3 ms·

What variant of `doas` do people run as an alternative? I see Duncaen/OpenDoas, slicer69/doas, multiplexd/doas on GitHub. None seem super widely used as judged

• duncaen 6y ago
  I would say that the concept and implementation in C is inherently insecure. Switching to something less reviewed because there is a sudo vulnerability is not a guarantee that you are now "safer" especially if those ports are not reviewed. As far as I can say, never ever use slicer69/doas, I've found 3 critical security vulnerabilities in it, the author does not understand C or how it should work in general. Here are 3 examples if issues I found and the author used misleading commit titles to hide the issues and made excuses saying a clear buffer overflow very similar to the one found in sudo is just "potential": - https://github.com/slicer69/doas/commit/261c2164496dbebe6e3e7191db3dd7c840f6af58 https://github.com/slicer69/doas/commit/261c2164496dbebe6e3e... - https://github.com/slicer69/doas/commit/2f83222829448e5bc4c9391d607ec265a1e06531 https://github.com/slicer69/doas/commit/2f83222829448e5bc4c9... I even had to do a PR myself to fix an issue the author was not able to understand and more and more people started to use it: - https://github.com/slicer69/doas/pull/23 https://github.com/slicer69/doas/pull/23
  • cyounkins 6y ago
    Oh dear... Thank you for that info.
• anoki 6y ago
  opendoas. It's a port of OpenBSD doas by a void linux developer.