Comment by stego-tech
14 hours ago
This is why Big Tech is so desperate for AI to work as a wholesale replacement for software developers: they do not pay for their Open Source consumption as-is, and new maintainers aren’t stepping up because they can’t afford rent, let alone to devote their full time to FOSS work free of charge like a lot of older project maintainers do.
The fact that sudo is a critical security pillar for trillions of dollars of global infrastructure but this guy gets bupkis for it screams volumes about the current state of technology.
We must do better, or it’ll be closed systems (OpenAI, Microsoft, Apple, Google, Oracle) all the way down as maintainers age out, go bankrupt, or die without succession plans in place.
Why should something like sudo not be "done" after 30 years?
Sudo is one of the poster children for creeping featuritis, to the point that the sudoers man page is a meme ("Don't despair if you are unfamiliar with EBNF ...")
Even OpenBSD gave up and implmented their own simplified replacement (doas).
Different platform but the simplest mainframe utility IEFBR14, a noop process to trigger JCL events started as one instruction. Then two. Then debate started about which machine instruction should be used to set the return code to zero …
Hence IEFBR14A
> Why should something like sudo not be "done" after 30 years?
Because new needs arise over time. For example, when I started in IT the "sudoedit" functionality was not present and so allowing someone to do "sudo vi …" would allow them breakout of the editor when it was running as root.
With sudoedit you can give people permissions to edit particular files with elevated permissions.
> Even OpenBSD gave up and implmented their own simplified replacement (doas).
They did not "give up": they found they needed only much simpler functionality shipped in the base OS. For example, sudo has functionality to talk to LDAP (which I've used at multiple jobs over the years), but is not needed for a local-only box. Once you need centralized account and privilege management, doas becomes much less useful.
Let's be honest, though. If you designed a new sudo in a system with doas(1) it would look nothing like modern sudo.
I can't remember the name, but I read about a rust project a few months ago which claimed that even doas had too much feature creep.
> sudo has functionality to talk to LDAP
That is scary! I may need to look more at openbsd
4 replies →
Bugfixes and security vulnerabilities, mostly. So long as fallible humans make fallible hardware running fallible software that in turn executes and/or compiles fallible code, there will always be a need for continued development of critical tooling and packages.
On a long enough timeline, those fixes become fewer and less frequent as the codebase improves, but there is no "done" in software unfortunately. Hell, entropy itself means nothing is ever done, just in an ever-changing state.
Is it really creeping, though? Pretty sure I first saw the EBNF in the man page more than 20 years ago, it's just how that generation learned to write and discuss parsers. (What I'm getting at is that even if it is, that isn't a sign of it.)
Of course, 20+ years ago a big feature was platform compatibility, and since then we've gone from 10+ to 2ish, so if it's not explicitly enabling retrocomputing, it should be getting simpler, right?
Even if sudo itself never changed, the system around it changes pretty drastically. I agree the scope of the tool should be smaller and it violates the Unix philosophy (whatever that is worth these days)
This community and others like it are so weird in that if they see something as stable as sudo but without recent commits, rather than conclude that it's solid and doesn't need further changes, they see it as some kind of a problem and want to switch to something that's seen major changes in the last week.
Maybe that's somehow related to why so many companies are shoving AI into a bunch of stuff that doesn't need it. Gotta keep everything on the hype train. Working and fulfilling people's needs is no longer good enough.
The thing is, there is next to no software that "doesn't need further changes" at all. There is always something, sure it might be infrequent and/or most of the time nothing really big or difficult (except sometimes) but the point is: someone needs to step up and do it.
If a see a project with recent activity, best from multiple people it is a strong signal that this will happen, if the last commit is a year ago I must assume it's completely abandoned because most of the time it just is. Sometimes it's clearly communicated that it is the way because the authors see it as essentially feature complete, there are some examples of this but not that many honestly.
Because environments change, it hasn't been immutable.
What are you, a dentist moonlighting as an angel investor?
Software is never "done".
The underlying APIs are always changing. The compilers and system libraries are changing.
Featuritis is a thing, but rolling it back is non-trivial as there are folks who depend upon it.
Just curious, why did you use "dentist" in your analogy over any other profession?
Because we haven't progressed to the angelic level of software development, so nothing is bug-free, which especially important in something security-critical like sudo
Similarly sudo-rs and doas-rs exist now.
I'm not sure what can be gained for further development of the OG c sudo, add security patches of course.
But fund adding yet another feature 99.9% of users will never use? I can't fathom the justification for that. Just adding attack surface at this point.
Rightly both doas and the *-rs drops ins intend to drop most of those unnecessary features.
Are you saying you would be using something that fills the same critical role as sudo even if it had not received any updates in a decade or more? Because that sounds insane
This might be a controversial view:
What if the exploitative aspect is open source itself? Trick some above average but naive developers into giving their talent, effort, insights and time away for free or very little? Maybe open source or something similar could have been organized in a way that wasn't exploitative and wasn't (possibly) unsustainable, but that is not how things ended up with what Richard Stallman and others organized.
All of this is true, but ironically Free Software is about ensuring people have control over their computers, and Open Source spun the narrative to make it about getting software cheap or without paying at all.
People having control over their computer (and even having the right to share what they run on their computer!) is completely compatible with people paying for software labor.
No it isn't. People having control over their own computer is in direct contradiction with people paying for software labor. In an honest world, sure, but in reality, people don't want to pay for shit and are going to steal from you. The Pirate Bay is still running and isn't going away. So is Anna's archive.
I think at least the license should say something like we will charge on a per CPU or whatever basis for commercial usage.
You give it away for free so don’t be surprised to get abused. Human nature working at its best and worst here.
We shouldn't let cynical greedy bastards set the terms for how the rest of society wishes to engage
There can be "cynical greedy bastards" in many places. If you optimize against them in one regard and place, will you also handle them elsewhere well? And calling for change can be abused by some of them to open new opportunities for exploitation, this time benefitting some different group of them.
You need to have an alternative, and it needs to be a credible and reliable one, to ensure that it does not end up being the case that one scam is replaced with another scam.
3 replies →
The exact moment you charge for something, you need payment processing, a bank, a legal entity to hold said processed funds, you have liability, you need some sort of marketing / sales process (even if it's just copy on a website), and the barrier for someone to use your product is suddenly extremely high, simply because it costs something.
Release it for free, no barrier to entry, no legal liability, the entire world can use it instantly. This is why free software spreads and catches on - precisely because it's free.
There is no way to form a business around FOSS without becoming a gatekeeping high-barrier entity. You can release for free then charge extra for consulting or special features, which many have done and continue to experiment with.
But the core reason why FOSS spreads and took over is precisely why it is difficult to fund. No one is going to pay for something when the alternative is free. And the moment you start to charge some free alternative comes along and your prior users spurn you as greedy
This is an upfront cost and is possibly a one-time cost per-agreement.
Practically nobody downloads and installs sudo directly from the project website; people install it with their distribution of choice. The agreement could be automated and included in the licensing process. ie: the license gives specific distributions access to the software (either via paid or other agreed-upon terms appropriate to the distribution) and perhaps individual licensing terms for non-commercial entities.
Of course, the bigger ask in this decade is in use for training LLMs. OSS shouldn't be laundered through an LLM (IMHO) for license avoidance. Maybe some projects are OK with that (eg: many BSD licensed works.) There are some that likely aren't.
The code can become "radioactive" as well when a software library goes paid. It starts phoning home with information about its environment to ensure compliance which is just kinda... icky to most devs. I certainly don't want that bloat in my dependencies.
1 reply →
> The exact moment you charge for something, you need payment processing, a bank, a legal entity to hold said processed funds, you have liability, you need some sort of marketing / sales process (even if it's just copy on a website),
That seems like an area that's ripe for innovation. What does it take to get setup on a platform like Patreon? Seems like something similar ought to be setup for open source/independent development, probably an idealistic nonprofit.
> and the barrier for someone to use your product is suddenly extremely high, simply because it costs something.
All the organizations who really ought to pay are already setup to do all that, and do it all the time.
> But the core reason why FOSS spreads and took over is precisely why it is difficult to fund. No one is going to pay for something when the alternative is free. And the moment you start to charge some free alternative comes along and your prior users spurn you as greedy
What we need is innovation. Maybe a license that has a trip-wire? If not enough money is voluntarily deposited into a tip jar over a certain period of time, the license requires a modest payment from all for-profit organizations of a particular size.
That's up-front, is for the most part free, and incentivizes some payment.
I think you have good arguments, but I wonder if there are alternatives that could work in at least some cases. Like, how Unreal engine's license works. Source-available to game developers, but in theory limited to paying customers, or something along those lines.
>"it screams volumes about the current state of technology."
about the current state of Big Corp vampires who are happy to bleed everyone dry to put more $$ in their own very fat pockets
Our economic system starves you to death if you don't
People aren't vampires because they're on top, they're on top because they're vampires.
Shit flows downstream
A change in economic system might be neither sufficient nor necessary, especially if the new economic system turns out to be even worse, or a scam.
One approach is to have expectations to not only the economic system, but also other systems, and the different people involved, no matter if they're on the top, on the bottom, or somewhere in the middle.
Exactly
Sounds like the system is working as intended...
Not trying to be glib here. This feels like the embrace, extend, extinguish pattern that we jokingly used to think was only Microsoft. It is now becoming more and more obviously the modus operandi of the entire enterprise software ecosystem.
I believe you are correct to be frustrated and ringing the alarm bell. This is a "death of the commons" moment for OSS.
> and new maintainers aren’t stepping up because they can’t afford rent, let alone to devote their full time to FOSS work free of charge like a lot of older project maintainers do.
What about the Rust rewrite (sudo-rs)? I think it shows people are interested in maintaining and/or modernizing tools taken for granted.
It has a more lax license AFAIK. Also, many Rust projects and libraries have been abandoned, or are in so-so shapes.
Edit:
To specify, new projects like sudo-rs may seem promising, but going by observation and experience with similar projects, there is no guarantee that sudo-rs and similar projects will be successful, good and continued to be maintained. The problems with old projects can end up applying to new projects as well. And projects in Rust are no exception, going by experience with existing, older Rust projects.
Aside, a pet peeve I have is that for instance Ruffle has not turned out as successful as I had hoped for, even after several years and many sponsors. The proprietary Flash runtimes written in C still outperform Ruffle greatly in some cases, causing problems for some users that want to use Ruffle instead of other runtimes.
> Also, many Rust projects and libraries have been abandoned, or are in so-so shapes.
This seems like a bit of a non-sequitur; the state of non-sudo-rs projects/libraries says nothing about the state of sudo-rs itself.
Not to mention that I'd imagine a similar statement would probably be true for projects and libraries written in any reasonably popular language.
1 reply →
How is this a counter argument for anything? A more permissive license is not inherently a bad thing. Many C and C++ projects are also abandon or in so-so condition, why you uniquely call out Rust makes little sense. Either sudo-rs fills the void or it doesn't, but it is a counter point to this idea that open source projects have no path of evolution. Just because that path doesn't look like how you want it to doesn't mean it doesn't exist.
> It has a more lax license AFAIK.
Sudo uses the OpenBSD license, while sudo-rs is dual licensed under MIT and Apache 2.0. Both licenses seem equally permissive to me.
By modernizing do you mean rewriting mature software in a meme language with less features than the original and introducing new bugs in the process?
The Rust smokescreen is mostly being used to slowly eradicate the GPL.
Like Lenin said, "Who stands to gain?"
"Meme language"? There are plenty of memes about C, and they aren't as flattering.
IMO rust rewrites are done quickly to gain attention and kudos. They are very rarely maintainted to the same quality of the originals.
Yes, I'm sure they also founded a whole foundation[0] to do that just for "attention and kudos".
[0]: https://trifectatech.org/
maintainers need to learn to say "no" to scope creep and entitled users.
sudo should have been a near complete tool after it was written.
So no #includedir, no LDAP integration, no log_input/output, no PAM integration ...?
I've always favored the view that digital goods are only scarce until they are released. if we had a market for patch releases once they hit some goal. Uses could tip to reach the goal. After the goal is reached the patch is released and to all. Still have free loaders but one might live on the work
So...crowdfunding via a platform like Kickstarter?
Honestly, it seems like the idealism of open source shouldn't have survived its contact with capitalism, but I suppose the contact wasn't painful enough the the exploitation continued for a long time.
Maybe we need a license that's even more onerous to corporations than the AGPL, like something with a revenue share clause.
Or maybe the problem is the naivete of software engineers. In aggregate, there was so much embrace of libertarianism that no groundwork was laid to protect ourselves from things like AI and offshoring.
Been pitching that with my FOSS colleagues and peers for years, now. A license for individual and educational use, but pay-to-play for anyone tangentially making revenue from its use. Then the conversation boils down to the business engineering of how much should something cost, with some arguing for flat yearly rates, and others arguing for cost-per-unit, while others still fret about "disrupting" the status quo immediately after acknowledging its untenability.
It's...frustrating, but those who do the work are the most qualified to explain what they need. For the rest of us, it's encouraging them to seek reasonable compensation for their work from those who exploit it for profit, and that doing so doesn't necessarily go against the spirit of open source.
can't wait for popularity-contest(1) to be mandatory and required a linked credit card.
> the idealism of open source shouldn't have survived its contact with capitalism
The US economy of the 1980s, 1990s, and 2000s made it possible.
I don't mean to come across as far too cynical, but in what world has a software license ever stopped the greedy and powerful from pillaging the IP of other people smaller and weaker than them?
In my opinion, libertarianism in software is a hollow dream that leads people to make foolish decisions that can't be protected. This makes it easy for corporations to exploit and quash any barely audible opposition.
Almost as if by plan, the libertarian mindset has eroded and weakened open source protections, defanging and declawing it every step of the way.