Sudo is a Bloated Insecure Mess (install doas)

In this video I go over a recent sudo vulnerability, explain why you should use doas, and show you how to install doas.

explanation of buffer overflow in sudo

₿💰💵💲Help Support the Channel by Donating Crypto💲💵💰₿

Monero
45F2bNHVcRzXVBsvZ5giyvKGAgm6LFhMsjUUVPTEtdgJJ5SNyxzSNUmFSBR5qCCWLpjiUjYMkmZoX9b3cChNjvxR7kvh436

Bitcoin
3MMKHXPQrGHEsmdHaAGD59FWhKFGeUsAxV

Ethereum
0xeA4DA3F9BAb091Eb86921CA6E41712438f4E5079

Litecoin
MBfrxLJMuw26hbVi2MjCVDFkkExz8rYvUF

Dash
Xh9PXPEy5RoLJgFDGYCDjrbXdjshMaYerz

Zcash
t1aWtU5SBpxuUWBSwDKy4gTkT2T1ZwtFvrr

Chainlink
0x0f7f21D267d2C9dbae17fd8c20012eFEA3678F14

Bitcoin Cash
qz2st00dtu9e79zrq5wshsgaxsjw299n7c69th8ryp

Etherum Classic
0xeA641e59913960f578ad39A6B4d02051A5556BfC

USD Coin
0x0B045f743A693b225630862a3464B52fefE79FdB

and be sure to click that notification bell so you know when new videos are released.

[Calajese]

Reject sudo, embrace running everything as root, just as Terry would have wanted

[AROAH]

I'm not sure I feel comfortable trusting the security of my machine to some random dude who hopefully ported a BSD app to Linux properly.

[TheWilldrick]

Normally I agree with some of your arguments even if I don't agree with the general point of the video, but can't on this one: you're recommending that because there's a CVE on sudo, you're replacing a program with over 10k commits, combed through by thousands of eyes, for another one that's only ~100 commits? even if your pc was on the sidewalk, the chance of someone executing that exploit is minimal at best.

[posonseede]

The proper term would be unsecure, insecure means it feels bad about itself, but to be honest, sudo probably would feel bad about itself.

[mawi]

its funny because I'm gonna use sudo to uninstall sudo

[karai]

Still 100x better than windows 10 administrator permissions

[nordern]

If you remove the included dependencies it brings the actual amount of C LOC down to 15k. Still nothing to sneeze at, but it's not 400k. (That 400k also includes translations into many languages, e.g.)

Also, you didn't remove the "insecure bloated mess", you just added another program that does the same but isn't in package management. After that, I'd say your system is less secure than it was before.

Personally I think 1 vulnerability a year for what is a pretty huge attack vector is a good track record.

Nothing against doas, I know nothing about it and it might really be the better alternative. But this is not how to solve that problem.

[yn]

Next video: Gentoo is a bloated mess. use LFS instead

[supremelizard]

Tfw you jump ship just to come running back when it turns out doas was more flawed and Sudo gets a patch

[censoredterminalautism]

I do this:
export AUTH="doas"
alias sudo=$AUTH
And I use $AUTH in every script of mine so it's easier to replace. In a system with no doas, I just set AUTH to sudo and everything works.

[jefferson-silva]

This video misleads people into believing that sudo is bad and a port of doas is secure. EVERY software has bugs, well maintained software gets its bugs fixed fast. Doing what this video suggests causes more harm than good.

[XZenon]

>Implying I use soodo
>Implying I don't just run everything as root

>Implying I'm not a Windows user

[bits_for_bytes]

He’s also telling people that 10x fewer lines of code somehow indicates the “application” is more secure. There are several attack vectors and it’s rarely based on the number of lines of code, exploiting the dependencies, modules, heap, etc are all unrelated to the number of lines in a given repo. The sudo vulnerability was actually in the ‘sudoers’ command. But again, geek squad.

[lucaherrmann]

This is the first video of this channel I wached which I judge really poor. Judging by the popularity of slicer69's forc of doas, this seems more like "security by obscurity" to me.

[Joe-uckf]

Why would you use doas, if you then keep sudo around and just keep updating it? There is no point. Your system will now be vulnerable to bugs from both.

[SemNikit]

"Bloated Insecure Mess" I thought you were talking to me

[Jamiered]

8:43 Your "au" command alias is wrong. You wrote "upgarde" instead of "upgrade"

I think it's extremely important to point out that you are responsible for updating it if you are in a situation where you have to build the program yourself. If your goal is to avoid unpatched exploits, them maybe don't install from source unless you have a method of updating it alongside everything else 🙂

[yepstill]

"permit persist keepenv user as root" is a better line for the doas.conf file. What it does is fairly obvious. You could also have a group of people allowed to run as root like "permit persist keepenv :wheel as root".

[lyingcat]

How would aliasing sudo to doas remove the vulnerability? The heap overflow exploit is done by someone logged in as a user and running some script that breaks sudo. All the hacker would need to do is remove your alias and the hack would work just fine. Or am I missing something?