3 ms·

Do you have an example of the logic bugs you're referring to?

• johnisgood 1y ago
  I am pretty sure it is around here somewhere: https://github.com/trifectatechfoundation/sudo-rs/issues https://github.com/trifectatechfoundation/sudo-rs/issues. I apologize, I do not bookmark these issues, but maybe I should start doing that? In any case, you will find logic bugs which may raise the question "is it really worth the rewrite?".
  • internetter 1y ago
    You have the burden of proof to substantiate your accusations. Until then they're entirely unfounded.
    • butlike 1y ago
      Aren't full rewrites pretty much universally considered harmful?
      • tcfhgj 1y ago
        No
        • johnisgood 1y ago
          Not universally, but often it introduces logic bugs that the original project did not have. I guess it heavily depends. In this case, I think it may do more harm than good. Just use "doas" or something. FWIW, I trust "sudo" more than "sudo-rs".
  • yjftsjthsd-h 1y ago
    A more interesting link is https://github.com/trifectatechfoundation/sudo-rs/issues?q=label%3Asecurity https://github.com/trifectatechfoundation/sudo-rs/issues?q=l... IMO. Glancing down that list, a lot of them aren't what I would personally view as major problems (ex. "rustup is inappropriate for security critical software" - maybe it is, but that's not a specific exploitable bug), but I would suggest https://github.com/trifectatechfoundation/sudo-rs/issues/575 https://github.com/trifectatechfoundation/sudo-rs/issues/575 as a potentially interesting looking example. > I apologize, I do not bookmark these issues, but maybe I should start doing that? Yes. If you want to point out problems, it really helps if you can point at specifics. > In any case, you will find logic bugs which may raise the question "is it really worth the rewrite?". There's a cost/benefit question, but note that the mere presence of some bugs doesn't make a rewrite worthless.
    • johnisgood 1y ago
      Thank you!