doas ported to MidnightBSD reddit / BSD ---------------------------------------------------------------------- rdcldrmr · 2021-09-15 00:32 This is the same unofficial port that had catastrophic security issues not present in OpenBSD's code due to lazy porting and unfamiliarity with the codebase. Let's not recommend it. ---------------------------------------------------------------------- daemonpenguin · 2021-09-15 00:52 This port hasn't had any serious security issues. I think you must be considering another port. ---------------------------------------------------------------------- rdcldrmr · 2021-09-15 02:05 > This port hasn't had any serious security issues. https://github.com/slicer69/doas/commit/720db72 > I think you must be considering another port. Nope. ---------------------------------------------------------------------- brynet · 2021-09-15 04:02 This is indeed the project that has made a number of very questionable porting decisions early on, such a for the port to Linux **replacing strlcpy calls with strncpy**. At least in this instance that is no longer the case, but it seriously calls into question the quality of the project. That matters when this is a port of a security tool from OpenBSD. ---------------------------------------------------------------------- brynet · 2021-09-15 04:15 [More examples](https://github.com/slicer69/doas/commit/64ab988d34f95a 7d9482152a74592ce32647d983). ---------------------------------------------------------------------- jantari · 2021-09-15 10:03 When it comes to security, let the professionals handle it ---------------------------------------------------------------------- m1k3e · 2021-09-15 11:46 Oh wow. Is there another recommended port? Or best to just stick with su/sudo on FreeBSD? ---------------------------------------------------------------------- daemonpenguin · 2021-09-15 12:07 Some people in this thread seem to think this port of doas is unsafe or has had security issues in the past. This is a mistake due to lack of context These folks seem to think the doas port was uploaded as a completed product and then bugs were found later that caused authentication failure. This isn't what happened. When I decided to port doas, I didn't hack together a port and then upload it to github afterwards. What I did was download the OpenBSD source and apply the NetBSD port patch to it, then immediately upload this publicly as a starting point. I'm from the camp of "release early and release often" and wanted to be transparent. The commit linked to suggesting a security flaw (and the first issue report on this project) are both from the same author (me) because it's the first work I did on the port. Which was adding to/fixing the NetBSD port. I was doing this out in the open, much the same way the NetBSD port had been shared, so people could see "how the sausage was made". Despite what some people think, this wasn't a mistake or a serious security issue. It was part of the first efforts of just getting the doas port to compile and run done out in the open rather than doing it behind closed doors and then committing/releasing it after things were polished. I get why seeing this sort of "behind the scenes" work makes people nervous, but it's really just the same work which would have gone into the port anyway to polish the NetBSD patch, but done out in the open. I don't think you should avoid or make "the sky is falling" remarks about this software just because the project was transparent right from the start, before porting efforts and auditing were even started.