News for hackers. Stuff that matters.
Re:Rowhammer Resistant Coding in Sudo by wongarsu on Sunday January 28, 2024 @05:10PM (#39170309)
Sudo has much more fine-grained abilities for more surgical use-cases, like giving users the ability to only execute certain commands as a certain user, with detailed logging and auditing. It has a pretty involved config file (the pdf docu for it is 80 pages long), a plugin system, a seperate log format and log server, etc

I also believe those use-cases aren't that common anymore since multi-user systems fell out of favor. There is an argument that most of us could use a vastly simpler tool instead to reduce the attack surface. But that tool wouldn't be sudo, because sudo is built around supporting all these use cases.

Re:Rowhammer Resistant Coding in Sudo by bpye on Sunday January 28, 2024 @05:28PM (#39170460)
doas [0, 1] in OpenBSD is somewhat simpler.

[0] - https://man.openbsd.org/doas.1

[1] - https://man.openbsd.org/doas.conf.5

Re:Rowhammer Resistant Coding in Sudo by alwillis on Sunday January 28, 2024 @07:47PM (#39171570)
Switched to doas a couple of months ago on my FreeBSD box; it’s been a seamless switch.
Re:Rowhammer Resistant Coding in Sudo by idatum on Sunday January 28, 2024 @09:38PM (#39172124)
doas.conf makes things clear to me what I'm enabling.

And we have the OpenBSD folks focused on clarity and security.