Live data from Hacker News

Todd C. Miller – Sudo maintainer for over 30 years

millert.dev

281–290 of 337 posts

Re: Todd C. Miller – Sudo maintainer for over 30 years

#281
post #258

Earlier quoted context omitted.

How did liquid glass break your Web UI?

Liquid Glass changed dimensions and viewport measurements for fixed position elements, amongst a whole host of positioning related bugs: https://stackoverflow.com/questions/79753701/ios-26-safari-w... Many of the bugs were fixed in 26.1, but still, I had to fix it to use it. I was surprised that not much of the entire web was broken, but a cursory search of commits showed that the WebKit/Apple team took the approach…

Maybe I’m not looking in the right places, but I rarely see fixed position elements in modern web layouts— I imagine that’s why you didn’t see more disruption.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#282

Earlier quoted context omitted.

Contributed immediately. Thanks to sudo-rs: this stolen valor project made me want to financially support the original author.

how does the metaphor of stolen valor (in my understanding: claiming accolades or military credentials/decorations that one never received) apply to that project? I don’t know anything about the history here; it’s a genuine question.

Authors of useless rewrites do:

* skip the hard part: designing, getting user feedback and designing again;

* get straight to the fun part: coding in their favorite language after a well-established and proven design;

* get to call themselves "creator of XXX-rs", where "XXX" is a well-known brand and "-rs" is often overlooked.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#283

Earlier quoted context omitted.

This is a good example of Diffusion of Responsibility. Everybody thinks somebody else should help, so nobody does.

Google made 10^7 as much money as I did last year. Yea, I don't think it's as simple as you make it seem.

Google sponsors a lot of open source work: https://opensource.google/organizations-we-support

I wonder if sudo would be better off joining one of those open source foundations instead of staying solo. It's too small to justify a meaningful amount of contribution to these companies, at which point the bureaucratic overhead of dealing with it probably kills the motivation

Re: Todd C. Miller – Sudo maintainer for over 30 years

#284
post #240

Earlier quoted context omitted.

Wow, is it related to the "make me a sandwich" XKCD? https://xkcd.com/149/

You do realize the answer is right there: https://www.sudo.ws/about/logo/ (and the old logo) ;)

I missed that, thanks!

Re: Todd C. Miller – Sudo maintainer for over 30 years

#285

Earlier quoted context omitted.

> Why should something like sudo not be "done" after 30 years? Because new needs arise over time. For example, when I started in IT the "sudoedit" functionality was not present and so allowing someone to do "sudo vi …" would allow them breakout of the editor when it was running as root. With sudoedit you can give people permissions to edit particular files with elevated permissions. > Even OpenBSD gave up and implmen…

> sudo has functionality to talk to LDAP That is scary! I may need to look more at openbsd

> That is scary! I may need to look more at openbsd

Very useful when you're running fleets of systems that are more pet than cattle.

Ubuntu/Debian are moving to sudo using SSS to talk to LDAP (versus the current sudo-ldap package).

Re: Todd C. Miller – Sudo maintainer for over 30 years

#286

Earlier quoted context omitted.

> Why should something like sudo not be "done" after 30 years? Because new needs arise over time. For example, when I started in IT the "sudoedit" functionality was not present and so allowing someone to do "sudo vi …" would allow them breakout of the editor when it was running as root. With sudoedit you can give people permissions to edit particular files with elevated permissions. > Even OpenBSD gave up and implmen…

Let's be honest, though. If you designed a new sudo in a system with doas(1) it would look nothing like modern sudo. I can't remember the name, but I read about a rust project a few months ago which claimed that even doas had too much feature creep.

> I can't remember the name, but I read about a rust project a few months ago which claimed that even doas had too much feature creep.

Features are added because people cannot do X and want to, and so it is added.

I'm happy to have a spectrum of privilege-escalation utilities of varying capabilities, but just because one person does not need certain functionality (like talking to LDAP) does not mean I don't.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#287

Earlier quoted context omitted.

> MacOS is fairly constant Except when they killed all 32bit games a few years ago with Catalina.

I think that GP meant that MacOS has a constant nonzero rate of platform churn. I might be wrong though!

Oops, yes, I meant a constant non-zero rate. It's slightly above mobile phones, where the developer is treated as the problem that needs to fix itself.

Stuff written for one version of MacOS will probably work for the next few versions, but there's just as likely a chance that Apple has decided that you need to do a full on update of all your older tools. Things like dropping Rosetta, 32-bit from the kernel and so on and so forth. There's not really any recourse, unlike Windows and Linux where you can usually finagle a workable solution without having to resort to updating everything all the time (so platform churn exists, but a user can theoretically choose to avoid it).

This is unlike phones, where there's basically no real expectations for when you need to update stuff, so it becomes a case of "you need to test every version". The lack of respect for tool stability is just one other reason why the mobile ecosystem is the user-hostile hell it is; this platform churn pretty much is one of the two roots of why mobile apps are Like That. (The other being that running your own choice of tools is treated as a privilege, not a right.)

Re: Todd C. Miller – Sudo maintainer for over 30 years

#288
post #225

Earlier quoted context omitted.

"Done" software is a myth they tell to young developers so that they can sleep easy at night.

Absolutely false. I have built tons of tools which are feature complete and continue to work to this day without intervention. Heck, I even have tools I no longer use that people asked me to keep available because they do, and they’ve been chugging along for over a decade, no bugs or maintenance necessary. Just today I saw a report of Adobe discontinuing a tool in use by professionals because it is done and they don’…

[deleted]

Re: Todd C. Miller – Sudo maintainer for over 30 years

#289
post #258

Earlier quoted context omitted.

Liquid Glass changed dimensions and viewport measurements for fixed position elements, amongst a whole host of positioning related bugs: https://stackoverflow.com/questions/79753701/ios-26-safari-w... Many of the bugs were fixed in 26.1, but still, I had to fix it to use it. I was surprised that not much of the entire web was broken, but a cursory search of commits showed that the WebKit/Apple team took the approach…

Maybe I’m not looking in the right places, but I rarely see fixed position elements in modern web layouts— I imagine that’s why you didn’t see more disruption.

They may not be used in layouts, but they can be present in cases like keyboard open (if you wanted to attach some controls above the software keyboard for example); or just ever growing compatibility hacks.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#290

Earlier quoted context omitted.

$.01/user/month would be quite a bit here

Subtract the standard ~3 cent transaction fee and he’d end up owing money instead. That seems to always be the catch with micropayment ideas.

There are at least two catches with micropayment ideas. One is transaction costs. The other is taxation.

If person in country X is accepting payments (micro or regular) directly from customers/donors in country Y they are then running an international business. That can have income tax, sale tax, VAT, and probably other tax collecting and reporting requirements in one or both countries.

It's a big can of worms you probably don't want to deal with unless you are making significant money from Y. Multiply all that by the number of different countries you get paid from.

The best way to fix the transaction fee problem is probably to use an intermediary. For micropayments people (payers and payees) have accounts at the intermediary. Payers preload their account with a payment large enough that the transaction fees are only a tiny percentage, then can direct how that money is distributed. On the payee side the intermediary waits until the payer has received enough to be able to do a transfer to the payees bank account without transaction fees eating too much.

The intermediary can also fix the tax problem. The way that works is that the intermediary operates as a legal entity in both country X and Y. Payers interact solely with the legal entity in their country, and payees interact solely with the legal entity in their country. Payers and payees then only have to deal with their own country's tax system.

The problem here is who should run the intermediary service? I doubt people will be able to agree on that. What we probably need is a system where there can be multiple intermediary services, but the services talk to each other so if say I want to donate to project Foo and Foo and I use different services I tell mine to send Foo a micropayment and my service and Foo's service make that happen.

This could work similar to the way peering works on the internet backbone.

Post reply on HN