Hacker News new | ask | show | jobs
by spyc 410 days ago
Both implementations of doas for Linux have (the same) unfixed security issue:

- https://github.com/Duncaen/OpenDoas/issues/106

- https://github.com/slicer69/doas/issues/110

I have a hard time recommending doas over sudo on Linux when the issue has been fixed in sudo but not in doas.
2 comments
lapsis_beeftech 410 days ago
Those should be closed WONTFIX. Neither doas nor sudo can protect you from the consequences of running untrusted code and must not attempt to do so because it adds needless complexity to safety-critical software.
link
oynqr 410 days ago
Which distros still have TIOCSTI enabled in their kernel? I just checked for Arch and it's disabled.
link