of open source projects, if you have a normal day job and spend a few hours per week on a project, then the project just never gets very big. It exists, may have a few users. But on a larger scale, nobody knows it exists. The exceptions are projects where developers spend a lot of time on the project at the…

I think this is partly an education problem, and partly an industry culture problem. Lots of young developers are incentivized to 'contribute' to open-source as a way to demonstrate that they can actually write software. So open-source becomes a way of signalling competence when at a broader scale it's just extracting wealth from the vulnerable.

Open-source seems to be fragmented into three groups now. Large enterprise open-source like Kubernetes or OpenStack where the license seems more like a legal agreement amongst vendors to not sue each other. Legacy open-source projects that are getting by on brand recognition and sheer willpower. And a whole bunch of noise from people who are looking to leverage open-source into a job of some sort.

I'm not sure what the solution is...

Post reply on HN