[HN Gopher] Doas Mastery (2016)
___________________________________________________________________
Doas Mastery (2016)
Author : nesarkvechnep
Score : 33 points
Date : 2023-06-13 04:58 UTC (1 days ago)
(HTM) web link (flak.tedunangst.com)
(TXT) w3m dump (flak.tedunangst.com)
| PreInternet01 wrote:
| So, I've found `doas` to be a great firewall against not-so-
| competent sysadmins, in addition to all the other safety
| guarantees it brings.
|
| -Ehm, I try to `sudo X` and it says command not found
|
| -Yup, that's by design. Try `doas X`
|
| -Well, I tried sudo again and it just doesn't work. What is the
| root password? I need this, like, an hour ago. Do the
| needfull!!1!
|
| -Sure, have your manager call me...
| arp242 wrote:
| Wait, are you saying there are people who can't process "you
| need to replace the word sudo with doas and then it will work
| exactly the same"?
| PreInternet01 wrote:
| Yes. Really.
|
| And I guess I can't really blame them. Their mental modal is:
| I need to run `sudo X`. Because, well, that's what the
| runbook-they-got-from-their-previous-job, Google, or ChatGPT
| says.
|
| The response they get does not get them any nearer to being
| able to run `sudo X`. So, they get angry, and push back.
| Unless you can get someone to sit down, reflect, and think
| about _what they really want to achieve_ , this is a
| situation that is very hard to resolve.
|
| So, that's one more reason I love `doas`: it leads to, eh,
| valuable conversations.
| rcoveson wrote:
| This is why I alias `ls` to `dd` and vice versa on all the
| systems I admin.
| somat wrote:
| You joke, but I found something like this in the wild. It
| was an old legacy sco system been around forever and I
| was asked to do some maintenance work on it. It used rsh
| to talk to other machines. But I was having a hell of a
| hard time finding the rsh command. After a lot of pouring
| over script sources I found it had been renamed to
| something else. when I asked their sysadmin WTF was going
| on with this system. he said it had been done for
| security. Which is still stupid but I have to admit it
| may work against your normal "script of the month" style
| attack. It certainly worked for me.
| kjs3 wrote:
| I think this says _way_ more about you than the teammates
| you 're condescending to. I've never had someone "get
| angry, and push back" when you simply and clearly explain
| "things have changed here...X isn't the command you want
| and you need to use Y, and here's how you do it". But I get
| that a mentor-like approach doesn't let you polish you BOFH
| creds and put the contemptable little people in their
| place.
| kstrauser wrote:
| One time we hired someone who interviewed extremely well. They
| were filling a compliance auditing role, but had credibly
| talked a lot about their experience as a security engineer in a
| Unix shop.
|
| On their first day, I was helping them set up their laptop:
|
| - You need to run `sudo X`
|
| - types `X-but-misspelled`
|
| - No, that's `sudo`, then `X`
|
| - types `sudo_X-but-misspelled` (literally
| `sudo`-underscore-`misspelled version of X`)
|
| - I mean, with a space after `sudo`, like using sudo to run X.
|
| - types `sudo_X`
|
| - Have you used sudo?
|
| - Finally types `sudo X`.
|
| I saved a screenshot of our zoom so I could show our mutual
| boss later. They ghosted us after a week.
|
| Huh. A Unix security engineer who doesn't have sudo (or
| presumably doas) in muscle memory? Interesting.
| dang wrote:
| Discussed at the time:
|
| _Doas mastery_ - https://news.ycombinator.com/item?id=12429050 -
| Sept 2016 (15 comments)
___________________________________________________________________
(page generated 2023-06-14 23:02 UTC)