Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Memory-safe sudo to become the default in Ubuntu

trifectatech.org

Post reply on HN
Print view View original

91–100 of 282 posts

Re: Memory-safe sudo to become the default in Ubuntu

#91

Post by bheadmaster »

xethos wrote: post #85
Gabrys1 wrote: post #78

> Ubuntu is the most widely deployed Linux operating system Nitpicking, but I thought Android was the most widely deployed Linux OS around...

[flagged]

> we do not need a flame war or chain of comments about what RMS' valid points were, when he was being (tremendously but unintentionally) offensive, and when he was merely being overly pedantic

If your intention is to not start a flame war, you might want to avoid contraversial topics such as the obviously manufactured canceling of RMS by the-powers-that-be.

Re: Memory-safe sudo to become the default in Ubuntu

#92

Post by estebank »

778464636 wrote: post #63
davrosthedalek wrote: post #50

Earlier quoted context omitted.

Only if you don't buy any downsides with it. That makes it situational dependent. For example: - less people being able to read the code, work with the code, find (security) bugs - slower I know, I know, rust is not really slower, and for sudo it probably wouldn't even matter. But safety isn't the be all and end all of software. There is a lot of software out there where memory safety doesn't matter, or matters a lot…

Supply chain attacks is a big downside no one ever mentions. Even sudo-rs drags dependencies in from Github at build time instead of being self-contained, which is just an absurd thing to do for such an essential tool, especially in the current political climate.

1) every dependency comes from crates.io, not straight from GitHub

2) the dependency list is tiny

3) it uses a cargo lock, so even if it were using a GitHub dependency, that file keeps a hash of the dependency and points at the specific commit, so if the dependency were to introduce a backdoor it wouldn't be automatically picked up and a commit history rewrite would also fail

https://github.com/trifectatechfoundation/sudo-rs/blob/main/...

Re: Memory-safe sudo to become the default in Ubuntu

#93

Post by johnisgood »

kokada wrote: post #10

I am not sure if memory-safety is the biggest issue in sudo design. I find the fact that it is a setuid binary a much bigger issue because a bug can possible result in privilege escalation. I found an alternative implementation that doesn't rely in being a setuid binary like systemd-run0 much more interesting from a security perspective, but I am no security expert.

Rust version of sudo had lots of ridiculous logic bugs. I do not see the improvement.

Re: Memory-safe sudo to become the default in Ubuntu

#94

Post by dataflow »

tialaramex wrote: post #61
homefree wrote: post #11

Earlier quoted context omitted.

[flagged]

Politics is just everything. "No politics" usually means, "Opinions which conflict with mine are unwelcome" or at best the small-C conservative idea that the status quo has existed forever and so whatever happens to presently be the case is just how things should be. In your own comment you mention "actually the best outcome" but that's a matter of politics, doubtless you have different ideas about what "best" would…

> Politics is just everything. "No politics" usually means, "Opinions which conflict with mine are unwelcome" or at best the small-C conservative idea that the status quo has existed forever and so whatever happens to presently be the case is just how things should be.

Everything is political in the same way that everything is offensive and everyone is evil. As in, you're welcome to go around saying that, but don't expect people to find this to be an enlightened perspective.

Re: Memory-safe sudo to become the default in Ubuntu

#95

Post by fsflover »

bheadmaster wrote: post #91
xethos wrote: post #85

Earlier quoted context omitted.

[flagged]

> we do not need a flame war or chain of comments about what RMS' valid points were, when he was being (tremendously but unintentionally) offensive, and when he was merely being overly pedantic If your intention is to not start a flame war, you might want to avoid contraversial topics such as the obviously manufactured canceling of RMS by the-powers-that-be.

And if you do want to see some flame war about the real RMS cancelling, here you go: https://news.ycombinator.com/item?id=22299156

Re: Memory-safe sudo to become the default in Ubuntu

#96

Post by johnisgood »

nailer wrote: post #52
homefree wrote: post #11

Earlier quoted context omitted.

[flagged]

It's not religious. Memory safety is a thing. If by politics you mean the government: they only got started recommending memory safe languages once it became clear that foreign actors were going to keep exploiting C / C++ vulnerabilities. https://www.theregister.com/2024/11/08/the_us_government_wan...

So why are we not using Ada / SPARK?

Re: Memory-safe sudo to become the default in Ubuntu

#97

Post by hulitu »

charcircuit wrote: post #27
MajesticHobo2 wrote: post #16

Earlier quoted context omitted.

Right, but now the vector for privilege escalation will have to be a logic bug in memory-safe sudo instead of either a memory corruption (see CVE-2021-3156) or a logic bug. It’s hard not to see this as a major improvement.

Being a setuid binary means that sudo also suffers from attacks where an attacker runs `sudo ./malware` and then convinces the user to authenticate. Depending on how sudo authenticates phishing attacks or password reuse from another breach can be used to escalate privileges.

> Being a setuid binary means that sudo also suffers from attacks where an attacker runs `sudo ./malware` and then convinces the user to authenticate

So does your OS.

Re: Memory-safe sudo to become the default in Ubuntu

#98

Post by FpUser »

Gabrys1 wrote: post #78

> Ubuntu is the most widely deployed Linux operating system Nitpicking, but I thought Android was the most widely deployed Linux OS around...

I was Ubuntu user until they've introduced snap and started forcing it down everybody's throat. No more Ubuntu for me.

Re: Memory-safe sudo to become the default in Ubuntu

#100

Post by Ygg2 »

Gabrys1 wrote: post #78

> Ubuntu is the most widely deployed Linux operating system Nitpicking, but I thought Android was the most widely deployed Linux OS around...

Some would say that Android isn't Linux OS[1]. It runs Linux, in same way Linux runs Wine. As a (POSIX) compatibility layer.

[1] because it doesn't abstract the hardware platform, doesn't multiplex hardware, nor protect software principals from each other https://www.youtube.com/watch?v=36myc8wQhLo&t=8m48s

Post reply on HN