4 ms·

So, I've found `doas` to be a great firewall against not-so-competent sysadmins, in addition to all the other safety guarantees it brings. -Ehm, I try to `sudo

So, I've found `doas` to be a great firewall against not-so-competent sysadmins, in addition to all the other safety guarantees it brings. -Ehm, I try to `sudo X` and it says command not found -Yup, that's by design. Try `doas X` -Well, I tried sudo again and it just doesn't work. What is the root password? I need this, like, an hour ago. Do the needfull!!1! -Sure, have your manager call me...

arp242 3y ago
Wait, are you saying there are people who can't process "you need to replace the word sudo with doas and then it will work exactly the same"?
- JdeBP 3y ago
  There are, at both ends. Both the "script kiddies" who cannot deviate from scripts because they lack almost any knowledge at all; and the knowledgeable ones who know that there are subtle differences between sudo and doas which require doing things slightly differently to achieve the same effect. * https://github.com/Duncaen/OpenDoas/issues/116#issuecomment-1493951475 https://github.com/Duncaen/OpenDoas/issues/116#issuecomment-...
- PreInternet01 3y ago
  Yes. Really. And I guess I can't really blame them. Their mental modal is: I need to run `sudo X`. Because, well, that's what the runbook-they-got-from-their-previous-job, Google, or ChatGPT says. The response they get does not get them any nearer to being able to run `sudo X`. So, they get angry, and push back. Unless you can get someone to sit down, reflect, and think about what they really want to achieve, this is a situation that is very hard to resolve. So, that's one more reason I love `doas`: it leads to, eh, valuable conversations.
  - rcoveson 3y ago
    This is why I alias `ls` to `dd` and vice versa on all the systems I admin.
    - somat 3y ago
      You joke, but I found something like this in the wild. It was an old legacy sco system been around forever and I was asked to do some maintenance work on it. It used rsh to talk to other machines. But I was having a hell of a hard time finding the rsh command. After a lot of pouring over script sources I found it had been renamed to something else. when I asked their sysadmin WTF was going on with this system. he said it had been done for security. Which is still stupid but I have to admit it may work against your normal "script of the month" style attack. It certainly worked for me.
      - JdeBP 3y ago
        It probably was done for security, the r- utilities being the security pitfalls that they are. It's not defending against attacks. It is, in fact, defending against exactly you, a person who comes along and wants to use the r- utilities. It's a compromise between (most likely) "We mustn't use r- utilities on our LAN any more, and must remove them everywhere." and "This is SCO Unix; it's not even OpenServer.".
      - sam_bristow 3y ago
        I think he meant _job_ security.
  - kjs3 3y ago
    I think this says way more about you than the teammates you're condescending to. I've never had someone "get angry, and push back" when you simply and clearly explain "things have changed here...X isn't the command you want and you need to use Y, and here's how you do it". But I get that a mentor-like approach doesn't let you polish you BOFH creds and put the contemptable little people in their place.
    - yjftsjthsd-h 3y ago
      > I've never had someone "get angry, and push back" when you simply and clearly explain "things have changed here...X isn't the command you want and you need to use Y, and here's how you do it". And you're replying to someone who has. Life is funny like that.
kstrauser 3y ago
One time we hired someone who interviewed extremely well. They were filling a compliance auditing role, but had credibly talked a lot about their experience as a security engineer in a Unix shop. On their first day, I was helping them set up their laptop: - You need to run `sudo X` - types `X-but-misspelled` - No, that's `sudo`, then `X` - types `sudo_X-but-misspelled` (literally `sudo`-underscore-`misspelled version of X`) - I mean, with a space after `sudo`, like using sudo to run X. - types `sudo_X` - Have you used sudo? - Finally types `sudo X`. I saved a screenshot of our zoom so I could show our mutual boss later. They ghosted us after a week. Huh. A Unix security engineer who doesn't have sudo (or presumably doas) in muscle memory? Interesting.

arp242 3y ago

Wait, are you saying there are people who can't process "you need to replace the word sudo with doas and then it will work exactly the same"?

JdeBP 3y ago
There are, at both ends. Both the "script kiddies" who cannot deviate from scripts because they lack almost any knowledge at all; and the knowledgeable ones who know that there are subtle differences between sudo and doas which require doing things slightly differently to achieve the same effect. * https://github.com/Duncaen/OpenDoas/issues/116#issuecomment-1493951475 https://github.com/Duncaen/OpenDoas/issues/116#issuecomment-...
PreInternet01 3y ago
Yes. Really. And I guess I can't really blame them. Their mental modal is: I need to run `sudo X`. Because, well, that's what the runbook-they-got-from-their-previous-job, Google, or ChatGPT says. The response they get does not get them any nearer to being able to run `sudo X`. So, they get angry, and push back. Unless you can get someone to sit down, reflect, and think about what they really want to achieve, this is a situation that is very hard to resolve. So, that's one more reason I love `doas`: it leads to, eh, valuable conversations.
- rcoveson 3y ago
  This is why I alias `ls` to `dd` and vice versa on all the systems I admin.
  - somat 3y ago
    You joke, but I found something like this in the wild. It was an old legacy sco system been around forever and I was asked to do some maintenance work on it. It used rsh to talk to other machines. But I was having a hell of a hard time finding the rsh command. After a lot of pouring over script sources I found it had been renamed to something else. when I asked their sysadmin WTF was going on with this system. he said it had been done for security. Which is still stupid but I have to admit it may work against your normal "script of the month" style attack. It certainly worked for me.
    - JdeBP 3y ago
      It probably was done for security, the r- utilities being the security pitfalls that they are. It's not defending against attacks. It is, in fact, defending against exactly you, a person who comes along and wants to use the r- utilities. It's a compromise between (most likely) "We mustn't use r- utilities on our LAN any more, and must remove them everywhere." and "This is SCO Unix; it's not even OpenServer.".
    - sam_bristow 3y ago
      I think he meant _job_ security.
- kjs3 3y ago
  I think this says way more about you than the teammates you're condescending to. I've never had someone "get angry, and push back" when you simply and clearly explain "things have changed here...X isn't the command you want and you need to use Y, and here's how you do it". But I get that a mentor-like approach doesn't let you polish you BOFH creds and put the contemptable little people in their place.
  - yjftsjthsd-h 3y ago
    > I've never had someone "get angry, and push back" when you simply and clearly explain "things have changed here...X isn't the command you want and you need to use Y, and here's how you do it". And you're replying to someone who has. Life is funny like that.

kstrauser 3y ago

One time we hired someone who interviewed extremely well. They were filling a compliance auditing role, but had credibly talked a lot about their experience as a security engineer in a Unix shop. On their first day, I was helping them set up their laptop: - You need to run `sudo X` - types `X-but-misspelled` - No, that's `sudo`, then `X` - types `sudo_X-but-misspelled` (literally `sudo`-underscore-`misspelled version of X`) - I mean, with a space after `sudo`, like using sudo to run X. - types `sudo_X` - Have you used sudo? - Finally types `sudo X`. I saved a screenshot of our zoom so I could show our mutual boss later. They ghosted us after a week. Huh. A Unix security engineer who doesn't have sudo (or presumably doas) in muscle memory? Interesting.