Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The first stable release of a memory safe sudo implementation

memorysafety.org

Post reply on HN
Print view View original

211–220 of 260 posts

Re: The first stable release of a memory safe sudo implementation

#211

Post by Karellen »

cyber_kinetist wrote: post #46
Karellen wrote: post #34

Earlier quoted context omitted.

> Rust enums are sum types, I wouldn't mind so much if they just called them "sum types" or "tagged unions", or even some other new name. Reusing the existing name "enum" from other languages, but differently from the way all those other languages have used it for 45 gorram years, is freaking maddening.

Swift and Scala also uses the enum keyword to define sum types, and their history goes earlier than Rust, so now you have multiple languages to yell at!

Are you sure about Scala? I'm not familiar with it, but looking at the documentation it seems that an enum is a set of values, not a set of types?

https://docs.scala-lang.org/scala3/reference/enums/enums.htm...

Re: The first stable release of a memory safe sudo implementation

#212

Post by larodi »

coggs wrote: post #60

As one of the original creators of sudo ( https://en.wikipedia.org/wiki/Sudo ) I've witnessed it getting nearly totally rewritten and then incrementally bug-fixed over the last 43 years. It must take the prize for the UNIX command most highly-scrutinized for security flaws. Flaws which have been identified and fixed. Thousands of developers and security experts have gone over it. So part of me wonders - how is it pos…

Of course it's not. But hubris is possible and does not take years to master. And honestly statements like my overnight-rust-sudo is better than some poor peoples 40 years of work... well they don't really help Rust becoming more popular, but actually contribute to everything rust becoming even more irritating. Most rust tools are released with this pathos of "we fix what oldies couldn't get right with C". Not a great attitude to approach giants whose shoulders we're standing on indeed.

Re: The first stable release of a memory safe sudo implementation

#213

Post by [deleted] »

AndyKelley wrote: post #209
coggs wrote: post #60

As one of the original creators of sudo ( https://en.wikipedia.org/wiki/Sudo ) I've witnessed it getting nearly totally rewritten and then incrementally bug-fixed over the last 43 years. It must take the prize for the UNIX command most highly-scrutinized for security flaws. Flaws which have been identified and fixed. Thousands of developers and security experts have gone over it. So part of me wonders - how is it pos…

By making it simpler and not having a ton of rarely used features, and by using a programming language that makes it more difficult to write bugs.

[deleted]

Re: The first stable release of a memory safe sudo implementation

#214

Post by knorker »

coggs wrote: post #60

As one of the original creators of sudo ( https://en.wikipedia.org/wiki/Sudo ) I've witnessed it getting nearly totally rewritten and then incrementally bug-fixed over the last 43 years. It must take the prize for the UNIX command most highly-scrutinized for security flaws. Flaws which have been identified and fixed. Thousands of developers and security experts have gone over it. So part of me wonders - how is it pos…

> how is it possible for a single dev team to totally reimplement it without unknowingly introducing at least a bug or two?

As someone with over three decades of C programming experience (so not as much as you), maintaining widely used stuff written in C for decades, that has recently switched from C and C++ as main languages for systems programming to Rust, I'd instead ask this: How is it possible, even given 43 years of working the problem, to create a program in C that does what it's supposed to, and only what it's supposed to?

But also, one of the answers from the article is "Leaving out less commonly used features so as to reduce attack surface". Most security bugs in sudo are in features I don't use.

Rust isn't just memory safe. It's also orders of magnitude harder to accidentally make other mistakes, such as race conditions.

Re: The first stable release of a memory safe sudo implementation

#215

Post by stouset »

djbusby wrote: post #26
happymellon wrote: post #12

Earlier quoted context omitted.

What issues do you run into with the log files? I have plenty of ideological problems with the design of the logs, but not actually ran into problems in the real world.

I'm still mad I can't just `tail -f`

    journalctl -f
On the flip side, now you get structured logging, efficiently-searchable logs over any of those fields, the ability to easily aggregate logs from multiple machines, the ability to accurately iterate over logs in processes without missing entries, and on and on and on.

Logs as a database is wildly superior to logs as a plain text file, with virtually the only downside being that you need a specific program to tail them.

Re: The first stable release of a memory safe sudo implementation

#216

Post by csdvrx »

hannob wrote: post #172
zokier wrote: post #129

Earlier quoted context omitted.

It's solved; TIOCSTI is disabled by default since Linux 6.2 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

The thing you linked says "default y" to "Allow legacy TIOCSTI usage". So yeah, you can disable it, no, it's not the default. There's also a related issue with TIOCLINUX and the paste functionality. (That will however be solved in an upcoming kernel version. I wrote the patch for it :-)

> There's also a related issue with TIOCLINUX and the paste functionality. (That will however be solved in an upcoming kernel version. I wrote the patch for it :-)

If anyone wants to apply that to their kernel, it's on https://lore.kernel.org/all/2023101158-esteemed-condiment-1d...

Re: The first stable release of a memory safe sudo implementation

#217

Post by jerf »

ndriscoll wrote: post #210
jerf wrote: post #84

Earlier quoted context omitted.

"But it does nothing for logics bugs." "Nothing" is too strong. It does not solve logic bugs, but type systems stronger than C can solve some logic bugs too. Even something as simple as having some concept of "private" and "public" and some boundaries between them can help. I'm writing some code right now in Go, hardly a super strong type system, but I've still put some basic barriers in place like, you can have a re…

C does have some notion of visibility: put private declarations into the .c file instead of the .h file and declare static linkage. You could have a function that returns a pointer to const for read only data. Obviously they can cast that away, but other languages have unsafe escape hatches too. C also has static analyzers to help with some classes of bugs. Cowboy code might be common, but you don't have to do that.…

C has "some notion" of a lot of things. That doesn't make them particularly usable at scale. C has the worst static typing of a language that can even plausibly call itself statically typed in the modern world.

C++ is an option to obtain the sort of thing I talked about, yeah, but in 2023 you need to use something memory safe for something as important as sudo, and C++ on its own is not. C++ and a great static analysis tool would be the minimum I would consider acceptable, but there is something to be said for things like Rust that build the analysis all the way in to the compiler rather than relying on external tools, and then future Rust external tools can build on that even more solid foundation if even more assurance is needed.

Re: The first stable release of a memory safe sudo implementation

#219

Post by alpaca128 »

0xbadcafebee wrote: post #176
alpaca128 wrote: post #164

Earlier quoted context omitted.

> Like building an entirely new car company around only making side-impact collisions safer ...which still results in safer cars overall, so I don't see the problem. Especially if those cars are almost completely immune to side-impact collisions and if it's actually not a car company but a technology every manufacturer can use for future products.

You don't see the problem in starting an entirely new car manufacturer from scratch just to fix one safety issue? > if it's actually not a car company but a technology every manufacturer can use for future products In that case it's like every single manufacturer changing their engine design in order to have a different wiring harness with a slightly thicker shielding around a single cable. The amount of work and cos…

> it's like every single manufacturer changing their engine design in order to have a different wiring harness with a slightly thicker shielding around a single cable.

Car manufacturers improve their engine designs all the time.

It's also not uncommon that programs get rewritten in order to achieve better results, and recently Rust happens to be a popular choice where both speed and security are important. There's nothing extraordinary about it really.

Re: The first stable release of a memory safe sudo implementation

#220

Post by kristopolous »

jjgreen wrote: post #200
kristopolous wrote: post #182

Earlier quoted context omitted.

So let's settle this. Does sudo rhyme with judo or voodoo?

su(peruser) do, so soodoo

Language isn't necessarily that logical. It can be whatever he says it is.
Post reply on HN