Hacker News new | ask | show | jobs
by Veserv 1094 days ago
How many hundreds of thousands of lines of code do you think sudo is?

How many hundreds of thousands of lines of churn do you think happen per year in sudo?

If your answer is: What do you mean hundreds of thousands? That is the right question, but the wrong answer. The answers being around ~500,000 and on average ~200,000, including this year, respectively.

In contrast, OpenBSD doas, which exists to serve the same primary purpose of executing commands as a super user, clocks in somewhere around a few hundred to maybe 1 or 2 thousand lines total just eyeballing it.
3 comments
0cf8612b2e1e 1094 days ago
I must have a fundamental misunderstanding of exactly what sudo does. That is so much code.
link
j16sdiz 1094 days ago
sudo integrates with PAM, parse command, sends email, record session logs, do IPC.....
link
littlestymaar 1094 days ago
Turns out even in the 80s the so-called “UNIX philosophy” wasn't so ubiquitous…
link
lelanthran 1094 days ago
> If your answer is: What do you mean hundreds of thousands? That is the right question, but the wrong answer. The answers being around ~500,000 and on average ~200,000, including this year, respectively.

> In contrast, OpenBSD doas, which exists to serve the same primary purpose of executing commands as a super user, clocks in somewhere around a few hundred to maybe 1 or 2 thousand lines total just eyeballing it.

It seems to me, with those numbers, that the big problem with sudo is not the language it is written in but the extremely large attack surface.

I would guess that for 1 out of every million invocations of sudo, all that extra functionality is needed. For the rest of the time, its merely being used to execute a single command as root.

We could make systems more secure by simply removing sudo from those systems that don't use that extra functionality, and replace it with doas.

link
peoplefromibiza 1094 days ago
> In contrast, OpenBSD doas

That's my point, sudo survived 43 years, had to support a myriad of different platforms and configurations, doas was started in 2015.

incidentally OpenDoas is written in C too.

We'll see in 35 years how doas is doing.

link