Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Todd C. Miller – Sudo maintainer for over 30 years

millert.dev

Post reply on HN
Print view View original

81–90 of 337 posts

Re: Todd C. Miller – Sudo maintainer for over 30 years

#81

Post by anigbrowl »

I've said it before, open source works poorly in this area. It's great if everyone's getting paid fat money in a day job and can maintain their pet project a few days a month, but that's just not true for a lot of people.

It's disgusting that maintainers of critical projects have to go through the humiliation of begging for money, and absurd to suggest they all hang out Kofi or PAtreon banners. Realistically nobody is going to go through their bash history working out what utilities they use in order of frequency and allocating funds to the maintainers proportionally. I'm baffled that some entity like the Linux Software Foundation isn't administering this already.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#84

Post by ycombinatrix »

karamanolev wrote: post #74
ycombinatrix wrote: post #66

Earlier quoted context omitted.

payment processors: "how about no"

Why? If every person participating is giving $10-$20 per month to tens or hundreds of projects and then once distributed, this equates to $x00 or $x000/project/month, why would the payment processors mind. Of course, it's all in theory.

they charge a minimum fee per transaction. from Accursed Farms' donation page (https://www.accursedfarms.com/donations/)

"Paypal keeps $0.30 + 2.9% of every donation, so please keep anything less than $0.32 as they have enough money already."

i think Cash App has the lowest fees i've seen at like $0.01 which would still be too much.

not saying it is impossible - but likely not viable directly with the current payment providers.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#85

Post by shevy-java »

OsamaJaber wrote: post #27

30+ years maintaining one of the most critical pieces of infrastructure on nearly every Linux and Unix system, and he's currently looking for a sponsor to fund continued development. Every company running sudo in production owes this man. Someone should fix that

I disagree on "the most critical" part. You can be superuser at all times. I understand the arguments why not; I am pointing out that this is possible. Despite people claiming aliens will arrive and nothing will work, everything works fine when the superuser account is used too.

Also, I disagree that every company needs to pay the man. Funding is important, yes, but a *nix system is not crippled without sudo. You can change the permission systems. The superuser can do so too. It is not black magic. The permission system is trivial. sudo is simply a feature of convenience, not a "if sudo does not exist, nothing works" - that just makes no sense.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#86

Post by __turbobrew__ »

einsteinx2 wrote: post #73
bobmcnamara wrote: post #65

Earlier quoted context omitted.

$.01/user/month would be quite a bit here

Subtract the standard ~3 cent transaction fee and he’d end up owing money instead. That seems to always be the catch with micropayment ideas.

Sounds like we need an open source index fund where you can make one payment that goes into a pool of money which is invested into the top 1000 open source projects.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#87

Post by larodi »

shevy-java wrote: post #83

The funding problem is an issue. We need to find better models. Even if it is just "low(er)" payment; that would still be better than zero or near zero payment.

Universal Global Contributor Wellness Fund

may also fund retirements for certain individuals, and there is for sure enough free juice to get it started in a very reasonable way. these people really deserve it, the same way Nobels extist, etc.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#88

Post by adolph »

groundzeros2015 wrote: post #67
throw0101a wrote: post #56

Earlier quoted context omitted.

> Why should something like sudo not be "done" after 30 years? Because new needs arise over time. For example, when I started in IT the "sudoedit" functionality was not present and so allowing someone to do "sudo vi …" would allow them breakout of the editor when it was running as root. With sudoedit you can give people permissions to edit particular files with elevated permissions. > Even OpenBSD gave up and implmen…

> sudo has functionality to talk to LDAP That is scary! I may need to look more at openbsd

The purpose is to allow users access by ldap criteria like group so the sodoers file need not be edited on each and every server.

https://www.sudo.ws/docs/man/sudoers.ldap.man/

Re: Todd C. Miller – Sudo maintainer for over 30 years

#89

Post by pphysch »

acdha wrote: post #60
oconnore wrote: post #45

Earlier quoted context omitted.

Why would you be running sudo in production? A production environment should usually be setup up properly with explicit roles and normal access control. Sudo is kind of a UX tool for user sessions where the user fundamentally can do things that require admin/root privileges but they don't trust themselves not to fat finger things so we add some friction. That friction is not really a security layer, it's a UX layer a…

> A production environment should usually be setup up properly with explicit roles and normal access control. … and sudo is a common tool for doing that so you can do things like say members of this group can restart a specific service or trigger a task as a service user without otherwise giving them root. Yes, there are many other ways to accomplish that goal but it seems odd to criticize a tool being used for its o…

PSA for anyone reading this, you should probably use polkit instead of sudo if you just want to grant systemd-related permissions, like restarting a service, to an unprivileged user.

It's roughly the same complexity (one drop-in file) to implement.

Re: Todd C. Miller – Sudo maintainer for over 30 years

#90

Post by robertlagrant »

squigz wrote: post #68
rileymat2 wrote: post #39

Earlier quoted context omitted.

The problem is if I was going to do that with the open source projects I use, it is more like a penny a month * 1000 projects.

This is why I feel like a missing piece of Patreon/Kofi/whatever is the ability to say "Here's $x; divide it automagically amongst the creators I'm currently following" Sure, I think a lot of those donations would amount to a few pennies or so at once, but I feel like a lot more people would be willing to support creators if they didn't have to constantly choose which to support.

I would love it if something like Github would accept donations from a repo and parcel it out to the repo's dependencies somehow. It would sadly make Github even stickier, but it would be a great feature.
Post reply on HN