Todd C. Miller – Sudo maintainer for over 30 years

https://www.millert.dev/

by wodniok • 6 months ago

611 327 6 months ago

wodniok2• 6 months ago

Quote from Website: "For the past 30+ years I’ve been the maintainer of sudo. I’m currently in search of a sponsor to fund continued sudo maintenance and development. If you or your organization is interested in sponsoring sudo, please let me know."

stego-tech3• 6 months ago

This is why Big Tech is so desperate for AI to work as a wholesale replacement for software developers: they do not pay for their Open Source consumption as-is, and new maintainers aren’t stepping up because they can’t afford rent, let alone to devote their full time to FOSS work free of charge like a lot of older project maintainers do.

The fact that sudo is a critical security pillar for trillions of dollars of global infrastructure but this guy gets bupkis for it screams volumes about the current state of technology.

We must do better, or it’ll be closed systems (OpenAI, Microsoft, Apple, Google, Oracle) all the way down as maintainers age out, go bankrupt, or die without succession plans in place.

palmotea2• 6 months ago

Honestly, it seems like the idealism of open source shouldn't have survived its contact with capitalism, but I suppose the contact wasn't painful enough the the exploitation continued for a long time.

Maybe we need a license that's even more onerous to corporations than the AGPL, like something with a revenue share clause.

Or maybe the problem is the naivete of software engineers. In aggregate, there was so much embrace of libertarianism that no groundwork was laid to protect ourselves from things like AI and offshoring.

stego-tech3• 6 months ago

Been pitching that with my FOSS colleagues and peers for years, now. A license for individual and educational use, but pay-to-play for anyone tangentially making revenue from its use. Then the conversation boils down to the business engineering of how much should something cost, with some arguing for flat yearly rates, and others arguing for cost-per-unit, while others still fret about "disrupting" the status quo immediately after acknowledging its untenability.

It's...frustrating, but those who do the work are the most qualified to explain what they need. For the rest of us, it's encouraging them to seek reasonable compensation for their work from those who exploit it for profit, and that doing so doesn't necessarily go against the spirit of open source.

acuozzo• 6 months ago

the idealism of open source shouldn't have survived its contact with capitalism

The US economy of the 1980s, 1990s, and 2000s made it possible.

softfalcon3• 6 months ago

I don't mean to come across as far too cynical, but in what world has a software license ever stopped the greedy and powerful from pillaging the IP of other people smaller and weaker than them?

In my opinion, libertarianism in software is a hollow dream that leads people to make foolish decisions that can't be protected. This makes it easy for corporations to exploit and quash any barely audible opposition.

Almost as if by plan, the libertarian mindset has eroded and weakened open source protections, defanging and declawing it every step of the way.

htx80nerd• 6 months ago

"it screams volumes about the current state of technology."

about the current state of Big Corp vampires who are happy to bleed everyone dry to put more $$ in their own very fat pockets

softfalcon3• 6 months ago

Exactly

functionmouse• 6 months ago

Our economic system starves you to death if you don't

People aren't vampires because they're on top, they're on top because they're vampires.

Shit flows downstream

softfalcon3• 6 months ago

Sounds like the system is working as intended...

Not trying to be glib here. This feels like the embrace, extend, extinguish pattern that we jokingly used to think was only Microsoft. It is now becoming more and more obviously the modus operandi of the entire enterprise software ecosystem.

I believe you are correct to be frustrated and ringing the alarm bell. This is a "death of the commons" moment for OSS.

drnick13• 6 months ago

and new maintainers aren’t stepping up because they can’t afford rent, let alone to devote their full time to FOSS work free of charge like a lot of older project maintainers do.

What about the Rust rewrite (sudo-rs)? I think it shows people are interested in maintaining and/or modernizing tools taken for granted.

whatis9916• 6 months ago

It has a more lax license AFAIK. Also, many Rust projects and libraries have been abandoned, or are in so-so shapes.

Edit:

To specify, new projects like sudo-rs may seem promising, but going by observation and experience with similar projects, there is no guarantee that sudo-rs and similar projects will be successful, good and continued to be maintained. The problems with old projects can end up applying to new projects as well. And projects in Rust are no exception, going by experience with existing, older Rust projects.

Aside, a pet peeve I have is that for instance Ruffle has not turned out as successful as I had hoped for, even after several years and many sponsors. The proprietary Flash runtimes written in C still outperform Ruffle greatly in some cases, causing problems for some users that want to use Ruffle instead of other runtimes.

tokyobreakfast• 6 months ago

By modernizing do you mean rewriting mature software in a meme language with less features than the original and introducing new bugs in the process?

The Rust smokescreen is mostly being used to slowly eradicate the GPL.

Like Lenin said, "Who stands to gain?"

alt2272• 6 months ago

IMO rust rewrites are done quickly to gain attention and kudos. They are very rarely maintainted to the same quality of the originals.

whatis9916• 6 months ago

This might be a controversial view:

What if the exploitative aspect is open source itself? Trick some above average but naive developers into giving their talent, effort, insights and time away for free or very little? Maybe open source or something similar could have been organized in a way that wasn't exploitative and wasn't (possibly) unsustainable, but that is not how things ended up with what Richard Stallman and others organized.

markus_zhang• 6 months ago

I think at least the license should say something like we will charge on a per CPU or whatever basis for commercial usage.

You give it away for free so don’t be surprised to get abused. Human nature working at its best and worst here.

monero-xmr• 6 months ago

The exact moment you charge for something, you need payment processing, a bank, a legal entity to hold said processed funds, you have liability, you need some sort of marketing / sales process (even if it's just copy on a website), and the barrier for someone to use your product is suddenly extremely high, simply because it costs something.

Release it for free, no barrier to entry, no legal liability, the entire world can use it instantly. This is why free software spreads and catches on - precisely because it's free.

There is no way to form a business around FOSS without becoming a gatekeeping high-barrier entity. You can release for free then charge extra for consulting or special features, which many have done and continue to experiment with.

But the core reason why FOSS spreads and took over is precisely why it is difficult to fund. No one is going to pay for something when the alternative is free. And the moment you start to charge some free alternative comes along and your prior users spurn you as greedy

Zambyte2• 6 months ago

All of this is true, but ironically Free Software is about ensuring people have control over their computers, and Open Source spun the narrative to make it about getting software cheap or without paying at all.

People having control over their computer (and even having the right to share what they run on their computer!) is completely compatible with people paying for software labor.

kristopolous3• 6 months ago

We shouldn't let cynical greedy bastards set the terms for how the rest of society wishes to engage

SoftTalker• 6 months ago

Why should something like sudo not be "done" after 30 years?

Sudo is one of the poster children for creeping featuritis, to the point that the sudoers man page is a meme ("Don't despair if you are unfamiliar with EBNF ...")

Even OpenBSD gave up and implmented their own simplified replacement (doas).

asveikau• 6 months ago

This community and others like it are so weird in that if they see something as stable as sudo but without recent commits, rather than conclude that it's solid and doesn't need further changes, they see it as some kind of a problem and want to switch to something that's seen major changes in the last week.

Maybe that's somehow related to why so many companies are shoving AI into a bunch of stuff that doesn't need it. Gotta keep everything on the hype train. Working and fulfilling people's needs is no longer good enough.

blame-troi• 6 months ago

Different platform but the simplest mainframe utility IEFBR14, a noop process to trigger JCL events started as one instruction. Then two. Then debate started about which machine instruction should be used to set the return code to zero …

rustyhancock• 6 months ago

Similarly sudo-rs and doas-rs exist now.

I'm not sure what can be gained for further development of the OG c sudo, add security patches of course.

But fund adding yet another feature 99.9% of users will never use? I can't fathom the justification for that. Just adding attack surface at this point.

Rightly both doas and the *-rs drops ins intend to drop most of those unnecessary features.

eviks• 6 months ago

Because we haven't progressed to the angelic level of software development, so nothing is bug-free, which especially important in something security-critical like sudo

ddtaylor• 6 months ago

Even if sudo itself never changed, the system around it changes pretty drastically. I agree the scope of the tool should be smaller and it violates the Unix philosophy (whatever that is worth these days)

stego-tech3• 6 months ago

Bugfixes and security vulnerabilities, mostly. So long as fallible humans make fallible hardware running fallible software that in turn executes and/or compiles fallible code, there will always be a need for continued development of critical tooling and packages.

On a long enough timeline, those fixes become fewer and less frequent as the codebase improves, but there is no "done" in software unfortunately. Hell, entropy itself means nothing is ever done, just in an ever-changing state.

throw0101a4• 6 months ago

Why should something like sudo not be "done" after 30 years?

Because new needs arise over time. For example, when I started in IT the "sudoedit" functionality was not present and so allowing someone to do "sudo vi …" would allow them breakout of the editor when it was running as root.

With sudoedit you can give people permissions to edit particular files with elevated permissions.

Even OpenBSD gave up and implmented their own simplified replacement (doas).

They did not "give up": they found they needed only much simpler functionality shipped in the base OS. For example, sudo has functionality to talk to LDAP (which I've used at multiple jobs over the years), but is not needed for a local-only box. Once you need centralized account and privilege management, doas becomes much less useful.

numbsafari• 6 months ago

What are you, a dentist moonlighting as an angel investor?

Software is never "done".

The underlying APIs are always changing. The compilers and system libraries are changing.

Featuritis is a thing, but rolling it back is non-trivial as there are folks who depend upon it.

b00ty4breakfast• 6 months ago

Are you saying you would be using something that fills the same critical role as sudo even if it had not received any updates in a decade or more? Because that sounds insane

butterfi• 6 months ago

Because environments change, it hasn't been immutable.

eichin2• 6 months ago

Is it really creeping, though? Pretty sure I first saw the EBNF in the man page more than 20 years ago, it's just how that generation learned to write and discuss parsers. (What I'm getting at is that even if it is, that isn't a sign of it.)

Of course, 20+ years ago a big feature was platform compatibility, and since then we've gone from 10+ to 2ish, so if it's not explicitly enabling retrocomputing, it should be getting simpler, right?

arccy• 6 months ago

maintainers need to learn to say "no" to scope creep and entitled users.

sudo should have been a near complete tool after it was written.

sllabres• 6 months ago

So no #includedir, no LDAP integration, no log_input/output, no PAM integration ...?

pwndByDeath• 6 months ago

I've always favored the view that digital goods are only scarce until they are released. if we had a market for patch releases once they hit some goal. Uses could tip to reach the goal. After the goal is reached the patch is released and to all. Still have free loaders but one might live on the work

WorkerBee28474• 6 months ago

So...crowdfunding via a platform like Kickstarter?

akokanka• 6 months ago

Have used sudo millions of times. It's so smooth I don't even consider it software. Thinking that sudo could give me bug one day haunts me now. Thanks Miller for your work!

amelius• 6 months ago

I still think the integration with X11 $DISPLAY could be smoother.

jmclnx• 6 months ago

I would love to know were IBM is on this. They use sudo everywhere, even on AIX. Not to mention IBM owns Red Hat Linux.

IBM should be able to send a decent amount to Todd once in a while, but based upon how much IBM supports ssh ($0), all they are proving is they are very cheap and only wants be a parasite living off other's work.

fdupress• 6 months ago

Seeing the server temperatures go up as this gets posted to HN is fun. I'm not sure his server agrees.

divbzero3• 6 months ago

“Machine Room Temperature” from Todd C. Miller’s website:

https://www.millert.dev/therm/

Server exhaust fan temperature was typically 94°F (ranged 92°F to 96°F) over the previous week and has climbed to 97°F.

divbzero3• 6 months ago

But, on the whole, the server seems to be doing well enough for something near the top of HN. The website is served by nginx and appears to be mostly static pages.

calvinmorrison2• 6 months ago

I once wrote hacking is ethical. Maybe I meant 'eventual'. Instead of Red-Hat sponsoring sudo, china can sponsor him to put hacks in.

kleiba2• 6 months ago

Obligatory xkcd: https://xkcd.com/2347/

kleiba2• 6 months ago

...although this one would have been a good fit too, of course: https://xkcd.com/149/

divbzero3• 6 months ago

This xkcd is featured as the maintainer’s user icon on GitHub:

https://github.com/millert

zerotolerance• 6 months ago

But today people can just vibe code their own sudo "with blackjack and hookers!"

Really though, it is remarkable just how high we've built this towering house of cards on the selfless works of individuals. The geek in me immediately begins meditating on OSS funding mechanisms I've seen in the past, and what might work today. Then I remember that I don't believe it can work, but hope desperately that people like Todd can keep paying rent and continue getting some satisfaction from the efforts.

OsamaJaber• 6 months ago

30+ years maintaining one of the most critical pieces of infrastructure on nearly every Linux and Unix system, and he's currently looking for a sponsor to fund continued development. Every company running sudo in production owes this man. Someone should fix that

boringg• 6 months ago

Right? A company to step and cut a check to support this would get positive publicity and there doing something good for community at large. Someone step up.

lovich• 6 months ago

Companies don’t step up and do things for the common good. They do things for profit. Occasionally that looks like they are charitable if the value of the PR is worth it for them.

No one[1] changes what product they are using based on funding or not of open source software. Companies will step in and fund it if they want control, like with Rust, or if the maintainer finally stops giving them free labor and they actually need the software.

[1] not enough people to alter finances

oconnore• 6 months ago

Why would you be running sudo in production? A production environment should usually be setup up properly with explicit roles and normal access control.

Sudo is kind of a UX tool for user sessions where the user fundamentally can do things that require admin/root privileges but they don't trust themselves not to fat finger things so we add some friction. That friction is not really a security layer, it's a UX layer against fat fingering.

I know there is more to sudo if you really go deep on it, but the above is what 99+% of users are doing with it. If you're using sudo as a sort of framework for building setuid-like tooling, then this does not apply to you.

acdha3• 6 months ago

A production environment should usually be setup up properly with explicit roles and normal access control.

… and sudo is a common tool for doing that so you can do things like say members of this group can restart a specific service or trigger a task as a service user without otherwise giving them root.

Yes, there are many other ways to accomplish that goal but it seems odd to criticize a tool being used for its original purpose.

bobmcnamara2• 6 months ago

Auditing.

throw0101a4• 6 months ago

Why would you be running sudo in production? A production environment should usually be setup up properly with explicit roles and normal access control.

And doing cross-role actions may be part of that production environment.

You could configure an ACME client to run as a service account to talk to an ACME server (like Let's Encrypt), write the nonce files in /var/www, and then the resulting new certificate in /etc/certs. But you still need to restart (or at least reload) the web/IMAP/SMTP server to pick up the updated certs.

But do you want the ACME client to run as the same service user as the web server? You can add sudo so that the ACME service account can tell the web service account/web server to do a reload.

bigstrat2003• 6 months ago

Almost everyone is running sudo in production.

bloqs• 6 months ago

the fact this is a reply to the content in the parent just demos the complete lack of social skills or empathy many in this community are known for

jcelerier• 6 months ago

bro i just want to apt install gimp :(

brightball• 6 months ago

This is a good example of Diffusion of Responsibility.

Everybody thinks somebody else should help, so nobody does.

lenerdenator2• 6 months ago

I don't think they even see it as their responsibility, more, "If he wanted money, he should have charged for his software".

shimman2• 6 months ago

Seriously, just put a VAT on digital services to fund a system that pays out grants to individuals to help maintain open source software. It should be obvious by now that corporations will rat fuck the commons for monetary gain and there is a serious need for democratic initiatives to put technology back into the hands of the people.

AmbroseBierce• 6 months ago

I mean, he should just put a message when you run sudo the first time asking for funding if he wants it that bad, that should speed things up.

selfmodruntime• 6 months ago

Google made 10^7 as much money as I did last year. Yea, I don't think it's as simple as you make it seem.

shevy-java2• 6 months ago

I disagree on "the most critical" part. You can be superuser at all times. I understand the arguments why not; I am pointing out that this is possible. Despite people claiming aliens will arrive and nothing will work, everything works fine when the superuser account is used too.

Also, I disagree that every company needs to pay the man. Funding is important, yes, but a *nix system is not crippled without sudo. You can change the permission systems. The superuser can do so too. It is not black magic. The permission system is trivial. sudo is simply a feature of convenience, not a "if sudo does not exist, nothing works" - that just makes no sense.

account425• 6 months ago

You don't even have to be root all the time, su is all you need unless you have a fetish for software bloat.

noosphr3• 6 months ago

Whenever people say that MIT or GPL licenses are a good idea I point out projects like this.

Only humans should have freedom zero. Corporations and robots must pay.

groby_b3• 6 months ago

That's a nice slogan, but how does it work?

Say, I clone sudo. Clearly, a human applying freedom zero. I use it in my projects. Probably still freedom zero. I use it in my CI pipeline for the stuff that makes me money... corporation or human? If it's corporation, what if I sponsor a not-for-profit that provides that piece of CI infra?

The problem is that "corporation or not" has more shades than you can reasonably account for. And, worse, the cost of accounting for it is more than any volunteer wants to shoulder.

Even if this were a hard and legally enforceable rule, what individual maintainer wants to sue a company with a legal department?

What could work is a large collective that licenses free software with the explicit goal of extracting money from corporate users and distributing it to authors. Maybe.

wmf• 6 months ago

You can demand payment but it doesn't mean you'll get paid. These days companies will clone your work instead of paying.

saubeidl4• 6 months ago

The GPL is a good idea. It's our socieconomic system that isn't.

omoikane• 6 months ago

I am not sure sudo is licensed under MIT or GPL, looks it's like a mix of licenses[1]. The end of the first license says it's sponsored in part by DARPA.

From 2010 to February 2024, it was sponsored by Quest Software according to the history page[2].

[1] https://github.com/sudo-project/sudo/blob/main/LICENSE.md

[2] https://www.sudo.ws/about/history/

sixtyj• 6 months ago

The behavior of corporations is shameful.

After all, people in these companies don't work for free and are able to spend a lot of money for other services.

throw0101c• 6 months ago

Corporations and robots must pay.

Greenpeace is a (non-profit) corporation. Unions are corporations. Municipalities. Colleges and universities.

* https://en.wikipedia.org/wiki/Legal_person

Should they have to pay?

groby_b3• 6 months ago

You can only fix that with leverage. The sudo maintainer doesn't have it. sudo is valuable, but if Todd stepped away, you could (and would) find other maintainers because it's so important.

If you want to fix it, you need organizational heft comparable to the companies using it, and the ability & willingness to make freeriding a more painful experience.

eichin2• 6 months ago

Wasn't the sudo-rs (rust version) already reducing that leverage even further? (and finding interesting bugs, but that's not the point here)

af78• 6 months ago

Surprisingly Jia Tan has not offered to help yet.

SunlitCat• 6 months ago

Maybe someone should suggest, sudo needs compression capabilities and suggest a great developer, being helpful with that one? :D

midtake2• 6 months ago

Jia Tan and his 40 sockpuppets are undoubtedly trying.

tuhgdetzhh• 6 months ago

Reminds me of https://xkcd.com/2347/

gonzo41• 6 months ago

At the least, all the hyperscalers should be putting money into a fund for this sort of thing.

aboardRat46• 6 months ago

Why would it be needed to continue the development of sudo?

Isn't it done and finished, after 30 years of development?

not_ai• 6 months ago

The monthly releases seem to indicate otherwise.

drnick13• 6 months ago

It's all bug fixes it seems. What is surprising is that so many bugs remain even after all this time and effort. And no, for the most part these are not the kinds of bugs that are squashed by a rewrite in Rust.

firesteelrain• 6 months ago

I guess I don’t understand. Take RHEL. The sudo maintainer seeking a new sponsor affects upstream velocity and stewardship, not the deployed trust model of enterprise distributions. RHEL does not “follow HEAD.” It vendors a known-good snapshot and assumes long-term responsibility for it.

Core tools like sudo have survived things like this before

hiAndrewQuinn• 6 months ago

I wonder how many guys who have have written or significantly maintained "household name" level FOSS products just earn a corporate sinecure somewhere as hypercompetent remote sysadmins or ICs or something. Folks who don't necessarily care to earn top dollar, with all the headaches that entails, but also almost never have to actually work more than 2 hours in a given day to keep the ship going, and the arrangement is just so cozy and gives them enough time to themselves to work on their actual passion that they accept the arrangement.

I know of at least one recruiter who does something like this and specializes in greybeard hiring, and it seems like a steady niche if you have the network to pull it off.

account425• 6 months ago

one of the most critical pieces of infrastructure

It's really not.

Hendrikto2• 6 months ago

How is it not? A suid binary installed on pretty much every Unix system ever seems pretty critical to me.

jandrese2• 6 months ago

Honestly he should open a Patreon. There are loads of people that would subscribe to Sudo for $2/month or $5/month.

rileymat2• 6 months ago

The problem is if I was going to do that with the open source projects I use, it is more like a penny a month * 1000 projects.

bobmcnamara2• 6 months ago

$.01/user/month would be quite a bit here

ycombinatrix4• 6 months ago

payment processors: "how about no"

squigz• 6 months ago

This is why I feel like a missing piece of Patreon/Kofi/whatever is the ability to say "Here's $x; divide it automagically amongst the creators I'm currently following"

Sure, I think a lot of those donations would amount to a few pennies or so at once, but I feel like a lot more people would be willing to support creators if they didn't have to constantly choose which to support.

ak009• 6 months ago

wouldn't https://github.com/sponsors/sudo-project achieve the same thing in this case?

jandrese2• 6 months ago

That's great, I wish he had mentioned it.

adolph2• 6 months ago

They are using github sponsors and have had some level of contributions.

https://github.com/sponsors/sudo-project

RhysU• 6 months ago

I would kick him $20. Anyone know how?

xxs• 6 months ago

Patreon

And they start making videos about, mentioning the sponsors. There are better options to get money.

fHr• 6 months ago

Unbelievable, every fortune 500 company should sponsor this you all rely and use this. This makes me so sad I hope this has a good end.

dwflanagan• 6 months ago

sudo pay him

anigbrowl• 6 months ago

I've said it before, open source works poorly in this area. It's great if everyone's getting paid fat money in a day job and can maintain their pet project a few days a month, but that's just not true for a lot of people.

It's disgusting that maintainers of critical projects have to go through the humiliation of begging for money, and absurd to suggest they all hang out Kofi or PAtreon banners. Realistically nobody is going to go through their bash history working out what utilities they use in order of frequency and allocating funds to the maintainers proportionally. I'm baffled that some entity like the Linux Software Foundation isn't administering this already.

fragmede4• 6 months ago

Realistically nobody is going to go through their bash history working out what utilities they use in order of frequency and allocating funds to the maintainers proportionally.

Not if we don't make it easy for them. I had Claude whip up fundcli a while ago, but this post got me to finally upload it. It goes through your http://atuin.sh/ history (raw .bash_history/.*history doesn't have enough information) and generates links to projects for you to donate to.

    git clone https://github.com/fragmede/fundcli
    uv run src/fundcli/cli.py analyze
    uv run ./src/fundcli donate --amount 100

to get links to donate $100 for last month's usage. There's also http://thanks.dev if you're looking for other places to donate to based on your open source usage.

jongjong• 6 months ago

I feel like this should have been the responsibility of investors and venture capitalists. In a normal society, the moneyed folks should give special treatment to the folks who have proven themselves to be effective givers.

Unfortunately, it seems like either the moneyed folks don't care or the current financial structure simply does not support this.

badsectoracula• 6 months ago

I think that's because the moneyed folks tend to be effective takers :-P

phicoh• 6 months ago

I wonder if a few people going beyond what is reasonable, is representative of open source projects.

For a lot of open source projects, if you have a normal day job and spend a few hours per week on a project, then the project just never gets very big. It exists, may have a few users. But on a larger scale, nobody knows it exists.

The exceptions are projects where developers spend a lot of time on the project at the expense of a day job. Though there is the possibility that they may have a hard time having a day job in the first place, which may have let to the situation with the open source project.

In general, I think we do have a culture problem where we think projects need to be successful. And people working on a project 'need' to support users (who in general don't pay).

And that expectation of free work happens throughout the open source ecosystem as well. Distributions expect projects to fix bugs for free. Open source projects expect libraries and compilers to be maintained.

Ultimately, change has to come from people who refuse to work for free. Doing something as a hobby for free is perfectly fine. As long as it stays within the scope of a hobby project.

kcexn• 6 months ago

I think this is partly an education problem, and partly an industry culture problem. Lots of young developers are incentivized to 'contribute' to open-source as a way to demonstrate that they can actually write software. So open-source becomes a way of signalling competence when at a broader scale it's just extracting wealth from the vulnerable.

Open-source seems to be fragmented into three groups now. Large enterprise open-source like Kubernetes or OpenStack where the license seems more like a legal agreement amongst vendors to not sue each other. Legacy open-source projects that are getting by on brand recognition and sheer willpower. And a whole bunch of noise from people who are looking to leverage open-source into a job of some sort.

I'm not sure what the solution is...

shevy-java2• 6 months ago

The funding problem is an issue.

We need to find better models. Even if it is just "low(er)" payment; that would still be better than zero or near zero payment.

larodi• 6 months ago

Universal Global Contributor Wellness Fund

may also fund retirements for certain individuals, and there is for sure enough free juice to get it started in a very reasonable way. these people really deserve it, the same way Nobels extist, etc.

dangoodmanUT• 6 months ago

Impressive

but the mascot for sudo is terrifying

ahartmetz2• 6 months ago

But also quite funny when you make the connection!

hobofan11• 6 months ago

Perpetuating misogyny as the mascot of one of the most used pieces of software. Yay!

thelastgallon• 6 months ago

There's also NTP.

The Largely Untold Story Of How One Guy In California Keeps The World’s Computers Running On The Right Time Zone: https://onezero.medium.com/the-largely-untold-story-of-how-o...

https://xkcd.com/2347/

debo_2• 6 months ago

You forgot the more relevant: https://xkcd.com/149/

ryandrake• 6 months ago

Reading the release history[1]. I'm kind of shocked that sudo gets active development and monthly releases. I would have thought that something this old and venerated would have been "done" long ago.

1: https://www.sudo.ws/releases/devel/

hobofan11• 6 months ago

"Done" software is a myth they tell to young developers so that they can sleep easy at night.

kachapopopow• 6 months ago

wireguard is relatively "done"

latexr3• 6 months ago

Absolutely false. I have built tons of tools which are feature complete and continue to work to this day without intervention. Heck, I even have tools I no longer use that people asked me to keep available because they do, and they’ve been chugging along for over a decade, no bugs or maintenance necessary.

Just today I saw a report of Adobe discontinuing a tool in use by professionals because it is done and they don’t know what else to add.

https://mastodon.social/@grishka/116005782128372247

“Software is never done” is a myth they tell to keep extracting money from you.

A lot of the time, failing to to finish software indicates a badly defined scope.

noirscape2• 6 months ago

There's a difference between software that's "done" (it never needs updates, ever) and software that's done (it only needs maintenance for security and platform churn).

The former is extremely rare; platform churn alone will usually demand updates, even if your code is otherwise airtight. Forces generally beyond your access will demand that your code is able to conform to platform standards. The demand this places can be very variable and depends more on the platform than you. (Windows has low platform churn since it's possible to futz with compat features, Linux is extremely variable on your codebase, MacOS is fairly constant and from what I know about mobile phones, you're basically signing up to forever maintenance duty).

The latter is much more common; sure, sudo still gets updates but most of those won't be new features. Specification wise, sudo is "done". It does what it needs to, it's interface is defined and there aren't going to be any strange surprises when I run sudo between any system made in the past 10 years or so.

The problem is that when you're selling software, demanding compensation for the former is a hard sell since it's things customers won't see or necessarily care about. Demanding compensation for the latter is much more obviously acceptable.

Intralexical4• 6 months ago

The OpenBox WM is a respected piece of software, commonly used on minimal Linux desktops, that has been "done" since at least 2015.

UqWBcuFx6NV4r2• 6 months ago

Keep selling your bosses that myth. Nobody here believes you though.

sizzzzlerz• 6 months ago

I was wondering the same thing. I would have thought every possible combination of parameters would have been tried by now. I guess it just goes to show you that your code is never really complete.

Aperocky• 6 months ago

I guess it just goes to show you that your code is never really complete.

Yes and no, feature bloat usually justify themselves innocently and once you go down that slope there is no return.

The hardest thing to do in software is commit yourself to a set of feature and protect it from any "helpful additions", naming might be the second hardest.

varenc• 6 months ago

pros and cons to this approach, like the CVE introduced in sudo 9.1.14 (June 2023) fixed in 1.9.17p1 (June 2025). https://www.cve.org/CVERecord?id=CVE-2025-32463

But also sudo has A LOT of features that 95% of people don't use. Just checkout `man sudo` to get a sense for this. And it includes plugins like the popular visudo plugin. You can see from the release cadence that real improvements continue to be made. Though it is a bit more work to secure a moving target.

tombert• 6 months ago

Yeah, silly as it is, I guess it didn't even occur to me that sudo had a developer or maintainer, or was even a "program"; to me it has been one of those things that has and always will exist and I had just assumed it evolved and came about alongside Cro-Magnon man.

But of course, that's silly. Of every piece of software has to be written. I should probably throw the guy a few bucks, considering his code runs in basically every big script on the planet.

qznc• 6 months ago

It seems to have features I was not aware of. I would not have guessed that it contains anything networking-related.

ninkendo• 6 months ago

Sudo’s networking functionality is infuriating too, because if my system’s DNS is broken, I get to wait 60 seconds for sudo to work, during which time I can’t even ctrl+c to cancel!

(It has to do with sudoers entries having a host field, since the file is designed to be deployed to multiple servers, which may each want differing sudoers rules. It’s truly 90s era software.)

account425• 6 months ago

Feature bloat is the last thing you'd want in security relevant software.

surajrmal• 6 months ago

I really prefer the design of run0.

arjie• 6 months ago

I think the rise of the open-source redistributor groupie has been an interesting cultural revolution. I wonder if it will persist. Even 10 years ago, the idea of Free As In Speech dominated the idea of Free Software. Today, the greatest enthusiasm on Hacker News and Reddit is for something like Meta's Llama license (which cannot be used by people or corps with sufficient numbers of users). It certainly seems like someone out there could go out and propose the Microfree License which only applies to sufficiently non-rich people.

For my part, I want none of it. I find this reduction of a significant philosophy to some kind of base tax-and-distribute mechanism distasteful. I don't like communities were this stuff is big and they always want to run some taxation scheme where they redirect money to their own personal pet projects. It is fortunate that modern tools are good enough to build personal insulation from this stuff.

Imagine the farce of Apply HN repeated continuously. Simply awful.

debo_2• 6 months ago

Someone make this man a sandwich.

https://xkcd.com/149/

baggy_trough• 6 months ago

systemd, as might be expected, has a sudo replacement in recent versions, for those who think sudo might be a bit long in the tooth: run0

https://www.freedesktop.org/software/systemd/man/256/run0.ht...

h4kunamata• 6 months ago

Canonical tried to change that with sudo-rs, but by being Canonical they did what Canonical do best since they got too big: Read poop here

gwbas1c• 6 months ago

Halloween `91 with Todd as the infamous Ducktape Man!

https://www.millert.dev/images/photos/todd_ducktape_man.gif

Uhm, how did Todd relieve himself in that costume?

cr125rider• 6 months ago

This is the guy in the XKCD comic holding up the entire stack.

DonHopkins• 6 months ago

Let's sudo and say we didn't.

RickJWagner• 6 months ago

Todd C. Miller, thank you for your contributions. Sudo is an awesome piece of work.

heftykoo• 6 months ago

It's genuinely terrifying to think how much of the modern internet rests on the shoulders of a few people maintaining core utilities like sudo, curl, and openssl for decades. Todd is a legend.

rixed• 6 months ago

Yes but that would be even more terrifying if it rested on the whims of some soulless corporation.

redog• 6 months ago

ms-sudo to Get-AdministratorPermissionForElevatedSecurityOperations

khaki54• 6 months ago

I think xkcd should fund it, that would be comical.

ilaksh• 6 months ago

https://github.com/sponsors/sudo-project

Can donate there.

My bank account is basically empty but I will contribute a few bucks.

wodniok2• 6 months ago

Or here.

https://opencollective.com/sudo-project

egorfine3• 6 months ago

Contributed immediately.

Thanks to sudo-rs: this stolen valor project made me want to financially support the original author.

zbentley3• 6 months ago

how does the metaphor of stolen valor (in my understanding: claiming accolades or military credentials/decorations that one never received) apply to that project?

I don’t know anything about the history here; it’s a genuine question.

b2ccb2• 6 months ago

A good time to advertise for Sudo Mastery by Michael W. Lucas, highly recommend it if you want to dig in a bit deeper.

chr1ss_code• 6 months ago

Thank you :)

jacquesm• 6 months ago

Does he live in Nevada, by chance?

arkensaw• 6 months ago

It never even occurred to me that sudo was something people had to maintain. it's always just been part of linux

dewey• 6 months ago

And Linux is maintained by who?

theGeatZhopa• 6 months ago

sudo contribute --bank --amount

sodimel• 6 months ago

Didn't knew that sudo had a website with a... somewhat interesting logo: https://www.sudo.ws/

esnard2• 6 months ago

Wow, is it related to the "make me a sandwich" XKCD?

https://xkcd.com/149/

Joe_Cool• 6 months ago

You do realize the answer is right there: https://www.sudo.ws/about/logo/

(and the old logo) ;)

zeroping• 6 months ago

"This incident will be reported" (in /var/log/auth.log)

philipwhiuk• 6 months ago

Only enable the TLS listener by default if a TLS cert is specified.

There's a TLS listener in sudo? This project seems to have a tonne of features it shouldn't.

amai2• 6 months ago

Only recently sudo got copied by Microsoft for Windows 11:

https://learn.microsoft.com/windows/advanced-settings/sudo/

I guess they didn't pay a cent to Todd Miller.

burkaman• 6 months ago

https://github.com/microsoft/sudo?tab=readme-ov-file#relatio...

This project is not a fork of the Unix/Linux sudo project, nor is it a port of that sudo project. Instead, Sudo for Windows is a Windows-specific implementation of the sudo concept.

amai2• 6 months ago

They copied the name and the concept. The rest is probably AI-generated code.

anon-3988• 6 months ago

if sudo needs 30 years of development, we need to rethink how it works. Perhaps it is time to trim down 99% of the features. Reset our brain, take a deep look at what it needs to do and how it does it.

geldedus• 6 months ago

Referring to oneself to the a third person is a sign of narcissism ("Todd this, Todd that, Todd the other thing etc)"

Todd C. Miller – Sudo maintainer for over 30 years

Related Stories