It's hard to imagine something as fundamental to computing as the sudo command becoming abandonware, yet here we are: its solitary maintainer is asking for help to keep the project alive.
Sudo maintainer, handling utility for more than 30 years, is looking for support
https://www.theregister.com/2026/02/03/sudo_maintainer_asks_for_help/
85 Comments
breadsmasher@lemmy.world · 137 pts · 194d
imagine if he said fuck it and turned sudo into a crypto mining malware
muhyb@programming.dev · 76 pts · 194d
$udoeleijeep@piefed.social · 34 pts · 194d
sudo rm $(which sudo)nao@sh.itjust.works · 1 pts · 193d
does it work?
Scrollone@feddit.it · 29 pts · 194d
To be honest, it wouldn't take much for distro maintainers to detect that and stop it
JustEnoughDucks@feddit.nl · 3 pts · 194d
But who is seriously looking at the sudo code at every update. I would bet a lot of money that the vast majority simply trust him and gloss over it maximum.
The chain of trust has to exist otherwise distrobox maintainers would spend 24 hours a day reviewing code changes and only update once every 6 months.
cows_are_underrated@feddit.org · 10 pts · 194d
You may want to look into how the xz backdoor has been discovered. That backdoor was very well hidden. Implementing a crypto mining malware would be blatantly obvious and yes, people do in fact look at such code
JustEnoughDucks@feddit.nl · 8 pts · 193d
Yes, but people are forgetting how it was discovered.
It was discovered because there was a visible performance impact by running benchmark tests on other, time-critical software.
Do you know how it was not discovered? By maintainers looking through changes of the software and looking through the code, exactly the way that the commenter and you and others are saying things would be caught.
If the attacker hadn't been so eager and only set it to start working after a time delay a year later or multiple updates later? It would have infected almost every server in the world, even if it got noticed immediately, it would have been a giant problem that would have reaped the benefits for the malicious party before it could be regressed and changed.
bradboimler@lemmy.world · 2 pts · 193d
That was scary. I had the bad version on my computer for a bit.
Triumph@fedia.io · 12 pts · 194d
Lulz would be had.
roguetrick@lemmy.world · 78 pts · 194d
That Ubuntu unity article where the maintainer was a 10 year old when he started the project but now has shit to do is pretty funny.
hddsx@lemmy.ca · 18 pts · 194d
Please link article thanks
portnull@lemmy.dbzer0.com · 47 pts · 194d
https://www.theregister.com/2025/10/29/ubuntu_unity_child_maintainer/
From the article
jaybone@lemmy.zip · 18 pts · 194d
This has been depressing for a while now. I’m a big Unity fan and I’m concerned about the future.
Wasn’t any of this documented anywhere? And who are these other team members they interviewed? How is it they don’t know how to write code? Are they just manual testers or something?
I’d try to help myself if there was some decent documentation on where to begin. But if it’s all in this kids head, we might be kinda fucked.
Gonzako@lemmy.world · 6 pts · 194d
To me I tried to add people to my unity project and they were unable to actually boot it up and that angered me enough to go godot
0xtero@beehaw.org · 72 pts · 194d
It’s been 12 years since Heartbleed and we’ve had numerous ”lone maintainer” issues since then. The situation shouldn’t come as a surprise or be especially ”hard to believe”.
This is the state of free software, especially when it matures.
Unless the creators manage to roll some kind of ”commercial” version, it’s not very sustainable in the long run. Turns out many eyes don’t really equal many PRs
mech@feddit.org · 47 pts · 194d
The state of free software also includes the fact that even if the
sudomaintainer doesn't find support, no one steps up andsudobecomes unmaintained,sudo-rs,doas,opendoas,run0andpleasealready exist as alternatives.0xtero@beehaw.org · 13 pts · 194d
and let's not forget - systemd, which has RedHat money backing it up.
srestegosaurio@lemmy.dbzer0.com · 8 pts · 194d
Hope you don't see who pays for kernel development…
0xtero@beehaw.org · 7 pts · 194d
Why? I'm not against developers getting paid to do FOSS work. It's far more reasonable than the whole "bazaar of free people"-model that lives entirely on ideology.
srestegosaurio@lemmy.dbzer0.com · 1 pts · 187d
Oh, mb then. I read that comment as complaining about corpos involvement in FOSS.
And yeah, people should be compensated, specially if they are the backbone making billions of profit to companies.
sbeak@sopuli.xyz · 10 pts · 194d
hang on, there's one called please? Are there any downsides with using please instead of sudo?
Brickhead92@lemmy.world · 7 pts · 194d
It promotes familiarity with the machine which is best to avoid. Except of course if the machine uprising happens, then it would be in you favour to have been using it for years.
mech@feddit.org · 6 pts · 194d
From what I can see, it's a sudo clone with added optional regex functionality, written in Rust.
So you can use it just like sudo, or you can limit superuser rights to directory names that contain a 💩 emoji, but only on Mondays.
sbeak@sopuli.xyz · 7 pts · 194d
Interesting. I just found out that you can just use alias to use please instead of sudo which is cool!
FizzyOrange@programming.dev · 25 pts · 194d
In my experience a lot of these old projects really go out of their way to dissuade contributions anyway. Lots of naysaying "it's always been like that", ancient infrastructure - e.g. insisting on
git send-emailpatches, etc.Usually the only way it gets resolved is when someone writes a more modern competitor and it starts gaining traction. Suddenly all those improvements that people tried to do and were told were impossible and stupid aren't such a bad idea after all.
I don't think that's the case with Unity but it probably is with things like GCC, sudo, sysvinit, X11, etc.
srestegosaurio@lemmy.dbzer0.com · 4 pts · 194d
I think that's at least a big part of it. There's so much unnecessary friction in legacy projects that, while understandable to a degree, sucks.
Slashme@lemmy.world · 40 pts · 194d
Following publication, Miller has been in touch to tell us that he has no plans to abandon sudo, or even hand it off, but he suspects change is still on the horizon for the essential tool.
"While I don't expect to maintain sudo for an additional 30 years, I also don't currently have someone to pass the torch to," Miller told us. He noted that the xz utils backdoor has made him hesitant to hand it off to someone he doesn't know, and that he "feels responsible for sudo" after having spent so long as its lead dev and maintainer.
Unfortunately, a lack of financial backing means sudo work has ground to a glacial pace.
"Since I have limited time I've mostly been focused on fixing bugs and cleaning up the code base rather than adding new features," Miller said. "As a result the amount of time I spend is heavily influenced by the bug reports I receive."
Funding or not, Miller expects sudo-rs to become the next generation of the tool in coming years.
"Ubuntu is already shipping sudo-rs as the default sudo command in their latest versions," Miller told us. "I've been in contact with the people working on sudo-rs since the project started and I trust them to do right by the sudo user base."
Regardless of what happens, Miller agrees the sudo situation he's in is yet another example of how open-source maintainers is putting the entire computing community in a bind.
"Without some form of assistance it is untenable," Miller said. "Maintainer burn-out is real."
randomname@scribe.disroot.org · 36 pts · 194d
It reminds me somehow on the famous xkcd webcomic: https://xkcd.com/2347
Edit for an addition: Maybe it's also a reminder that we should frequently donate when we use FOSS.
howrar@lemmy.ca · 6 pts · 194d
Of those who regularly donate (or think of donating) to FOSS projects, how many of them would've even had
sudocross their mind as a potential recipient for those donations?egrets@lemmy.world · 7 pts · 194d
wonderingwanderer@sopuli.xyz · 2 pts · 194d
That's what I thought of too. I was like "Oh, is he that guy in Nebraska I've been hearing about?"
OpenStars@piefed.social · -159 pts · 194d
Also relevant:
tanisnikana@lemmy.world · 88 pts · 194d
Really? You want to post slop on Lemmy? That’s what went through your brain? That’s what you considered a good enough idea that you’d execute it?
in_my_honest_opinion@piefed.social · 102 pts · 194d
Not just AI slop but a right wing dog whistle as AI slop.
caseyweederman@lemmy.ca · 49 pts · 194d
And also... Completely irrelevant to the discussion. What's the connection?
AugustWest@lemmy.world · 36 pts · 194d
It’s not a dog whistle when its meaning is plainly and purposefully obvious.
gustofwind@lemmy.world · 34 pts · 194d
Pretty sure the usage of an ai generated meme makes you one of the weak
fleem@piefed.zeromedia.vip · 21 pts · 194d
The third frame here needs to be the same businessman in increasingly more fancy suits or gold or other gaudy-ass shit.
bitcrafter@programming.dev · 14 pts · 194d
Yeah, the transition from the third frame to the fourth frame just doesn't make sense as currently depicted; why would people playing video games suddenly start to revolt?
However, if the third frame were to depict rich men getting richer as you suggest, then the revolt in the fourth frame would make more sense.
mushroommunk@lemmy.today · 8 pts · 194d
You're putting way too much thought into analyzing AI slop
fleem@piefed.zeromedia.vip · 3 pts · 194d
damnit it got mee tooooooooooooo
i not looking at anything but darkwing duck from now on
abbadon420@sh.itjust.works · 4 pts · 194d
I can get with that. More darkwing duck, less beans
MousePotatoDoesStuff@lemmy.world · 10 pts · 194d
gtfo with that alt-reich slop
biotin7@sopuli.xyz · 10 pts · 194d
Nope none of this crap
Kornblumenratte@feddit.org · 1 pts · 193d
This meme is debunked.
MousePotatoDoesStuff@lemmy.world · 0 pts · 194d
in_my_honest_opinion@piefed.social · 14 pts · 194d
https://git.sudo.ws/sudo
According to the above Robert Manner and AZero13 also have one contribution each. There's also the https://opencollective.com/sudo-project which has a board.
If Todd wants to pass off the project he has all the resources to do this.
please_send_me_nudes_girl@lemmy.sdf.org · 12 pts · 194d
Excuse me, but how isn't this a core feature, or do I think too complicated?
Petter1@discuss.tchncs.de · 4 pts · 194d
Having to install sudo on Arch manually is one thing that made me use endeavourOS (besides having yay and DE preinstalled)
Kornblumenratte@feddit.org · 3 pts · 193d
Because there are lots of alternatives.
wonderingwanderer@sopuli.xyz · 9 pts · 194d
Isn't the whole point of FOSS software that anyone can fork it?
SailorMoss@sh.itjust.works · 23 pts · 193d
The article points out that sudo has already been forked by Ubuntu maintainer canonical into sudo-rs which reimplements sudo in rust with better memory protections. It also states that the maintainer of sudo expects sudo-rs to be the future of sudo.
mint_tamas@lemmy.world · 7 pts · 193d
sudo-rs is not a fork.
aloso@lemmy.blahaj.zone · 5 pts · 192d
sudo-rs is a complete re-implementation, not a fork. Also, sudo-rs was not created by Canonical. It was created by Tweede Golf and Ferrous System with funding from Prossimo. Since 2024 it is being maintained by the Trifecta Tech Foundation. Ubuntu merely packages it.
wonderingwanderer@sopuli.xyz · 3 pts · 193d
That's good, at least everything won't collapse catastrophically at this like a single point of failure without any redundancies. It would be better if someone other than canonical would do it, but at least it's not like no one is...
3abas@lemmy.world · 14 pts · 194d
You can fork it. Are you gonna maintain your fork? Is your fork going to be adopted by the majority of distributions?
wonderingwanderer@sopuli.xyz · -3 pts · 193d
Mine won't certainly, but by the magic of FOSS I'm sure someone will do it.
Oh look, someone already has...
3abas@lemmy.world · 3 pts · 193d
What do you mean someone already has? As of this comment it has 268 forks on GitHub.
Creating a fork takes one click, and doesn't mean anyone will adopt it. Maintaining a codebase is not as simple as "magic of FOSS", someone has to dedicate their time to it.
wonderingwanderer@sopuli.xyz · 0 pts · 192d
Okay, that's a lot of someones. That doesn't contradict "someone has forked it." You're being unnecessarily assy.
As per other comments, sudo-rs exists and is being maintained. And that's the magic of FOSS.
Although it's apparently not a fork. But it's still a workable substitute, and that's what matters. My entire point was that the entire Linux ecosystem isn't going to be fucked just because one guy dies or decides to stop maintaining a widely used codebase.
some_guy@lemmy.sdf.org · 9 pts · 194d
Don't tap Jia Tan…
kibiz0r@midwest.social · 7 pts · 194d
Just waiting for another xz utils situation
vext01@lemmy.sdf.org · 7 pts · 194d
Join us. Use doas.
srestegosaurio@lemmy.dbzer0.com · 4 pts · 194d
Still a setuid bin. 🥺
Samiaouuu@jlai.lu · 3 pts · 194d
I might be wrong but I think run0 (for systemd users) solves that
thingsiplay@lemmy.ml · 3 pts · 194d
No. I just use the default on my system. Hopefully sudo-rs will become the default.
aichan@piefed.blahaj.zone · 6 pts · 194d
The fact that the FOSS model is still considered the best thing ever is so sad to me. The "free" part is clearly not working. Or rather it is working as is now intended: free labour for the private sector to exploit.
The Telekommunist Manifesto for the longer version of this 🙃
jonathan7luke@lemmy.zip · 17 pts · 194d
I'm not so sure the "open source" part is working either when you think about how AI tools were trained.
It's really sad, because the accessibility of developing software and collaborative nature of the open source community is a big part of what drew me to software engineering as a career, and it's always been one of the first things I mention about why I love it. But, of course, these fucking evil companies found a way to take every individual part of something good and twist it into something awful.
d0ntpan1c@lemmy.blahaj.zone · 5 pts · 194d
FOSS will always be incompatible with capitalism. There is no incentive for the capitalist class to pay for the open source they consume.
thingsiplay@lemmy.ml · 2 pts · 194d
Wrong. In example Valve is putting money and work into FOSS. AND they make money of it and rely on it. Even Microsoft does contribute to Open Source, believe it or not, even is one of the top sponsors for Linux.
d0ntpan1c@lemmy.blahaj.zone · 4 pts · 194d
The pittance that most of these companies do contribute is in no way a fair share of the profits they reap from using FOSS.
Valve is an exception to the rule.
You're arguing that the factory owner giving a few bucks to someone who produced a tool that improved productivity of the factory is somehow a just compensation.
tetrislife@leminal.space · 2 pts · 194d
There has been the "4opens" criteria, that has been more on point than free/libre/open source.
In hindsight, defeating corporate and AI piggery might have needed single-maintainer closed source with open protocols. Software components? Maybe it would have led to the compound document model instead of the app model, architecturally enforcing openness.
Bogus007@lemmy.zip · 10 pts · 194d
Funny, you are using with lemmy something for free, which is to some extent in the spirit of FOSS.
aichan@piefed.blahaj.zone · 6 pts · 194d
"Haha funny you use a phone and buy things yet you are anticapitalist haha" ahh argument
The copyfarleft licenses are not incompatible with the spirit of FOSS, they work exactly the same for the people, the only difference is that companies can either fuck off or pay
biotin7@sopuli.xyz · 2 pts · 194d
Yes the CopyLeft licences is the epitome of FOSS spirit
thingsiplay@lemmy.ml · 7 pts · 194d
How is the free part not working? FOSS is the cure of the industry. Or do you think Adobe and Microsoft is working that great? Imagine if we didn't have FOSS...
aichan@piefed.blahaj.zone · 1 pts · 194d
I don't deny its great contributions to the public and free culture, but I think it has become insufficient. The industry abuses it as much as it can, so I believe the only way to defend ourself is to migrate to a copyfarleft licensing model. With it, we can keep the same openness and freedom for the commons, but force the private sector to choose: either pay for our work, or fuck off.
UnityDevice@startrek.website · 4 pts · 194d
I remember seeing a thread about redis on r/linux where lots and lots of people were basically defending Amazon as if from an anarcho-capitalist position. This confused me as I always saw foss (and foss users) as leaning socialist and anti-corporate.
I spoke to someone about that and they linked me this article (and the article linked in the first sentence) which really opened my eyes.
The TL;Dr is basically:
aichan@piefed.blahaj.zone · 2 pts · 193d
Wow, super based article! Thanks for it, I will also look at other articles from the author :D
Defectus@lemmy.world · 6 pts · 194d
One does not simply maintain sudo (lotrmeme.jpg)
HuntressHimbo@lemmy.zip · 1 pts · 194d
Not gonna lie, kinda blame systemd for this. The more utilities they swallow the more funding gets concentrated to the RedHat folks, and the less freedom you have to choose different software. They've certainly made some improvements in specific utilities, but there is an invisible cost of centralization
nykula@piefed.social · 13 pts · 194d
It doesn't seem any money that the sudo developer had received was redirected to systemd, even though systemd has its own sudo called run0, with interesting features such as limiting the amount of memory or CPU a command it runs can use. His employer supported sudo as his side project while he was employed to work on something else. The funding from big tech is instead going to the Rust rewrite, sudo-rs and other projects of its community.
HuntressHimbo@lemmy.zip · 6 pts · 194d
I didn't mean they were directly responsible for him losing the sponsorship, just that it has made it harder to find new ones.
If my memory serves this isn't the first time systemd has moved into a space and the existing infrastructure has withered away. Vaguely thinking udev or logind, but its not so much a critique as a worry. I've played with OpenRc, RunIt, and Upstart over the years, and I want them to remain viable alternatives
srestegosaurio@lemmy.dbzer0.com · 2 pts · 194d
About
run0, isn't it also not a setuid binary?Iirc sudo-rs was still setuid…
WorldsDumbestMan@lemmy.today · -5 pts · 194d
Or get this: Linux is perfect as it is, so are current PC's.
Ship it pre-installed on shovelware PC's, you don't need better.
Eat_Your_Paisley@lemmy.world · -5 pts · 194d
With the push to immutable distros and flatpak I wonder how long we will need sudo.