Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Todd C. Miller – Sudo maintainer for over 30 years

millert.dev

Post reply on HN
Print view View original

61–70 of 337 posts

Re: Todd C. Miller – Sudo maintainer for over 30 years

#61

Post by bobmcnamara »

oconnore wrote: post #45
OsamaJaber wrote: post #27

30+ years maintaining one of the most critical pieces of infrastructure on nearly every Linux and Unix system, and he's currently looking for a sponsor to fund continued development. Every company running sudo in production owes this man. Someone should fix that

Why would you be running sudo in production? A production environment should usually be setup up properly with explicit roles and normal access control. Sudo is kind of a UX tool for user sessions where the user fundamentally can do things that require admin/root privileges but they don't trust themselves not to fat finger things so we add some friction. That friction is not really a security layer, it's a UX layer a…

Auditing.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#62

Post by throw0101a »

oconnore wrote: post #45
OsamaJaber wrote: post #27

30+ years maintaining one of the most critical pieces of infrastructure on nearly every Linux and Unix system, and he's currently looking for a sponsor to fund continued development. Every company running sudo in production owes this man. Someone should fix that

Why would you be running sudo in production? A production environment should usually be setup up properly with explicit roles and normal access control. Sudo is kind of a UX tool for user sessions where the user fundamentally can do things that require admin/root privileges but they don't trust themselves not to fat finger things so we add some friction. That friction is not really a security layer, it's a UX layer a…

> Why would you be running sudo in production? A production environment should usually be setup up properly with explicit roles and normal access control.

And doing cross-role actions may be part of that production environment.

You could configure an ACME client to run as a service account to talk to an ACME server (like Let's Encrypt), write the nonce files in /var/www, and then the resulting new certificate in /etc/certs. But you still need to restart (or at least reload) the web/IMAP/SMTP server to pick up the updated certs.

But do you want the ACME client to run as the same service user as the web server? You can add sudo so that the ACME service account can tell the web service account/web server to do a reload.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#63

Post by imoverclocked »

monero-xmr wrote: post #32
whatis991 wrote: post #16

Earlier quoted context omitted.

This might be a controversial view: What if the exploitative aspect is open source itself? Trick some above average but naive developers into giving their talent, effort, insights and time away for free or very little? Maybe open source or something similar could have been organized in a way that wasn't exploitative and wasn't (possibly) unsustainable, but that is not how things ended up with what Richard Stallman an…

The exact moment you charge for something, you need payment processing, a bank, a legal entity to hold said processed funds, you have liability, you need some sort of marketing / sales process (even if it's just copy on a website), and the barrier for someone to use your product is suddenly extremely high, simply because it costs something. Release it for free, no barrier to entry, no legal liability, the entire worl…

This is an upfront cost and is possibly a one-time cost per-agreement.

Practically nobody downloads and installs sudo directly from the project website; people install it with their distribution of choice. The agreement could be automated and included in the licensing process. ie: the license gives specific distributions access to the software (either via paid or other agreed-upon terms appropriate to the distribution) and perhaps individual licensing terms for non-commercial entities.

Of course, the bigger ask in this decade is in use for training LLMs. OSS shouldn't be laundered through an LLM (IMHO) for license avoidance. Maybe some projects are OK with that (eg: many BSD licensed works.) There are some that likely aren't.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#64

Post by bigstrat2003 »

oconnore wrote: post #45
OsamaJaber wrote: post #27

30+ years maintaining one of the most critical pieces of infrastructure on nearly every Linux and Unix system, and he's currently looking for a sponsor to fund continued development. Every company running sudo in production owes this man. Someone should fix that

Why would you be running sudo in production? A production environment should usually be setup up properly with explicit roles and normal access control. Sudo is kind of a UX tool for user sessions where the user fundamentally can do things that require admin/root privileges but they don't trust themselves not to fat finger things so we add some friction. That friction is not really a security layer, it's a UX layer a…

Almost everyone is running sudo in production.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#65

Post by bobmcnamara »

rileymat2 wrote: post #39
jandrese wrote: post #30

Honestly he should open a Patreon. There are loads of people that would subscribe to Sudo for $2/month or $5/month.

The problem is if I was going to do that with the open source projects I use, it is more like a penny a month * 1000 projects.

$.01/user/month would be quite a bit here

Re: Todd C. Miller – Sudo maintainer for over 30 years

#66

Post by ycombinatrix »

rileymat2 wrote: post #39
jandrese wrote: post #30

Honestly he should open a Patreon. There are loads of people that would subscribe to Sudo for $2/month or $5/month.

The problem is if I was going to do that with the open source projects I use, it is more like a penny a month * 1000 projects.

payment processors: "how about no"

Re: Todd C. Miller – Sudo maintainer for over 30 years

#67

Post by groundzeros2015 »

throw0101a wrote: post #56
SoftTalker wrote: post #24

Earlier quoted context omitted.

Why should something like sudo not be "done" after 30 years? Sudo is one of the poster children for creeping featuritis, to the point that the sudoers man page is a meme ("Don't despair if you are unfamiliar with EBNF ...") Even OpenBSD gave up and implmented their own simplified replacement (doas).

> Why should something like sudo not be "done" after 30 years? Because new needs arise over time. For example, when I started in IT the "sudoedit" functionality was not present and so allowing someone to do "sudo vi …" would allow them breakout of the editor when it was running as root. With sudoedit you can give people permissions to edit particular files with elevated permissions. > Even OpenBSD gave up and implmen…

> sudo has functionality to talk to LDAP

That is scary! I may need to look more at openbsd

Re: Todd C. Miller – Sudo maintainer for over 30 years

#68

Post by squigz »

rileymat2 wrote: post #39
jandrese wrote: post #30

Honestly he should open a Patreon. There are loads of people that would subscribe to Sudo for $2/month or $5/month.

The problem is if I was going to do that with the open source projects I use, it is more like a penny a month * 1000 projects.

This is why I feel like a missing piece of Patreon/Kofi/whatever is the ability to say "Here's $x; divide it automagically amongst the creators I'm currently following"

Sure, I think a lot of those donations would amount to a few pennies or so at once, but I feel like a lot more people would be willing to support creators if they didn't have to constantly choose which to support.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#69

Post by brightball »

OsamaJaber wrote: post #27

30+ years maintaining one of the most critical pieces of infrastructure on nearly every Linux and Unix system, and he's currently looking for a sponsor to fund continued development. Every company running sudo in production owes this man. Someone should fix that

This is a good example of Diffusion of Responsibility.

Everybody thinks somebody else should help, so nobody does.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#70

Post by ycombinatrix »

numbsafari wrote: post #58
SoftTalker wrote: post #24

Earlier quoted context omitted.

Why should something like sudo not be "done" after 30 years? Sudo is one of the poster children for creeping featuritis, to the point that the sudoers man page is a meme ("Don't despair if you are unfamiliar with EBNF ...") Even OpenBSD gave up and implmented their own simplified replacement (doas).

What are you, a dentist moonlighting as an angel investor? Software is never "done". The underlying APIs are always changing. The compilers and system libraries are changing. Featuritis is a thing, but rolling it back is non-trivial as there are folks who depend upon it.

Just curious, why did you use "dentist" in your analogy over any other profession?
Post reply on HN