7 ms·

‘ Fundamentally, sudo adds significant attack surface because it is a powerful tool with many features like support for security policies defined in LDAP, so th

‘ Fundamentally, sudo adds significant attack surface because it is a powerful tool with many features like support for security policies defined in LDAP, so the system is likely more secure without it. ’ This is uncontexualized hype clearly written by someone with no real world experience, hoping to gaslight users into thinking their current system is insecure. Then I scroll up and noticed the article is written by a company who sell presumably consulting services in unix. Go figure. Failing that, there’s limited reasons to use BSD systems instead of Linux unless you have highly specialised requirements. Under many cases I’d imagine it would be more expensive in terms of effort required to hire/train skilled staff.

lmm 4y ago
> Failing that, there’s limited reasons to use BSD systems instead of Linux unless you have highly specialised requirements. Under many cases I’d imagine it would be more expensive in terms of effort required to hire/train skilled staff. I'd expect you'd need more training for Linux, since it changes more often.
- nightfly 4y ago
  Linux systems hasn't changed a lot in the last 4 years or os. We mostly run Ubuntu LTS at my work and the 18.04 -> 20.04 -> 22.04 deltas have been really low on the server side, and not that significant on the desktop side either During this time frame we've also migrated our last FreeBSD servers to Ubuntu
  - johnklos 4y ago
    My goodness. How can you possibly say that Ubuntu hasn't changed much from 18 -> 22? There are whole how-tos that are completely useless from those changes. All sorts of things are different. That's ridiculous.
    - CoolCold 4y ago
      Netplan happened on 20.04 AFAIR. Doesn't matter much for your cloud vps you never change networking on, but still. From my perspective, it's not changed much too - I was using apt-get install nginx - I keep using it. Was using systemctl - keep using it. Cannot say I've adjusted my habits during that moves. Ah, home dirs are property secured now.
    - nightfly 4y ago
      The other comment pointed out the installer, which I did forget about. But other then that what significant has changed? Ubuntu's documentation, and lots of third party documentation targeting ubuntu, is like 10 years out of date for lots of things anyways, and even when it _works_ often gives bad advice that either was never true or hasn't been true for years.
  - throw0101c 4y ago
    > We mostly run Ubuntu LTS at my work and the 18.04 -> 20.04 -> 22.04 deltas have been really low on the server side Except for the giant, buggy change in the auto-install process in 20.04: * https://utcc.utoronto.ca/~cks/space/blog/linux/Ubuntu2004AutoinstFormat https://utcc.utoronto.ca/~cks/space/blog/linux/Ubuntu2004Aut...
    - nightfly 4y ago
      We deferred to switching to the new installer until 22.04 and kept using the legacy net boot image for as long as possible. The switchover wasn't as bad as I was afraid it would and took only a few days to make new internal app to drive our installations. The worst part of the new installer is it requires a minimum of 2GiB of RAM to run, so all of our new VMs have to start with at least that much and be scaled down later
  - KronisLV 4y ago
    > Linux systems hasn't changed a lot in the last 4 years or os. We mostly run Ubuntu LTS at my work and the 18.04 -> 20.04 -> 22.04 deltas have been really low on the server side, and not that significant on the desktop side either You know, I actually set this comment aside because I was curious about how HN would engage with it. So far, it seems like folks are pointing out that there indeed have been changes in certain aspects of the OS, as well as probably the introduction of the whole snap mechanism. Regardless, to me Ubuntu LTS seems like one of the better OS distros out there, both for desktop and server use. It's not ideal, but it's good enough in most respects, to the point where it's hard to recommend anything else. Previously I recall many looking in the direction of CentOS as something to install on servers and have it serve them for a long time with security updates and pretty good stability, but I guess now one would have to count on Rocky Linux and Alma Linux for that. Additionally, I have to admit that some of the choices that RPM distros make can be a bit odd and the software support isn't where I'd like it to be, things like Docker were admittedly broken (DNS resolution, firewall masquerades and other oddness with SELinux) for a while. It feels like they have their own enterprise-focused way of doing everything, OpenShift being an example of this. On the other hand, there's Debian and Ubuntu. Personally, I might even like Debian better, but Ubuntu's LTS lifecycle is far more worry free. You might not get 10 years of support, but setting up something and running it for 5 years (with security and other updates) is pretty freeing, especially when you're primarily interested in just keeping things running in a stable manner and don't always need the latest packages. There are changes, of course, there are packages that change names, that break or are deprecated, sometimes you get other growing pains that all of the OSes out there need to deal with. But Ubuntu LTS to me feels like it's good enough for both server use in both development/testing/prod, as well as personal use, as a daily driver. I actually will stand by that statement, recently I moved to building all of my container images on Ubuntu as a base: https://blog.kronis.dev/articles/using-ubuntu-as-the-base-for-all-of-my-containers https://blog.kronis.dev/articles/using-ubuntu-as-the-base-fo... I also experimented with running an offshoot of it, Linux Mint, on the desktop (because their XFCE spin is great): https://blog.kronis.dev/articles/a-week-of-linux-instead-of-windows https://blog.kronis.dev/articles/a-week-of-linux-instead-of-... And nowadays I'm considering migrating my Debian servers after the EOL to Ubuntu, my new ones already running it. I will say that every distro has its place and in certain domains there are better options than Ubuntu, of course, and OSes like the *BSDs have consistency and engineering that Linux cannot quite match (due to the "engineered vs grown" approach to building them), but sometimes you just want something that is simple to run, has ample tutorials and resources, and won't make you chase down odd issues.
- hsbauauvhabzb 4y ago
  Are you honestly suggesting BSD is easier to use than Linux?
  - yjftsjthsd-h 4y ago
    No, they're suggesting that BSD changes less. If you learn FreeBSD, and you learn, let's say Ubuntu, and then you keep using them for a decade, the stated position is that FreeBSD would require you to learn fewer new things than ex. Ubuntu over the same timespan.
    - Gordonjcp 4y ago
      I've been using Linux for 27 years, and it hasn't changed all that much in that time. Packaging has got better, systemd is a bit of a pain in the tits but necessary if you want to support the kind of things we expect to do with "real" computers instead of servers sitting in a dark room untouched for years. I've been using NetBSD for about the same amount of time, and it hasn't changed all that much either.
      - throw0101c 4y ago
        > I've been using Linux for 27 years, and it hasn't changed all that much in that time. First there's networking configuration. On Debian and Ubuntu the interfaces(5) used to be nice and simple, but dog knows what to use on any particular system nowadays since there are like three ways to do things: interface, netplan, system-networkd, other? Plus there's resolv.conf(5) being fiddled with a myriad of ways and you have to figure out which system to use there as well. ifconfig kind of works and kind of doesn't for some things. How may firewall system changes have there been in the last 27 years? Are we supposed to be using iptables or nftables in 2022?
        Volundr 4y ago
        > ifconfig kind of works and kind of doesn't for some things. And is being replaced with 'ip'
        4y ago
- CoolCold 4y ago
  LTS from RedHat/clones gives you like 7 years to adopt for new release. Enough time from my POV. Not even mentioning nowdays Linux is largely just layer to run docker and noone cares on learning things beyond docker-compose and docker files.
chillfox 4y ago
Yeah, so I went down the Freebsd rabbit hole last year for my personal hosting and I have some mixed feelings about it. It's a much nicer/less changing environment than Linux, and it's really good for the things it does well. But the moment you step off the happy path then you will find yourself lost in the woods. Basically I ended up using the Freebsd box as a fileserver (ZFS and Minio), and still running an Alpine Linux box with zfs for most other things. I did briefly run a Minecraft server on the Freebsd box which worked really well.
- takeda 4y ago
  Could you expand on "But the moment you step off the happy path then you will find yourself lost in the woods."? Because from my experience FreeBSD is very predictable, and knowing how things are laid out you can figure things out for other things that one is not familiar with. If anything, I see Linux as a bit of a mess that in many places is inconsistent.
  - chillfox 4y ago
    Setting up NFSv4, I spent two evenings on that before abandoning it. Virtual network for a bunch of jails with nat. I wanted exposed ports on the host machine mapped to a reverse proxy jail that did tls termination before forwarding to other jails on a virtual network (while allowing the jails on the virtual net outgoing internet access). Several applications that were apparently built for Linux, so they did not compile on Freebsd (and no alternatives available). Getting newer versions of software. Often the version available in pkg is several major versions out of date. Documentation for how to do things in general. Yeah when there are docs/tutorials they can often be of high quality, but frequently there is just nothing or the available docs does not cover the edge case you are trying to solve.
    - nix23 4y ago
      >Setting up NFSv4, I spent two evenings on that before abandoning it. That's really a bit of a pain (lack of a good tutorial/doc) >Virtual network for a bunch of jails with nat. I solved that this way: Create'd a vnet haproxy-jail (the tls-terminator and "forwarder") all other jail's a "non-vnet" with a internal IP. But you can do it with just nat'd jails and haproxy as the terminator...no problem, do you need some pf examples? >Getting newer versions of software. Often the version available in pkg is several major versions out of date. Same on Linux-Distros, freebsd is pretty much on par: https://repology.org/repositories/statistics https://repology.org/repositories/statistics >Documentation for how to do things in general. Yeah when there are docs/tutorials they can often be of high quality, but frequently there is just nothing or the available docs does not cover the edge case you are trying to solve. Can you give some examples so one could do something against it? NFSv4 with kerb and ldap is one..i know ;)
5e92cb50239222b 4y ago
In addition to what you've said, nobody is forcing anybody to use sudo. Most of my systems don't have it at all — it's simply not necessary. Some of the others use the lightweight doas ported from OpenBSD: https://github.com/Duncaen/OpenDoas https://github.com/Duncaen/OpenDoas
- yjftsjthsd-h 4y ago
  > nobody is forcing anybody to use sudo Some folks kind of are; for instance, last time I looked Arch Linux has sudo as part of base so it's hard to remove. Edit: Sorry, apparently Arch does let you remove sudo (now?). If you substitute in RHEL et al. the general point stands (and I actually checked this time and Rocky 8 makes unhappy noises if you ask it to remove sudo), but my initial example was wrong.
  - 5e92cb50239222b 4y ago
    Don't remember it ever being a problem tbh. Haven't had it installed for quite some time (since I discovered doas). I just installed it and then removed to re-check: $ yay -Rsn sudo checking dependencies... :: libisoburn optionally requires sudo: for use with xorriso-dd-target :: pacman-contrib optionally requires sudo: privilege elevation for several scripts :: refind optionally requires sudo: for privilege elevation in refind-install and refind-mkdefault :: wireguard-tools optionally requires sudo: elevate privileges :: yay optionally requires sudo: privilege elevation Package (1) Old Version Net Change sudo 1.9.12.p1-1 -7.10 MiB Total Removed Size: 7.10 MiB :: Do you want to remove these packages? [Y/n] :: Processing package changes... (1/1) removing sudo [###############################################] 100% :: Running post-transaction hooks... (1/2) Reloading system manager configuration... (2/2) Arming ConditionNeedsUpdate... libisoburn, refind, wg, yay can be elevated by doas or su. pacman-contrib is a bunch of package development scripts. Your typical user won't have them. Also the previous point applies.
    - yjftsjthsd-h 4y ago
      Strange; now I've tried it and it does indeed work. I'm fairly sure I tried that before and it wouldn't let me remove sudo, which was irritating because I switched to using doas and didn't like having sudo around. Assuming my memory isn't failing me, that must have been fixed fairly recently.
yjftsjthsd-h 4y ago
> hoping to gaslight users into thinking their current system is insecure. I mean, https://nvd.nist.gov/vuln/detail/CVE-2022-43995 https://nvd.nist.gov/vuln/detail/CVE-2022-43995 is lest than a week old, so probably yes. (That is, a lot of systems haven't been updated and have a nice open CVE that wouldn't be there if they weren't using sudo.)
- hsbauauvhabzb 4y ago
  If you compare the risk of having sudo vs the risk of granting users less constrained access to root or similar, you’ll have less cves, but be more likely to be breached due to weakened rbac. Furthermore, there would be no vulnerabilities if you just unplug your computer and walk away, at some point you need to make usability and risk compromises.
  - hnlmorg 4y ago
    I can think of very few instances where you should be giving people shell access, let alone need to worry about RBAC. Furthermore, the UNIX user model and file system hierarchy already provides you with RBAC. Combine that with ACLs and SetUID (et al) bits and you’ve already got sudo baked into the core system. Your point about it being a convenience tool is bang on: it makes it easier to administer all of the above but that convenience, like nearly all convenience tools in computing, comes with a slight security trade off. To be clear, I don’t agree with the author’s recommendation to ditch sudo. But they are absolutely correct in the technical sense. Just as you are. In fact you are both basically arguing the same point but from different perspectives: “sudo adds a vector of attack”. It’s then up to your threat modelling to decide if that is appropriate or not. But to come back to my original point: just don’t give people shell access. There’s no need in 99% of cases of servers these days and if we are talking about local user machines, then RBAC is less of an issue since it would be a machine per user.
    - couchand 4y ago
      Even (or perhaps especially) with a machine per user, it's critical to keep that user from accidentally shooting themselves in the foot. Typing sudo does help remind a user they're doing something different. I don't want to always have the right to force delete root!
adql 4y ago
> This is uncontexualized hype clearly written by someone with no real world experience, hoping to gaslight users into thinking their current system is insecure. So typical for BSD fans, find a single flaw then try overblow it and show how their flavour of *BSD is better. It's frankly tiring at this point.
- hnlmorg 4y ago
  Whether you agree with the sudo comment or not, your reply here is needlessly antagonistic. You’re basically just setting up for a flame war. Please don’t make generalisations about peoples character.
nortonham 4y ago
well the only thing I can say is that the people behind it do have real world experience, given that one of them is Alan Jude.
vermaden 4y ago
Just use doas(1) instead. Small. Simple. Secure.
- jmclnx 4y ago
  No kidding, I am still waiting for Linux distros and other BSDs to switch to doas(1) as their default. Similar to how openssh took over from the proprietary version of ssh years ago.
worldsavior 4y ago
I don't know if you noticed, but sudo has many CVE's since it existed, for such a small target (executing with root).
shiftoutbox 4y ago
That’s what I was thinking when I read your post . “Clearly written by someone with no real world experience trying to gaslight users “
- hsbauauvhabzb 4y ago
  Good one. Care to elaborate on your thoughts though? I work in security, I see problems caused by people trying to be edgy in architecture design all the time. You don’t need k8s, or bsd, or rust if you’re a pizza shop website.
throw0101c 4y ago
> This is uncontexualized hype And yet just a few days ago there was a thread about sudo's recent heap-overflow issue, where the top comment's first line is: > Sudo must be the program with the largest number of buffer overflows I’ve heard about. * https://news.ycombinator.com/item?id=33465707#unv_33467000 https://news.ycombinator.com/item?id=33465707#unv_33467000
- Beltalowda 4y ago
  It's not like you need to use sudo on Linux. And sudo has been maintained by an OpenBSD developer since the early 90s. Aside from what the problems and benefits of sudo may or may not be, bringing up sudo in a "BSD vs. Linux" debate is a red herring: it's just completely unrelated.
  - gnubison 4y ago
    Note that OpenBSD now uses the much smaller doas instead.
    - michaelmrose 4y ago
      Which you can use on Linux however it's missing sudo -e and emacs tramp doesn't work with it. Sudo -e FILE opens a copy of the file with $EDITOR and then moves copy to replace FILE Tramp opens a file including present buffer and writes it as root to achieve the same effect. EDIT Tramp now works correctly for me sudo -e is simple enough to script looks like a winner for simple things when complex isn't required
    - Beltalowda 4y ago
      Yes, but it's still a red herring when discussing the advantages of FreeBSD (or OpenBSD, for that matter) over Linux.

lmm 4y ago

> Failing that, there’s limited reasons to use BSD systems instead of Linux unless you have highly specialised requirements. Under many cases I’d imagine it would be more expensive in terms of effort required to hire/train skilled staff. I'd expect you'd need more training for Linux, since it changes more often.

nightfly 4y ago
Linux systems hasn't changed a lot in the last 4 years or os. We mostly run Ubuntu LTS at my work and the 18.04 -> 20.04 -> 22.04 deltas have been really low on the server side, and not that significant on the desktop side either During this time frame we've also migrated our last FreeBSD servers to Ubuntu
- johnklos 4y ago
  My goodness. How can you possibly say that Ubuntu hasn't changed much from 18 -> 22? There are whole how-tos that are completely useless from those changes. All sorts of things are different. That's ridiculous.
  - CoolCold 4y ago
    Netplan happened on 20.04 AFAIR. Doesn't matter much for your cloud vps you never change networking on, but still. From my perspective, it's not changed much too - I was using apt-get install nginx - I keep using it. Was using systemctl - keep using it. Cannot say I've adjusted my habits during that moves. Ah, home dirs are property secured now.
  - nightfly 4y ago
    The other comment pointed out the installer, which I did forget about. But other then that what significant has changed? Ubuntu's documentation, and lots of third party documentation targeting ubuntu, is like 10 years out of date for lots of things anyways, and even when it _works_ often gives bad advice that either was never true or hasn't been true for years.
- throw0101c 4y ago
  > We mostly run Ubuntu LTS at my work and the 18.04 -> 20.04 -> 22.04 deltas have been really low on the server side Except for the giant, buggy change in the auto-install process in 20.04: * https://utcc.utoronto.ca/~cks/space/blog/linux/Ubuntu2004AutoinstFormat https://utcc.utoronto.ca/~cks/space/blog/linux/Ubuntu2004Aut...
  - nightfly 4y ago
    We deferred to switching to the new installer until 22.04 and kept using the legacy net boot image for as long as possible. The switchover wasn't as bad as I was afraid it would and took only a few days to make new internal app to drive our installations. The worst part of the new installer is it requires a minimum of 2GiB of RAM to run, so all of our new VMs have to start with at least that much and be scaled down later
- KronisLV 4y ago
  > Linux systems hasn't changed a lot in the last 4 years or os. We mostly run Ubuntu LTS at my work and the 18.04 -> 20.04 -> 22.04 deltas have been really low on the server side, and not that significant on the desktop side either You know, I actually set this comment aside because I was curious about how HN would engage with it. So far, it seems like folks are pointing out that there indeed have been changes in certain aspects of the OS, as well as probably the introduction of the whole snap mechanism. Regardless, to me Ubuntu LTS seems like one of the better OS distros out there, both for desktop and server use. It's not ideal, but it's good enough in most respects, to the point where it's hard to recommend anything else. Previously I recall many looking in the direction of CentOS as something to install on servers and have it serve them for a long time with security updates and pretty good stability, but I guess now one would have to count on Rocky Linux and Alma Linux for that. Additionally, I have to admit that some of the choices that RPM distros make can be a bit odd and the software support isn't where I'd like it to be, things like Docker were admittedly broken (DNS resolution, firewall masquerades and other oddness with SELinux) for a while. It feels like they have their own enterprise-focused way of doing everything, OpenShift being an example of this. On the other hand, there's Debian and Ubuntu. Personally, I might even like Debian better, but Ubuntu's LTS lifecycle is far more worry free. You might not get 10 years of support, but setting up something and running it for 5 years (with security and other updates) is pretty freeing, especially when you're primarily interested in just keeping things running in a stable manner and don't always need the latest packages. There are changes, of course, there are packages that change names, that break or are deprecated, sometimes you get other growing pains that all of the OSes out there need to deal with. But Ubuntu LTS to me feels like it's good enough for both server use in both development/testing/prod, as well as personal use, as a daily driver. I actually will stand by that statement, recently I moved to building all of my container images on Ubuntu as a base: https://blog.kronis.dev/articles/using-ubuntu-as-the-base-for-all-of-my-containers https://blog.kronis.dev/articles/using-ubuntu-as-the-base-fo... I also experimented with running an offshoot of it, Linux Mint, on the desktop (because their XFCE spin is great): https://blog.kronis.dev/articles/a-week-of-linux-instead-of-windows https://blog.kronis.dev/articles/a-week-of-linux-instead-of-... And nowadays I'm considering migrating my Debian servers after the EOL to Ubuntu, my new ones already running it. I will say that every distro has its place and in certain domains there are better options than Ubuntu, of course, and OSes like the *BSDs have consistency and engineering that Linux cannot quite match (due to the "engineered vs grown" approach to building them), but sometimes you just want something that is simple to run, has ample tutorials and resources, and won't make you chase down odd issues.
hsbauauvhabzb 4y ago
Are you honestly suggesting BSD is easier to use than Linux?
- yjftsjthsd-h 4y ago
  No, they're suggesting that BSD changes less. If you learn FreeBSD, and you learn, let's say Ubuntu, and then you keep using them for a decade, the stated position is that FreeBSD would require you to learn fewer new things than ex. Ubuntu over the same timespan.
  - Gordonjcp 4y ago
    I've been using Linux for 27 years, and it hasn't changed all that much in that time. Packaging has got better, systemd is a bit of a pain in the tits but necessary if you want to support the kind of things we expect to do with "real" computers instead of servers sitting in a dark room untouched for years. I've been using NetBSD for about the same amount of time, and it hasn't changed all that much either.
    - throw0101c 4y ago
      > I've been using Linux for 27 years, and it hasn't changed all that much in that time. First there's networking configuration. On Debian and Ubuntu the interfaces(5) used to be nice and simple, but dog knows what to use on any particular system nowadays since there are like three ways to do things: interface, netplan, system-networkd, other? Plus there's resolv.conf(5) being fiddled with a myriad of ways and you have to figure out which system to use there as well. ifconfig kind of works and kind of doesn't for some things. How may firewall system changes have there been in the last 27 years? Are we supposed to be using iptables or nftables in 2022?
      - Volundr 4y ago
        > ifconfig kind of works and kind of doesn't for some things. And is being replaced with 'ip'
      - 4y ago
CoolCold 4y ago
LTS from RedHat/clones gives you like 7 years to adopt for new release. Enough time from my POV. Not even mentioning nowdays Linux is largely just layer to run docker and noone cares on learning things beyond docker-compose and docker files.

chillfox 4y ago

Yeah, so I went down the Freebsd rabbit hole last year for my personal hosting and I have some mixed feelings about it. It's a much nicer/less changing environment than Linux, and it's really good for the things it does well. But the moment you step off the happy path then you will find yourself lost in the woods. Basically I ended up using the Freebsd box as a fileserver (ZFS and Minio), and still running an Alpine Linux box with zfs for most other things. I did briefly run a Minecraft server on the Freebsd box which worked really well.

takeda 4y ago
Could you expand on "But the moment you step off the happy path then you will find yourself lost in the woods."? Because from my experience FreeBSD is very predictable, and knowing how things are laid out you can figure things out for other things that one is not familiar with. If anything, I see Linux as a bit of a mess that in many places is inconsistent.
- chillfox 4y ago
  Setting up NFSv4, I spent two evenings on that before abandoning it. Virtual network for a bunch of jails with nat. I wanted exposed ports on the host machine mapped to a reverse proxy jail that did tls termination before forwarding to other jails on a virtual network (while allowing the jails on the virtual net outgoing internet access). Several applications that were apparently built for Linux, so they did not compile on Freebsd (and no alternatives available). Getting newer versions of software. Often the version available in pkg is several major versions out of date. Documentation for how to do things in general. Yeah when there are docs/tutorials they can often be of high quality, but frequently there is just nothing or the available docs does not cover the edge case you are trying to solve.
  - nix23 4y ago
    >Setting up NFSv4, I spent two evenings on that before abandoning it. That's really a bit of a pain (lack of a good tutorial/doc) >Virtual network for a bunch of jails with nat. I solved that this way: Create'd a vnet haproxy-jail (the tls-terminator and "forwarder") all other jail's a "non-vnet" with a internal IP. But you can do it with just nat'd jails and haproxy as the terminator...no problem, do you need some pf examples? >Getting newer versions of software. Often the version available in pkg is several major versions out of date. Same on Linux-Distros, freebsd is pretty much on par: https://repology.org/repositories/statistics https://repology.org/repositories/statistics >Documentation for how to do things in general. Yeah when there are docs/tutorials they can often be of high quality, but frequently there is just nothing or the available docs does not cover the edge case you are trying to solve. Can you give some examples so one could do something against it? NFSv4 with kerb and ldap is one..i know ;)

5e92cb50239222b 4y ago

In addition to what you've said, nobody is forcing anybody to use sudo. Most of my systems don't have it at all — it's simply not necessary. Some of the others use the lightweight doas ported from OpenBSD: https://github.com/Duncaen/OpenDoas https://github.com/Duncaen/OpenDoas

yjftsjthsd-h 4y ago
> nobody is forcing anybody to use sudo Some folks kind of are; for instance, last time I looked Arch Linux has sudo as part of base so it's hard to remove. Edit: Sorry, apparently Arch does let you remove sudo (now?). If you substitute in RHEL et al. the general point stands (and I actually checked this time and Rocky 8 makes unhappy noises if you ask it to remove sudo), but my initial example was wrong.
- 5e92cb50239222b 4y ago
  Don't remember it ever being a problem tbh. Haven't had it installed for quite some time (since I discovered doas). I just installed it and then removed to re-check: $ yay -Rsn sudo checking dependencies... :: libisoburn optionally requires sudo: for use with xorriso-dd-target :: pacman-contrib optionally requires sudo: privilege elevation for several scripts :: refind optionally requires sudo: for privilege elevation in refind-install and refind-mkdefault :: wireguard-tools optionally requires sudo: elevate privileges :: yay optionally requires sudo: privilege elevation Package (1) Old Version Net Change sudo 1.9.12.p1-1 -7.10 MiB Total Removed Size: 7.10 MiB :: Do you want to remove these packages? [Y/n] :: Processing package changes... (1/1) removing sudo [###############################################] 100% :: Running post-transaction hooks... (1/2) Reloading system manager configuration... (2/2) Arming ConditionNeedsUpdate... libisoburn, refind, wg, yay can be elevated by doas or su. pacman-contrib is a bunch of package development scripts. Your typical user won't have them. Also the previous point applies.
  - yjftsjthsd-h 4y ago
    Strange; now I've tried it and it does indeed work. I'm fairly sure I tried that before and it wouldn't let me remove sudo, which was irritating because I switched to using doas and didn't like having sudo around. Assuming my memory isn't failing me, that must have been fixed fairly recently.

yjftsjthsd-h 4y ago

> hoping to gaslight users into thinking their current system is insecure. I mean, https://nvd.nist.gov/vuln/detail/CVE-2022-43995 https://nvd.nist.gov/vuln/detail/CVE-2022-43995 is lest than a week old, so probably yes. (That is, a lot of systems haven't been updated and have a nice open CVE that wouldn't be there if they weren't using sudo.)

hsbauauvhabzb 4y ago
If you compare the risk of having sudo vs the risk of granting users less constrained access to root or similar, you’ll have less cves, but be more likely to be breached due to weakened rbac. Furthermore, there would be no vulnerabilities if you just unplug your computer and walk away, at some point you need to make usability and risk compromises.
- hnlmorg 4y ago
  I can think of very few instances where you should be giving people shell access, let alone need to worry about RBAC. Furthermore, the UNIX user model and file system hierarchy already provides you with RBAC. Combine that with ACLs and SetUID (et al) bits and you’ve already got sudo baked into the core system. Your point about it being a convenience tool is bang on: it makes it easier to administer all of the above but that convenience, like nearly all convenience tools in computing, comes with a slight security trade off. To be clear, I don’t agree with the author’s recommendation to ditch sudo. But they are absolutely correct in the technical sense. Just as you are. In fact you are both basically arguing the same point but from different perspectives: “sudo adds a vector of attack”. It’s then up to your threat modelling to decide if that is appropriate or not. But to come back to my original point: just don’t give people shell access. There’s no need in 99% of cases of servers these days and if we are talking about local user machines, then RBAC is less of an issue since it would be a machine per user.
  - couchand 4y ago
    Even (or perhaps especially) with a machine per user, it's critical to keep that user from accidentally shooting themselves in the foot. Typing sudo does help remind a user they're doing something different. I don't want to always have the right to force delete root!

adql 4y ago

> This is uncontexualized hype clearly written by someone with no real world experience, hoping to gaslight users into thinking their current system is insecure. So typical for BSD fans, find a single flaw then try overblow it and show how their flavour of *BSD is better. It's frankly tiring at this point.

hnlmorg 4y ago
Whether you agree with the sudo comment or not, your reply here is needlessly antagonistic. You’re basically just setting up for a flame war. Please don’t make generalisations about peoples character.

nortonham 4y ago

well the only thing I can say is that the people behind it do have real world experience, given that one of them is Alan Jude.

vermaden 4y ago

Just use doas(1) instead. Small. Simple. Secure.

jmclnx 4y ago
No kidding, I am still waiting for Linux distros and other BSDs to switch to doas(1) as their default. Similar to how openssh took over from the proprietary version of ssh years ago.

worldsavior 4y ago

I don't know if you noticed, but sudo has many CVE's since it existed, for such a small target (executing with root).

shiftoutbox 4y ago

That’s what I was thinking when I read your post . “Clearly written by someone with no real world experience trying to gaslight users “

hsbauauvhabzb 4y ago
Good one. Care to elaborate on your thoughts though? I work in security, I see problems caused by people trying to be edgy in architecture design all the time. You don’t need k8s, or bsd, or rust if you’re a pizza shop website.

throw0101c 4y ago

> This is uncontexualized hype And yet just a few days ago there was a thread about sudo's recent heap-overflow issue, where the top comment's first line is: > Sudo must be the program with the largest number of buffer overflows I’ve heard about. * https://news.ycombinator.com/item?id=33465707#unv_33467000 https://news.ycombinator.com/item?id=33465707#unv_33467000

Beltalowda 4y ago
It's not like you need to use sudo on Linux. And sudo has been maintained by an OpenBSD developer since the early 90s. Aside from what the problems and benefits of sudo may or may not be, bringing up sudo in a "BSD vs. Linux" debate is a red herring: it's just completely unrelated.
- gnubison 4y ago
  Note that OpenBSD now uses the much smaller doas instead.
  - michaelmrose 4y ago
    Which you can use on Linux however it's missing sudo -e and emacs tramp doesn't work with it. Sudo -e FILE opens a copy of the file with $EDITOR and then moves copy to replace FILE Tramp opens a file including present buffer and writes it as root to achieve the same effect. EDIT Tramp now works correctly for me sudo -e is simple enough to script looks like a winner for simple things when complex isn't required
  - Beltalowda 4y ago
    Yes, but it's still a red herring when discussing the advantages of FreeBSD (or OpenBSD, for that matter) over Linux.