Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Todd C. Miller – Sudo maintainer for over 30 years

millert.dev

Post reply on HN
Print view View original

301–310 of 337 posts

Re: Todd C. Miller – Sudo maintainer for over 30 years

#301

Post by Intralexical »

noirscape wrote: post #238
hobofan wrote: post #115

Earlier quoted context omitted.

"Done" software is a myth they tell to young developers so that they can sleep easy at night.

There's a difference between software that's "done" (it never needs updates, ever) and software that's done (it only needs maintenance for security and platform churn). The former is extremely rare; platform churn alone will usually demand updates, even if your code is otherwise airtight. Forces generally beyond your access will demand that your code is able to conform to platform standards. The demand this places ca…

> platform churn alone will usually demand updates, even if your code is otherwise airtight. Forces generally beyond your access will demand that your code is able to conform to platform standards.

Platform churn updates are a failure to limit scope and dependency. If you stick with stable standards like C99/POSIX/X11/SDL, test strictly and build liberally etc., then who cares what the Web/Qt/Metal people are doing?

Re: Todd C. Miller – Sudo maintainer for over 30 years

#303

Post by Intralexical »

latexr wrote: post #225
hobofan wrote: post #115

Earlier quoted context omitted.

"Done" software is a myth they tell to young developers so that they can sleep easy at night.

Absolutely false. I have built tons of tools which are feature complete and continue to work to this day without intervention. Heck, I even have tools I no longer use that people asked me to keep available because they do, and they’ve been chugging along for over a decade, no bugs or maintenance necessary. Just today I saw a report of Adobe discontinuing a tool in use by professionals because it is done and they don’…

It's a bit ironic that digital goods, which are arguably the only products which once compiled can be stored, used, and copied perfectly bit-for-bit, are also the only industry that seems to have this problem with being unwilling to call a product "done".

The reasons for software churn are economic, cultural, and psychological, not technological.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#304

Post by habitable5 »

kllrnohj wrote: post #283
selfmodruntime wrote: post #216

Earlier quoted context omitted.

Google made 10^7 as much money as I did last year. Yea, I don't think it's as simple as you make it seem.

Google sponsors a lot of open source work: https://opensource.google/organizations-we-support I wonder if sudo would be better off joining one of those open source foundations instead of staying solo. It's too small to justify a meaningful amount of contribution to these companies, at which point the bureaucratic overhead of dealing with it probably kills the motivation

This is the current list but from a cursory look it lacks GSoC which has been a significant source of new contributors since forever.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#305

Post by burkaman »

amai wrote: post #302

Only recently sudo got copied by Microsoft for Windows 11: https://learn.microsoft.com/windows/advanced-settings/sudo/ I guess they didn't pay a cent to Todd Miller.

https://github.com/microsoft/sudo?tab=readme-ov-file#relatio...

> This project is not a fork of the Unix/Linux sudo project, nor is it a port of that sudo project. Instead, Sudo for Windows is a Windows-specific implementation of the sudo concept.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#306

Post by amelius »

akokanka wrote: post #4

Have used sudo millions of times. It's so smooth I don't even consider it software. Thinking that sudo could give me bug one day haunts me now. Thanks Miller for your work!

I still think the integration with X11 $DISPLAY could be smoother.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#307

Post by parsimo2010 »

latexr wrote: post #225
hobofan wrote: post #115

Earlier quoted context omitted.

"Done" software is a myth they tell to young developers so that they can sleep easy at night.

Absolutely false. I have built tons of tools which are feature complete and continue to work to this day without intervention. Heck, I even have tools I no longer use that people asked me to keep available because they do, and they’ve been chugging along for over a decade, no bugs or maintenance necessary. Just today I saw a report of Adobe discontinuing a tool in use by professionals because it is done and they don’…

You might have written software that is "done" if you compile it with a single compiler version and don't use any OS hooks/APIs and don't care if future changes breaks your software. I.e. it's done if you think that people will stop needing to use it at some point in the future.

A tool like sudo can never be done because it integrates with the constantly updating OS and will always need maintenance.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#308

Post by senderista »

egorfine wrote: post #282
zbentley wrote: post #279

Earlier quoted context omitted.

how does the metaphor of stolen valor (in my understanding: claiming accolades or military credentials/decorations that one never received) apply to that project? I don’t know anything about the history here; it’s a genuine question.

Authors of useless rewrites do: * skip the hard part: designing, getting user feedback and designing again; * get straight to the fun part: coding in their favorite language after a well-established and proven design; * get to call themselves "creator of XXX-rs", where "XXX" is a well-known brand and "-rs" is often overlooked.

A security-focused rewrite of a security-critical program that removes insecure features and prevents whole classes of vulnerabilities from being introduced in the future is hardly “useless”.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#309

Post by david-gpu »

jibal wrote: post #227
david-gpu wrote: post #151

Earlier quoted context omitted.

If you can't explain why it did not work in the past, and can't explain how & why things will be different this time, you don't have a plan. History is a harsh mistress.

Communism worked in China, for some definition of "worked". Stalinism eventually failed in the USSR and elsewhere. An extensive literature explains these things, as well as explaining different forms and varieties of "communism", and things that people call "communism" but aren't.

Communism worked so well in China that as soon as they adopted something resembling free markets in some regions, thanks to Deng Xiaoping, their GDP per capita rose amazingly fast for 3~4 decades. Not exactly a stellar example.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#310

Post by pphysch »

acdha wrote: post #127
pphysch wrote: post #89

Earlier quoted context omitted.

PSA for anyone reading this, you should probably use polkit instead of sudo if you just want to grant systemd-related permissions, like restarting a service, to an unprivileged user. It's roughly the same complexity (one drop-in file) to implement.

I’d broaden that slightly to say you should try to have as few mechanisms for elevating privileges as possible: if you had tooling around sudo, dzdo, etc. for PAM, auditing, etc. I wouldn’t lightly add a third tool until you were confident that you had parity on that side.

Privilege escalation (superuser capabilities) and RBAC ought to be viewed differently, IMO.

There's a place for true superusers, such as auditing, where no stone should be too heavy. But mostly for securing systems, we want RBAC, and sudo is abused as a pile-driver where only a mallet was needed. Polkit is more of a proper policy toolkit.

Post reply on HN