Wow he changed two million lines of the sudo codebase over the project history and made 10,548 commits. That's bonkers. Sudo is clearly doing a lot more under the hood than I thought it did. A simple security critical command shouldn't have that much churn. It should arc towards immutability like TeX, which has had like twelve changes in the last 40 years.
Re:Heap-based buffer overflow in Sudo
by masklinn on Wednesday January 27, 2021 @01:28AM
(#25924981)
> Sudo is clearly doing a lot more under the hood than I thought it did.
There’s a number of reasons openbsd dropped it, and all of them are fundamentally rooted in size and complexity: https://flak.tedunangst.com/post/doas
OpenBSD is a fabulous project. I've been working on tool called Cosmopolitan which helps Mac/Linux/Windows/FreeBSD developers write software that's compatible with OpenBSD: https://github.com/jart/cosmopolitan/blob/master/libc/sysv/s... As you can see, I've studied these systems a lot and I've got to say that OpenBSD is the closest to the Bell Labs roots I've seen from community distros. It takes a certain degree of judiciousness to maintain that authenticity and the clairvoyance w.r.t sudo should be all the proof we need that OpenBSD is up to something good.
Re:Heap-based buffer overflow in Sudo
by breakingcups on Wednesday January 27, 2021 @03:52AM
(#25925791)
Sidebar: Wonderful post, but what an awful fake loading bar. Every time I switch from the tab / window to something else and switch back to continue reading I'm interrupted by it for no reason.
Re:Heap-based buffer overflow in Sudo
by gerikson on Wednesday January 27, 2021 @05:09AM
(#25926351)
You're supposed to disable javascript in your browser.
doas is a wonderful alternative to sudo.
For one, the config file is actually easy enough to read properly.
Re:Heap-based buffer overflow in Sudo
by anonymousiam on Tuesday January 26, 2021 @10:55PM
(#25924052)
Does he moonlight for the NSA?
This response is the “must be aliens” of security. If you remotely think this is the case, ask whether one of the top intelligence agencies in the world would be more likely to attract attention to a deep cover operation many, many years in the making or would invest in making sure that the bug was well concealed so nobody else would be able to use it on, say, .gov servers. If you remember Dual EC_DRBG I know which one I’d bet on…
Re:Heap-based buffer overflow in Sudo
by anonymousiam on Wednesday January 27, 2021 @03:47PM
(#25933715)
It was meant as a joke. Lighten up.
Having worked with the IC for decades, I'm well aware of what's going on.
https://github.com/sudo-project/sudo/graphs/contributors
That’s one maintainer, not even full time according to his résumé. What you just described is multiple specialists and some supporting tools, so another way of looking at this is to ask how much value the IT world has gotten from sudo but not contributed back in support.
When something is this widely used, it’s easy to forget that the answer to who should do more isn’t the one person who actually steps up to keep it alive.