Comment by 9dev

1 month ago

> So is sudo... And that's not "too risky" for the entire industry.

Sure it is, and that's why I'm looking forward to systemd's Run0 -- but for now, there's just no way around the sudo package. That's different for Mise, though, because there are a lot of ways to work productively without it. I'm not fond of consciously adding supply chain vulnerabilities to our stack when I don't have real pain to do so.

1 comment

9dev

doodlesdev 1 month ago

   > Sure it is, and that's why I'm looking forward to systemd's Run0 -- but for now, there's just no way around the sudo package.

Regarding Run0, I'd prefer to not rely so much on Polkit authentication after crazy vulnerabilities such as PwnKit (a pkexec vuln, but a good reminder that moving the security boundary won't magically solve issues).

   > I'm not fond of consciously adding supply chain vulnerabilities to our stack when I don't have real pain to do so.

I SUPER agree with you on that, btw. It's just likely that mise solves a problem which is much bigger for me than it is for you. Honestly, I'd prefer if I could manage everything with my distro packages, but, for a multitude of reasons, they're rarely enough for development tooling with multiple versions and environments.