Earlier quoted context omitted.
You have the burden of proof to substantiate your accusations. Until then they're entirely unfounded.
Aren't full rewrites pretty much universally considered harmful?
No
Memory-safe sudo to become the default in Ubuntu
221–230 of 282 posts
Re: Memory-safe sudo to become the default in Ubuntu
#222doas is a much simpler (and therefore better) alternative.
Both implementations of doas for Linux have (the same) unfixed security issue:
- https://github.com/Duncaen/OpenDoas/issues/106
- https://github.com/slicer69/doas/issues/110
I have a hard time recommending doas over sudo on Linux when the issue has been fixed in sudo but not in doas.
Re: Memory-safe sudo to become the default in Ubuntu
#223Earlier quoted context omitted.
Aren't full rewrites pretty much universally considered harmful?
No
Not universally, but often it introduces logic bugs that the original project did not have. I guess it heavily depends. In this case, I think it may do more harm than good. Just use "doas" or something. FWIW, I trust "sudo" more than "sudo-rs".
Re: Memory-safe sudo to become the default in Ubuntu
#224Earlier quoted context omitted.
GPLv2 was fine. AGPL is fine. V3 is incompatible with selling bootloader locked software stacks (pretty much all consumer hardware these days). Concretely, I can’t do this local thing: Take GPLv3 software, build a board, link the software to vendor blob firmware (~ all current hardware requires this step), flash it to a ROM on the board and sell it to you with a copy of the GPLv3 software’s source code. I can take th…
> V3 is incompatible with selling bootloader locked software stacks (pretty much all consumer hardware these days). Which is great. It prevents enshitification of consumer devices.
If you look just at consumer devices, it's great.
But their argument is that blocking that loophole, while not blocking an even worse loophole, caused more harm than good.
In other words we should have moved as much as possible directly to AGPL, and left the rest on GPLv2.
Re: Memory-safe sudo to become the default in Ubuntu
#225Re: Memory-safe sudo to become the default in Ubuntu
#226Earlier quoted context omitted.
I was Ubuntu user until they've introduced snap and started forcing it down everybody's throat. No more Ubuntu for me.
>> I was Ubuntu user until they've introduced snap and started forcing it down everybody's throat. No more Ubuntu for me. What issues did you have with snap packages? I am not aware of any problems with snap packages. They have some pretty nice features compared to traditional packages: https://snapcraft.io/docs/get-started#p-19156-connect-an-int... If snap packages have caused problems for you, what were the problem…
Big and slow.
Re: Memory-safe sudo to become the default in Ubuntu
#227Earlier quoted context omitted.
It's not religious. Memory safety is a thing. If by politics you mean the government: they only got started recommending memory safe languages once it became clear that foreign actors were going to keep exploiting C / C++ vulnerabilities. https://www.theregister.com/2024/11/08/the_us_government_wan...
So why are we not using Ada / SPARK?
Why does it matter, really? I mean sure, ada could've been an alternative language that everyone pushed for using but it kind of missed the boat due to historical circumstances , the context around its early use, etc. It might even be that rust users are just more enthusiastic and have been able to push more... But so what?
But why does it matter if the language that has seen some traction in terms of "rewriting software in safer languages" is rust? At that point it becomes even more religious to just reflexively oppose rust because "well why didn't x or y see the same push??"? Again, it really doesn't matter why!
Re: Memory-safe sudo to become the default in Ubuntu
#228I am not sure if memory-safety is the biggest issue in sudo design. I find the fact that it is a setuid binary a much bigger issue because a bug can possible result in privilege escalation. I found an alternative implementation that doesn't rely in being a setuid binary like systemd-run0 much more interesting from a security perspective, but I am no security expert.
I used to be annoyed that sudo would reliably crash from memory errors.
Eventually the bug (and associated vulnerability) was patched. I think.
Re: Memory-safe sudo to become the default in Ubuntu
#229Earlier quoted context omitted.
The comment you responded to says: "Seems odd that they don't advertise it [the usage of Rust], though." Isn't not advertising a language the polar opposite of being religious about a language? I am all for a memory safe sudo and I don't care which language it is written in, use C, Ada, Rust, as long as it is a suitable systems programming language understood by a community of developers and you can proof memory safe…
I don't have a strong opinion on what language - the bit you edited in what I was replying to changed the meaning of what they were saying. My reply is flagged dead now which is fine since it did create an unproductive thread, but it was more that I had noticed Rust as a community seems to have more of an identity based political bent around it more so than other languages. Something I've also noticed with Mozilla -…
> but I don't think it's been predictive of someone's political identity before?
This is a pretty astounding claim. On which data did you base that conclusion? Because if it is purely anecdotal, you might consider that this is a bit like with Apple fanboys. Apple generally makes good products. Most people who use their stuff don't even talk about it, but those who do talk about it tend to have strong opinions that extend the quality of Apples products themselves.
But these opinions are not even remotely representative of the broad majority of Apple users.
Rust similarily lends itself to fanboyism, because the language has a strong narrative going for it, that is part of its success. The narrative isn't even a bad one: create a programming language that makes certain common classes of mistakes impossible and others much harder. Like every topic with strong narrative this will draw in a certain amount of people who will strongly defend said narrative, but those aren't necessarily the manority of the people who use the language.
So unless you made a proper poll that tries to select for a broad set of Rust users instead of basing your judgment on a loud online minority I wouldn't be confident in the result.
I with "identity based bent" you mean they are inclusive and have strong community rules, it might just be that this is normal where the Rust users are from. Last time I checked Rust was very popular in European countries and over here these kind of rules are pretty off the shelve standard. But please tell me this isn't about you calling them "woke" and confusing basic human dignity with politics.
Re: Memory-safe sudo to become the default in Ubuntu
#230doas is a much simpler (and therefore better) alternative.
Both implementations of doas for Linux have (the same) unfixed security issue: - https://github.com/Duncaen/OpenDoas/issues/106 - https://github.com/slicer69/doas/issues/110 I have a hard time recommending doas over sudo on Linux when the issue has been fixed in sudo but not in doas.
Which distros still have TIOCSTI enabled in their kernel? I just checked for Arch and it's disabled.