Unbelievable, every fortune 500 company should sponsor this you all rely and use this. This makes me so sad I hope this has a good end.
Todd C. Miller – Sudo maintainer for over 30 years
41–50 of 337 posts
Re: Todd C. Miller – Sudo maintainer for over 30 years
#42This is why Big Tech is so desperate for AI to work as a wholesale replacement for software developers: they do not pay for their Open Source consumption as-is, and new maintainers aren’t stepping up because they can’t afford rent, let alone to devote their full time to FOSS work free of charge like a lot of older project maintainers do. The fact that sudo is a critical security pillar for trillions of dollars of glo…
Why should something like sudo not be "done" after 30 years? Sudo is one of the poster children for creeping featuritis, to the point that the sudoers man page is a meme ("Don't despair if you are unfamiliar with EBNF ...") Even OpenBSD gave up and implmented their own simplified replacement (doas).
Similarly sudo-rs and doas-rs exist now.
I'm not sure what can be gained for further development of the OG c sudo, add security patches of course.
But fund adding yet another feature 99.9% of users will never use? I can't fathom the justification for that. Just adding attack surface at this point.
Rightly both doas and the *-rs drops ins intend to drop most of those unnecessary features.
Re: Todd C. Miller – Sudo maintainer for over 30 years
#43This is why Big Tech is so desperate for AI to work as a wholesale replacement for software developers: they do not pay for their Open Source consumption as-is, and new maintainers aren’t stepping up because they can’t afford rent, let alone to devote their full time to FOSS work free of charge like a lot of older project maintainers do. The fact that sudo is a critical security pillar for trillions of dollars of glo…
I've always favored the view that digital goods are only scarce until they are released. if we had a market for patch releases once they hit some goal. Uses could tip to reach the goal. After the goal is reached the patch is released and to all. Still have free loaders but one might live on the work
Re: Todd C. Miller – Sudo maintainer for over 30 years
#44This is why Big Tech is so desperate for AI to work as a wholesale replacement for software developers: they do not pay for their Open Source consumption as-is, and new maintainers aren’t stepping up because they can’t afford rent, let alone to devote their full time to FOSS work free of charge like a lot of older project maintainers do. The fact that sudo is a critical security pillar for trillions of dollars of glo…
I've always favored the view that digital goods are only scarce until they are released. if we had a market for patch releases once they hit some goal. Uses could tip to reach the goal. After the goal is reached the patch is released and to all. Still have free loaders but one might live on the work
So...crowdfunding via a platform like Kickstarter?
Re: Todd C. Miller – Sudo maintainer for over 30 years
#4530+ years maintaining one of the most critical pieces of infrastructure on nearly every Linux and Unix system, and he's currently looking for a sponsor to fund continued development. Every company running sudo in production owes this man. Someone should fix that
Why would you be running sudo in production? A production environment should usually be setup up properly with explicit roles and normal access control.
Sudo is kind of a UX tool for user sessions where the user fundamentally can do things that require admin/root privileges but they don't trust themselves not to fat finger things so we add some friction. That friction is not really a security layer, it's a UX layer against fat fingering.
I know there is more to sudo if you really go deep on it, but the above is what 99+% of users are doing with it. If you're using sudo as a sort of framework for building setuid-like tooling, then this does not apply to you.
Re: Todd C. Miller – Sudo maintainer for over 30 years
#46This is why Big Tech is so desperate for AI to work as a wholesale replacement for software developers: they do not pay for their Open Source consumption as-is, and new maintainers aren’t stepping up because they can’t afford rent, let alone to devote their full time to FOSS work free of charge like a lot of older project maintainers do. The fact that sudo is a critical security pillar for trillions of dollars of glo…
This might be a controversial view: What if the exploitative aspect is open source itself? Trick some above average but naive developers into giving their talent, effort, insights and time away for free or very little? Maybe open source or something similar could have been organized in a way that wasn't exploitative and wasn't (possibly) unsustainable, but that is not how things ended up with what Richard Stallman an…
All of this is true, but ironically Free Software is about ensuring people have control over their computers, and Open Source spun the narrative to make it about getting software cheap or without paying at all.
People having control over their computer (and even having the right to share what they run on their computer!) is completely compatible with people paying for software labor.
Re: Todd C. Miller – Sudo maintainer for over 30 years
#47Earlier quoted context omitted.
This might be a controversial view: What if the exploitative aspect is open source itself? Trick some above average but naive developers into giving their talent, effort, insights and time away for free or very little? Maybe open source or something similar could have been organized in a way that wasn't exploitative and wasn't (possibly) unsustainable, but that is not how things ended up with what Richard Stallman an…
The exact moment you charge for something, you need payment processing, a bank, a legal entity to hold said processed funds, you have liability, you need some sort of marketing / sales process (even if it's just copy on a website), and the barrier for someone to use your product is suddenly extremely high, simply because it costs something. Release it for free, no barrier to entry, no legal liability, the entire worl…
> The exact moment you charge for something, you need payment processing, a bank, a legal entity to hold said processed funds, you have liability, you need some sort of marketing / sales process (even if it's just copy on a website),
That seems like an area that's ripe for innovation. What does it take to get setup on a platform like Patreon? Seems like something similar ought to be setup for open source/independent development, probably an idealistic nonprofit.
> and the barrier for someone to use your product is suddenly extremely high, simply because it costs something.
All the organizations who really ought to pay are already setup to do all that, and do it all the time.
> But the core reason why FOSS spreads and took over is precisely why it is difficult to fund. No one is going to pay for something when the alternative is free. And the moment you start to charge some free alternative comes along and your prior users spurn you as greedy
What we need is innovation. Maybe a license that has a trip-wire? If not enough money is voluntarily deposited into a tip jar over a certain period of time, the license requires a modest payment from all for-profit organizations of a particular size.
That's up-front, is for the most part free, and incentivizes some payment.
Re: Todd C. Miller – Sudo maintainer for over 30 years
#48Earlier quoted context omitted.
This might be a controversial view: What if the exploitative aspect is open source itself? Trick some above average but naive developers into giving their talent, effort, insights and time away for free or very little? Maybe open source or something similar could have been organized in a way that wasn't exploitative and wasn't (possibly) unsustainable, but that is not how things ended up with what Richard Stallman an…
The exact moment you charge for something, you need payment processing, a bank, a legal entity to hold said processed funds, you have liability, you need some sort of marketing / sales process (even if it's just copy on a website), and the barrier for someone to use your product is suddenly extremely high, simply because it costs something. Release it for free, no barrier to entry, no legal liability, the entire worl…
The code can become "radioactive" as well when a software library goes paid. It starts phoning home with information about its environment to ensure compliance which is just kinda... icky to most devs. I certainly don't want that bloat in my dependencies.
Re: Todd C. Miller – Sudo maintainer for over 30 years
#49This is why Big Tech is so desperate for AI to work as a wholesale replacement for software developers: they do not pay for their Open Source consumption as-is, and new maintainers aren’t stepping up because they can’t afford rent, let alone to devote their full time to FOSS work free of charge like a lot of older project maintainers do. The fact that sudo is a critical security pillar for trillions of dollars of glo…
Why should something like sudo not be "done" after 30 years? Sudo is one of the poster children for creeping featuritis, to the point that the sudoers man page is a meme ("Don't despair if you are unfamiliar with EBNF ...") Even OpenBSD gave up and implmented their own simplified replacement (doas).
Because we haven't progressed to the angelic level of software development, so nothing is bug-free, which especially important in something security-critical like sudo
Re: Todd C. Miller – Sudo maintainer for over 30 years
#50Earlier quoted context omitted.
> and new maintainers aren’t stepping up because they can’t afford rent, let alone to devote their full time to FOSS work free of charge like a lot of older project maintainers do. What about the Rust rewrite (sudo-rs)? I think it shows people are interested in maintaining and/or modernizing tools taken for granted.
It has a more lax license AFAIK. Also, many Rust projects and libraries have been abandoned, or are in so-so shapes. Edit: To specify, new projects like sudo-rs may seem promising, but going by observation and experience with similar projects, there is no guarantee that sudo-rs and similar projects will be successful, good and continued to be maintained. The problems with old projects can end up applying to new proje…
> It has a more lax license AFAIK.
Sudo uses the OpenBSD license, while sudo-rs is dual licensed under MIT and Apache 2.0. Both licenses seem equally permissive to me.