Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Todd C. Miller – Sudo maintainer for over 30 years

millert.dev

Post reply on HN
Print view View original

31–40 of 337 posts

Re: Todd C. Miller – Sudo maintainer for over 30 years

#31

Post by voxl »

whatis991 wrote: post #17
drnick1 wrote: post #14

Earlier quoted context omitted.

> and new maintainers aren’t stepping up because they can’t afford rent, let alone to devote their full time to FOSS work free of charge like a lot of older project maintainers do. What about the Rust rewrite (sudo-rs)? I think it shows people are interested in maintaining and/or modernizing tools taken for granted.

It has a more lax license AFAIK. Also, many Rust projects and libraries have been abandoned, or are in so-so shapes. Edit: To specify, new projects like sudo-rs may seem promising, but going by observation and experience with similar projects, there is no guarantee that sudo-rs and similar projects will be successful, good and continued to be maintained. The problems with old projects can end up applying to new proje…

How is this a counter argument for anything? A more permissive license is not inherently a bad thing. Many C and C++ projects are also abandon or in so-so condition, why you uniquely call out Rust makes little sense. Either sudo-rs fills the void or it doesn't, but it is a counter point to this idea that open source projects have no path of evolution. Just because that path doesn't look like how you want it to doesn't mean it doesn't exist.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#32

Post by monero-xmr »

whatis991 wrote: post #16
stego-tech wrote: post #3

This is why Big Tech is so desperate for AI to work as a wholesale replacement for software developers: they do not pay for their Open Source consumption as-is, and new maintainers aren’t stepping up because they can’t afford rent, let alone to devote their full time to FOSS work free of charge like a lot of older project maintainers do. The fact that sudo is a critical security pillar for trillions of dollars of glo…

This might be a controversial view: What if the exploitative aspect is open source itself? Trick some above average but naive developers into giving their talent, effort, insights and time away for free or very little? Maybe open source or something similar could have been organized in a way that wasn't exploitative and wasn't (possibly) unsustainable, but that is not how things ended up with what Richard Stallman an…

The exact moment you charge for something, you need payment processing, a bank, a legal entity to hold said processed funds, you have liability, you need some sort of marketing / sales process (even if it's just copy on a website), and the barrier for someone to use your product is suddenly extremely high, simply because it costs something.

Release it for free, no barrier to entry, no legal liability, the entire world can use it instantly. This is why free software spreads and catches on - precisely because it's free.

There is no way to form a business around FOSS without becoming a gatekeeping high-barrier entity. You can release for free then charge extra for consulting or special features, which many have done and continue to experiment with.

But the core reason why FOSS spreads and took over is precisely why it is difficult to fund. No one is going to pay for something when the alternative is free. And the moment you start to charge some free alternative comes along and your prior users spurn you as greedy

Re: Todd C. Miller – Sudo maintainer for over 30 years

#33

Post by wrs »

tokyobreakfast wrote: post #29
drnick1 wrote: post #14

Earlier quoted context omitted.

> and new maintainers aren’t stepping up because they can’t afford rent, let alone to devote their full time to FOSS work free of charge like a lot of older project maintainers do. What about the Rust rewrite (sudo-rs)? I think it shows people are interested in maintaining and/or modernizing tools taken for granted.

By modernizing do you mean rewriting mature software in a meme language with less features than the original and introducing new bugs in the process? The Rust smokescreen is mostly being used to slowly eradicate the GPL. Like Lenin said, "Who stands to gain?"

"Meme language"? There are plenty of memes about C, and they aren't as flattering.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#34

Post by asveikau »

SoftTalker wrote: post #24
stego-tech wrote: post #3

This is why Big Tech is so desperate for AI to work as a wholesale replacement for software developers: they do not pay for their Open Source consumption as-is, and new maintainers aren’t stepping up because they can’t afford rent, let alone to devote their full time to FOSS work free of charge like a lot of older project maintainers do. The fact that sudo is a critical security pillar for trillions of dollars of glo…

Why should something like sudo not be "done" after 30 years? Sudo is one of the poster children for creeping featuritis, to the point that the sudoers man page is a meme ("Don't despair if you are unfamiliar with EBNF ...") Even OpenBSD gave up and implmented their own simplified replacement (doas).

This community and others like it are so weird in that if they see something as stable as sudo but without recent commits, rather than conclude that it's solid and doesn't need further changes, they see it as some kind of a problem and want to switch to something that's seen major changes in the last week.

Maybe that's somehow related to why so many companies are shoving AI into a bunch of stuff that doesn't need it. Gotta keep everything on the hype train. Working and fulfilling people's needs is no longer good enough.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#35

Post by blame-troi »

SoftTalker wrote: post #24
stego-tech wrote: post #3

This is why Big Tech is so desperate for AI to work as a wholesale replacement for software developers: they do not pay for their Open Source consumption as-is, and new maintainers aren’t stepping up because they can’t afford rent, let alone to devote their full time to FOSS work free of charge like a lot of older project maintainers do. The fact that sudo is a critical security pillar for trillions of dollars of glo…

Why should something like sudo not be "done" after 30 years? Sudo is one of the poster children for creeping featuritis, to the point that the sudoers man page is a meme ("Don't despair if you are unfamiliar with EBNF ...") Even OpenBSD gave up and implmented their own simplified replacement (doas).

Different platform but the simplest mainframe utility IEFBR14, a noop process to trigger JCL events started as one instruction. Then two. Then debate started about which machine instruction should be used to set the return code to zero …

Re: Todd C. Miller – Sudo maintainer for over 30 years

#36

Post by boringg »

OsamaJaber wrote: post #27

30+ years maintaining one of the most critical pieces of infrastructure on nearly every Linux and Unix system, and he's currently looking for a sponsor to fund continued development. Every company running sudo in production owes this man. Someone should fix that

Right? A company to step and cut a check to support this would get positive publicity and there doing something good for community at large. Someone step up.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#37

Post by arccy »

stego-tech wrote: post #3

This is why Big Tech is so desperate for AI to work as a wholesale replacement for software developers: they do not pay for their Open Source consumption as-is, and new maintainers aren’t stepping up because they can’t afford rent, let alone to devote their full time to FOSS work free of charge like a lot of older project maintainers do. The fact that sudo is a critical security pillar for trillions of dollars of glo…

maintainers need to learn to say "no" to scope creep and entitled users.

sudo should have been a near complete tool after it was written.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#38

Post by whatis991 »

monero-xmr wrote: post #32
whatis991 wrote: post #16

Earlier quoted context omitted.

This might be a controversial view: What if the exploitative aspect is open source itself? Trick some above average but naive developers into giving their talent, effort, insights and time away for free or very little? Maybe open source or something similar could have been organized in a way that wasn't exploitative and wasn't (possibly) unsustainable, but that is not how things ended up with what Richard Stallman an…

The exact moment you charge for something, you need payment processing, a bank, a legal entity to hold said processed funds, you have liability, you need some sort of marketing / sales process (even if it's just copy on a website), and the barrier for someone to use your product is suddenly extremely high, simply because it costs something. Release it for free, no barrier to entry, no legal liability, the entire worl…

I think you have good arguments, but I wonder if there are alternatives that could work in at least some cases. Like, how Unreal engine's license works. Source-available to game developers, but in theory limited to paying customers, or something along those lines.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#39

Post by rileymat2 »

jandrese wrote: post #30

Honestly he should open a Patreon. There are loads of people that would subscribe to Sudo for $2/month or $5/month.

The problem is if I was going to do that with the open source projects I use, it is more like a penny a month * 1000 projects.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#40

Post by pjsg »

blame-troi wrote: post #35
SoftTalker wrote: post #24

Earlier quoted context omitted.

Why should something like sudo not be "done" after 30 years? Sudo is one of the poster children for creeping featuritis, to the point that the sudoers man page is a meme ("Don't despair if you are unfamiliar with EBNF ...") Even OpenBSD gave up and implmented their own simplified replacement (doas).

Different platform but the simplest mainframe utility IEFBR14, a noop process to trigger JCL events started as one instruction. Then two. Then debate started about which machine instruction should be used to set the return code to zero …

Hence IEFBR14A
Post reply on HN