Saagar Jha
(replying to Saagar Jha)
11 replies
Greg Gardner
(replying to Saagar Jha)
@saagar At least sudo isn't a critical piece of the security of almost every Unix-based system on the planet. Oh wait, it is.
pancake :radare2:
(replying to icraze)
@icraze @saagar yeah 23 prs merged in one week. I hope @millert reviewed them properly before merging, but to me the changes look safe, actually there are a couple of tricky ones that are fixing real memory safety bugs.
pancake :radare2:
(replying to Saagar Jha)
@saagar llms can spot a large variety of bugs that static analyzers don’t catch, yeah sometimes also hallucinate some. But combined with asan, clang analyzer and valgrind they are a really powerful solution for code review and bug catching. So I wouldn’t say sudo’s code is bad, but software engineering is so hard that it’s easy to find ways to improve the quality over time. C coding practices evolved and that’s a techdebt we are all used to face every day
Saagar Jha
(replying to pancake :radare2:)
pancake :radare2:
(replying to Saagar Jha)
@saagar yeah i doubt that too, im also not happy with blind merging or review less prs
Thomas Touhey
(replying to Saagar Jha)
@saagar The maintainer does seem to have commented/done review on some, but some of the PRs either fix security issues, or introduce some, finding out which would require some more experience with the codebase. Anyway, very scary stuff.
Byte
(replying to Saagar Jha)
@saagar sudo as in, *the* sudo millions of people and computers use every day??
Techokami
(replying to Saagar Jha)
@saagar Two of them did have comments, though: https://github.com/sudo-project/sudo/pull/498 this one points out an issue that was then resolved by him. https://github.com/sudo-project/sudo/pull/490 THIS one, an actual conversation (albeit a short one) on potentially deprecating and removing SecureID support
