Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Todd C. Miller – Sudo maintainer for over 30 years

millert.dev

Post reply on HN
Print view View original

71–80 of 337 posts

Re: Todd C. Miller – Sudo maintainer for over 30 years

#71

Post by whatis991 »

kristopolous wrote: post #57
whatis991 wrote: post #16

Earlier quoted context omitted.

This might be a controversial view: What if the exploitative aspect is open source itself? Trick some above average but naive developers into giving their talent, effort, insights and time away for free or very little? Maybe open source or something similar could have been organized in a way that wasn't exploitative and wasn't (possibly) unsustainable, but that is not how things ended up with what Richard Stallman an…

We shouldn't let cynical greedy bastards set the terms for how the rest of society wishes to engage

There can be "cynical greedy bastards" in many places. If you optimize against them in one regard and place, will you also handle them elsewhere well? And calling for change can be abused by some of them to open new opportunities for exploitation, this time benefitting some different group of them.

You need to have an alternative, and it needs to be a credible and reliable one, to ensure that it does not end up being the case that one scam is replaced with another scam.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#72

Post by b00ty4breakfast »

SoftTalker wrote: post #24
stego-tech wrote: post #3

This is why Big Tech is so desperate for AI to work as a wholesale replacement for software developers: they do not pay for their Open Source consumption as-is, and new maintainers aren’t stepping up because they can’t afford rent, let alone to devote their full time to FOSS work free of charge like a lot of older project maintainers do. The fact that sudo is a critical security pillar for trillions of dollars of glo…

Why should something like sudo not be "done" after 30 years? Sudo is one of the poster children for creeping featuritis, to the point that the sudoers man page is a meme ("Don't despair if you are unfamiliar with EBNF ...") Even OpenBSD gave up and implmented their own simplified replacement (doas).

Are you saying you would be using something that fills the same critical role as sudo even if it had not received any updates in a decade or more? Because that sounds insane

Re: Todd C. Miller – Sudo maintainer for over 30 years

#73

Post by einsteinx2 »

bobmcnamara wrote: post #65
rileymat2 wrote: post #39

Earlier quoted context omitted.

The problem is if I was going to do that with the open source projects I use, it is more like a penny a month * 1000 projects.

$.01/user/month would be quite a bit here

Subtract the standard ~3 cent transaction fee and he’d end up owing money instead. That seems to always be the catch with micropayment ideas.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#74

Post by karamanolev »

ycombinatrix wrote: post #66
rileymat2 wrote: post #39

Earlier quoted context omitted.

The problem is if I was going to do that with the open source projects I use, it is more like a penny a month * 1000 projects.

payment processors: "how about no"

Why? If every person participating is giving $10-$20 per month to tens or hundreds of projects and then once distributed, this equates to $x00 or $x000/project/month, why would the payment processors mind. Of course, it's all in theory.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#75

Post by bloqs »

oconnore wrote: post #45
OsamaJaber wrote: post #27

30+ years maintaining one of the most critical pieces of infrastructure on nearly every Linux and Unix system, and he's currently looking for a sponsor to fund continued development. Every company running sudo in production owes this man. Someone should fix that

Why would you be running sudo in production? A production environment should usually be setup up properly with explicit roles and normal access control. Sudo is kind of a UX tool for user sessions where the user fundamentally can do things that require admin/root privileges but they don't trust themselves not to fat finger things so we add some friction. That friction is not really a security layer, it's a UX layer a…

the fact this is a reply to the content in the parent just demos the complete lack of social skills or empathy many in this community are known for

Re: Todd C. Miller – Sudo maintainer for over 30 years

#77

Post by overfeed »

groundzeros2015 wrote: post #67
throw0101a wrote: post #56

Earlier quoted context omitted.

> Why should something like sudo not be "done" after 30 years? Because new needs arise over time. For example, when I started in IT the "sudoedit" functionality was not present and so allowing someone to do "sudo vi …" would allow them breakout of the editor when it was running as root. With sudoedit you can give people permissions to edit particular files with elevated permissions. > Even OpenBSD gave up and implmen…

> sudo has functionality to talk to LDAP That is scary! I may need to look more at openbsd

There's a Linux port of doas named OpenDoas

Re: Todd C. Miller – Sudo maintainer for over 30 years

#78

Post by ycombinatrix »

hypeatei wrote: post #48
monero-xmr wrote: post #32

Earlier quoted context omitted.

The exact moment you charge for something, you need payment processing, a bank, a legal entity to hold said processed funds, you have liability, you need some sort of marketing / sales process (even if it's just copy on a website), and the barrier for someone to use your product is suddenly extremely high, simply because it costs something. Release it for free, no barrier to entry, no legal liability, the entire worl…

The code can become "radioactive" as well when a software library goes paid. It starts phoning home with information about its environment to ensure compliance which is just kinda... icky to most devs. I certainly don't want that bloat in my dependencies.

That's a good point. There's no good way to ensure your open source (source available?) project isn't being ripped off by some company.

Even if you add functionality to phone home, it can be removed by all but the dumbest offenders.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#80

Post by lenerdenator »

brightball wrote: post #69
OsamaJaber wrote: post #27

30+ years maintaining one of the most critical pieces of infrastructure on nearly every Linux and Unix system, and he's currently looking for a sponsor to fund continued development. Every company running sudo in production owes this man. Someone should fix that

This is a good example of Diffusion of Responsibility. Everybody thinks somebody else should help, so nobody does.

I don't think they even see it as their responsibility, more, "If he wanted money, he should have charged for his software".
Post reply on HN