[HN Gopher] Todd C. Miller - Sudo maintainer for over 30 years
___________________________________________________________________
Todd C. Miller - Sudo maintainer for over 30 years
Author : wodniok
Score : 579 points
Date : 2026-02-02 17:25 UTC (1 days ago)
(HTM) web link (www.millert.dev)
(TXT) w3m dump (www.millert.dev)
| wodniok wrote:
| Quote from Website: "For the past 30+ years I've been the
| maintainer of sudo. I'm currently in search of a sponsor to fund
| continued sudo maintenance and development. If you or your
| organization is interested in sponsoring sudo, please let me
| know."
| stego-tech wrote:
| This is why Big Tech is so desperate for AI to work as a
| wholesale replacement for software developers: they do not pay
| for their Open Source consumption as-is, and new maintainers
| aren't stepping up because they can't afford rent, let alone to
| devote their full time to FOSS work free of charge like a lot of
| older project maintainers do.
|
| The fact that sudo is a critical security pillar for trillions of
| dollars of global infrastructure but this guy gets bupkis for it
| screams volumes about the current state of technology.
|
| We must do better, or it'll be closed systems (OpenAI, Microsoft,
| Apple, Google, Oracle) all the way down as maintainers age out,
| go bankrupt, or die without succession plans in place.
| palmotea wrote:
| Honestly, it seems like the idealism of open source shouldn't
| have survived its contact with capitalism, but I suppose the
| contact wasn't painful enough the the exploitation continued
| for a long time.
|
| Maybe we need a license that's even more onerous to
| corporations than the AGPL, like something with a revenue share
| clause.
|
| Or maybe the problem is the naivete of software engineers. In
| aggregate, there was so much embrace of libertarianism that no
| groundwork was laid to protect ourselves from things like AI
| and offshoring.
| stego-tech wrote:
| Been pitching that with my FOSS colleagues and peers for
| years, now. A license for individual and educational use, but
| pay-to-play for anyone tangentially making revenue from its
| use. Then the conversation boils down to the business
| engineering of how much should something cost, with some
| arguing for flat yearly rates, and others arguing for cost-
| per-unit, while others still fret about "disrupting" the
| status quo immediately after acknowledging its untenability.
|
| It's...frustrating, but those who do the work are the most
| qualified to explain what they need. For the rest of us, it's
| encouraging them to seek reasonable compensation for their
| work from those who exploit it for profit, and that doing so
| doesn't necessarily go against the spirit of open source.
| calvinmorrison wrote:
| can't wait for popularity-contest(1) to be mandatory and
| required a linked credit card.
| acuozzo wrote:
| > the idealism of open source shouldn't have survived its
| contact with capitalism
|
| The US economy of the 1980s, 1990s, and 2000s made it
| possible.
| softfalcon wrote:
| I don't mean to come across as far too cynical, but in what
| world has a software license ever stopped the greedy and
| powerful from pillaging the IP of other people smaller and
| weaker than them?
|
| In my opinion, libertarianism in software is a hollow dream
| that leads people to make foolish decisions that can't be
| protected. This makes it easy for corporations to exploit and
| quash any barely audible opposition.
|
| Almost as if by plan, the libertarian mindset has eroded and
| weakened open source protections, defanging and declawing it
| every step of the way.
| htx80nerd wrote:
| >"it screams volumes about the current state of technology."
|
| about the current state of Big Corp vampires who are happy to
| bleed everyone dry to put more $$ in their own very fat pockets
| softfalcon wrote:
| Exactly
| functionmouse wrote:
| Our economic system starves you to death if you don't
|
| People aren't vampires because they're on top, they're on top
| because they're vampires.
|
| Shit flows downstream
| whatis991 wrote:
| A change in economic system might be neither sufficient nor
| necessary, especially if the new economic system turns out
| to be even worse, or a scam.
|
| One approach is to have expectations to not only the
| economic system, but also other systems, and the different
| people involved, no matter if they're on the top, on the
| bottom, or somewhere in the middle.
| softfalcon wrote:
| Sounds like the system is working as intended...
|
| Not trying to be glib here. This feels like the embrace,
| extend, extinguish pattern that we jokingly used to think was
| only Microsoft. It is now becoming more and more obviously the
| modus operandi of the entire enterprise software ecosystem.
|
| I believe you are correct to be frustrated and ringing the
| alarm bell. This is a "death of the commons" moment for OSS.
| drnick1 wrote:
| > and new maintainers aren't stepping up because they can't
| afford rent, let alone to devote their full time to FOSS work
| free of charge like a lot of older project maintainers do.
|
| What about the Rust rewrite (sudo-rs)? I think it shows people
| are interested in maintaining and/or modernizing tools taken
| for granted.
| whatis991 wrote:
| It has a more lax license AFAIK. Also, many Rust projects and
| libraries have been abandoned, or are in so-so shapes.
|
| Edit:
|
| To specify, new projects like sudo-rs may seem promising, but
| going by observation and experience with similar projects,
| there is no guarantee that sudo-rs and similar projects will
| be successful, good and continued to be maintained. The
| problems with old projects can end up applying to new
| projects as well. And projects in Rust are no exception,
| going by experience with existing, older Rust projects.
|
| Aside, a pet peeve I have is that for instance Ruffle has not
| turned out as successful as I had hoped for, even after
| several years and many sponsors. The proprietary Flash
| runtimes written in C still outperform Ruffle greatly in some
| cases, causing problems for some users that want to use
| Ruffle instead of other runtimes.
| aw1621107 wrote:
| > Also, many Rust projects and libraries have been
| abandoned, or are in so-so shapes.
|
| This seems like a bit of a non-sequitur; the state of non-
| sudo-rs projects/libraries says nothing about the state of
| sudo-rs itself.
|
| Not to mention that I'd imagine a similar statement would
| probably be true for projects and libraries written in
| _any_ reasonably popular language.
| fragmede wrote:
| If there are 1000 projects that aren't sudo-rs but are
| similarly load bearing, and they have all been
| abandoned/in so-so shape, you're right that it doesn't
| actually say anything about sudo-rs, but there's a highly
| probable outcome that will be inferred by most people.
| Incorrectly or otherwise.
| voxl wrote:
| How is this a counter argument for anything? A more
| permissive license is not inherently a bad thing. Many C
| and C++ projects are also abandon or in so-so condition,
| why you uniquely call out Rust makes little sense. Either
| sudo-rs fills the void or it doesn't, but it is a counter
| point to this idea that open source projects have no path
| of evolution. Just because that path doesn't look like how
| you want it to doesn't mean it doesn't exist.
| ndiddy wrote:
| > It has a more lax license AFAIK.
|
| Sudo uses the OpenBSD license, while sudo-rs is dual
| licensed under MIT and Apache 2.0. Both licenses seem
| equally permissive to me.
| tokyobreakfast wrote:
| By modernizing do you mean rewriting mature software in a
| meme language with less features than the original and
| introducing new bugs in the process?
|
| The Rust smokescreen is mostly being used to slowly eradicate
| the GPL.
|
| Like Lenin said, "Who stands to gain?"
| wrs wrote:
| "Meme language"? There are plenty of memes about C, and
| they aren't as flattering.
| alt227 wrote:
| IMO rust rewrites are done quickly to gain attention and
| kudos. They are very rarely maintainted to the same quality
| of the originals.
| hobofan wrote:
| Yes, I'm sure they also founded a whole foundation[0] to do
| that just for "attention and kudos".
|
| [0]: https://trifectatech.org/
| whatis991 wrote:
| This might be a controversial view:
|
| What if the exploitative aspect is open source itself? Trick
| some above average but naive developers into giving their
| talent, effort, insights and time away for free or very little?
| Maybe open source or something similar could have been
| organized in a way that wasn't exploitative and wasn't
| (possibly) unsustainable, but that is not how things ended up
| with what Richard Stallman and others organized.
| markus_zhang wrote:
| I think at least the license should say something like we
| will charge on a per CPU or whatever basis for commercial
| usage.
|
| You give it away for free so don't be surprised to get
| abused. Human nature working at its best and worst here.
| monero-xmr wrote:
| The exact moment you charge for something, you need payment
| processing, a bank, a legal entity to hold said processed
| funds, you have liability, you need some sort of marketing /
| sales process (even if it's just copy on a website), and the
| barrier for someone to use your product is suddenly extremely
| high, simply because it costs something.
|
| Release it for free, no barrier to entry, no legal liability,
| the entire world can use it instantly. This is why free
| software spreads and catches on - precisely because it's
| free.
|
| There is no way to form a business around FOSS without
| becoming a gatekeeping high-barrier entity. You can release
| for free then charge extra for consulting or special
| features, which many have done and continue to experiment
| with.
|
| But the core reason why FOSS spreads and took over is
| precisely why it is difficult to fund. No one is going to pay
| for something when the alternative is free. And the moment
| you start to charge some free alternative comes along and
| your prior users spurn you as greedy
| whatis991 wrote:
| I think you have good arguments, but I wonder if there are
| alternatives that could work in at least some cases. Like,
| how Unreal engine's license works. Source-available to game
| developers, but in theory limited to paying customers, or
| something along those lines.
| palmotea wrote:
| > The exact moment you charge for something, you need
| payment processing, a bank, a legal entity to hold said
| processed funds, you have liability, you need some sort of
| marketing / sales process (even if it's just copy on a
| website),
|
| That seems like an area that's ripe for innovation. What
| does it take to get setup on a platform like Patreon? Seems
| like something similar ought to be setup for open
| source/independent development, probably an idealistic
| nonprofit.
|
| > and the barrier for someone to use your product is
| suddenly extremely high, simply because it costs something.
|
| All the organizations who really ought to pay are already
| setup to do all that, and do it all the time.
|
| > But the core reason why FOSS spreads and took over is
| precisely why it is difficult to fund. No one is going to
| pay for something when the alternative is free. And the
| moment you start to charge some free alternative comes
| along and your prior users spurn you as greedy
|
| What we need is innovation. Maybe a license that has a
| trip-wire? If not enough money is voluntarily deposited
| into a tip jar over a certain period of time, the license
| requires a modest payment from all for-profit organizations
| of a particular size.
|
| That's up-front, is for the most part free, and
| incentivizes some payment.
| hypeatei wrote:
| The code can become "radioactive" as well when a software
| library goes paid. It starts phoning home with information
| about its environment to ensure compliance which is just
| kinda... icky to most devs. I certainly don't want that
| bloat in my dependencies.
| ycombinatrix wrote:
| That's a good point. There's no good way to ensure your
| open source (source available?) project isn't being
| ripped off by some company.
|
| Even if you add functionality to phone home, it can be
| removed by all but the dumbest offenders.
| imoverclocked wrote:
| This is an upfront cost and is possibly a one-time cost
| per-agreement.
|
| Practically nobody downloads and installs sudo directly
| from the project website; people install it with their
| distribution of choice. The agreement could be automated
| and included in the licensing process. ie: the license
| gives specific distributions access to the software (either
| via paid or other agreed-upon terms appropriate to the
| distribution) and perhaps individual licensing terms for
| non-commercial entities.
|
| Of course, the bigger ask in this decade is in use for
| training LLMs. OSS shouldn't be laundered through an LLM
| (IMHO) for license avoidance. Maybe some projects are OK
| with that (eg: many BSD licensed works.) There are some
| that likely aren't.
| Zambyte wrote:
| All of this is true, but ironically Free Software is about
| ensuring people have control over their computers, and Open
| Source spun the narrative to make it about getting software
| cheap or without paying at all.
|
| People having control over their computer (and even having
| the right to share what they run on their computer!) is
| completely compatible with people paying for software labor.
| fragmede wrote:
| No it isn't. People having control over their own computer
| is in direct contradiction with people paying for software
| labor. In an honest world, sure, but in reality, people
| don't want to pay for shit and are going to steal from you.
| The Pirate Bay is still running and isn't going away. So is
| Anna's archive.
| kristopolous wrote:
| We shouldn't let cynical greedy bastards set the terms for
| how the rest of society wishes to engage
| whatis991 wrote:
| There can be "cynical greedy bastards" in many places. If
| you optimize against them in one regard and place, will you
| also handle them elsewhere well? And calling for change can
| be abused by some of them to open new opportunities for
| exploitation, this time benefitting some different group of
| them.
|
| You need to have an alternative, and it needs to be a
| credible and reliable one, to ensure that it does not end
| up being the case that one scam is replaced with another
| scam.
| kristopolous wrote:
| I really think that criminal theory needs to progress. We
| differentiate between say consensual intimacy and rape
| and we don't let the existence of sexual abusive people
| set the terms for our romantic encounters.
|
| We have carved out a class of engagements, labeled it
| deeply asocial, criminalized it and now we pursue people
| who engage in it through legal means.
|
| Business really doesn't have this. Personal example -
| last week I was at a place where the business owner tried
| to overcharge me by an order of magnitude and then
| verbally attacked me when I caught him and backed out of
| the transaction.
|
| His google and yelp reviews are full of people claiming
| false charges and all kinds of fraud, refusal to correct
| and repeated abuse until they closed their cards. It's
| wildly obvious what's going on here and I was on the ball
| enough to catch it.
|
| I contacted the police and they said "well you should
| call the BBB or something". It's dozens of reviews of
| clear credit card fraud and for some reason because he's
| a merchant, doesn't seem to hit the radar.
|
| These are purely criminal matters - people acting
| habitually in bad faith with ill intent in a brazenly
| dishonest manner.
|
| Whether it's plundering the commons, polluting the public
| discourse, or breaking other types of social compacts,
| these should be treated the same as any other crime.
| whatis991 wrote:
| Does your country allow suing him for a large monetary
| amount? Have you talked to the media? A lawyer? Maybe
| together with others? Made it as easy as possible for the
| police to get him, paper trail, receipts and all?
|
| You do have points, though, but there might at least be
| some actions that you and others can take in this case.
| Maybe a medium change like changing the law on this
| specific point might make sense.
| kristopolous wrote:
| I'm not law enforcement. This shouldn't be my job. If I
| see someone robbing a store with a mask on and a gun I
| should be able to call the police, report it, and hand it
| off.
|
| If there's an accumulation of complaints against this
| merchant then that should warrant an investigation.
|
| The police have like half the local city budget, can't
| they do their job?
| SoftTalker wrote:
| Why should something like sudo not be "done" after 30 years?
|
| Sudo is one of the poster children for creeping featuritis, to
| the point that the sudoers man page is a meme ("Don't despair
| if you are unfamiliar with EBNF ...")
|
| Even OpenBSD gave up and implmented their own simplified
| replacement (doas).
| asveikau wrote:
| This community and others like it are so weird in that if
| they see something as stable as sudo but without recent
| commits, rather than conclude that it's solid and doesn't
| need further changes, they see it as some kind of a problem
| and want to switch to something that's seen major changes in
| the last week.
|
| Maybe that's somehow related to why so many companies are
| shoving AI into a bunch of stuff that doesn't need it. Gotta
| keep everything on the hype train. Working and fulfilling
| people's needs is no longer good enough.
| catdog wrote:
| The thing is, there is next to no software that "doesn't
| need further changes" at all. There is always something,
| sure it might be infrequent and/or most of the time nothing
| really big or difficult (except sometimes) but the point
| is: someone needs to step up and do it.
|
| If a see a project with recent activity, best from multiple
| people it is a strong signal that this will happen, if the
| last commit is a year ago I must assume it's completely
| abandoned because most of the time it just is. Sometimes
| it's clearly communicated that it is the way because the
| authors see it as essentially feature complete, there are
| some examples of this but not that many honestly.
| blame-troi wrote:
| Different platform but the simplest mainframe utility
| IEFBR14, a noop process to trigger JCL events started as one
| instruction. Then two. Then debate started about which
| machine instruction should be used to set the return code to
| zero ...
| pjsg wrote:
| Hence IEFBR14A
| rustyhancock wrote:
| Similarly sudo-rs and doas-rs exist now.
|
| I'm not sure what can be gained for further development of
| the OG c sudo, add security patches of course.
|
| But fund adding yet another feature 99.9% of users will never
| use? I can't fathom the justification for that. Just adding
| attack surface at this point.
|
| Rightly both doas and the *-rs drops ins intend to drop most
| of those unnecessary features.
| eviks wrote:
| Because we haven't progressed to the angelic level of
| software development, so nothing is bug-free, which
| especially important in something security-critical like sudo
| ddtaylor wrote:
| Even if sudo itself never changed, the system around it
| changes pretty drastically. I agree the scope of the tool
| should be smaller and it violates the Unix philosophy
| (whatever that is worth these days)
| stego-tech wrote:
| Bugfixes and security vulnerabilities, mostly. So long as
| fallible humans make fallible hardware running fallible
| software that in turn executes and/or compiles fallible code,
| there will always be a need for continued development of
| critical tooling and packages.
|
| On a long enough timeline, those fixes become fewer and less
| frequent as the codebase improves, but there is no "done" in
| software unfortunately. Hell, entropy itself means _nothing_
| is ever done, just in an ever-changing state.
| throw0101a wrote:
| > _Why should something like sudo not be "done" after 30
| years?_
|
| Because new needs arise over time. For example, when I
| started in IT the "sudoedit" functionality was not present
| and so allowing someone to do "sudo vi ..." would allow them
| breakout of the editor when it was running as root.
|
| With _sudoedit_ you can give people permissions to edit
| particular files with elevated permissions.
|
| > _Even OpenBSD gave up and implmented their own simplified
| replacement (doas)._
|
| They did not "give up": they found they needed only much
| simpler functionality shipped in the base OS. For example,
| sudo has functionality to talk to LDAP (which I've used at
| multiple jobs over the years), but is not needed for a local-
| only box. Once you need centralized account and privilege
| management, _doas_ becomes much less useful.
| groundzeros2015 wrote:
| > sudo has functionality to talk to LDAP
|
| That is scary! I may need to look more at openbsd
| overfeed wrote:
| There's a Linux port of doas named OpenDoas
| groundzeros2015 wrote:
| Distros come with sudo. Scripts assume sudo. Complexity
| exists there.
| Piraty wrote:
| solved long ago. https://github.com/jirutka/doas-sudo-
| shim/
| groundzeros2015 wrote:
| so do I uninstall sudo from my distro? What do I do on
| upgrade? This shim is available from alpine package
| manager, can I get it anywhere else?
| adolph wrote:
| The purpose is to allow users access by ldap criteria
| like group so the sodoers file need not be edited on each
| and every server.
|
| https://www.sudo.ws/docs/man/sudoers.ldap.man/
| groundzeros2015 wrote:
| Yeah, that's not something I would expect a core until to
| do.
|
| I would expect another system to query ldap.
| throw0101a wrote:
| > _That is scary! I may need to look more at openbsd_
|
| Very useful when you're running fleets of systems that
| are more pet than cattle.
|
| Ubuntu/Debian are moving to sudo using SSS to talk to
| LDAP (versus the current sudo-ldap package).
| avadodin wrote:
| Let's be honest, though. If you designed a new sudo in a
| system with doas(1) it would look nothing like modern sudo.
|
| I can't remember the name, but I read about a rust project
| a few months ago which claimed that even doas had too much
| feature creep.
| throw0101a wrote:
| > _I can 't remember the name, but I read about a rust
| project a few months ago which claimed that even doas had
| too much feature creep._
|
| Features are added because people cannot do _X_ and want
| to, and so it is added.
|
| I'm happy to have a spectrum of privilege-escalation
| utilities of varying capabilities, but just because one
| person does not need certain functionality (like talking
| to LDAP) does not mean I don't.
| numbsafari wrote:
| What are you, a dentist moonlighting as an angel investor?
|
| Software is never "done".
|
| The underlying APIs are always changing. The compilers and
| system libraries are changing.
|
| Featuritis is a thing, but rolling it back is non-trivial as
| there are folks who depend upon it.
| ycombinatrix wrote:
| Just curious, why did you use "dentist" in your analogy
| over any other profession?
| b00ty4breakfast wrote:
| Are you saying you would be using something that fills the
| same critical role as sudo even if it had not received any
| updates in a decade or more? Because that sounds insane
| butterfi wrote:
| Because environments change, it hasn't been immutable.
| eichin wrote:
| Is it really creeping, though? Pretty sure I first saw the
| EBNF in the man page more than 20 years ago, it's just how
| that generation learned to write and discuss parsers. (What
| I'm getting at is that even if it is, _that_ isn 't a sign of
| it.)
|
| Of course, 20+ years ago a big feature was platform
| compatibility, and since then we've gone from 10+ to 2ish, so
| if it's not explicitly enabling retrocomputing, it should be
| getting simpler, right?
| arccy wrote:
| maintainers need to learn to say "no" to scope creep and
| entitled users.
|
| sudo should have been a near complete tool after it was
| written.
| sllabres wrote:
| So no #includedir, no LDAP integration, no log_input/output,
| no PAM integration ...?
| pwndByDeath wrote:
| I've always favored the view that digital goods are only scarce
| until they are released. if we had a market for patch releases
| once they hit some goal. Uses could tip to reach the goal.
| After the goal is reached the patch is released and to all.
| Still have free loaders but one might live on the work
| WorkerBee28474 wrote:
| So...crowdfunding via a platform like Kickstarter?
| akokanka wrote:
| Have used sudo millions of times. It's so smooth I don't even
| consider it software. Thinking that sudo could give me bug one
| day haunts me now. Thanks Miller for your work!
| amelius wrote:
| I still think the integration with X11 $DISPLAY could be
| smoother.
| jmclnx wrote:
| I would _love_ to know were IBM is on this. They use sudo
| everywhere, even on AIX. Not to mention IBM owns Red Hat Linux.
|
| IBM should be able to send a decent amount to Todd once in a
| while, but based upon how much IBM supports ssh ($0), all they
| are proving is they are very cheap and only wants be a parasite
| living off other's work.
| fdupress wrote:
| Seeing the server temperatures go up as this gets posted to HN is
| fun. I'm not sure his server agrees.
| divbzero wrote:
| "Machine Room Temperature" from Todd C. Miller's website:
|
| https://www.millert.dev/therm/
|
| Server exhaust fan temperature was typically 94degF (ranged
| 92degF to 96degF) over the previous week and has climbed to
| 97degF.
| divbzero wrote:
| But, on the whole, the server seems to be doing well enough
| for something near the top of HN. The website is served by
| nginx and appears to be mostly static pages.
| calvinmorrison wrote:
| I once wrote hacking is ethical. Maybe I meant 'eventual'.
| Instead of Red-Hat sponsoring sudo, china can sponsor him to put
| hacks in.
| kleiba wrote:
| Obligatory xkcd: https://xkcd.com/2347/
| kleiba wrote:
| ...although this one would have been a good fit too, of course:
| https://xkcd.com/149/
| divbzero wrote:
| This xkcd is featured as the maintainer's user icon on
| GitHub:
|
| https://github.com/millert
| varun_ch wrote:
| and it's also the inspiration for the logo of sudo
| https://www.sudo.ws/
| zerotolerance wrote:
| But today people can just vibe code their own sudo "with
| blackjack and hookers!"
|
| /s
|
| Really though, it is remarkable just how high we've built this
| towering house of cards on the selfless works of individuals. The
| geek in me immediately begins meditating on OSS funding
| mechanisms I've seen in the past, and what might work today. Then
| I remember that I don't believe it can work, but hope desperately
| that people like Todd can keep paying rent and continue getting
| some satisfaction from the efforts.
| OsamaJaber wrote:
| 30+ years maintaining one of the most critical pieces of
| infrastructure on nearly every Linux and Unix system, and he's
| currently looking for a sponsor to fund continued development.
| Every company running sudo in production owes this man. Someone
| should fix that
| boringg wrote:
| Right? A company to step and cut a check to support this would
| get positive publicity and there doing something good for
| community at large. Someone step up.
| lovich wrote:
| Companies don't step up and do things for the common good.
| They do things for profit. Occasionally that looks like they
| are charitable if the value of the PR is worth it for them.
|
| No one[1] changes what product they are using based on
| funding or not of open source software. Companies will step
| in and fund it if they want control, like with Rust, or if
| the maintainer finally stops giving them free labor and they
| actually need the software.
|
| [1] not enough people to alter finances
| oconnore wrote:
| Why would you be running sudo in production? A production
| environment should usually be setup up properly with explicit
| roles and normal access control.
|
| Sudo is kind of a UX tool for user sessions where the user
| fundamentally can do things that require admin/root privileges
| but they don't trust themselves not to fat finger things so we
| add some friction. That friction is not really a security
| layer, it's a UX layer against fat fingering.
|
| I know there is more to sudo if you really go deep on it, but
| the above is what 99+% of users are doing with it. If you're
| using sudo as a sort of framework for building setuid-like
| tooling, then this does not apply to you.
| acdha wrote:
| > A production environment should usually be setup up
| properly with explicit roles and normal access control.
|
| ... and sudo is a common tool for doing that so you can do
| things like say members of this group can restart a specific
| service or trigger a task as a service user without otherwise
| giving them root.
|
| Yes, there are many other ways to accomplish that goal but it
| seems odd to criticize a tool being used for its original
| purpose.
| pphysch wrote:
| PSA for anyone reading this, you _should_ probably use
| polkit instead of sudo if you just want to grant systemd-
| related permissions, like restarting a service, to an
| unprivileged user.
|
| It's roughly the same complexity (one drop-in file) to
| implement.
| acdha wrote:
| I'd broaden that slightly to say you should try to have
| as few mechanisms for elevating privileges as possible:
| if you had tooling around sudo, dzdo, etc. for PAM,
| auditing, etc. I wouldn't lightly add a third tool until
| you were confident that you had parity on that side.
| pphysch wrote:
| Privilege escalation (superuser capabilities) and RBAC
| ought to be viewed differently, IMO.
|
| There's a place for true superusers, such as auditing,
| where no stone should be too heavy. But mostly for
| securing systems, we want RBAC, and sudo is abused as a
| pile-driver where only a mallet was needed. Polkit is
| more of a proper policy toolkit.
| acdha wrote:
| That's a valid choice. I'm just saying that you should
| pick ideally one tool for that class of work. For
| example, if you support one tool for Mac and Linux users
| that's probably worth more than supporting two similar
| tools even if one of them is better.
| yjftsjthsd-h wrote:
| What's the benefit?
| Hendrikto wrote:
| You can acquire permission on-demand and scoped more
| tightly.
| bobmcnamara wrote:
| Auditing.
| throw0101a wrote:
| > _Why would you be running sudo in production? A production
| environment should usually be setup up properly with explicit
| roles and normal access control._
|
| And doing cross-role actions may be part of that production
| environment.
|
| You could configure an ACME client to run as a service
| account to talk to an ACME server (like Let's Encrypt), write
| the nonce files in /var/www, and then the resulting new
| certificate in /etc/certs. But you still need to restart (or
| at least reload) the web/IMAP/SMTP server to pick up the
| updated certs.
|
| But do you want the ACME client to run as the same service
| user as the web server? You can add _sudo_ so that the ACME
| service account can tell the web service account /web server
| to do a reload.
| charcircuit wrote:
| In your example certbot is given permission to write to
| /var/www/.well-known/acme-challenge and to write certs
| somewhere. Your web server also has permission to read
| those files too.
|
| There is no need for the acme client and web server to run
| as the same user. For reloads the certbot user can be given
| permission to just invoke the reload command / signal
| directly. There does not need to be sudo in between them.
| bigstrat2003 wrote:
| Almost everyone is running sudo in production.
| bloqs wrote:
| the fact this is a reply to the content in the parent just
| demos the complete lack of social skills or empathy many in
| this community are known for
| jcelerier wrote:
| bro i just want to apt install gimp :(
| brightball wrote:
| This is a good example of Diffusion of Responsibility.
|
| Everybody thinks somebody else should help, so nobody does.
| lenerdenator wrote:
| I don't think they even see it as their responsibility, more,
| "If he wanted money, he should have charged for his
| software".
| JuniperMesos wrote:
| If he actually did charge money someone else would've
| written an implementation of sudo to solve their own needs
| and avoid the overhead of transacting with a random
| developer.
| snvzz wrote:
| And then "If he wanted money, he should have charged for
| his software" would apply to that someone.
| Grimblewald wrote:
| And in such a system, before long, we have an ecosystem
| that resembles the venereal disease masequaraing as an
| addon store we see in wordpress.
| _fizz_buzz_ wrote:
| "Your 3 months sudo trial is expiring. Would you like to
| sign up for sudo-pro (best for hobbiest and small teams),
| sudo-business (up to 100 users) or sudo-enterprise (reach
| out for a quote)"
| lenerdenator wrote:
| Nightmarish, isn't it?
|
| But that's how the higher-ups at places like IBM and
| Oracle see the world.
|
| And these people are free to roam the streets unfettered.
| Hardly seems right.
| shimman wrote:
| Seriously, just put a VAT on digital services to fund a
| system that pays out grants to individuals to help maintain
| open source software. It should be obvious by now that
| corporations will rat fuck the commons for monetary gain and
| there is a serious need for democratic initiatives to put
| technology back into the hands of the people.
| TonyStr wrote:
| I would like to live in this utopia where free software is
| funded by the state. This seems impossible to get
| implemented in our world though.
| kortilla wrote:
| But how would that work? There isn't unlimited money so
| who decides what software to support with state money and
| which developers? I don't have trust in a bureaucracy to
| decide which developers should get paid to work on sudo.
| Just look at a the sudo-rs debacle and that's without
| money involved.
| shimman wrote:
| You have a failure of imagination if this is what you
| think, luckily in politics we don't have to listen to
| people like you and instead those with an actual vision
| of a better future.
| Antibabelic wrote:
| The EU does fund a lot of open source software.
| kasey_junk wrote:
| So does the US. In fact they did for this software.
| kergonath wrote:
| Several states fund open science, and a couple of them
| actually do fund open source projects. Germany has its
| sovereign tech agency for this; France has publicly-
| funded research agencies that work on a lot of open
| source stuff, and there are others. There are EU
| initiatives as well.
|
| It's not perfect, but it is already something that is
| being done.
| account42 wrote:
| No thanks, we don't need yet another specialty tax paid out
| to a dubious selection of individuals.
| AmbroseBierce wrote:
| I mean, he should just put a message when you run sudo the
| first time asking for funding if he wants it that bad, that
| should speed things up.
| mnau wrote:
| It would be removed by distros. XScreensaver had a notice
| when user ran old version and Debian removed it.
| j-krieger wrote:
| Google made 10^7 as much money as I did last year. Yea, I
| don't think it's as simple as you make it seem.
| kllrnohj wrote:
| Google sponsors a lot of open source work:
| https://opensource.google/organizations-we-support
|
| I wonder if sudo would be better off joining one of those
| open source foundations instead of staying solo. It's too
| small to justify a meaningful amount of contribution to
| these companies, at which point the bureaucratic overhead
| of dealing with it probably kills the motivation
| habitable5 wrote:
| This is the current list but from a cursory look it lacks
| GSoC which has been a significant source of new
| contributors since forever.
| shevy-java wrote:
| I disagree on "the most critical" part. You can be superuser at
| all times. I understand the arguments why not; I am pointing
| out that this is possible. Despite people claiming aliens will
| arrive and nothing will work, everything works fine when the
| superuser account is used too.
|
| Also, I disagree that every company needs to pay the man.
| Funding is important, yes, but a *nix system is not crippled
| without sudo. You can change the permission systems. The
| superuser can do so too. It is not black magic. The permission
| system is trivial. sudo is simply a feature of convenience, not
| a "if sudo does not exist, nothing works" - that just makes no
| sense.
| account42 wrote:
| You don't even have to be root all the time, su is all you
| need unless you have a fetish for software bloat.
| noosphr wrote:
| Whenever people say that MIT or GPL licenses are a good idea I
| point out projects like this.
|
| Only humans should have freedom zero. Corporations and robots
| must pay.
| groby_b wrote:
| That's a nice slogan, but how does it work?
|
| Say, I clone sudo. Clearly, a human applying freedom zero. I
| use it in my projects. Probably still freedom zero. I use it
| in my CI pipeline for the stuff that makes me money...
| corporation or human? If it's corporation, what if I sponsor
| a not-for-profit that provides that piece of CI infra?
|
| The problem is that "corporation or not" has more shades than
| you can reasonably account for. And, worse, the cost of
| accounting for it is more than any volunteer wants to
| shoulder.
|
| Even if this were a hard and legally enforceable rule, what
| individual maintainer wants to sue a company with a legal
| department?
|
| What _could_ work is a large collective that licenses free
| software with the explicit goal of extracting money from
| corporate users and distributing it to authors. Maybe.
| conception wrote:
| Not for commercial use without buying a license is a pretty
| standard licensing scheme. This has been worked out for
| decades.
| mulmen wrote:
| What happens when the code is abandoned? Can I make my
| own changes whenever I want?
|
| The problem with commercial software is the lock in.
| groby_b wrote:
| And the shades in between account for the large number of
| new licensing schemes sprouting, with different
| restrictions on what is and isn't possible. (Not to
| mention the large number of "just used it anyways"
| instances). And it struggles for smaller utilities, or
| packages of many different things.
|
| It's "worked out" in the sense that it still doesn't
| really work for a lot of maintainers.
| atq2119 wrote:
| The challenge is that this doesn't really work for
| community-developed software.
|
| Let's say somebody uses this scheme for software they
| wrote. Would anybody else ever contribute significantly
| if the original author would benefit financially but they
| wouldn't?
|
| Mediating the financial benefits through a non-profit
| might help, but (1) there's still a trust problem: who
| controls the non-profit? and (2) that's a lot of overhead
| to set up when starting out for a piece of software that
| may or may not become relevant.
| wmf wrote:
| You can demand payment but it doesn't mean you'll get paid.
| These days companies will clone your work instead of paying.
| zhengyi13 wrote:
| As covered literally just a few days ago (IIRC), you
| absolutely _can_ demand payment:
| https://github.com/LGUG2Z/komorebi actively works to detect
| MDM, and if found, demand payment.
|
| Not open source, but an interesting counterpoint, I think.
| bsnnkv wrote:
| Relevant articles are here
|
| - https://lgug2z.com/articles/normalize-identifying-
| corporate-...
|
| - https://lgug2z.com/articles/i-started-identifying-
| corporate-...
|
| The post-open source space is indeed a very exciting
| space in 2026
| alt187 wrote:
| That's not post open-source. That's dual licensing, an
| use-case FOSS has enabled and supported forever.
| bsnnkv wrote:
| > any time someone says something is post-$thing it means
| what they are doing is in dialogue with and in response
| to $thing. "we were doing that before $thing" no, you
| can't be in dialogue with something that hasn't happened
| yet.
|
| > this is like saying "what do you mean post-modernist
| architecture, architecture predates modernism".
|
| https://lobste.rs/s/kaftkn/i_started_identifying_corporat
| e_d...
| Aurornis wrote:
| Releasing open source software and then "demanding payment"
| goes against everything about open source.
|
| If someone expects to be paid for the use of their
| software, releasing it as open source is not what they
| want.
|
| If a maintainer of a software project starts trying to
| demand payment or threatening to change license terms, it's
| a reasonable response for a company to fork it or build
| their own solution.
| bsnnkv wrote:
| And this is why all new projects by independent
| developers should seriously consider using a post-open
| source license before defaulting to corporate-
| friendly/corporate-first OSI licenses
| saubeidl wrote:
| The GPL is a good idea. It's our socieconomic system that
| isn't.
| noosphr wrote:
| Everything is a good idea if you assume a world in which it
| works.
| fragmede wrote:
| Communism has entered the chat.
| saubeidl wrote:
| That, for example, would be a better system. One the GPL
| would work beautifully in.
| david-gpu wrote:
| If you can't explain why it did not work in the past, and
| can't explain how & why things will be different this
| time, you don't have a plan. History is a harsh mistress.
| mediumsmart wrote:
| It works, but you need real human staff. And we learn
| from history that we don't learn which can be harsh.
| jibal wrote:
| Communism worked in China, for some definition of
| "worked". Stalinism eventually failed in the USSR and
| elsewhere. An extensive literature explains these things,
| as well as explaining different forms and varieties of
| "communism", and things that people call "communism" but
| aren't.
| david-gpu wrote:
| Communism worked so well in China that as soon as they
| adopted something resembling free markets in some
| regions, thanks to Deng Xiaoping, their GDP per capita
| rose amazingly fast for 3~4 decades. Not exactly a
| stellar example.
| Muromec wrote:
| As a person who had a privilege to live in a commie-block
| half his life, no, it isn't a better system.
| jibal wrote:
| That was Stalinism, not communism. And there are many
| ways to implement communism, some of which are better
| than others.
| PunchyHamster wrote:
| GPLv3 is a bit overreaching , especially in patent clauses.
| The GPL as idea is great but the license needs a little
| more refining
|
| The constant fear of lawyers that using some GPL lib will
| infest entire codebase of their project with GPL is a real
| problem that stops many corporations from contributing in
| the first place.
| aboardRat4 wrote:
| GPL is a response to the copyright law, which was created
| for the big corporations to extract rent from ordinary
| people.
|
| It's copyright law which should go away.
| satvikpendem wrote:
| Including the hangups people have about AI training as
| well.
| JuniperMesos wrote:
| Copyright law is hundreds of years old and originally was
| intended to prevent owner-operators of mechanical
| printing presses from printing and selling copies of some
| author's books without paying them or getting permission.
| degamad wrote:
| > originally was intended to prevent owner-operators of
| mechanical printing presses from printing and selling
| copies of some author's books without paying them or
| getting permission.
|
| We agree that that was its initial stated intention.
|
| However, what we have seen in practice is that it has
| resulted in the owner-operators of those machines banding
| together to restrict access to the machines unless
| authors sign exploitative contracts assigning their
| rights to the operators (which they interpret as "getting
| permission").
| JuniperMesos wrote:
| The world has changed substantially since the 1710 Statue
| of Anne; there's a thousand things that you could call
| the modern-day equivalent of mechanically printing a
| book, with myriad capital and operating costs and
| availability. Many ways an independent author or artist
| can publish their work are extremely cheap and effective.
| I'm relatively anti-copyright, but that doesn't mean that
| everyone currently benefiting from copyright law is rent-
| seeking in an exploitive way.
| aboardRat4 wrote:
| It was created when there was a scarcity of content, so
| state violence was used to encourage production of
| content.
|
| But now we don't live in the age of scarcity of content.
| On the contrary, content creators are competing for a
| possibility to get into consumers' attention span and
| push their agenda (ads). Everything has changed.
|
| Removing all copyright restriction will not decrease the
| amount of content available for a person through their
| lifetime even a few percent.
| drnick1 wrote:
| > It's copyright law which should go away.
|
| This precisely. What started out as a way of rewarding
| authorship (of text, software, or other things) has
| mainly become a way of extracting rent -- see the music,
| movie, and software industries. In the digital age, when
| the cost of making copies of such works is approximately
| zero, copyright law ceases to make sense.
|
| Note that this does not mean you cannot make money
| selling software or software-related services. For
| example, game developers could still sell keys for online
| play on their servers even if they couldn't copyright the
| binaries.
| saubeidl wrote:
| GPL is much more than that. It is _distributing the means
| of production_ to the tech workers.
|
| rms is the Marx of the 20th Century. GPL is freedom from
| corporate oppression.
| omoikane wrote:
| I am not sure sudo is licensed under MIT or GPL, looks it's
| like a mix of licenses[1]. The end of the first license says
| it's sponsored in part by DARPA.
|
| From 2010 to February 2024, it was sponsored by Quest
| Software according to the history page[2].
|
| [1] https://github.com/sudo-project/sudo/blob/main/LICENSE.md
|
| [2] https://www.sudo.ws/about/history/
| sixtyj wrote:
| The behavior of corporations is shameful.
|
| After all, people in these companies don't work for free and
| are able to spend a lot of money for other services.
| 6LLvveMx2koXfwn wrote:
| Haven't you just hit the nail on the head? Corporations do
| not feel shame even if people within them do; hence actions
| . . .
| throw0101c wrote:
| > _Corporations and robots must pay._
|
| Greenpeace is a (non-profit) corporation. Unions are
| corporations. Municipalities. Colleges and universities.
|
| * https://en.wikipedia.org/wiki/Legal_person
|
| Should they have to pay?
| noosphr wrote:
| Yes.
| llbbdd wrote:
| Yes. Non-profits are more than capable of abusing the
| commons, the purpose of even small monetary requirements is
| to put a bound on that.
| isatty wrote:
| Yes. Not for profit does not mean they don't have money.
|
| With that logic why should non profits have to pay for
| anything at all?
| Muromec wrote:
| For the same logic they are tax-exempt. There is a
| general consensus that their goal is the greater good
| (like developing sudo and such) and not the usual
| capitalistic good of generating more money.
|
| Then again, you usual Friday outing of FANG engineers may
| have more money than some nonprofits too.
| degamad wrote:
| I used to volunteer for a local non-profit a few years ago.
|
| From time to time, I would reflect on the fact that
| Microsoft and other commercial suppliers were getting paid
| for providing services to us, but I was expected to work
| for free.
| LunaSea wrote:
| If Mozilla and Wikimedia can pay millions in salary to
| their CEOs, I'm sure that they can spare a few thousands
| for open source projects.
| groby_b wrote:
| You can only fix that with leverage. The sudo maintainer
| doesn't have it. sudo is valuable, but if Todd stepped away,
| you could (and would) find other maintainers because it's so
| important.
|
| If you want to fix it, you need organizational heft comparable
| to the companies using it, and the ability & willingness to
| make freeriding a more painful experience.
| eichin wrote:
| Wasn't the sudo-rs (rust version) already reducing that
| leverage even further? (and finding interesting bugs, but
| that's not the point here)
| af78 wrote:
| Surprisingly Jia Tan has not offered to help yet.
| SunlitCat wrote:
| Maybe someone should suggest, sudo needs compression
| capabilities and suggest a great developer, being helpful
| with that one? :D
| midtake wrote:
| Jia Tan and his 40 sockpuppets are undoubtedly trying.
| tuhgdetzhh wrote:
| Reminds me of https://xkcd.com/2347/
| gonzo41 wrote:
| At the least, all the hyperscalers should be putting money into
| a fund for this sort of thing.
| aboardRat4 wrote:
| Why would it be needed to continue the development of sudo?
|
| Isn't it done and finished, after 30 years of development?
| not_ai wrote:
| The monthly releases seem to indicate otherwise.
| aboardRat4 wrote:
| Something's deeply wrong here.
| mulmen wrote:
| Then fork it and finish it. I'm sure it will be a huge
| success.
| alt187 wrote:
| You should look up "doas". It might enlighten you.
| mulmen wrote:
| If you have a point to make then make it. I don't accept
| anonymous homework assignments.
| s5fs wrote:
| Things have changed quite a bit in the past 30 years!
|
| I encourage you to peek at their changelog
| (https://www.sudo.ws/releases/changelog/) for more
| insight into why this project is still under active
| development.
| jibal wrote:
| I just learned about amathia
| (https://modernstoicism.com/there-is-nothing-banal-about-
| phil...), which seems to apply here.
| account42 wrote:
| It's a kitchen sink tool that does way too many things.
| drnick1 wrote:
| It's all bug fixes it seems. What is surprising is that so
| many bugs remain even after all this time and effort. And no,
| for the most part these are not the kinds of bugs that are
| squashed by a rewrite in Rust.
| firesteelrain wrote:
| I guess I don't understand. Take RHEL. The sudo maintainer
| seeking a new sponsor affects upstream velocity and
| stewardship, not the deployed trust model of enterprise
| distributions. RHEL does not "follow HEAD." It vendors a known-
| good snapshot and assumes long-term responsibility for it.
|
| Core tools like sudo have survived things like this before
| hiAndrewQuinn wrote:
| I wonder how many guys who have have written or significantly
| maintained "household name" level FOSS products just earn a
| corporate sinecure somewhere as hypercompetent remote sysadmins
| or ICs or something. Folks who don't necessarily care to earn
| top dollar, with all the headaches that entails, but also
| almost never have to actually work more than 2 hours in a given
| day to keep the ship going, and the arrangement is just so cozy
| and gives them enough time to themselves to work on their
| actual passion that they accept the arrangement.
|
| I know of at least one recruiter who does something like this
| and specializes in greybeard hiring, and it seems like a steady
| niche if you have the network to pull it off.
| account42 wrote:
| > one of the most critical pieces of infrastructure
|
| It's really not.
| Hendrikto wrote:
| How is it not? A suid binary installed on pretty much every
| Unix system ever seems pretty critical to me.
| mayhemducks wrote:
| Living without it isn't hard IMO. It's more of a
| convenience. Most of the servers I ever login to only have
| one non-root user anyway. When I need root, I switch to
| root.
| rurban wrote:
| And how do you switch to root? sudo is the most popular
| way
| jandrese wrote:
| Honestly he should open a Patreon. There are loads of people that
| would subscribe to Sudo for $2/month or $5/month.
| rileymat2 wrote:
| The problem is if I was going to do that with the open source
| projects I use, it is more like a penny a month * 1000
| projects.
| bobmcnamara wrote:
| $.01/user/month would be quite a bit here
| einsteinx2 wrote:
| Subtract the standard ~3 cent transaction fee and he'd end
| up owing money instead. That seems to always be the catch
| with micropayment ideas.
| __turbobrew__ wrote:
| Sounds like we need an open source index fund where you
| can make one payment that goes into a pool of money which
| is invested into the top 1000 open source projects.
| krior wrote:
| What are the top 1000 oben source projects?
| tmtvl wrote:
| Well, there's systemd, systemd-resolved, journald, GNOME,
| Wayland, systemd-homed, systemd-boot,...
| aftbit wrote:
| It almost seems like someone ought to be able to build
| some kind of digital currency with low transaction fees
| and no centralized payment processor that could power
| microtransactions. I wonder why nobody has done that yet.
| einsteinx2 wrote:
| I know crypto was supposed to solve this problem, but
| I've never seen an implementation that actually did the
| job. You'd think someone would have built a successful
| "Patreon for micropayments" in the past 10 years, but no
| one has.
| aftbit wrote:
| Yeah I think the problem is that most of the main chains
| had astronomical transaction fees; most of the side
| chains that solved this problem had a trust problem; and
| Bitcoin Lightning was sorta dead on arrival, though it
| had both the trust and the technology solution. At that
| point, this forum had already moved BTC from "amazing new
| technology" to "huge threat to social order and
| environment".
| jorvi wrote:
| BAT literally was built for (accumulation of)
| micropayments.
| janandonly wrote:
| Sounds like the above 2 ideas should be combined.
| Lightning payments are more or less free, and an index or
| tracker that looks at your bash history could make it
| possible to spread 5$ per month over all projects that
| you use.
| tzs wrote:
| There are at least two catches with micropayment ideas.
| One is transaction costs. The other is taxation.
|
| If person in country X is accepting payments (micro or
| regular) directly from customers/donors in country Y they
| are then running an international business. That can have
| income tax, sale tax, VAT, and probably other tax
| collecting and reporting requirements in one or both
| countries.
|
| It's a big can of worms you probably don't want to deal
| with unless you are making significant money from Y.
| Multiply all that by the number of different countries
| you get paid from.
|
| The best way to fix the transaction fee problem is
| probably to use an intermediary. For micropayments people
| (payers and payees) have accounts at the intermediary.
| Payers preload their account with a payment large enough
| that the transaction fees are only a tiny percentage,
| then can direct how that money is distributed. On the
| payee side the intermediary waits until the payer has
| received enough to be able to do a transfer to the payees
| bank account without transaction fees eating too much.
|
| The intermediary can also fix the tax problem. The way
| that works is that the intermediary operates as a legal
| entity in both country X and Y. Payers interact solely
| with the legal entity in their country, and payees
| interact solely with the legal entity in their country.
| Payers and payees then only have to deal with their own
| country's tax system.
|
| The problem here is who should run the intermediary
| service? I doubt people will be able to agree on that.
| What we probably need is a system where there can be
| multiple intermediary services, but the services talk to
| each other so if say I want to donate to project Foo and
| Foo and I use different services I tell mine to send Foo
| a micropayment and my service and Foo's service make that
| happen.
|
| This could work similar to the way peering works on the
| internet backbone.
| ycombinatrix wrote:
| payment processors: "how about no"
| karamanolev wrote:
| Why? If every person participating is giving $10-$20 per
| month to tens or hundreds of projects and then once
| distributed, this equates to $x00 or $x000/project/month,
| why would the payment processors mind. Of course, it's all
| in theory.
| ycombinatrix wrote:
| they charge a minimum fee per transaction. from Accursed
| Farms' donation page
| (https://www.accursedfarms.com/donations/)
|
| "Paypal keeps $0.30 + 2.9% of every donation, so please
| keep anything less than $0.32 as they have enough money
| already."
|
| i think Cash App has the lowest fees i've seen at like
| $0.01 which would still be too much.
|
| not saying it is impossible - but likely not viable
| directly with the current payment providers.
| squigz wrote:
| This is why I feel like a missing piece of
| Patreon/Kofi/whatever is the ability to say "Here's $x;
| divide it automagically amongst the creators I'm currently
| following"
|
| Sure, I think a lot of those donations would amount to a few
| pennies or so at once, but I feel like a lot more people
| would be willing to support creators if they didn't have to
| constantly choose which to support.
| robertlagrant wrote:
| I would love it if something like Github would accept
| donations from a repo and parcel it out to the repo's
| dependencies somehow. It would sadly make Github even
| stickier, but it would be a great feature.
| ak009 wrote:
| wouldn't https://github.com/sponsors/sudo-project achieve the
| same thing in this case?
| jandrese wrote:
| That's great, I wish he had _mentioned it_.
| gregw2 wrote:
| True, but it sounds like he's more looking for "a" sponsor,
| not crowdfunding which he already has tried.
|
| That might be why he hasn't mentioned it.
| adolph wrote:
| They are using github sponsors and have had some level of
| contributions.
|
| https://github.com/sponsors/sudo-project
| RhysU wrote:
| I would kick him $20. Anyone know how?
| xxs wrote:
| >Patreon
|
| And they start making videos about, mentioning the sponsors.
| There are better options to get money.
| fHr wrote:
| Unbelievable, every fortune 500 company should sponsor this you
| all rely and use this. This makes me so sad I hope this has a
| good end.
| dwflanagan wrote:
| sudo pay him
| anigbrowl wrote:
| I've said it before, open source works poorly in this area. It's
| great if everyone's getting paid fat money in a day job and can
| maintain their pet project a few days a month, but that's just
| not true for a lot of people.
|
| It's disgusting that maintainers of critical projects have to go
| through the humiliation of begging for money, and absurd to
| suggest they all hang out Kofi or PAtreon banners. Realistically
| nobody is going to go through their bash history working out what
| utilities they use in order of frequency and allocating funds to
| the maintainers proportionally. I'm baffled that some entity like
| the Linux Software Foundation isn't administering this already.
| fragmede wrote:
| > Realistically nobody is going to go through their bash
| history working out what utilities they use in order of
| frequency and allocating funds to the maintainers
| proportionally.
|
| Not if we don't make it easy for them. I had Claude whip up
| _fundcli_ a while ago, but this post got me to finally upload
| it. It goes through your http://atuin.sh/ history (raw
| .bash_history/.*history doesn't have enough information) and
| generates links to projects for you to donate to.
| git clone https://github.com/fragmede/fundcli uv run
| src/fundcli/cli.py analyze uv run ./src/fundcli donate
| --amount 100
|
| to get links to donate $100 for last month's usage. There's
| also http://thanks.dev if you're looking for other places to
| donate to based on your open source usage.
| jongjong wrote:
| I feel like this should have been the responsibility of
| investors and venture capitalists. In a normal society, the
| moneyed folks should give special treatment to the folks who
| have proven themselves to be effective givers.
|
| Unfortunately, it seems like either the moneyed folks don't
| care or the current financial structure simply does not support
| this.
| badsectoracula wrote:
| I think that's because the moneyed folks tend to be effective
| takers :-P
| phicoh wrote:
| I wonder if a few people going beyond what is reasonable, is
| representative of open source projects.
|
| For a lot of open source projects, if you have a normal day job
| and spend a few hours per week on a project, then the project
| just never gets very big. It exists, may have a few users. But
| on a larger scale, nobody knows it exists.
|
| The exceptions are projects where developers spend a lot of
| time on the project at the expense of a day job. Though there
| is the possibility that they may have a hard time having a day
| job in the first place, which may have let to the situation
| with the open source project.
|
| In general, I think we do have a culture problem where we think
| projects need to be successful. And people working on a project
| 'need' to support users (who in general don't pay).
|
| And that expectation of free work happens throughout the open
| source ecosystem as well. Distributions expect projects to fix
| bugs for free. Open source projects expect libraries and
| compilers to be maintained.
|
| Ultimately, change has to come from people who refuse to work
| for free. Doing something as a hobby for free is perfectly
| fine. As long as it stays within the scope of a hobby project.
| kcexn wrote:
| I think this is partly an education problem, and partly an
| industry culture problem. Lots of young developers are
| incentivized to 'contribute' to open-source as a way to
| demonstrate that they can actually write software. So open-
| source becomes a way of signalling competence when at a
| broader scale it's just extracting wealth from the
| vulnerable.
|
| Open-source seems to be fragmented into three groups now.
| Large enterprise open-source like Kubernetes or OpenStack
| where the license seems more like a legal agreement amongst
| vendors to not sue each other. Legacy open-source projects
| that are getting by on brand recognition and sheer willpower.
| And a whole bunch of noise from people who are looking to
| leverage open-source into a job of some sort.
|
| I'm not sure what the solution is...
| shevy-java wrote:
| The funding problem is an issue.
|
| We need to find better models. Even if it is just "low(er)"
| payment; that would still be better than zero or near zero
| payment.
| larodi wrote:
| Universal Global Contributor Wellness Fund
|
| may also fund retirements for certain individuals, and there is
| for sure enough free juice to get it started in a very
| reasonable way. these people really deserve it, the same way
| Nobels extist, etc.
| dangoodmanUT wrote:
| Impressive
|
| but the mascot for sudo is terrifying
| ahartmetz wrote:
| But also quite funny when you make the connection!
| hobofan wrote:
| Perpetuating misogyny as the mascot of one of the most used
| pieces of software. Yay!
| ahartmetz wrote:
| Look again at the xkcd comic (I did before posting the
| comment). The sandwich-making person is not obviously
| female, in fact he(?) looks rather male according to xkcd
| convention.
| hobofan wrote:
| "make me a sandwich" has been a saying to dismiss women
| for decades before the xkcd comic existed.
| metalliqaz wrote:
| This kind of thing is why the left always loses. If you
| want to win, people have to like you.
| dannyw wrote:
| Context always matters. Phrases can also be normalized
| through everyday use without the negative connections.
| thelastgallon wrote:
| There's also NTP.
|
| The Largely Untold Story Of How One Guy In California Keeps The
| World's Computers Running On The Right Time Zone:
| https://onezero.medium.com/the-largely-untold-story-of-how-o...
|
| https://xkcd.com/2347/
| debo_ wrote:
| You forgot the more relevant: https://xkcd.com/149/
| ryandrake wrote:
| Reading the release history[1]. I'm kind of shocked that sudo
| gets active development and monthly releases. I would have
| thought that something this old and venerated would have been
| "done" long ago.
|
| 1: https://www.sudo.ws/releases/devel/
| hobofan wrote:
| "Done" software is a myth they tell to young developers so that
| they can sleep easy at night.
| kachapopopow wrote:
| wireguard is relatively "done"
| imchillyb wrote:
| "relatively" is just a word added to done and the fact that
| there is a qualifier precludes the word from bearing truth.
| yjftsjthsd-h wrote:
| Out of curiosity, what changes would it have at this
| point?
| hobofan wrote:
| I'm not intimately familiar with Wireguard, but there are
| some things that are almost universally applicable:
|
| - It should run on an maintained OS (which should run on
| available hardware), so whatever changes are necessary to
| keep pace with that
|
| - It may want to add optimizations regarding newer CPU
| architectures
|
| - It uses a compiler, so whatever changes necessary to
| stay on a maintained version of the compiler
|
| - It uses cryptography, so whatever changes necessary to
| stay up to date with latest cryptographic research to
| provide a secure solution, as well as updating
| cryptographic libraries to not be exposed to CVEs found
| in them. It also exists in the context of one/multiple
| jurisdictions, so possibly also changes to comply with
| interference in sound cryptography (let's hope not).
|
| And all of those are just part of the things to keep up
| with the world around you evolving. Of course there may
| also be bugs to fix in the code itself, and/or new ones
| created by doing any of the changes above.
|
| Even their definition of "complete"[0] includes "active
| maintenance" and "still much to do".
|
| [0]: https://www.wireguard.com/repositories/
| midtake wrote:
| It uses Curve25519 for key exchange and ChaCha20-Poly1305
| for symmetric encryption. There aren't many hardware
| primitives that would speed it up, although AVX2 and
| similar would help process ChaCha20.
| bayindirh wrote:
| > It uses Curve25519 for key exchange and
| ChaCha20-Poly1305 for symmetric encryption.
|
| For now.
|
| > There aren't many hardware primitives that would speed
| it up,
|
| For now.
|
| > although AVX2 and similar would help process ChaCha20.
|
| So, there's at least a bullet point for experimental
| branching.
|
| Also, the WireGuard Tunnel Manager on macOS is far from
| done.
| MagicMoonlight wrote:
| Of all the things to pick, software which needs to be
| secure and is actively attacked is the worst one.
| reverius42 wrote:
| So like sudo
| latexr wrote:
| Absolutely false. I have built tons of tools which are
| feature complete and continue to work to this day without
| intervention. Heck, I even have tools _I no longer use_ that
| people asked me to keep available because they do, and
| they've been chugging along for over a decade, no bugs or
| maintenance necessary.
|
| Just today I saw a report of Adobe discontinuing a tool in
| use by professionals _because it is done_ and they don't know
| what else to add.
|
| https://mastodon.social/@grishka/116005782128372247
|
| "Software is never done" is a myth they tell to keep
| extracting money from you.
|
| A lot of the time, failing to to finish software indicates a
| badly defined scope.
| rcxdude wrote:
| That tool, BTW, is essentially the authoring side of Flash
| rebranded.
| hobofan wrote:
| > Just today I saw a report of Adobe discontinuing a tool
| in use by professionals because it is done and they don't
| know what else to add.
|
| Yeah, I'm sure the reason stated by the customer support is
| the real one, and not the lack of profitability from that
| tool among a shift of focus towards AI[0] as reported
| everywhere.
|
| https://techcrunch.com/2026/02/02/adobe-animate-is-
| shutting-...
|
| > for over a decade, no bugs or maintenance necessary
|
| I'll believe it when I see it. Keeping something running
| for a long time is a lot easier task than building
| something that can be run in an ever changing world.
|
| Given that it's that old I'd wager that it isn't runnable
| on/compileable for ARM64 without some kind of maintenance.
| And if it's written in an interpretable language there is a
| good chance that the underling interpreter/runtime are EOL
| by now.
|
| > A lot of the time, failing to to finish software
| indicates a badly defined scope.
|
| And a lot of the time finished software becomes unused
| because it sticks to scopes that don't match up with
| reality/user needs anymore.
| dannyw wrote:
| Yeah, I have a relatively simple script with webUI for
| organising photos and videos I take on my NAS.
|
| Over the years I've had to upgrade the ffmpeg dependency,
| which resulted in breaking changes a couple times and
| maintenance.
|
| I've also had to spend nearly a whole day fixing the
| webUI when iOS's wonderful liquid glass came out.
| hobofan wrote:
| How did liquid glass break your Web UI?
| dannyw wrote:
| Liquid Glass changed dimensions and viewport measurements
| for fixed position elements, amongst a whole host of
| positioning related bugs:
|
| https://stackoverflow.com/questions/79753701/ios-26-safar
| i-w...
|
| Many of the bugs were fixed in 26.1, but still, I had to
| fix it to use it.
|
| I was surprised that not much of the entire web was
| broken, but a cursory search of commits showed that the
| WebKit/Apple team took the approach of coding in site
| specific hacks for popular sites (eg instagram, google
| search!) for iOS 26.
| DrewADesign wrote:
| Maybe I'm not looking in the right places, but I rarely
| see fixed position elements in modern web layouts-- I
| imagine that's why you didn't see more disruption.
| dannyw wrote:
| They may not be used in layouts, but they can be present
| in cases like keyboard open (if you wanted to attach some
| controls above the software keyboard for example); or
| just ever growing compatibility hacks.
| vanderZwan wrote:
| > _Yeah, I 'm sure the reason stated by the customer
| support is the real one, and not the lack of
| profitability from that tool among a shift of focus
| towards AI[0] as reported everywhere._
|
| Yeah, although "finished" software is antithetical to
| this always have new features to push onto your customers
| subscription model, so it's not entirely unrelated.
|
| Having said that I still find it strange. I can imagine
| it might not be able to ride on the AI bubble, and
| perhaps animators are especially vocal about not wanting
| AI in their tools. But even so, why would that make Adobe
| Animate unprofitable? They do have a subscription model,
| and customers, so people are paying for this product.
|
| Compared to other digital art, the data for vector
| animation takes relatively little space to store. It also
| requires much less resources to render than other forms
| of video, and rasterized video output should compress
| really well compared to alternatives, especially with
| modern codecs that are not only optimized for regular
| film. So surely it shouldn't be _that_ expensive to
| maintain for them compared to all their other projects.
| hobofan wrote:
| > But even so, why would that make Adobe Animate
| unprofitable?
|
| Sorry, I wasn't precise with my wording. What I meant to
| say was "less profitable than the perceived AI
| opportunities they could do with the same engineers".
| latexr wrote:
| > not the lack of profitability
|
| What "lack of profitability"? They just reported a record
| quarter. Adobe shoves full Creative Cloud subscriptions
| down everyone's throats; buying _one_ tool, especially
| when it's not one of the flagships, is uncommon. What
| exactly are they losing by just letting Animate _be_?
|
| > And if it's written in an interpretable language
|
| I have never ever ever had to change shell, Ruby, or
| JavaScript code because "the underling
| interpreter/runtime are EOL". Never. That code keeps
| happily running, doing its work, with whatever version of
| the interpreter I have available in whatever box.
|
| > And a lot of the time finished software becomes unused
| because it sticks to scopes that don't match up with
| reality/user needs anymore.
|
| So what? That's perfectly fine. Do you drink milk out of
| a baby bottle? Do you ride a bike with training wheels?
| It's perfectly fine to build a tool for a purpose and a
| time and place and let it exist there for the people who
| care for it. That's also true of video games (which, lest
| we forget, are software). In a world where people are
| constantly complaining about software updates moving shit
| around, removing features, and adding crap they don't
| want, plenty of people appreciate that the things they
| like continue to work as they always have.
| hobofan wrote:
| > What exactly are they losing by just letting Animate
| be?
|
| Maintenance cost (which you claim doesn't exist) of the
| engineers that they are planning to staff on other
| project they are assuming will be more profitable. Of
| course that's just a bet and not a sure thing.
|
| > I have never ever ever had to change shell, Ruby, or
| JavaScript code because "the underling
| interpreter/runtime are EOL".
|
| I think we are living in different realities. Almost
| every (open source) project that I encounter that's 10+
| years old isn't runnable without changes.
|
| > Do you drink milk out of a baby bottle? Do you ride a
| bike with training wheels?
|
| Do you still drive a Ford Model T?
| stearns wrote:
| > I'm sure the reason stated by the customer support is
| the real one
|
| Oh, but it's so much more beautiful than that! You're
| really underselling it! It's not "the reason stated by
| the customer support", it's:
|
| The reason snarkily paraphrased by a Mastodon post Which
| quotes a Twitter post Which quotes a Bluesky post Which
| tells a story about a conversation with an Adobe customer
| service rep.
|
| Surely that tongue-in-cheek Mastodon post increases the
| information that we have about this incident by exactly
| Zero.
| usrbinbash wrote:
| > Absolutely false. I have built tons of tools which are
| feature complete and continue to work to this day without
| intervention
|
| And how many of these tools are mission critical to the
| point that they are installed on almost every Linux box in
| existence, probably invoked tens of billions of times per
| day, both by humans and software, and the entire world
| would be in deep goddamn trouble if there was a serious
| security flaw that doesn't get fixed immediately?
|
| Because that's what `sudo` is.
|
| And no, such software is never "done".
| latexr wrote:
| You've moved the goalposts so far away, they've left the
| breathable atmosphere. Look at your condition, it's over
| 50 words. I didn't say "all software can be done", I just
| said that it's not true that software is _never_ done.
| It's not a universal truth that applies to all software.
| nananana9 wrote:
| Not a great example as that "done" tool (whose currrent
| iteration barely functions) will be made unavailable after
| a few years.
|
| That tool is still very much in active use in my industry,
| and we'll need to figure out what to do with some 10000 fla
| files that we need to occasionally edit and republish
| (hint: the solution probably involves a certain Swedish
| software repository).
| Intralexical wrote:
| It's a bit ironic that digital goods, which are arguably
| the only products which once compiled can be stored, used,
| and copied perfectly bit-for-bit, are also the only
| industry that seems to have this problem with being
| unwilling to call a product "done".
|
| The reasons for software churn are economic, cultural, and
| psychological, not technological.
| hobofan wrote:
| > unwilling to call a product "done"
|
| Unlike modern physical products, software often has a
| contiguous lineage, with less individual hard cuts
| between releases, that e.g. necessitate setting up a new
| production line for each iteration.
|
| Of course you can call individual releases "done" but
| then you also have to accept that the same realities
| apply to it that it's utility will decay over time same
| as e.g. household appliances do, where you also wouldn't
| use one that's 40 years old.
|
| Calling a software project as a whole "done" (and
| claiming that it doesn't have bugs and doesn't need
| maintenance) would be akin to Apple saying the iPhone
| (the whole product line/smartphone niche) is "done".
| Intralexical wrote:
| > Of course you can call individual releases "done" but
| then you also have to accept that the same realities
| apply to it that it's utility will decay over time same
| as e.g. household appliances do, where you also wouldn't
| use one that's 40 years old.
|
| Physical appliances decay because of wear and tear, which
| digital products are uniquely immune to.
|
| Replacing and fixing physical wear and tear is more like
| having to occasionally clean your logs folder, or
| reinstall your OS. Admin maintenance on a specific
| installation, not updates to the product from the
| developer. The product itself stays the same.
|
| Software churn, updates that change the product itself
| and not just the way it's run, are more like General
| Electric requiring you let one of their employees into
| your house to paint the appliance a new color every
| month.
|
| > Calling a software project as a whole "done" (and
| claiming that it doesn't have bugs and doesn't need
| maintenance) would be akin to Apple saying the iPhone
| (the whole product line/smartphone niche) is "done".
|
| Which seems like it would be fine? What do 95% people use
| their smartphone for, that an iPhone from 10 years ago
| was not already able to do? Besides, this comparison is a
| bit circular as software dropping support is often the
| part that forces consumers to upgrade hardware.
|
| Hardware products without software churn do in fact get
| used basically forever. When they do break, they can also
| be replaced with the exact same product, without all the
| issues that running old software gets you.
|
| Apple _could_ make a forever-iPhone that lasts 10 years,
| or 40 years. But it 's more profitable, competitive,
| exciting, and convenient to release a new product line
| every year (while turning old hardware into e-waste via
| software updates).
|
| I'm not saying it's better or worse that things are this
| way, but it does cause some problems and should not be
| presented as inevitable.
| parsimo2010 wrote:
| You might have written software that is "done" if you
| compile it with a single compiler version and don't use any
| OS hooks/APIs and don't care if future changes breaks your
| software. I.e. it's done if you think that people will stop
| needing to use it at some point in the future.
|
| A tool like sudo can never be done because it integrates
| with the constantly updating OS and will always need
| maintenance.
| noirscape wrote:
| There's a difference between software that's "done" (it never
| needs updates, ever) and software that's done (it only needs
| maintenance for security and platform churn).
|
| The former is extremely rare; platform churn alone will
| usually demand updates, even if your code is otherwise
| airtight. Forces generally beyond your access will demand
| that your code is able to conform to platform standards. The
| demand this places can be very variable and depends more on
| the platform than you. (Windows has low platform churn since
| it's possible to futz with compat features, Linux is
| extremely variable on your codebase, MacOS is fairly constant
| and from what I know about mobile phones, you're basically
| signing up to forever maintenance duty).
|
| The latter is much more common; sure, sudo still gets updates
| but most of those won't be new _features_. Specification
| wise, sudo is "done". It does what it needs to, it's
| interface is defined and there aren't going to be any strange
| surprises when I run sudo between any system made in the past
| 10 years or so.
|
| The problem is that when you're selling software, demanding
| compensation for the former is a hard sell since it's things
| customers won't see or necessarily care about. Demanding
| compensation for the latter is much more obviously
| acceptable.
| cousin_it wrote:
| > MacOS is fairly constant
|
| Except when they killed all 32bit games a few years ago
| with Catalina.
| zbentley wrote:
| I think that GP meant that MacOS has a constant nonzero
| rate of platform churn. I might be wrong though!
| noirscape wrote:
| Oops, yes, I meant a constant non-zero rate. It's
| slightly above mobile phones, where the developer is
| treated as the problem that needs to fix itself.
|
| Stuff written for one version of MacOS will _probably_
| work for the next few versions, but there 's just as
| likely a chance that Apple has decided that you need to
| do a full on update of all your older tools. Things like
| dropping Rosetta, 32-bit from the kernel and so on and so
| forth. There's not really any recourse, unlike Windows
| and Linux where you can usually finagle a workable
| solution without having to resort to updating everything
| all the time (so platform churn exists, but a user can
| theoretically choose to avoid it).
|
| This is unlike phones, where there's basically no real
| expectations for when you need to update stuff, so it
| becomes a case of "you need to test every version". The
| lack of respect for tool stability is just one other
| reason why the mobile ecosystem is the user-hostile hell
| it is; this platform churn pretty much is one of the two
| roots of why mobile apps are Like That. (The other being
| that running your own choice of tools is treated as a
| privilege, not a right.)
| DrewADesign wrote:
| I'm not sure truly 'done' exists on systems that interact
| with other systems unless it's an entirely closed loop.
|
| I reckon closed-loop systems can be 'done' every bit as
| much as hardware systems can be if the design, debugging
| and implementation are disciplined enough.
| Intralexical wrote:
| > platform churn alone will usually demand updates, even if
| your code is otherwise airtight. Forces generally beyond
| your access will demand that your code is able to conform
| to platform standards.
|
| Platform churn updates are a failure to limit scope and
| dependency. If you stick with stable standards like
| C99/POSIX/X11/SDL, test strictly and build liberally etc.,
| then who cares what the Web/Qt/Metal people are doing?
| Intralexical wrote:
| The OpenBox WM is a respected piece of software, commonly
| used on minimal Linux desktops, that has been "done" since at
| least 2015.
| sizzzzlerz wrote:
| I was wondering the same thing. I would have thought every
| possible combination of parameters would have been tried by
| now. I guess it just goes to show you that your code is never
| really complete.
| Aperocky wrote:
| > I guess it just goes to show you that your code is never
| really complete.
|
| Yes and no, feature bloat usually justify themselves
| innocently and once you go down that slope there is no
| return.
|
| The hardest thing to do in software is commit yourself to a
| set of feature and protect it from any "helpful additions",
| naming might be the second hardest.
| varenc wrote:
| pros and cons to this approach, like the CVE introduced in sudo
| 9.1.14 (June 2023) fixed in 1.9.17p1 (June 2025).
| https://www.cve.org/CVERecord?id=CVE-2025-32463
|
| But also sudo has A LOT of features that 95% of people don't
| use. Just checkout `man sudo` to get a sense for this. And it
| includes plugins like the popular visudo plugin. You can see
| from the release cadence that real improvements continue to be
| made. Though it is a bit more work to secure a moving target.
| tombert wrote:
| Yeah, silly as it is, I guess it didn't even occur to me that
| sudo had a developer or maintainer, or was even a "program"; to
| me it has been one of those things that has and always will
| exist and I had just assumed it evolved and came about
| alongside Cro-Magnon man.
|
| But of course, that's silly. Of every piece of software has to
| be written. I should probably throw the guy a few bucks,
| considering his code runs in basically every big script on the
| planet.
| qznc wrote:
| It seems to have features I was not aware of. I would not have
| guessed that it contains anything networking-related.
| ninkendo wrote:
| Sudo's networking functionality is infuriating too, because
| if my system's DNS is broken, I get to wait 60 seconds for
| sudo to work, during which time I can't even ctrl+c to
| cancel!
|
| (It has to do with sudoers entries having a host field, since
| the file is designed to be deployed to multiple servers,
| which may each want differing sudoers rules. It's truly 90s
| era software.)
| account42 wrote:
| Feature bloat is the last thing you'd want in security
| relevant software.
| surajrmal wrote:
| I really prefer the design of run0.
| arjie wrote:
| I think the rise of the open-source redistributor groupie has
| been an interesting cultural revolution. I wonder if it will
| persist. Even 10 years ago, the idea of Free As In Speech
| dominated the idea of Free Software. Today, the greatest
| enthusiasm on Hacker News and Reddit is for something like Meta's
| Llama license (which cannot be used by people or corps with
| sufficient numbers of users). It certainly seems like someone out
| there could go out and propose the Microfree License which only
| applies to sufficiently non-rich people.
|
| For my part, I want none of it. I find this reduction of a
| significant philosophy to some kind of base tax-and-distribute
| mechanism distasteful. I don't like communities were this stuff
| is big and they always want to run some taxation scheme where
| they redirect money to their own personal pet projects. It is
| fortunate that modern tools are good enough to build personal
| insulation from this stuff.
|
| Imagine the farce of Apply HN repeated continuously. Simply
| awful.
| debo_ wrote:
| Someone make this man a sandwich.
|
| https://xkcd.com/149/
| baggy_trough wrote:
| systemd, as might be expected, has a sudo replacement in recent
| versions, for those who think sudo might be a bit long in the
| tooth: run0
|
| https://www.freedesktop.org/software/systemd/man/256/run0.ht...
| h4kunamata wrote:
| Canonical tried to change that with sudo-rs, but by being
| Canonical they did what Canonical do best since they got too big:
| Read poop here
| gwbas1c wrote:
| > Halloween `91 with Todd as the infamous Ducktape Man!
|
| https://www.millert.dev/images/photos/todd_ducktape_man.gif
|
| Uhm, how did Todd relieve himself in that costume?
| cr125rider wrote:
| This is the guy in the XKCD comic holding up the entire stack.
| DonHopkins wrote:
| Let's sudo and say we didn't.
| RickJWagner wrote:
| Todd C. Miller, thank you for your contributions. Sudo is an
| awesome piece of work.
| heftykoo wrote:
| It's genuinely terrifying to think how much of the modern
| internet rests on the shoulders of a few people maintaining core
| utilities like sudo, curl, and openssl for decades. Todd is a
| legend.
| rixed wrote:
| Yes but that would be even more terrifying if it rested on the
| whims of some soulless corporation.
| redog wrote:
| ms-sudo to Get-
| AdministratorPermissionForElevatedSecurityOperations
| dannyw wrote:
| 0xEFF0332: Operation could not be performed due to missing
| TPM flag.
| mayhemducks wrote:
| LOL sob
| khaki54 wrote:
| I think xkcd should fund it, that would be comical.
| ilaksh wrote:
| https://github.com/sponsors/sudo-project
|
| Can donate there.
|
| My bank account is basically empty but I will contribute a few
| bucks.
| wodniok wrote:
| Or here.
|
| https://opencollective.com/sudo-project
| egorfine wrote:
| Contributed immediately.
|
| Thanks to sudo-rs: this stolen valor project made me want to
| financially support the original author.
| zbentley wrote:
| how does the metaphor of stolen valor (in my understanding:
| claiming accolades or military credentials/decorations that
| one never received) apply to that project?
|
| I don't know anything about the history here; it's a genuine
| question.
| egorfine wrote:
| Authors of useless rewrites do:
|
| * skip the hard part: designing, getting user feedback and
| designing again;
|
| * get straight to the fun part: coding in their favorite
| language after a well-established and proven design;
|
| * get to call themselves "creator of XXX-rs", where "XXX"
| is a well-known brand and "-rs" is often overlooked.
| ginsider_oaks wrote:
| would it be better if they didn't skip the hard part?
| (i.e. if they re-designed it from first principles) does
| something being hard to do make it more virtuous?
|
| would it be better if they didn't have fun coding it? is
| something worse if it was fun to make?
| zbentley wrote:
| I meannnnnn...
|
| Pedantically, the "stolen valor" metaphor absolutely
| doesn't fit here; you're just griping about the "sudo
| brand" being used in another project's title (which ...
| citation needed, and so what? Is "doas" not committing
| theft but "sudo-improved" is?)
|
| More generally, that's an easy case to make against any
| software you don't like: "it's just reimplementing
| $whatever and trying to pretend to be the original
| therefore it's unethical". Some rewrites are good, and a
| huge benefit of the act of rewriting is that you _do_
| have a clear blueprint and understanding of the
| requirements (hell, _Linux_ was a rewrite). Should the
| original creators of a thing be the only people who can
| ethically rewrite it? Where's the line here?
| senderista wrote:
| A security-focused rewrite of a security-critical program
| that removes insecure features and prevents whole classes
| of vulnerabilities from being introduced in the future is
| hardly "useless".
| b2ccb2 wrote:
| A good time to advertise for Sudo Mastery by Michael W. Lucas,
| highly recommend it if you want to dig in a bit deeper.
| chr1ss_code wrote:
| Thank you :)
| jacquesm wrote:
| Does he live in Nevada, by chance?
| arkensaw wrote:
| It never even occurred to me that sudo was something people had
| to maintain. it's always just been part of linux
| dewey wrote:
| And Linux is maintained by who?
| theGeatZhopa wrote:
| sudo contribute --bank --amount
| sodimel wrote:
| Didn't knew that sudo had a website with a... somewhat
| interesting logo: https://www.sudo.ws/
| esnard wrote:
| Wow, is it related to the "make me a sandwich" XKCD?
|
| https://xkcd.com/149/
| Joe_Cool wrote:
| You do realize the answer is right there:
| https://www.sudo.ws/about/logo/
|
| (and the old logo) ;)
| esnard wrote:
| I missed that, thanks!
| zeroping wrote:
| "This incident will be reported" (in /var/log/auth.log)
| philipwhiuk wrote:
| > Only enable the TLS listener by default if a TLS cert is
| specified.
|
| There's a TLS listener in sudo? This project seems to have a
| tonne of features it shouldn't.
| amai wrote:
| Only recently sudo got copied by Microsoft for Windows 11:
|
| https://learn.microsoft.com/windows/advanced-settings/sudo/
|
| I guess they didn't pay a cent to Todd Miller.
| burkaman wrote:
| https://github.com/microsoft/sudo?tab=readme-ov-file#relatio...
|
| > This project is not a fork of the Unix/Linux sudo project,
| nor is it a port of that sudo project. Instead, Sudo for
| Windows is a Windows-specific implementation of the sudo
| concept.
___________________________________________________________________
(page generated 2026-02-03 23:01 UTC)