alt.hn

2/2/2026 at 5:25:26 PM

Todd C. Miller – Sudo maintainer for over 30 years

 https://www.millert.dev/

by wodniok

2/2/2026 at 9:05:03 PM

Reading the release history[1]. I'm kind of shocked that sudo gets active development and monthly releases. I would have thought that something this old and venerated would have been "done" long ago.

1: https://www.sudo.ws/releases/devel/

by ryandrake

2/2/2026 at 9:13:06 PM

"Done" software is a myth they tell to young developers so that they can sleep easy at night.

by hobofan

2/3/2026 at 10:03:54 AM

Absolutely false. I have built tons of tools which are feature complete and continue to work to this day without intervention. Heck, I even have tools I no longer use that people asked me to keep available because they do, and they’ve been chugging along for over a decade, no bugs or maintenance necessary.

Just today I saw a report of Adobe discontinuing a tool in use by professionals because it is done and they don’t know what else to add.

https://mastodon.social/@grishka/116005782128372247

“Software is never done” is a myth they tell to keep extracting money from you.

A lot of the time, failing to to finish software indicates a badly defined scope.

by latexr

2/3/2026 at 5:37:47 PM

You might have written software that is "done" if you compile it with a single compiler version and don't use any OS hooks/APIs and don't care if future changes breaks your software. I.e. it's done if you think that people will stop needing to use it at some point in the future.

A tool like sudo can never be done because it integrates with the constantly updating OS and will always need maintenance.

by parsimo2010

2/3/2026 at 4:40:00 PM

Not a great example as that "done" tool (whose currrent iteration barely functions) will be made unavailable after a few years.

That tool is still very much in active use in my industry, and we'll need to figure out what to do with some 10000 fla files that we need to occasionally edit and republish (hint: the solution probably involves a certain Swedish software repository).

by nananana9

2/3/2026 at 10:35:25 AM

> Just today I saw a report of Adobe discontinuing a tool in use by professionals because it is done and they don’t know what else to add.

Yeah, I'm sure the reason stated by the customer support is the real one, and not the lack of profitability from that tool among a shift of focus towards AI[0] as reported everywhere.

https://techcrunch.com/2026/02/02/adobe-animate-is-shutting-...

> for over a decade, no bugs or maintenance necessary

I'll believe it when I see it. Keeping something running for a long time is a lot easier task than building something that can be run in an ever changing world.

Given that it's that old I'd wager that it isn't runnable on/compileable for ARM64 without some kind of maintenance. And if it's written in an interpretable language there is a good chance that the underling interpreter/runtime are EOL by now.

> A lot of the time, failing to to finish software indicates a badly defined scope.

And a lot of the time finished software becomes unused because it sticks to scopes that don't match up with reality/user needs anymore.

by hobofan

2/3/2026 at 3:42:58 PM

> I'm sure the reason stated by the customer support is the real one

Oh, but it's so much more beautiful than that! You're really underselling it! It's not "the reason stated by the customer support", it's:

The reason snarkily paraphrased by a Mastodon post Which quotes a Twitter post Which quotes a Bluesky post Which tells a story about a conversation with an Adobe customer service rep.

Surely that tongue-in-cheek Mastodon post increases the information that we have about this incident by exactly Zero.

by stearns

2/3/2026 at 12:27:53 PM

Yeah, I have a relatively simple script with webUI for organising photos and videos I take on my NAS.

Over the years I’ve had to upgrade the ffmpeg dependency, which resulted in breaking changes a couple times and maintenance.

I’ve also had to spend nearly a whole day fixing the webUI when iOS’s wonderful liquid glass came out.

by dannyw

2/3/2026 at 12:31:22 PM

How did liquid glass break your Web UI?

by hobofan

2/3/2026 at 12:40:30 PM

Liquid Glass changed dimensions and viewport measurements for fixed position elements, amongst a whole host of positioning related bugs:

https://stackoverflow.com/questions/79753701/ios-26-safari-w...

Many of the bugs were fixed in 26.1, but still, I had to fix it to use it.

I was surprised that not much of the entire web was broken, but a cursory search of commits showed that the WebKit/Apple team took the approach of coding in site specific hacks for popular sites (eg instagram, google search!) for iOS 26.

by dannyw

2/3/2026 at 3:00:19 PM

Maybe I’m not looking in the right places, but I rarely see fixed position elements in modern web layouts— I imagine that’s why you didn’t see more disruption.

by DrewADesign

2/3/2026 at 3:37:45 PM

They may not be used in layouts, but they can be present in cases like keyboard open (if you wanted to attach some controls above the software keyboard for example); or just ever growing compatibility hacks.

by dannyw

2/3/2026 at 12:53:53 PM

> not the lack of profitability

What “lack of profitability”? They just reported a record quarter. Adobe shoves full Creative Cloud subscriptions down everyone’s throats; buying one tool, especially when it’s not one of the flagships, is uncommon. What exactly are they losing by just letting Animate be?

> And if it's written in an interpretable language

I have never ever ever had to change shell, Ruby, or JavaScript code because “the underling interpreter/runtime are EOL”. Never. That code keeps happily running, doing its work, with whatever version of the interpreter I have available in whatever box.

> And a lot of the time finished software becomes unused because it sticks to scopes that don't match up with reality/user needs anymore.

So what? That’s perfectly fine. Do you drink milk out of a baby bottle? Do you ride a bike with training wheels? It’s perfectly fine to build a tool for a purpose and a time and place and let it exist there for the people who care for it. That’s also true of video games (which, lest we forget, are software). In a world where people are constantly complaining about software updates moving shit around, removing features, and adding crap they don’t want, plenty of people appreciate that the things they like continue to work as they always have.

by latexr

2/3/2026 at 8:33:13 PM

> What exactly are they losing by just letting Animate be?

Maintenance cost (which you claim doesn't exist) of the engineers that they are planning to staff on other project they are assuming will be more profitable. Of course that's just a bet and not a sure thing.

> I have never ever ever had to change shell, Ruby, or JavaScript code because “the underling interpreter/runtime are EOL”.

I think we are living in different realities. Almost every (open source) project that I encounter that's 10+ years old isn't runnable without changes.

> Do you drink milk out of a baby bottle? Do you ride a bike with training wheels?

Do you still drive a Ford Model T?

by hobofan

2/3/2026 at 12:41:00 PM

> Yeah, I'm sure the reason stated by the customer support is the real one, and not the lack of profitability from that tool among a shift of focus towards AI[0] as reported everywhere.

Yeah, although "finished" software is antithetical to this always have new features to push onto your customers subscription model, so it's not entirely unrelated.

Having said that I still find it strange. I can imagine it might not be able to ride on the AI bubble, and perhaps animators are especially vocal about not wanting AI in their tools. But even so, why would that make Adobe Animate unprofitable? They do have a subscription model, and customers, so people are paying for this product.

Compared to other digital art, the data for vector animation takes relatively little space to store. It also requires much less resources to render than other forms of video, and rasterized video output should compress really well compared to alternatives, especially with modern codecs that are not only optimized for regular film. So surely it shouldn't be that expensive to maintain for them compared to all their other projects.

by vanderZwan

2/3/2026 at 7:58:53 PM

> But even so, why would that make Adobe Animate unprofitable?

Sorry, I wasn't precise with my wording. What I meant to say was "less profitable than the perceived AI opportunities they could do with the same engineers".

by hobofan

2/3/2026 at 10:16:01 AM

That tool, BTW, is essentially the authoring side of Flash rebranded.

by rcxdude

2/3/2026 at 5:18:46 PM

It's a bit ironic that digital goods, which are arguably the only products which once compiled can be stored, used, and copied perfectly bit-for-bit, are also the only industry that seems to have this problem with being unwilling to call a product "done".

The reasons for software churn are economic, cultural, and psychological, not technological.

by Intralexical

2/3/2026 at 8:03:55 PM

> unwilling to call a product "done"

Unlike modern physical products, software often has a contiguous lineage, with less individual hard cuts between releases, that e.g. necessitate setting up a new production line for each iteration.

Of course you can call individual releases "done" but then you also have to accept that the same realities apply to it that it's utility will decay over time same as e.g. household appliances do, where you also wouldn't use one that's 40 years old.

Calling a software project as a whole "done" (and claiming that it doesn't have bugs and doesn't need maintenance) would be akin to Apple saying the iPhone (the whole product line/smartphone niche) is "done".

by hobofan

2/3/2026 at 10:24:40 PM

> Of course you can call individual releases "done" but then you also have to accept that the same realities apply to it that it's utility will decay over time same as e.g. household appliances do, where you also wouldn't use one that's 40 years old.

Physical appliances decay because of wear and tear, which digital products are uniquely immune to.

Replacing and fixing physical wear and tear is more like having to occasionally clean your logs folder, or reinstall your OS. Admin maintenance on a specific installation, not updates to the product from the developer. The product itself stays the same.

Software churn, updates that change the product itself and not just the way it's run, are more like General Electric requiring you let one of their employees into your house to paint the appliance a new color every month.

> Calling a software project as a whole "done" (and claiming that it doesn't have bugs and doesn't need maintenance) would be akin to Apple saying the iPhone (the whole product line/smartphone niche) is "done".

Which seems like it would be fine? What do 95% people use their smartphone for, that an iPhone from 10 years ago was not already able to do? Besides, this comparison is a bit circular as software dropping support is often the part that forces consumers to upgrade hardware.

Hardware products without software churn do in fact get used basically forever. When they do break, they can also be replaced with the exact same product, without all the issues that running old software gets you.

Apple could make a forever-iPhone that lasts 10 years, or 40 years. But it's more profitable, competitive, exciting, and convenient to release a new product line every year (while turning old hardware into e-waste via software updates).

I'm not saying it's better or worse that things are this way, but it does cause some problems and should not be presented as inevitable.

by Intralexical

2/3/2026 at 11:19:52 PM

All that you say is true in a world (or for product categories) that has reached a technological plateau.

The point about household appliances that I was trying to make wasn't about individual appliances decaying (= breaking down), but about the utility of a model decaying over time, as it e.g. becomes uncompetitive because it has worse energy efficiency than it's modern counterparts (or in the case of refrigerators uses harmful greenhouse gases).

by hobofan

2/3/2026 at 12:04:17 PM

> Absolutely false. I have built tons of tools which are feature complete and continue to work to this day without intervention

And how many of these tools are mission critical to the point that they are installed on almost every Linux box in existence, probably invoked tens of billions of times per day, both by humans and software, and the entire world would be in deep goddamn trouble if there was a serious security flaw that doesn't get fixed immediately?

Because that's what `sudo` is.

And no, such software is never "done".

by usrbinbash

2/3/2026 at 12:37:49 PM

You’ve moved the goalposts so far away, they’ve left the breathable atmosphere. Look at your condition, it’s over 50 words. I didn’t say “all software can be done”, I just said that it’s not true that software is never done. It’s not a universal truth that applies to all software.

by latexr

2/3/2026 at 11:18:39 AM

There's a difference between software that's "done" (it never needs updates, ever) and software that's done (it only needs maintenance for security and platform churn).

The former is extremely rare; platform churn alone will usually demand updates, even if your code is otherwise airtight. Forces generally beyond your access will demand that your code is able to conform to platform standards. The demand this places can be very variable and depends more on the platform than you. (Windows has low platform churn since it's possible to futz with compat features, Linux is extremely variable on your codebase, MacOS is fairly constant and from what I know about mobile phones, you're basically signing up to forever maintenance duty).

The latter is much more common; sure, sudo still gets updates but most of those won't be new features. Specification wise, sudo is "done". It does what it needs to, it's interface is defined and there aren't going to be any strange surprises when I run sudo between any system made in the past 10 years or so.

The problem is that when you're selling software, demanding compensation for the former is a hard sell since it's things customers won't see or necessarily care about. Demanding compensation for the latter is much more obviously acceptable.

by noirscape

2/3/2026 at 2:56:24 PM

I’m not sure truly ‘done’ exists on systems that interact with other systems unless it’s an entirely closed loop.

I reckon closed-loop systems can be ‘done’ every bit as much as hardware systems can be if the design, debugging and implementation are disciplined enough.

by DrewADesign

2/3/2026 at 2:33:29 PM

> MacOS is fairly constant

Except when they killed all 32bit games a few years ago with Catalina.

by cousin_it

2/3/2026 at 2:51:49 PM

I think that GP meant that MacOS has a constant nonzero rate of platform churn. I might be wrong though!

by zbentley

2/3/2026 at 3:23:46 PM

Oops, yes, I meant a constant non-zero rate. It's slightly above mobile phones, where the developer is treated as the problem that needs to fix itself.

Stuff written for one version of MacOS will probably work for the next few versions, but there's just as likely a chance that Apple has decided that you need to do a full on update of all your older tools. Things like dropping Rosetta, 32-bit from the kernel and so on and so forth. There's not really any recourse, unlike Windows and Linux where you can usually finagle a workable solution without having to resort to updating everything all the time (so platform churn exists, but a user can theoretically choose to avoid it).

This is unlike phones, where there's basically no real expectations for when you need to update stuff, so it becomes a case of "you need to test every version". The lack of respect for tool stability is just one other reason why the mobile ecosystem is the user-hostile hell it is; this platform churn pretty much is one of the two roots of why mobile apps are Like That. (The other being that running your own choice of tools is treated as a privilege, not a right.)

by noirscape

2/3/2026 at 4:59:55 PM

> platform churn alone will usually demand updates, even if your code is otherwise airtight. Forces generally beyond your access will demand that your code is able to conform to platform standards.

Platform churn updates are a failure to limit scope and dependency. If you stick with stable standards like C99/POSIX/X11/SDL, test strictly and build liberally etc., then who cares what the Web/Qt/Metal people are doing?

by Intralexical

2/4/2026 at 12:10:03 AM

Keep selling your bosses that myth. Nobody here believes you though.

by UqWBcuFx6NV4r

2/3/2026 at 4:48:40 PM

The OpenBox WM is a respected piece of software, commonly used on minimal Linux desktops, that has been "done" since at least 2015.

by Intralexical

2/3/2026 at 2:27:31 AM

wireguard is relatively "done"

by kachapopopow

2/3/2026 at 8:10:33 AM

Of all the things to pick, software which needs to be secure and is actively attacked is the worst one.

by MagicMoonlight

2/3/2026 at 10:09:35 AM

So like sudo

by reverius42

2/3/2026 at 3:01:12 AM

"relatively" is just a word added to done and the fact that there is a qualifier precludes the word from bearing truth.

by imchillyb

2/3/2026 at 5:53:34 AM

Out of curiosity, what changes would it have at this point?

by yjftsjthsd-h

2/3/2026 at 7:05:05 AM

I'm not intimately familiar with Wireguard, but there are some things that are almost universally applicable:

- It should run on an maintained OS (which should run on available hardware), so whatever changes are necessary to keep pace with that

- It may want to add optimizations regarding newer CPU architectures

- It uses a compiler, so whatever changes necessary to stay on a maintained version of the compiler

- It uses cryptography, so whatever changes necessary to stay up to date with latest cryptographic research to provide a secure solution, as well as updating cryptographic libraries to not be exposed to CVEs found in them. It also exists in the context of one/multiple jurisdictions, so possibly also changes to comply with interference in sound cryptography (let's hope not).

And all of those are just part of the things to keep up with the world around you evolving. Of course there may also be bugs to fix in the code itself, and/or new ones created by doing any of the changes above.

Even their definition of "complete"[0] includes "active maintenance" and "still much to do".

[0]: https://www.wireguard.com/repositories/

by hobofan

2/3/2026 at 8:26:22 AM

It uses Curve25519 for key exchange and ChaCha20-Poly1305 for symmetric encryption. There aren't many hardware primitives that would speed it up, although AVX2 and similar would help process ChaCha20.

by midtake

2/3/2026 at 9:18:30 AM

> It uses Curve25519 for key exchange and ChaCha20-Poly1305 for symmetric encryption.

For now.

> There aren't many hardware primitives that would speed it up,

For now.

> although AVX2 and similar would help process ChaCha20.

So, there's at least a bullet point for experimental branching.

Also, the WireGuard Tunnel Manager on macOS is far from done.

by bayindirh

2/3/2026 at 4:31:39 AM

pros and cons to this approach, like the CVE introduced in sudo 9.1.14 (June 2023) fixed in 1.9.17p1 (June 2025). https://www.cve.org/CVERecord?id=CVE-2025-32463

But also sudo has A LOT of features that 95% of people don't use. Just checkout `man sudo` to get a sense for this. And it includes plugins like the popular visudo plugin. You can see from the release cadence that real improvements continue to be made. Though it is a bit more work to secure a moving target.

by varenc

2/2/2026 at 9:31:14 PM

I was wondering the same thing. I would have thought every possible combination of parameters would have been tried by now. I guess it just goes to show you that your code is never really complete.

by sizzzzlerz

2/3/2026 at 4:02:47 PM

> I guess it just goes to show you that your code is never really complete.

Yes and no, feature bloat usually justify themselves innocently and once you go down that slope there is no return.

The hardest thing to do in software is commit yourself to a set of feature and protect it from any "helpful additions", naming might be the second hardest.

by Aperocky

2/3/2026 at 11:20:30 AM

It seems to have features I was not aware of. I would not have guessed that it contains anything networking-related.

by qznc

2/3/2026 at 12:09:33 PM

Feature bloat is the last thing you'd want in security relevant software.

by account42

2/3/2026 at 11:33:13 AM

Sudo’s networking functionality is infuriating too, because if my system’s DNS is broken, I get to wait 60 seconds for sudo to work, during which time I can’t even ctrl+c to cancel!

(It has to do with sudoers entries having a host field, since the file is designed to be deployed to multiple servers, which may each want differing sudoers rules. It’s truly 90s era software.)

by ninkendo

2/3/2026 at 2:16:58 PM

I really prefer the design of run0.

by surajrmal

2/3/2026 at 5:27:42 AM

Yeah, silly as it is, I guess it didn't even occur to me that sudo had a developer or maintainer, or was even a "program"; to me it has been one of those things that has and always will exist and I had just assumed it evolved and came about alongside Cro-Magnon man.

But of course, that's silly. Of every piece of software has to be written. I should probably throw the guy a few bucks, considering his code runs in basically every big script on the planet.

by tombert

2/3/2026 at 3:57:46 AM

https://github.com/sponsors/sudo-project

Can donate there.

My bank account is basically empty but I will contribute a few bucks.

by ilaksh

2/3/2026 at 9:33:44 AM

Contributed immediately.

Thanks to sudo-rs: this stolen valor project made me want to financially support the original author.

by egorfine

2/3/2026 at 2:55:23 PM

how does the metaphor of stolen valor (in my understanding: claiming accolades or military credentials/decorations that one never received) apply to that project?

I don’t know anything about the history here; it’s a genuine question.

by zbentley

2/3/2026 at 3:00:52 PM

Authors of useless rewrites do:

* skip the hard part: designing, getting user feedback and designing again;

* get straight to the fun part: coding in their favorite language after a well-established and proven design;

* get to call themselves "creator of XXX-rs", where "XXX" is a well-known brand and "-rs" is often overlooked.

by egorfine

2/3/2026 at 6:31:45 PM

A security-focused rewrite of a security-critical program that removes insecure features and prevents whole classes of vulnerabilities from being introduced in the future is hardly “useless”.

by senderista

2/3/2026 at 4:45:39 PM

would it be better if they didn't skip the hard part? (i.e. if they re-designed it from first principles) does something being hard to do make it more virtuous?

would it be better if they didn't have fun coding it? is something worse if it was fun to make?

by ginsider_oaks

2/3/2026 at 4:50:59 PM

I meannnnnn…

Pedantically, the “stolen valor” metaphor absolutely doesn’t fit here; you’re just griping about the “sudo brand” being used in another project’s title (which … citation needed, and so what? Is “doas” not committing theft but “sudo-improved” is?)

More generally, that’s an easy case to make against any software you don’t like: “it’s just reimplementing $whatever and trying to pretend to be the original therefore it’s unethical”. Some rewrites are good, and a huge benefit of the act of rewriting is that you do have a clear blueprint and understanding of the requirements (hell, Linux was a rewrite). Should the original creators of a thing be the only people who can ethically rewrite it? Where’s the line here?

by zbentley

2/4/2026 at 12:12:46 AM

For the love of God, drop the culture war BS. We get it, you don’t like Rust.

You don’t get to act so self-righteous when you do absolutely nothing to justify the assertion that sudo-rs is “useless”.

I look forward to hearing your argument that doesn’t end in “the memory safety footguns of C are massively overstated”, or “there is no value in having a sudo alternative that ditches antiquated, insecure functionality”

by UqWBcuFx6NV4r

2/2/2026 at 9:19:46 PM

I think the rise of the open-source redistributor groupie has been an interesting cultural revolution. I wonder if it will persist. Even 10 years ago, the idea of Free As In Speech dominated the idea of Free Software. Today, the greatest enthusiasm on Hacker News and Reddit is for something like Meta's Llama license (which cannot be used by people or corps with sufficient numbers of users). It certainly seems like someone out there could go out and propose the Microfree License which only applies to sufficiently non-rich people.

For my part, I want none of it. I find this reduction of a significant philosophy to some kind of base tax-and-distribute mechanism distasteful. I don't like communities were this stuff is big and they always want to run some taxation scheme where they redirect money to their own personal pet projects. It is fortunate that modern tools are good enough to build personal insulation from this stuff.

Imagine the farce of Apply HN repeated continuously. Simply awful.

by arjie

2/2/2026 at 6:16:13 PM

30+ years maintaining one of the most critical pieces of infrastructure on nearly every Linux and Unix system, and he's currently looking for a sponsor to fund continued development. Every company running sudo in production owes this man. Someone should fix that

by OsamaJaber

2/2/2026 at 7:45:41 PM

This is a good example of Diffusion of Responsibility.

Everybody thinks somebody else should help, so nobody does.

by brightball

2/3/2026 at 8:29:11 AM

Google made 10^7 as much money as I did last year. Yea, I don't think it's as simple as you make it seem.

by j-krieger

2/3/2026 at 3:05:17 PM

Google sponsors a lot of open source work: https://opensource.google/organizations-we-support

I wonder if sudo would be better off joining one of those open source foundations instead of staying solo. It's too small to justify a meaningful amount of contribution to these companies, at which point the bureaucratic overhead of dealing with it probably kills the motivation

by kllrnohj

2/3/2026 at 5:23:40 PM

This is the current list but from a cursory look it lacks GSoC which has been a significant source of new contributors since forever.

by habitable5

2/2/2026 at 8:07:28 PM

I don't think they even see it as their responsibility, more, "If he wanted money, he should have charged for his software".

by lenerdenator

2/3/2026 at 1:09:28 AM

If he actually did charge money someone else would've written an implementation of sudo to solve their own needs and avoid the overhead of transacting with a random developer.

by JuniperMesos

2/3/2026 at 5:25:48 AM

And then "If he wanted money, he should have charged for his software" would apply to that someone.

by snvzz

2/3/2026 at 12:51:02 PM

And in such a system, before long, we have an ecosystem that resembles the venereal disease masequaraing as an addon store we see in wordpress.

by Grimblewald

2/3/2026 at 8:40:48 AM

"Your 3 months sudo trial is expiring. Would you like to sign up for sudo-pro (best for hobbiest and small teams), sudo-business (up to 100 users) or sudo-enterprise (reach out for a quote)"

by _fizz_buzz_

2/3/2026 at 2:40:34 PM

Nightmarish, isn't it?

But that's how the higher-ups at places like IBM and Oracle see the world.

And these people are free to roam the streets unfettered. Hardly seems right.

by lenerdenator

2/3/2026 at 12:09:08 AM

I mean, he should just put a message when you run sudo the first time asking for funding if he wants it that bad, that should speed things up.

by AmbroseBierce

2/3/2026 at 10:20:32 AM

It would be removed by distros. XScreensaver had a notice when user ran old version and Debian removed it.

by mnau

2/2/2026 at 8:27:22 PM

Seriously, just put a VAT on digital services to fund a system that pays out grants to individuals to help maintain open source software. It should be obvious by now that corporations will rat fuck the commons for monetary gain and there is a serious need for democratic initiatives to put technology back into the hands of the people.

by shimman

2/3/2026 at 7:05:39 AM

I would like to live in this utopia where free software is funded by the state. This seems impossible to get implemented in our world though.

by TonyStr

2/3/2026 at 12:35:49 PM

Several states fund open science, and a couple of them actually do fund open source projects. Germany has its sovereign tech agency for this; France has publicly-funded research agencies that work on a lot of open source stuff, and there are others. There are EU initiatives as well.

It’s not perfect, but it is already something that is being done.

by kergonath

2/3/2026 at 9:48:24 AM

The EU does fund a lot of open source software.

by Antibabelic

2/3/2026 at 1:00:44 PM

So does the US. In fact they did for this software.

by kasey_junk

2/3/2026 at 8:04:23 AM

But how would that work? There isn’t unlimited money so who decides what software to support with state money and which developers? I don’t have trust in a bureaucracy to decide which developers should get paid to work on sudo. Just look at a the sudo-rs debacle and that’s without money involved.

by kortilla

2/3/2026 at 1:51:10 PM

You have a failure of imagination if this is what you think, luckily in politics we don't have to listen to people like you and instead those with an actual vision of a better future.

by shimman

2/3/2026 at 12:17:38 PM

No thanks, we don't need yet another specialty tax paid out to a dubious selection of individuals.

by account42

2/2/2026 at 8:35:56 PM

Whenever people say that MIT or GPL licenses are a good idea I point out projects like this.

Only humans should have freedom zero. Corporations and robots must pay.

by noosphr

2/2/2026 at 10:29:55 PM

> Corporations and robots must pay.

Greenpeace is a (non-profit) corporation. Unions are corporations. Municipalities. Colleges and universities.

* https://en.wikipedia.org/wiki/Legal_person

Should they have to pay?

by throw0101c

2/3/2026 at 4:43:02 AM

I used to volunteer for a local non-profit a few years ago.

From time to time, I would reflect on the fact that Microsoft and other commercial suppliers were getting paid for providing services to us, but I was expected to work for free.

by degamad

2/2/2026 at 11:32:11 PM

Yes. Non-profits are more than capable of abusing the commons, the purpose of even small monetary requirements is to put a bound on that.

by llbbdd

2/3/2026 at 1:48:07 PM

If Mozilla and Wikimedia can pay millions in salary to their CEOs, I'm sure that they can spare a few thousands for open source projects.

by LunaSea

2/3/2026 at 1:05:55 AM

Yes. Not for profit does not mean they don’t have money.

With that logic why should non profits have to pay for anything at all?

by isatty

2/3/2026 at 6:45:19 AM

For the same logic they are tax-exempt. There is a general consensus that their goal is the greater good (like developing sudo and such) and not the usual capitalistic good of generating more money.

Then again, you usual Friday outing of FANG engineers may have more money than some nonprofits too.

by Muromec

2/2/2026 at 10:33:00 PM

Yes.

by noosphr

2/2/2026 at 10:26:41 PM

The behavior of corporations is shameful.

After all, people in these companies don't work for free and are able to spend a lot of money for other services.

by sixtyj

2/3/2026 at 4:31:32 AM

Haven't you just hit the nail on the head? Corporations do not feel shame even if people within them do; hence actions . . .

by 6LLvveMx2koXfwn

2/2/2026 at 8:57:53 PM

You can demand payment but it doesn't mean you'll get paid. These days companies will clone your work instead of paying.

by wmf

2/2/2026 at 9:06:16 PM

As covered literally just a few days ago (IIRC), you absolutely can demand payment: https://github.com/LGUG2Z/komorebi actively works to detect MDM, and if found, demand payment.

Not open source, but an interesting counterpoint, I think.

by zhengyi13

2/2/2026 at 9:39:36 PM

Relevant articles are here

- https://lgug2z.com/articles/normalize-identifying-corporate-...

- https://lgug2z.com/articles/i-started-identifying-corporate-...

The post-open source space is indeed a very exciting space in 2026

by bsnnkv

2/3/2026 at 2:24:13 AM

That's not post open-source. That's dual licensing, an use-case FOSS has enabled and supported forever.

by alt187

2/3/2026 at 2:36:58 AM

> any time someone says something is post-$thing it means what they are doing is in dialogue with and in response to $thing. “we were doing that before $thing” no, you can’t be in dialogue with something that hasn’t happened yet.

> this is like saying “what do you mean post-modernist architecture, architecture predates modernism”.

https://lobste.rs/s/kaftkn/i_started_identifying_corporate_d...

by bsnnkv

2/3/2026 at 2:23:29 PM

Releasing open source software and then “demanding payment” goes against everything about open source.

If someone expects to be paid for the use of their software, releasing it as open source is not what they want.

If a maintainer of a software project starts trying to demand payment or threatening to change license terms, it’s a reasonable response for a company to fork it or build their own solution.

by Aurornis

2/3/2026 at 4:14:55 PM

And this is why all new projects by independent developers should seriously consider using a post-open source license before defaulting to corporate-friendly/corporate-first OSI licenses

by bsnnkv

2/2/2026 at 9:00:32 PM

[dead]

by zxcvasd

2/2/2026 at 8:48:13 PM

That's a nice slogan, but how does it work?

Say, I clone sudo. Clearly, a human applying freedom zero. I use it in my projects. Probably still freedom zero. I use it in my CI pipeline for the stuff that makes me money... corporation or human? If it's corporation, what if I sponsor a not-for-profit that provides that piece of CI infra?

The problem is that "corporation or not" has more shades than you can reasonably account for. And, worse, the cost of accounting for it is more than any volunteer wants to shoulder.

Even if this were a hard and legally enforceable rule, what individual maintainer wants to sue a company with a legal department?

What could work is a large collective that licenses free software with the explicit goal of extracting money from corporate users and distributing it to authors. Maybe.

by groby_b

2/2/2026 at 8:57:01 PM

Not for commercial use without buying a license is a pretty standard licensing scheme. This has been worked out for decades.

by conception

2/3/2026 at 12:26:22 PM

The challenge is that this doesn't really work for community-developed software.

Let's say somebody uses this scheme for software they wrote. Would anybody else ever contribute significantly if the original author would benefit financially but they wouldn't?

Mediating the financial benefits through a non-profit might help, but (1) there's still a trust problem: who controls the non-profit? and (2) that's a lot of overhead to set up when starting out for a piece of software that may or may not become relevant.

by atq2119

2/2/2026 at 9:39:54 PM

And the shades in between account for the large number of new licensing schemes sprouting, with different restrictions on what is and isn't possible. (Not to mention the large number of "just used it anyways" instances). And it struggles for smaller utilities, or packages of many different things.

It's "worked out" in the sense that it still doesn't really work for a lot of maintainers.

by groby_b

2/2/2026 at 9:38:06 PM

What happens when the code is abandoned? Can I make my own changes whenever I want?

The problem with commercial software is the lock in.

by mulmen

2/2/2026 at 9:26:51 PM

The GPL is a good idea. It's our socieconomic system that isn't.

by saubeidl

2/3/2026 at 12:08:00 AM

GPL is a response to the copyright law, which was created for the big corporations to extract rent from ordinary people.

It's copyright law which should go away.

by aboardRat4

2/3/2026 at 1:51:10 AM

> It's copyright law which should go away.

This precisely. What started out as a way of rewarding authorship (of text, software, or other things) has mainly become a way of extracting rent -- see the music, movie, and software industries. In the digital age, when the cost of making copies of such works is approximately zero, copyright law ceases to make sense.

Note that this does not mean you cannot make money selling software or software-related services. For example, game developers could still sell keys for online play on their servers even if they couldn't copyright the binaries.

by drnick1

2/3/2026 at 1:11:35 AM

Copyright law is hundreds of years old and originally was intended to prevent owner-operators of mechanical printing presses from printing and selling copies of some author's books without paying them or getting permission.

by JuniperMesos

2/3/2026 at 7:38:57 AM

It was created when there was a scarcity of content, so state violence was used to encourage production of content.

But now we don't live in the age of scarcity of content. On the contrary, content creators are competing for a possibility to get into consumers' attention span and push their agenda (ads). Everything has changed.

Removing all copyright restriction will not decrease the amount of content available for a person through their lifetime even a few percent.

by aboardRat4

2/3/2026 at 4:50:25 AM

> originally was intended to prevent owner-operators of mechanical printing presses from printing and selling copies of some author's books without paying them or getting permission.

We agree that that was its initial stated intention.

However, what we have seen in practice is that it has resulted in the owner-operators of those machines banding together to restrict access to the machines unless authors sign exploitative contracts assigning their rights to the operators (which they interpret as "getting permission").

by degamad

2/3/2026 at 7:18:42 AM

The world has changed substantially since the 1710 Statue of Anne; there's a thousand things that you could call the modern-day equivalent of mechanically printing a book, with myriad capital and operating costs and availability. Many ways an independent author or artist can publish their work are extremely cheap and effective. I'm relatively anti-copyright, but that doesn't mean that everyone currently benefiting from copyright law is rent-seeking in an exploitive way.

by JuniperMesos

2/3/2026 at 12:44:19 AM

Including the hangups people have about AI training as well.

by satvikpendem

2/3/2026 at 10:36:01 PM

GPL is much more than that. It is distributing the means of production to the tech workers.

rms is the Marx of the 20th Century. GPL is freedom from corporate oppression.

by saubeidl

2/2/2026 at 10:13:53 PM

Everything is a good idea if you assume a world in which it works.

by noosphr

2/2/2026 at 10:23:27 PM

Communism has entered the chat.

by fragmede

2/2/2026 at 10:24:47 PM

That, for example, would be a better system. One the GPL would work beautifully in.

by saubeidl

2/2/2026 at 10:54:04 PM

If you can't explain why it did not work in the past, and can't explain how & why things will be different this time, you don't have a plan. History is a harsh mistress.

by david-gpu

2/3/2026 at 6:20:20 AM

It works, but you need real human staff. And we learn from history that we don’t learn which can be harsh.

by mediumsmart

2/3/2026 at 10:10:21 AM

Communism worked in China, for some definition of "worked". Stalinism eventually failed in the USSR and elsewhere. An extensive literature explains these things, as well as explaining different forms and varieties of "communism", and things that people call "communism" but aren't.

by jibal

2/3/2026 at 7:05:20 PM

Communism worked so well in China that as soon as they adopted something resembling free markets in some regions, thanks to Deng Xiaoping, their GDP per capita rose amazingly fast for 3~4 decades. Not exactly a stellar example.

by david-gpu

2/3/2026 at 6:49:03 AM

As a person who had a privilege to live in a commie-block half his life, no, it isn't a better system.

by Muromec

2/3/2026 at 10:12:02 AM

That was Stalinism, not communism. And there are many ways to implement communism, some of which are better than others.

by jibal

2/2/2026 at 11:32:38 PM

GPLv3 is a bit overreaching , especially in patent clauses. The GPL as idea is great but the license needs a little more refining

The constant fear of lawyers that using some GPL lib will infest entire codebase of their project with GPL is a real problem that stops many corporations from contributing in the first place.

by PunchyHamster

2/2/2026 at 9:19:13 PM

Surprisingly Jia Tan has not offered to help yet.

by af78

2/3/2026 at 2:38:52 AM

Maybe someone should suggest, sudo needs compression capabilities and suggest a great developer, being helpful with that one? :D

by SunlitCat

2/3/2026 at 8:28:27 AM

Jia Tan and his 40 sockpuppets are undoubtedly trying.

by midtake

2/2/2026 at 8:12:34 PM

I disagree on "the most critical" part. You can be superuser at all times. I understand the arguments why not; I am pointing out that this is possible. Despite people claiming aliens will arrive and nothing will work, everything works fine when the superuser account is used too.

Also, I disagree that every company needs to pay the man. Funding is important, yes, but a *nix system is not crippled without sudo. You can change the permission systems. The superuser can do so too. It is not black magic. The permission system is trivial. sudo is simply a feature of convenience, not a "if sudo does not exist, nothing works" - that just makes no sense.

by shevy-java

2/3/2026 at 12:24:26 PM

You don't even have to be root all the time, su is all you need unless you have a fetish for software bloat.

by account42

2/3/2026 at 2:55:33 AM

I guess I don’t understand. Take RHEL. The sudo maintainer seeking a new sponsor affects upstream velocity and stewardship, not the deployed trust model of enterprise distributions. RHEL does not “follow HEAD.” It vendors a known-good snapshot and assumes long-term responsibility for it.

Core tools like sudo have survived things like this before

by firesteelrain

2/2/2026 at 6:26:09 PM

Right? A company to step and cut a check to support this would get positive publicity and there doing something good for community at large. Someone step up.

by boringg

2/2/2026 at 9:24:40 PM

Companies don’t step up and do things for the common good. They do things for profit. Occasionally that looks like they are charitable if the value of the PR is worth it for them.

No one[1] changes what product they are using based on funding or not of open source software. Companies will step in and fund it if they want control, like with Rust, or if the maintainer finally stops giving them free labor and they actually need the software.

[1] not enough people to alter finances

by lovich

2/3/2026 at 12:02:17 AM

Why would it be needed to continue the development of sudo?

Isn't it done and finished, after 30 years of development?

by aboardRat4

2/3/2026 at 1:54:15 AM

It's all bug fixes it seems. What is surprising is that so many bugs remain even after all this time and effort. And no, for the most part these are not the kinds of bugs that are squashed by a rewrite in Rust.

by drnick1

2/3/2026 at 12:13:30 AM

The monthly releases seem to indicate otherwise.

by not_ai

2/3/2026 at 12:15:05 AM

Something's deeply wrong here.

by aboardRat4

2/3/2026 at 12:25:22 PM

It's a kitchen sink tool that does way too many things.

by account42

2/3/2026 at 12:34:23 AM

Then fork it and finish it. I’m sure it will be a huge success.

by mulmen

2/3/2026 at 2:26:10 AM

You should look up "doas". It might enlighten you.

by alt187

2/3/2026 at 8:29:00 AM

If you have a point to make then make it. I don’t accept anonymous homework assignments.

by mulmen

2/3/2026 at 12:15:52 PM

> one of the most critical pieces of infrastructure

It's really not.

by account42

2/3/2026 at 12:44:19 PM

How is it not? A suid binary installed on pretty much every Unix system ever seems pretty critical to me.

by Hendrikto

2/3/2026 at 1:38:13 PM

Living without it isn't hard IMO. It's more of a convenience. Most of the servers I ever login to only have one non-root user anyway. When I need root, I switch to root.

by mayhemducks

2/3/2026 at 4:48:21 PM

And how do you switch to root? sudo is the most popular way

by rurban

2/2/2026 at 8:51:37 PM

You can only fix that with leverage. The sudo maintainer doesn't have it. sudo is valuable, but if Todd stepped away, you could (and would) find other maintainers because it's so important.

If you want to fix it, you need organizational heft comparable to the companies using it, and the ability & willingness to make freeriding a more painful experience.

by groby_b

2/2/2026 at 11:48:42 PM

Wasn't the sudo-rs (rust version) already reducing that leverage even further? (and finding interesting bugs, but that's not the point here)

by eichin

2/3/2026 at 11:25:08 AM

I wonder how many guys who have have written or significantly maintained "household name" level FOSS products just earn a corporate sinecure somewhere as hypercompetent remote sysadmins or ICs or something. Folks who don't necessarily care to earn top dollar, with all the headaches that entails, but also almost never have to actually work more than 2 hours in a given day to keep the ship going, and the arrangement is just so cozy and gives them enough time to themselves to work on their actual passion that they accept the arrangement.

I know of at least one recruiter who does something like this and specializes in greybeard hiring, and it seems like a steady niche if you have the network to pull it off.

by hiAndrewQuinn

2/2/2026 at 10:38:51 PM

At the least, all the hyperscalers should be putting money into a fund for this sort of thing.

by gonzo41

2/2/2026 at 6:45:47 PM

Why would you be running sudo in production? A production environment should usually be setup up properly with explicit roles and normal access control.

Sudo is kind of a UX tool for user sessions where the user fundamentally can do things that require admin/root privileges but they don't trust themselves not to fat finger things so we add some friction. That friction is not really a security layer, it's a UX layer against fat fingering.

I know there is more to sudo if you really go deep on it, but the above is what 99+% of users are doing with it. If you're using sudo as a sort of framework for building setuid-like tooling, then this does not apply to you.

by oconnore

2/2/2026 at 7:33:48 PM

> A production environment should usually be setup up properly with explicit roles and normal access control.

… and sudo is a common tool for doing that so you can do things like say members of this group can restart a specific service or trigger a task as a service user without otherwise giving them root.

Yes, there are many other ways to accomplish that goal but it seems odd to criticize a tool being used for its original purpose.

by acdha

2/2/2026 at 8:16:45 PM

PSA for anyone reading this, you should probably use polkit instead of sudo if you just want to grant systemd-related permissions, like restarting a service, to an unprivileged user.

It's roughly the same complexity (one drop-in file) to implement.

by pphysch

2/2/2026 at 9:40:16 PM

I’d broaden that slightly to say you should try to have as few mechanisms for elevating privileges as possible: if you had tooling around sudo, dzdo, etc. for PAM, auditing, etc. I wouldn’t lightly add a third tool until you were confident that you had parity on that side.

by acdha

2/3/2026 at 7:15:44 PM

Privilege escalation (superuser capabilities) and RBAC ought to be viewed differently, IMO.

There's a place for true superusers, such as auditing, where no stone should be too heavy. But mostly for securing systems, we want RBAC, and sudo is abused as a pile-driver where only a mallet was needed. Polkit is more of a proper policy toolkit.

by pphysch

2/3/2026 at 10:21:44 PM

That’s a valid choice. I’m just saying that you should pick ideally one tool for that class of work. For example, if you support one tool for Mac and Linux users that’s probably worth more than supporting two similar tools even if one of them is better.

by acdha

2/3/2026 at 6:02:32 AM

What's the benefit?

by yjftsjthsd-h

2/3/2026 at 12:50:40 PM

You can acquire permission on-demand and scoped more tightly.

by Hendrikto

2/2/2026 at 7:41:01 PM

> Why would you be running sudo in production? A production environment should usually be setup up properly with explicit roles and normal access control.

And doing cross-role actions may be part of that production environment.

You could configure an ACME client to run as a service account to talk to an ACME server (like Let's Encrypt), write the nonce files in /var/www, and then the resulting new certificate in /etc/certs. But you still need to restart (or at least reload) the web/IMAP/SMTP server to pick up the updated certs.

But do you want the ACME client to run as the same service user as the web server? You can add sudo so that the ACME service account can tell the web service account/web server to do a reload.

by throw0101a

2/3/2026 at 2:52:13 AM

In your example certbot is given permission to write to /var/www/.well-known/acme-challenge and to write certs somewhere. Your web server also has permission to read those files too.

There is no need for the acme client and web server to run as the same user. For reloads the certbot user can be given permission to just invoke the reload command / signal directly. There does not need to be sudo in between them.

by charcircuit

2/2/2026 at 7:41:18 PM

Almost everyone is running sudo in production.

by bigstrat2003

2/2/2026 at 7:58:15 PM

the fact this is a reply to the content in the parent just demos the complete lack of social skills or empathy many in this community are known for

by bloqs

2/2/2026 at 7:38:51 PM

Auditing.

by bobmcnamara

2/3/2026 at 2:46:02 AM

bro i just want to apt install gimp :(

by jcelerier

2/2/2026 at 6:03:27 PM

Seeing the server temperatures go up as this gets posted to HN is fun. I'm not sure his server agrees.

by fdupress

2/2/2026 at 6:14:16 PM

“Machine Room Temperature” from Todd C. Miller’s website:

https://www.millert.dev/therm/

Server exhaust fan temperature was typically 94°F (ranged 92°F to 96°F) over the previous week and has climbed to 97°F.

by divbzero

2/2/2026 at 7:22:35 PM

But, on the whole, the server seems to be doing well enough for something near the top of HN. The website is served by nginx and appears to be mostly static pages.

by divbzero

2/4/2026 at 1:44:41 AM

if sudo needs 30 years of development, we need to rethink how it works. Perhaps it is time to trim down 99% of the features. Reset our brain, take a deep look at what it needs to do and how it does it.

by anon-3988

2/3/2026 at 2:52:55 AM

It's genuinely terrifying to think how much of the modern internet rests on the shoulders of a few people maintaining core utilities like sudo, curl, and openssl for decades. Todd is a legend.

by heftykoo

2/3/2026 at 5:36:41 AM

Yes but that would be even more terrifying if it rested on the whims of some soulless corporation.

by rixed

2/3/2026 at 11:03:07 AM

ms-sudo to Get-AdministratorPermissionForElevatedSecurityOperations

by redog

2/3/2026 at 12:33:01 PM

0xEFF0332: Operation could not be performed due to missing TPM flag.

by dannyw

2/3/2026 at 1:44:02 PM

LOL sob

by mayhemducks

2/3/2026 at 9:05:58 AM

A good time to advertise for Sudo Mastery by Michael W. Lucas, highly recommend it if you want to dig in a bit deeper.

by b2ccb2

2/3/2026 at 12:13:57 PM

"This incident will be reported" (in /var/log/auth.log)

by zeroping

2/2/2026 at 8:00:32 PM

sudo pay him

by dwflanagan

2/3/2026 at 9:38:14 AM

Does he live in Nevada, by chance?

by jacquesm

2/2/2026 at 5:50:50 PM

Have used sudo millions of times. It's so smooth I don't even consider it software. Thinking that sudo could give me bug one day haunts me now. Thanks Miller for your work!

by akokanka

2/3/2026 at 5:35:35 PM

I still think the integration with X11 $DISPLAY could be smoother.

by amelius

2/3/2026 at 10:50:03 AM

Didn't knew that sudo had a website with a... somewhat interesting logo: https://www.sudo.ws/

by sodimel

2/3/2026 at 11:22:19 AM

Wow, is it related to the "make me a sandwich" XKCD?

https://xkcd.com/149/

by esnard

2/3/2026 at 12:19:21 PM

You do realize the answer is right there: https://www.sudo.ws/about/logo/

(and the old logo) ;)

by Joe_Cool

2/3/2026 at 3:08:45 PM

I missed that, thanks!

by esnard

2/2/2026 at 6:18:11 PM

Honestly he should open a Patreon. There are loads of people that would subscribe to Sudo for $2/month or $5/month.

by jandrese

2/2/2026 at 6:27:24 PM

The problem is if I was going to do that with the open source projects I use, it is more like a penny a month * 1000 projects.

by rileymat2

2/2/2026 at 7:42:10 PM

$.01/user/month would be quite a bit here

by bobmcnamara

2/2/2026 at 7:52:55 PM

Subtract the standard ~3 cent transaction fee and he’d end up owing money instead. That seems to always be the catch with micropayment ideas.

by einsteinx2

2/3/2026 at 3:42:03 PM

There are at least two catches with micropayment ideas. One is transaction costs. The other is taxation.

If person in country X is accepting payments (micro or regular) directly from customers/donors in country Y they are then running an international business. That can have income tax, sale tax, VAT, and probably other tax collecting and reporting requirements in one or both countries.

It's a big can of worms you probably don't want to deal with unless you are making significant money from Y. Multiply all that by the number of different countries you get paid from.

The best way to fix the transaction fee problem is probably to use an intermediary. For micropayments people (payers and payees) have accounts at the intermediary. Payers preload their account with a payment large enough that the transaction fees are only a tiny percentage, then can direct how that money is distributed. On the payee side the intermediary waits until the payer has received enough to be able to do a transfer to the payees bank account without transaction fees eating too much.

The intermediary can also fix the tax problem. The way that works is that the intermediary operates as a legal entity in both country X and Y. Payers interact solely with the legal entity in their country, and payees interact solely with the legal entity in their country. Payers and payees then only have to deal with their own country's tax system.

The problem here is who should run the intermediary service? I doubt people will be able to agree on that. What we probably need is a system where there can be multiple intermediary services, but the services talk to each other so if say I want to donate to project Foo and Foo and I use different services I tell mine to send Foo a micropayment and my service and Foo's service make that happen.

This could work similar to the way peering works on the internet backbone.

by tzs

2/2/2026 at 8:12:45 PM

Sounds like we need an open source index fund where you can make one payment that goes into a pool of money which is invested into the top 1000 open source projects.

by __turbobrew__

2/3/2026 at 1:24:14 AM

What are the top 1000 oben source projects?

by krior

2/3/2026 at 2:36:00 PM

Well, there's systemd, systemd-resolved, journald, GNOME, Wayland, systemd-homed, systemd-boot,...

by tmtvl

2/2/2026 at 8:34:08 PM

It almost seems like someone ought to be able to build some kind of digital currency with low transaction fees and no centralized payment processor that could power microtransactions. I wonder why nobody has done that yet.

by aftbit

2/2/2026 at 9:11:31 PM

I know crypto was supposed to solve this problem, but I’ve never seen an implementation that actually did the job. You’d think someone would have built a successful “Patreon for micropayments” in the past 10 years, but no one has.

by einsteinx2

2/2/2026 at 10:29:32 PM

Yeah I think the problem is that most of the main chains had astronomical transaction fees; most of the side chains that solved this problem had a trust problem; and Bitcoin Lightning was sorta dead on arrival, though it had both the trust and the technology solution. At that point, this forum had already moved BTC from "amazing new technology" to "huge threat to social order and environment".

by aftbit

2/3/2026 at 6:05:44 AM

BAT literally was built for (accumulation of) micropayments.

by jorvi

2/2/2026 at 8:57:01 PM

Sounds like the above 2 ideas should be combined. Lightning payments are more or less free, and an index or tracker that looks at your bash history could make it possible to spread 5$ per month over all projects that you use.

by janandonly

2/2/2026 at 7:44:15 PM

payment processors: "how about no"

by ycombinatrix

2/2/2026 at 7:55:10 PM

Why? If every person participating is giving $10-$20 per month to tens or hundreds of projects and then once distributed, this equates to $x00 or $x000/project/month, why would the payment processors mind. Of course, it's all in theory.

by karamanolev

2/2/2026 at 8:12:18 PM

they charge a minimum fee per transaction. from Accursed Farms' donation page (https://www.accursedfarms.com/donations/)

"Paypal keeps $0.30 + 2.9% of every donation, so please keep anything less than $0.32 as they have enough money already."

i think Cash App has the lowest fees i've seen at like $0.01 which would still be too much.

not saying it is impossible - but likely not viable directly with the current payment providers.

by ycombinatrix

2/2/2026 at 7:44:51 PM

This is why I feel like a missing piece of Patreon/Kofi/whatever is the ability to say "Here's $x; divide it automagically amongst the creators I'm currently following"

Sure, I think a lot of those donations would amount to a few pennies or so at once, but I feel like a lot more people would be willing to support creators if they didn't have to constantly choose which to support.

by squigz

2/2/2026 at 8:17:08 PM

I would love it if something like Github would accept donations from a repo and parcel it out to the repo's dependencies somehow. It would sadly make Github even stickier, but it would be a great feature.

by robertlagrant

2/2/2026 at 8:05:36 PM

wouldn't https://github.com/sponsors/sudo-project achieve the same thing in this case?

by ak009

2/2/2026 at 8:29:09 PM

That's great, I wish he had mentioned it.

by jandrese

2/2/2026 at 10:32:44 PM

True, but it sounds like he's more looking for "a" sponsor, not crowdfunding which he already has tried.

That might be why he hasn't mentioned it.

by gregw2

2/3/2026 at 9:17:24 AM

>Patreon

And they start making videos about, mentioning the sponsors. There are better options to get money.

by xxs

2/2/2026 at 10:52:06 PM

I would kick him $20. Anyone know how?

by RhysU

2/2/2026 at 5:51:09 PM

I would love to know were IBM is on this. They use sudo everywhere, even on AIX. Not to mention IBM owns Red Hat Linux.

IBM should be able to send a decent amount to Todd once in a while, but based upon how much IBM supports ssh ($0), all they are proving is they are very cheap and only wants be a parasite living off other's work.

by jmclnx

2/2/2026 at 10:33:44 PM

Canonical tried to change that with sudo-rs, but by being Canonical they did what Canonical do best since they got too big: Read poop here

by h4kunamata

2/3/2026 at 2:11:49 AM

Todd C. Miller, thank you for your contributions. Sudo is an awesome piece of work.

by RickJWagner

2/2/2026 at 8:11:44 PM

The funding problem is an issue.

We need to find better models. Even if it is just "low(er)" payment; that would still be better than zero or near zero payment.

by shevy-java

2/2/2026 at 8:14:28 PM

Universal Global Contributor Wellness Fund

may also fund retirements for certain individuals, and there is for sure enough free juice to get it started in a very reasonable way. these people really deserve it, the same way Nobels extist, etc.

by larodi

2/2/2026 at 8:09:27 PM

I've said it before, open source works poorly in this area. It's great if everyone's getting paid fat money in a day job and can maintain their pet project a few days a month, but that's just not true for a lot of people.

It's disgusting that maintainers of critical projects have to go through the humiliation of begging for money, and absurd to suggest they all hang out Kofi or PAtreon banners. Realistically nobody is going to go through their bash history working out what utilities they use in order of frequency and allocating funds to the maintainers proportionally. I'm baffled that some entity like the Linux Software Foundation isn't administering this already.

by anigbrowl

2/2/2026 at 8:56:04 PM

I wonder if a few people going beyond what is reasonable, is representative of open source projects.

For a lot of open source projects, if you have a normal day job and spend a few hours per week on a project, then the project just never gets very big. It exists, may have a few users. But on a larger scale, nobody knows it exists.

The exceptions are projects where developers spend a lot of time on the project at the expense of a day job. Though there is the possibility that they may have a hard time having a day job in the first place, which may have let to the situation with the open source project.

In general, I think we do have a culture problem where we think projects need to be successful. And people working on a project 'need' to support users (who in general don't pay).

And that expectation of free work happens throughout the open source ecosystem as well. Distributions expect projects to fix bugs for free. Open source projects expect libraries and compilers to be maintained.

Ultimately, change has to come from people who refuse to work for free. Doing something as a hobby for free is perfectly fine. As long as it stays within the scope of a hobby project.

by phicoh

2/3/2026 at 3:38:05 AM

I think this is partly an education problem, and partly an industry culture problem. Lots of young developers are incentivized to 'contribute' to open-source as a way to demonstrate that they can actually write software. So open-source becomes a way of signalling competence when at a broader scale it's just extracting wealth from the vulnerable.

Open-source seems to be fragmented into three groups now. Large enterprise open-source like Kubernetes or OpenStack where the license seems more like a legal agreement amongst vendors to not sue each other. Legacy open-source projects that are getting by on brand recognition and sheer willpower. And a whole bunch of noise from people who are looking to leverage open-source into a job of some sort.

I'm not sure what the solution is...

by kcexn

2/2/2026 at 8:21:08 PM

> Realistically nobody is going to go through their bash history working out what utilities they use in order of frequency and allocating funds to the maintainers proportionally.

Not if we don't make it easy for them. I had Claude whip up fundcli a while ago, but this post got me to finally upload it. It goes through your http://atuin.sh/ history (raw .bash_history/.*history doesn't have enough information) and generates links to projects for you to donate to.

    git clone https://github.com/fragmede/fundcli
    uv run src/fundcli/cli.py analyze
    uv run ./src/fundcli donate --amount 100
to get links to donate $100 for last month's usage. There's also http://thanks.dev if you're looking for other places to donate to based on your open source usage.

by fragmede

2/2/2026 at 8:32:55 PM

I feel like this should have been the responsibility of investors and venture capitalists. In a normal society, the moneyed folks should give special treatment to the folks who have proven themselves to be effective givers.

Unfortunately, it seems like either the moneyed folks don't care or the current financial structure simply does not support this.

by jongjong

2/3/2026 at 12:27:45 AM

I think that's because the moneyed folks tend to be effective takers :-P

by badsectoracula

2/3/2026 at 10:30:18 AM

It never even occurred to me that sudo was something people had to maintain. it's always just been part of linux

by arkensaw

2/3/2026 at 2:07:31 PM

And Linux is maintained by who?

by dewey

2/3/2026 at 10:33:28 AM

sudo contribute --bank --amount

by theGeatZhopa

2/3/2026 at 3:54:58 AM

I think xkcd should fund it, that would be comical.

by khaki54

2/3/2026 at 2:03:14 PM

> Only enable the TLS listener by default if a TLS cert is specified.

There's a TLS listener in sudo? This project seems to have a tonne of features it shouldn't.

by philipwhiuk

2/2/2026 at 8:23:04 PM

Impressive

but the mascot for sudo is terrifying

by dangoodmanUT

2/2/2026 at 8:57:54 PM

But also quite funny when you make the connection!

by ahartmetz

2/2/2026 at 9:15:58 PM

Perpetuating misogyny as the mascot of one of the most used pieces of software. Yay!

by hobofan

2/2/2026 at 10:35:02 PM

Look again at the xkcd comic (I did before posting the comment). The sandwich-making person is not obviously female, in fact he(?) looks rather male according to xkcd convention.

by ahartmetz

2/2/2026 at 10:44:03 PM

"make me a sandwich" has been a saying to dismiss women for decades before the xkcd comic existed.

by hobofan

2/3/2026 at 12:36:20 PM

Context always matters. Phrases can also be normalized through everyday use without the negative connections.

by dannyw

2/3/2026 at 12:56:01 AM

This kind of thing is why the left always loses. If you want to win, people have to like you.

by metalliqaz

2/3/2026 at 9:27:10 AM

Thank you :)

by chr1ss_code

2/2/2026 at 6:29:30 PM

Unbelievable, every fortune 500 company should sponsor this you all rely and use this. This makes me so sad I hope this has a good end.

by fHr

2/2/2026 at 6:10:38 PM

I once wrote hacking is ethical. Maybe I meant 'eventual'. Instead of Red-Hat sponsoring sudo, china can sponsor him to put hacks in.

by calvinmorrison

2/3/2026 at 2:11:39 AM

Let's sudo and say we didn't.

by DonHopkins

2/3/2026 at 2:01:51 AM

This is the guy in the XKCD comic holding up the entire stack.

by cr125rider

2/2/2026 at 5:33:27 PM

This is why Big Tech is so desperate for AI to work as a wholesale replacement for software developers: they do not pay for their Open Source consumption as-is, and new maintainers aren’t stepping up because they can’t afford rent, let alone to devote their full time to FOSS work free of charge like a lot of older project maintainers do.

The fact that sudo is a critical security pillar for trillions of dollars of global infrastructure but this guy gets bupkis for it screams volumes about the current state of technology.

We must do better, or it’ll be closed systems (OpenAI, Microsoft, Apple, Google, Oracle) all the way down as maintainers age out, go bankrupt, or die without succession plans in place.

by stego-tech

2/2/2026 at 6:14:39 PM

Why should something like sudo not be "done" after 30 years?

Sudo is one of the poster children for creeping featuritis, to the point that the sudoers man page is a meme ("Don't despair if you are unfamiliar with EBNF ...")

Even OpenBSD gave up and implmented their own simplified replacement (doas).

by SoftTalker

2/2/2026 at 7:27:35 PM

> Why should something like sudo not be "done" after 30 years?

Because new needs arise over time. For example, when I started in IT the "sudoedit" functionality was not present and so allowing someone to do "sudo vi …" would allow them breakout of the editor when it was running as root.

With sudoedit you can give people permissions to edit particular files with elevated permissions.

> Even OpenBSD gave up and implmented their own simplified replacement (doas).

They did not "give up": they found they needed only much simpler functionality shipped in the base OS. For example, sudo has functionality to talk to LDAP (which I've used at multiple jobs over the years), but is not needed for a local-only box. Once you need centralized account and privilege management, doas becomes much less useful.

by throw0101a

2/2/2026 at 7:44:33 PM

> sudo has functionality to talk to LDAP

That is scary! I may need to look more at openbsd

by groundzeros2015

2/3/2026 at 3:10:31 PM

> That is scary! I may need to look more at openbsd

Very useful when you're running fleets of systems that are more pet than cattle.

Ubuntu/Debian are moving to sudo using SSS to talk to LDAP (versus the current sudo-ldap package).

by throw0101a

2/2/2026 at 8:01:15 PM

There's a Linux port of doas named OpenDoas

by overfeed

2/3/2026 at 5:18:23 AM

Distros come with sudo. Scripts assume sudo. Complexity exists there.

by groundzeros2015

2/3/2026 at 11:12:31 AM

solved long ago. https://github.com/jirutka/doas-sudo-shim/

by Piraty

2/3/2026 at 3:42:39 PM

so do I uninstall sudo from my distro? What do I do on upgrade? This shim is available from alpine package manager, can I get it anywhere else?

by groundzeros2015

2/2/2026 at 8:15:26 PM

The purpose is to allow users access by ldap criteria like group so the sodoers file need not be edited on each and every server.

https://www.sudo.ws/docs/man/sudoers.ldap.man/

by adolph

2/2/2026 at 9:01:28 PM

Yeah, that’s not something I would expect a core until to do.

I would expect another system to query ldap.

by groundzeros2015

2/2/2026 at 11:56:45 PM

Let's be honest, though. If you designed a new sudo in a system with doas(1) it would look nothing like modern sudo.

I can't remember the name, but I read about a rust project a few months ago which claimed that even doas had too much feature creep.

by avadodin

2/3/2026 at 3:13:32 PM

> I can't remember the name, but I read about a rust project a few months ago which claimed that even doas had too much feature creep.

Features are added because people cannot do X and want to, and so it is added.

I'm happy to have a spectrum of privilege-escalation utilities of varying capabilities, but just because one person does not need certain functionality (like talking to LDAP) does not mean I don't.

by throw0101a

2/2/2026 at 6:26:03 PM

Different platform but the simplest mainframe utility IEFBR14, a noop process to trigger JCL events started as one instruction. Then two. Then debate started about which machine instruction should be used to set the return code to zero …

by blame-troi

2/2/2026 at 6:28:41 PM

Hence IEFBR14A

by pjsg

2/2/2026 at 7:26:39 PM

Bugfixes and security vulnerabilities, mostly. So long as fallible humans make fallible hardware running fallible software that in turn executes and/or compiles fallible code, there will always be a need for continued development of critical tooling and packages.

On a long enough timeline, those fixes become fewer and less frequent as the codebase improves, but there is no "done" in software unfortunately. Hell, entropy itself means nothing is ever done, just in an ever-changing state.

by stego-tech

2/2/2026 at 11:57:54 PM

Is it really creeping, though? Pretty sure I first saw the EBNF in the man page more than 20 years ago, it's just how that generation learned to write and discuss parsers. (What I'm getting at is that even if it is, that isn't a sign of it.)

Of course, 20+ years ago a big feature was platform compatibility, and since then we've gone from 10+ to 2ish, so if it's not explicitly enabling retrocomputing, it should be getting simpler, right?

by eichin

2/2/2026 at 7:25:31 PM

Even if sudo itself never changed, the system around it changes pretty drastically. I agree the scope of the tool should be smaller and it violates the Unix philosophy (whatever that is worth these days)

by ddtaylor

2/2/2026 at 6:25:04 PM

This community and others like it are so weird in that if they see something as stable as sudo but without recent commits, rather than conclude that it's solid and doesn't need further changes, they see it as some kind of a problem and want to switch to something that's seen major changes in the last week.

Maybe that's somehow related to why so many companies are shoving AI into a bunch of stuff that doesn't need it. Gotta keep everything on the hype train. Working and fulfilling people's needs is no longer good enough.

by asveikau

2/2/2026 at 10:18:46 PM

The thing is, there is next to no software that "doesn't need further changes" at all. There is always something, sure it might be infrequent and/or most of the time nothing really big or difficult (except sometimes) but the point is: someone needs to step up and do it.

If a see a project with recent activity, best from multiple people it is a strong signal that this will happen, if the last commit is a year ago I must assume it's completely abandoned because most of the time it just is. Sometimes it's clearly communicated that it is the way because the authors see it as essentially feature complete, there are some examples of this but not that many honestly.

by catdog

2/2/2026 at 7:30:03 PM

What are you, a dentist moonlighting as an angel investor?

Software is never "done".

The underlying APIs are always changing. The compilers and system libraries are changing.

Featuritis is a thing, but rolling it back is non-trivial as there are folks who depend upon it.

by numbsafari

2/2/2026 at 7:50:25 PM

Just curious, why did you use "dentist" in your analogy over any other profession?

by ycombinatrix

2/2/2026 at 8:19:37 PM

Because environments change, it hasn't been immutable.

by butterfi

2/2/2026 at 7:00:47 PM

Because we haven't progressed to the angelic level of software development, so nothing is bug-free, which especially important in something security-critical like sudo

by eviks

2/2/2026 at 6:30:14 PM

Similarly sudo-rs and doas-rs exist now.

I'm not sure what can be gained for further development of the OG c sudo, add security patches of course.

But fund adding yet another feature 99.9% of users will never use? I can't fathom the justification for that. Just adding attack surface at this point.

Rightly both doas and the *-rs drops ins intend to drop most of those unnecessary features.

by rustyhancock

2/2/2026 at 7:50:56 PM

Are you saying you would be using something that fills the same critical role as sudo even if it had not received any updates in a decade or more? Because that sounds insane

by b00ty4breakfast

2/2/2026 at 6:04:39 PM

This might be a controversial view:

What if the exploitative aspect is open source itself? Trick some above average but naive developers into giving their talent, effort, insights and time away for free or very little? Maybe open source or something similar could have been organized in a way that wasn't exploitative and wasn't (possibly) unsustainable, but that is not how things ended up with what Richard Stallman and others organized.

by whatis991

2/2/2026 at 6:46:05 PM

All of this is true, but ironically Free Software is about ensuring people have control over their computers, and Open Source spun the narrative to make it about getting software cheap or without paying at all.

People having control over their computer (and even having the right to share what they run on their computer!) is completely compatible with people paying for software labor.

by Zambyte

2/2/2026 at 10:41:55 PM

No it isn't. People having control over their own computer is in direct contradiction with people paying for software labor. In an honest world, sure, but in reality, people don't want to pay for shit and are going to steal from you. The Pirate Bay is still running and isn't going away. So is Anna's archive.

by fragmede

2/2/2026 at 7:28:47 PM

We shouldn't let cynical greedy bastards set the terms for how the rest of society wishes to engage

by kristopolous

2/2/2026 at 7:50:47 PM

There can be "cynical greedy bastards" in many places. If you optimize against them in one regard and place, will you also handle them elsewhere well? And calling for change can be abused by some of them to open new opportunities for exploitation, this time benefitting some different group of them.

You need to have an alternative, and it needs to be a credible and reliable one, to ensure that it does not end up being the case that one scam is replaced with another scam.

by whatis991

2/2/2026 at 8:21:35 PM

I really think that criminal theory needs to progress. We differentiate between say consensual intimacy and rape and we don't let the existence of sexual abusive people set the terms for our romantic encounters.

We have carved out a class of engagements, labeled it deeply asocial, criminalized it and now we pursue people who engage in it through legal means.

Business really doesn't have this. Personal example - last week I was at a place where the business owner tried to overcharge me by an order of magnitude and then verbally attacked me when I caught him and backed out of the transaction.

His google and yelp reviews are full of people claiming false charges and all kinds of fraud, refusal to correct and repeated abuse until they closed their cards. It's wildly obvious what's going on here and I was on the ball enough to catch it.

I contacted the police and they said "well you should call the BBB or something". It's dozens of reviews of clear credit card fraud and for some reason because he's a merchant, doesn't seem to hit the radar.

These are purely criminal matters - people acting habitually in bad faith with ill intent in a brazenly dishonest manner.

Whether it's plundering the commons, polluting the public discourse, or breaking other types of social compacts, these should be treated the same as any other crime.

by kristopolous

2/2/2026 at 8:28:28 PM

Does your country allow suing him for a large monetary amount? Have you talked to the media? A lawyer? Maybe together with others? Made it as easy as possible for the police to get him, paper trail, receipts and all?

You do have points, though, but there might at least be some actions that you and others can take in this case. Maybe a medium change like changing the law on this specific point might make sense.

by whatis991

2/2/2026 at 10:05:48 PM

I'm not law enforcement. This shouldn't be my job. If I see someone robbing a store with a mask on and a gun I should be able to call the police, report it, and hand it off.

If there's an accumulation of complaints against this merchant then that should warrant an investigation.

The police have like half the local city budget, can't they do their job?

by kristopolous

2/2/2026 at 6:16:51 PM

I think at least the license should say something like we will charge on a per CPU or whatever basis for commercial usage.

You give it away for free so don’t be surprised to get abused. Human nature working at its best and worst here.

by markus_zhang

2/2/2026 at 6:19:54 PM

The exact moment you charge for something, you need payment processing, a bank, a legal entity to hold said processed funds, you have liability, you need some sort of marketing / sales process (even if it's just copy on a website), and the barrier for someone to use your product is suddenly extremely high, simply because it costs something.

Release it for free, no barrier to entry, no legal liability, the entire world can use it instantly. This is why free software spreads and catches on - precisely because it's free.

There is no way to form a business around FOSS without becoming a gatekeeping high-barrier entity. You can release for free then charge extra for consulting or special features, which many have done and continue to experiment with.

But the core reason why FOSS spreads and took over is precisely why it is difficult to fund. No one is going to pay for something when the alternative is free. And the moment you start to charge some free alternative comes along and your prior users spurn you as greedy

by monero-xmr

2/2/2026 at 7:00:37 PM

The code can become "radioactive" as well when a software library goes paid. It starts phoning home with information about its environment to ensure compliance which is just kinda... icky to most devs. I certainly don't want that bloat in my dependencies.

by hypeatei

2/2/2026 at 8:02:34 PM

That's a good point. There's no good way to ensure your open source (source available?) project isn't being ripped off by some company.

Even if you add functionality to phone home, it can be removed by all but the dumbest offenders.

by ycombinatrix

2/2/2026 at 7:41:08 PM

This is an upfront cost and is possibly a one-time cost per-agreement.

Practically nobody downloads and installs sudo directly from the project website; people install it with their distribution of choice. The agreement could be automated and included in the licensing process. ie: the license gives specific distributions access to the software (either via paid or other agreed-upon terms appropriate to the distribution) and perhaps individual licensing terms for non-commercial entities.

Of course, the bigger ask in this decade is in use for training LLMs. OSS shouldn't be laundered through an LLM (IMHO) for license avoidance. Maybe some projects are OK with that (eg: many BSD licensed works.) There are some that likely aren't.

by imoverclocked

2/2/2026 at 6:47:15 PM

> The exact moment you charge for something, you need payment processing, a bank, a legal entity to hold said processed funds, you have liability, you need some sort of marketing / sales process (even if it's just copy on a website),

That seems like an area that's ripe for innovation. What does it take to get setup on a platform like Patreon? Seems like something similar ought to be setup for open source/independent development, probably an idealistic nonprofit.

> and the barrier for someone to use your product is suddenly extremely high, simply because it costs something.

All the organizations who really ought to pay are already setup to do all that, and do it all the time.

> But the core reason why FOSS spreads and took over is precisely why it is difficult to fund. No one is going to pay for something when the alternative is free. And the moment you start to charge some free alternative comes along and your prior users spurn you as greedy

What we need is innovation. Maybe a license that has a trip-wire? If not enough money is voluntarily deposited into a tip jar over a certain period of time, the license requires a modest payment from all for-profit organizations of a particular size.

That's up-front, is for the most part free, and incentivizes some payment.

by palmotea

2/2/2026 at 6:27:09 PM

I think you have good arguments, but I wonder if there are alternatives that could work in at least some cases. Like, how Unreal engine's license works. Source-available to game developers, but in theory limited to paying customers, or something along those lines.

by whatis991

2/2/2026 at 5:53:37 PM

>"it screams volumes about the current state of technology."

about the current state of Big Corp vampires who are happy to bleed everyone dry to put more $$ in their own very fat pockets

by htx80nerd

2/2/2026 at 6:04:39 PM

Our economic system starves you to death if you don't

People aren't vampires because they're on top, they're on top because they're vampires.

Shit flows downstream

by functionmouse

2/2/2026 at 6:13:56 PM

A change in economic system might be neither sufficient nor necessary, especially if the new economic system turns out to be even worse, or a scam.

One approach is to have expectations to not only the economic system, but also other systems, and the different people involved, no matter if they're on the top, on the bottom, or somewhere in the middle.

by whatis991

2/2/2026 at 5:54:31 PM

Exactly

by softfalcon

2/2/2026 at 5:53:52 PM

Sounds like the system is working as intended...

Not trying to be glib here. This feels like the embrace, extend, extinguish pattern that we jokingly used to think was only Microsoft. It is now becoming more and more obviously the modus operandi of the entire enterprise software ecosystem.

I believe you are correct to be frustrated and ringing the alarm bell. This is a "death of the commons" moment for OSS.

by softfalcon

2/2/2026 at 6:04:01 PM

> and new maintainers aren’t stepping up because they can’t afford rent, let alone to devote their full time to FOSS work free of charge like a lot of older project maintainers do.

What about the Rust rewrite (sudo-rs)? I think it shows people are interested in maintaining and/or modernizing tools taken for granted.

by drnick1

2/2/2026 at 6:17:16 PM

By modernizing do you mean rewriting mature software in a meme language with less features than the original and introducing new bugs in the process?

The Rust smokescreen is mostly being used to slowly eradicate the GPL.

Like Lenin said, "Who stands to gain?"

by tokyobreakfast

2/2/2026 at 6:23:48 PM

"Meme language"? There are plenty of memes about C, and they aren't as flattering.

by wrs

2/2/2026 at 6:07:50 PM

It has a more lax license AFAIK. Also, many Rust projects and libraries have been abandoned, or are in so-so shapes.

Edit:

To specify, new projects like sudo-rs may seem promising, but going by observation and experience with similar projects, there is no guarantee that sudo-rs and similar projects will be successful, good and continued to be maintained. The problems with old projects can end up applying to new projects as well. And projects in Rust are no exception, going by experience with existing, older Rust projects.

Aside, a pet peeve I have is that for instance Ruffle has not turned out as successful as I had hoped for, even after several years and many sponsors. The proprietary Flash runtimes written in C still outperform Ruffle greatly in some cases, causing problems for some users that want to use Ruffle instead of other runtimes.

by whatis991

2/2/2026 at 6:15:40 PM

> Also, many Rust projects and libraries have been abandoned, or are in so-so shapes.

This seems like a bit of a non-sequitur; the state of non-sudo-rs projects/libraries says nothing about the state of sudo-rs itself.

Not to mention that I'd imagine a similar statement would probably be true for projects and libraries written in any reasonably popular language.

by aw1621107

2/2/2026 at 10:33:48 PM

If there are 1000 projects that aren't sudo-rs but are similarly load bearing, and they have all been abandoned/in so-so shape, you're right that it doesn't actually say anything about sudo-rs, but there's a highly probable outcome that will be inferred by most people. Incorrectly or otherwise.

by fragmede

2/2/2026 at 6:18:38 PM

How is this a counter argument for anything? A more permissive license is not inherently a bad thing. Many C and C++ projects are also abandon or in so-so condition, why you uniquely call out Rust makes little sense. Either sudo-rs fills the void or it doesn't, but it is a counter point to this idea that open source projects have no path of evolution. Just because that path doesn't look like how you want it to doesn't mean it doesn't exist.

by voxl

2/2/2026 at 7:14:00 PM

> It has a more lax license AFAIK.

Sudo uses the OpenBSD license, while sudo-rs is dual licensed under MIT and Apache 2.0. Both licenses seem equally permissive to me.

by ndiddy

2/2/2026 at 7:26:48 PM

IMO rust rewrites are done quickly to gain attention and kudos. They are very rarely maintainted to the same quality of the originals.

by alt227

2/2/2026 at 9:18:58 PM

Yes, I'm sure they also founded a whole foundation[0] to do that just for "attention and kudos".

[0]: https://trifectatech.org/

by hobofan

2/2/2026 at 6:27:08 PM

maintainers need to learn to say "no" to scope creep and entitled users.

sudo should have been a near complete tool after it was written.

by arccy

2/2/2026 at 7:30:24 PM

So no #includedir, no LDAP integration, no log_input/output, no PAM integration ...?

by sllabres

2/2/2026 at 6:35:53 PM

I've always favored the view that digital goods are only scarce until they are released. if we had a market for patch releases once they hit some goal. Uses could tip to reach the goal. After the goal is reached the patch is released and to all. Still have free loaders but one might live on the work

by pwndByDeath

2/2/2026 at 6:37:55 PM

So...crowdfunding via a platform like Kickstarter?

by WorkerBee28474

2/2/2026 at 5:51:53 PM

Honestly, it seems like the idealism of open source shouldn't have survived its contact with capitalism, but I suppose the contact wasn't painful enough the the exploitation continued for a long time.

Maybe we need a license that's even more onerous to corporations than the AGPL, like something with a revenue share clause.

Or maybe the problem is the naivete of software engineers. In aggregate, there was so much embrace of libertarianism that no groundwork was laid to protect ourselves from things like AI and offshoring.

by palmotea

2/2/2026 at 5:56:50 PM

Been pitching that with my FOSS colleagues and peers for years, now. A license for individual and educational use, but pay-to-play for anyone tangentially making revenue from its use. Then the conversation boils down to the business engineering of how much should something cost, with some arguing for flat yearly rates, and others arguing for cost-per-unit, while others still fret about "disrupting" the status quo immediately after acknowledging its untenability.

It's...frustrating, but those who do the work are the most qualified to explain what they need. For the rest of us, it's encouraging them to seek reasonable compensation for their work from those who exploit it for profit, and that doing so doesn't necessarily go against the spirit of open source.

by stego-tech

2/2/2026 at 6:10:01 PM

can't wait for popularity-contest(1) to be mandatory and required a linked credit card.

by calvinmorrison

2/2/2026 at 5:57:09 PM

> the idealism of open source shouldn't have survived its contact with capitalism

The US economy of the 1980s, 1990s, and 2000s made it possible.

by acuozzo

2/2/2026 at 6:00:08 PM

I don't mean to come across as far too cynical, but in what world has a software license ever stopped the greedy and powerful from pillaging the IP of other people smaller and weaker than them?

In my opinion, libertarianism in software is a hollow dream that leads people to make foolish decisions that can't be protected. This makes it easy for corporations to exploit and quash any barely audible opposition.

Almost as if by plan, the libertarian mindset has eroded and weakened open source protections, defanging and declawing it every step of the way.

by softfalcon

2/2/2026 at 5:25:26 PM

Quote from Website: "For the past 30+ years I’ve been the maintainer of sudo. I’m currently in search of a sponsor to fund continued sudo maintenance and development. If you or your organization is interested in sponsoring sudo, please let me know."

by wodniok

2/2/2026 at 6:14:46 PM

But today people can just vibe code their own sudo "with blackjack and hookers!"

/s

Really though, it is remarkable just how high we've built this towering house of cards on the selfless works of individuals. The geek in me immediately begins meditating on OSS funding mechanisms I've seen in the past, and what might work today. Then I remember that I don't believe it can work, but hope desperately that people like Todd can keep paying rent and continue getting some satisfaction from the efforts.

by zerotolerance

2/2/2026 at 10:11:47 PM

[flagged]

by gsich