4 ms·
100x slower would definitely be an issue. I am prompted for my sudo password probably 30x daily.
by encryptluks2 4y ago
100x slower would definitely be an issue. I am prompted for my sudo password probably 30x daily.
- bee_rider 4y agoHow long does sudo take to load on your system. Multiply that by 3000, is it really a noticeable number?
- Izkata 4y agoSeems to float around 0.005s (using "time sudo -k" to avoid timing user input), so yeah, x3000 = 15 seconds. Very noticeable. Or even the x100 from (G)GP, that's a half second. Sometimes spiking to a full second.
- titzer 4y agoI am seeing an average of 0.0008 over 100 runs on Linux (i.e. less than a millisecond).
- tmtvl 4y agoCareful, admiral Hopper will give you an earful if you disrespect milliseconds.
- dathinab 4y agoI have once seen a proposal to make any sudo call wait for 10 seconds before doing anything so that the person running it has a moment to thing about what they just did do (and have ~10 seconds to ^C cancel it). The person arguing also brought up that normally anything needing sudo should be automatized so that should be fine. I'm not doing enough system administration to judge if that is a sane idea or not ;=)
- bee_rider 4y agoThat might be a reasonable idea but the time probably shouldn't be imposed by performance constraints.
- westurner 4y agoDoes it say somewhere that non-neteork-io PAM modules are supposed to be constant time? def add_noise(t=10): time.sleep(t-1) time.sleep( uniformrandom(min=0,max=1)) Constant time: https://en.wikipedia.org/wiki/Time_complexity#Constant_time https://en.wikipedia.org/wiki/Time_complexity#Constant_time (Re: Short, DES passwords https://en.wikipedia.org/wiki/Triple_DES https://en.wikipedia.org/wiki/Triple_DES : > A CVE released in 2016, CVE-2016-2183 disclosed a major security vulnerability in DES and 3DES encryption algorithms. This CVE, combined with the inadequate key size of DES and 3DES, NIST has deprecated DES and 3DES for new applications in 2017, and for all applications by the end of 2023.[1] It has been replaced with the more secure, more robust AES. Except for PQ. For PQ in 2022: https://news.ycombinator.com/item?id=32760170 https://news.ycombinator.com/item?id=32760170 : > NIST PQ algos are only just now announced: https://news.ycombinator.com/item?id=32281357 https://news.ycombinator.com/item?id=32281357 : Kyber, NTRU, {FIPS-140-3}? [TLS1.4/2.0?]
- bee_rider 4y agoI'm not sure I follow this comment. Adding a random amount of time seems like a reasonable thing to do. Not sure what the links are all about, or the discussion of time complexity... I mean, there isn't an "input size" to talk about big-O scaling anyway, in the case of sudo.
- westurner 4y agoShould the time to complete the (single-character) password-hashing/key-strengthening routine vary in relation to any aspect of the input ? Timing attacks > Avoidance https://en.wikipedia.org/wiki/Timing_attack https://en.wikipedia.org/wiki/Timing_attack
- kaba0 4y agoThat assumes that sudo the executable taking longer would linearly increase the time when in fact your OS loaded the exe into memory, created a process, allocated memory and let it go. A significant amount of time was just that, nothing related to the program’s job.
- bee_rider 4y agoAh, fair enough, that's a bit high of a multiplier.
- andrewaylett 4y agoI just checked, and on the machine I'm sitting at 100x slower would mean it took 0.1s of CPU time.
- kaba0 4y agoCome on, wtf? Your computer can literally emulate another architecture in real time and you think sudo 100x slower would be humanly sensible? Computers literally wait eons for human inputs in the majority of times. I assume you actually think that sudo takes the time it does, but you just likely entered your password wrong and are made to wait deliberately through a sleep. Are we really that bad at ball parking code execution times?!