5 ms·

Another question is who wants to maintain four decades old GNU C soup? It was written at a different time, with different best practices. In some point someone

Another question is who wants to maintain four decades old GNU C soup? It was written at a different time, with different best practices. In some point someone will rewrite all GNU/UNIX user land in modern Rust or similar and save the day. Until this happens these kind of incidents will happen yearly.

jeffbee 6y ago
The GNU project is wall-to-wall toxic waste, but I note for the record that I don't think sudo is a GNU program and IIRC it's not even GPL.
- DaiPlusPlus 6y ago
  How is it possible that GNU’s `sudo` is not GPL? Unless it’s BSD, I guess?
  - rincebrain 6y ago
    It's not GNU's `sudo`, it's under an ISC-style license, and is maintained by an OpenBSD developer, so it's closer to "BSD's sudo" (though OpenBSD has been shipping `doas` instead for a little while now).
    - arp242 6y ago
      sudo even predates GNU by several years.
      - riffraff 6y ago
        wow, I never realized sudo is from 1980[0]! I thought it was a product of the late '90s. It's actually incredible it has managed to stay around this long. [0] https://www.sudo.ws/history.html https://www.sudo.ws/history.html
        DaiPlusPlus 6y ago
        Pffft, `sed` is from 1974: https://en.wikipedia.org/wiki/Sed https://en.wikipedia.org/wiki/Sed And `ed` dates from 1969: https://en.wikipedia.org/wiki/Ed_(text_editor) https://en.wikipedia.org/wiki/Ed_(text_editor)
        riffraff 6y ago
        ah, yes, but those _felt_ as old as dirt. On the other side, I remember howtos/manuals/READMEs in the early '00s referring to su(1) and only sometimes saying "..these days you should be using sudo(8)", so it always felt like something "new" :)
  - deleted 6y ago
    [deleted]
  - cbarrick 6y ago
    There is no such thing as GNU sudo. The homepage for sudo is https://www.sudo.ws/ https://www.sudo.ws/ It is licensed under an ISC style license.
- mtrycz2 6y ago
  Three decades of free software that generated billions upon billions of revenue and a big part of existing infrastructure is built upon is far from "wall to wall toxic waste". I'm not a fanboy for the sake of it, but you're being a little over your head here.
  - jeffbee 6y ago
    Even in the literal sense revenue does not imply the absence of toxic waste. Indeed, historically speaking, revenue has been strongly associated with toxic waste. I don't mind expressing this opinion. There is nothing anywhere in the GNU project which should be emulated, except the license.
  - jart 6y ago
    Online Linux services are so powerful, that they can even ban the president of the united states of america.
umvi 6y ago
> It was written at a different time, with different best practices. Not that I have any faith in modern "best practices". I'm imagining `grep` written in modern a modern language like JS and I shutter when I think of the hundreds of micro-dependencies like "left-pad" that would need to be downloaded to make it work. Maybe it's fair to say that systems programming languages are in a better state in terms of modern best practices than scripting languages.
- acdha 6y ago
  Try https://github.com/BurntSushi/ripgrep https://github.com/BurntSushi/ripgrep – it’s across the board better, and one of the best personal productivity boosts you can make if you use grep frequently.
- megous 6y ago
  I actually like some modern grep alternatives, like `ag`.
- masklinn 6y ago
  > Not that I have any faith in modern "best practices". I'm imagining `grep` written in modern a modern language like JS and I shutter when I think of the hundreds of micro-dependencies like "left-pad" that would need to be downloaded to make it work. You don't have to imagine: `ripgrep` exists and has all of 10 direct dependencies, 4 of which by the same author because they extracted features / systems from ripgrep (or developed them separately from the start) as they were useful on their own e.g. * regex, for obvious reasons * ignore to match and apply ignorefiles (gitignore and friends which ripgrep takes in account by default) * bstr for conventional utf8 strings rather than guaranteed * grep intends to be essentially "ripgrep as a library"
young_unixer 6y ago
> someone will rewrite all GNU/UNIX user land in modern Rust or similar Or everyone just switches to musl + busybox.
- anthk 6y ago
  Or doas. Much simpler.
im3w1l 6y ago
Rewriting sudo is a weekend project*. Getting people to adopt it is a many-year political campaign.
- toyg 6y ago
  You can bet your last dollar that if the "right" RedHat or Debian developer rewrote sudo with feature parity, it would be adopted by all major distros in a couple of months. It's the sort of thing nobody really cares about except OpenBSD (which wrote their own). The problem is feature parity. Most rewrites cannot guarantee that off-the-bat, so they end up struggling to persuade people to switch - why break stuff that works just fine and lose features, in the name of some engineering purity?
  - axaxs 6y ago
    Poettering to save the day with systemd-sudo?
    - magicalhippo 6y ago
      https://www.youtube.com/watch?v=TkR9QWuoyJ8 https://www.youtube.com/watch?v=TkR9QWuoyJ8
    - kuschku 6y ago
      Polkit-exec (pkexec) already exists, has much better security, and integrates with your DE instead of expecting passwords on the terminal.
      - deckard1 6y ago
        This thing? https://gitlab.freedesktop.org/polkit/polkit/-/blob/master/src/programs/pkexec.c https://gitlab.freedesktop.org/polkit/polkit/-/blob/master/s... Which also seems to not have tests. In fact, the only tests I'm seeing are from 2 years ago. https://gitlab.freedesktop.org/polkit/polkit/-/tree/master/test/polkit https://gitlab.freedesktop.org/polkit/polkit/-/tree/master/t... > has much better security It's using D-bus. My faith in D-bus security is close to my faith in seeing a fresh Linux install with zero D-bus error messages from apps. Which is to say, nonexistent. > integrates with your DE instead of expecting passwords on the terminal. There's nothing inherently insecure about passwords on the terminal, and certainly nothing a DE can do better. I have yet to see a display manager or lock screen app that knows what the hell PAM is doing. Try doing even the simplest things with PAM, such as getting a fingerprint reader or Yubikey working, and every single display manager simply chokes. I'm not sure which is more of a Byzantine mess: Linux authentication and authorization, or Linux audio.

jeffbee 6y ago

The GNU project is wall-to-wall toxic waste, but I note for the record that I don't think sudo is a GNU program and IIRC it's not even GPL.

DaiPlusPlus 6y ago
How is it possible that GNU’s `sudo` is not GPL? Unless it’s BSD, I guess?
- rincebrain 6y ago
  It's not GNU's `sudo`, it's under an ISC-style license, and is maintained by an OpenBSD developer, so it's closer to "BSD's sudo" (though OpenBSD has been shipping `doas` instead for a little while now).
  - arp242 6y ago
    sudo even predates GNU by several years.
    - riffraff 6y ago
      wow, I never realized sudo is from 1980[0]! I thought it was a product of the late '90s. It's actually incredible it has managed to stay around this long. [0] https://www.sudo.ws/history.html https://www.sudo.ws/history.html
      - DaiPlusPlus 6y ago
        Pffft, `sed` is from 1974: https://en.wikipedia.org/wiki/Sed https://en.wikipedia.org/wiki/Sed And `ed` dates from 1969: https://en.wikipedia.org/wiki/Ed_(text_editor) https://en.wikipedia.org/wiki/Ed_(text_editor)
        riffraff 6y ago
        ah, yes, but those _felt_ as old as dirt. On the other side, I remember howtos/manuals/READMEs in the early '00s referring to su(1) and only sometimes saying "..these days you should be using sudo(8)", so it always felt like something "new" :)
- deleted 6y ago
  [deleted]
- cbarrick 6y ago
  There is no such thing as GNU sudo. The homepage for sudo is https://www.sudo.ws/ https://www.sudo.ws/ It is licensed under an ISC style license.
mtrycz2 6y ago
Three decades of free software that generated billions upon billions of revenue and a big part of existing infrastructure is built upon is far from "wall to wall toxic waste". I'm not a fanboy for the sake of it, but you're being a little over your head here.
- jeffbee 6y ago
  Even in the literal sense revenue does not imply the absence of toxic waste. Indeed, historically speaking, revenue has been strongly associated with toxic waste. I don't mind expressing this opinion. There is nothing anywhere in the GNU project which should be emulated, except the license.
- jart 6y ago
  Online Linux services are so powerful, that they can even ban the president of the united states of america.

umvi 6y ago

> It was written at a different time, with different best practices. Not that I have any faith in modern "best practices". I'm imagining `grep` written in modern a modern language like JS and I shutter when I think of the hundreds of micro-dependencies like "left-pad" that would need to be downloaded to make it work. Maybe it's fair to say that systems programming languages are in a better state in terms of modern best practices than scripting languages.

acdha 6y ago
Try https://github.com/BurntSushi/ripgrep https://github.com/BurntSushi/ripgrep – it’s across the board better, and one of the best personal productivity boosts you can make if you use grep frequently.
megous 6y ago
I actually like some modern grep alternatives, like `ag`.
masklinn 6y ago
> Not that I have any faith in modern "best practices". I'm imagining `grep` written in modern a modern language like JS and I shutter when I think of the hundreds of micro-dependencies like "left-pad" that would need to be downloaded to make it work. You don't have to imagine: `ripgrep` exists and has all of 10 direct dependencies, 4 of which by the same author because they extracted features / systems from ripgrep (or developed them separately from the start) as they were useful on their own e.g. * regex, for obvious reasons * ignore to match and apply ignorefiles (gitignore and friends which ripgrep takes in account by default) * bstr for conventional utf8 strings rather than guaranteed * grep intends to be essentially "ripgrep as a library"

young_unixer 6y ago

> someone will rewrite all GNU/UNIX user land in modern Rust or similar Or everyone just switches to musl + busybox.

anthk 6y ago
Or doas. Much simpler.

im3w1l 6y ago

Rewriting sudo is a weekend project*. Getting people to adopt it is a many-year political campaign.

toyg 6y ago
You can bet your last dollar that if the "right" RedHat or Debian developer rewrote sudo with feature parity, it would be adopted by all major distros in a couple of months. It's the sort of thing nobody really cares about except OpenBSD (which wrote their own). The problem is feature parity. Most rewrites cannot guarantee that off-the-bat, so they end up struggling to persuade people to switch - why break stuff that works just fine and lose features, in the name of some engineering purity?
- axaxs 6y ago
  Poettering to save the day with systemd-sudo?
  - magicalhippo 6y ago
    https://www.youtube.com/watch?v=TkR9QWuoyJ8 https://www.youtube.com/watch?v=TkR9QWuoyJ8
  - kuschku 6y ago
    Polkit-exec (pkexec) already exists, has much better security, and integrates with your DE instead of expecting passwords on the terminal.
    - deckard1 6y ago
      This thing? https://gitlab.freedesktop.org/polkit/polkit/-/blob/master/src/programs/pkexec.c https://gitlab.freedesktop.org/polkit/polkit/-/blob/master/s... Which also seems to not have tests. In fact, the only tests I'm seeing are from 2 years ago. https://gitlab.freedesktop.org/polkit/polkit/-/tree/master/test/polkit https://gitlab.freedesktop.org/polkit/polkit/-/tree/master/t... > has much better security It's using D-bus. My faith in D-bus security is close to my faith in seeing a fresh Linux install with zero D-bus error messages from apps. Which is to say, nonexistent. > integrates with your DE instead of expecting passwords on the terminal. There's nothing inherently insecure about passwords on the terminal, and certainly nothing a DE can do better. I have yet to see a display manager or lock screen app that knows what the hell PAM is doing. Try doing even the simplest things with PAM, such as getting a fingerprint reader or Yubikey working, and every single display manager simply chokes. I'm not sure which is more of a Byzantine mess: Linux authentication and authorization, or Linux audio.