Top
Best
New

Posted by akersten 23 hours ago

Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords(pbxscience.com)
324 points | 333 commentspage 7
pojntfx 21 hours ago|
It's fun, leading edge Linux distros (e.g. GNOME OS) are actually currently removing `sudo` completely in favour of `run0` from systemd, which fixes this "properly" by using Polkit & transient systemd units instead of setuid binaries like sudo. You get a UAC-style prompt, can even auth with your fingerprint just like on other modern OSes.

Instead of doing this, Ubuntu is just using a Rust rewrite of sudo. Some things really never change.

timhh 21 hours ago||
You make it sound like there was a discussion where they looked at these two alternatives and chose improving sudo over using run0. Actually I just submitted a patch for this and they accepted it. I don't work for Ubuntu and I didn't even know run0 existed until now (it does sound good though; I hope they switch to that).
rich_sasha 20 hours ago|||
Why is running a command as an ephemeral systemd unit better? Just curious, I don't have an opinion one way or the other.

Without knowing more, creating a transient unit just to run a single shell command seems quite roundabout.

1una 21 hours ago|||
It's possible to auth with your fingerprint (or even a YubiKey) in sudo. It's a functionality provided by PAM, after all.
silisili 21 hours ago|||
Ubuntu truly are masters of going all in on being different in a worse way, only to about face soon thereafter.

You'd think by now they'd have learned, but apparently not.

necovek 21 hours ago|||
Courage to be different is an open door to creativity.

Yes, it means going in a wrong direction sometimes as well: that's why it takes courage — success ain't guaranteed and you might be mocked or ridiculed when you fail.

Still, Ubuntu got from zero to most-used Linux distribution on desktops and servers with much smaller investment than the incumbents who are sometimes only following (like Red Hat).

So perhaps they also did a few things right?

(This discussion is rooted in one of those decisions too: Ubuntu was the first to standardize on sudo and no root account on the desktop, at least of mainstream distributions)

silisili 21 hours ago||
Ubuntu became the most used because they were the first to really dumb down the install process. No insult intended, it was my first distro as well. If you weren't around, it was rather stark. Most others had install media that just loaded a curses based install menu, asking you about partioning. Ubuntu gave you a live environment and graphical installer, which didn't ask any hard questions... way ahead of their time.

Nobody picked Ubuntu because of Mir, or Compiz, or Upstart(or snaps, while we're on the topic). They were obvious errors. That it's popular doesn't negate that fact.

necovek 19 hours ago|||
I'd say good hw support, no nonsense live installer, and free CDs worldwide got their foot in the door. And 6 months release cycle matching GNOME + 2 months.

Mir/Compiz/Snaps came much-much later (snaps are as much a mistake as flatpak is: they make sense, but are notoriously expensive to make; Unity was a better UX than Gnome Shell 3, but it did not pay...).

However, none of this explains Ubuntu's penetration on cloud servers.

Canonical was actually solving exactly the same problems Red Hat was, just with much lower investment. Their wins made them dominant, their losses still allowed them to pivot to new de facto standards (like systemd too).

prmoustache 19 hours ago||||
> Ubuntu became the most used because they were the first to really dumb down the install process.

That is an urban myth relayed by people who weren't even using Ubuntu in its early days.

Other distros were as easy to install as Ubuntu even before Ubuntu was founded. Besides Ubuntu was using the then experimental debian installer you could already use with a regular debian. They just shipped it on the default CD image earlier than debian did.

What they did to be on top was using Mark shuttleworth's money to ship an insane amount of free install CDs to anyone asking for them which meant that for a small period of time, when most people were on dial up internet ISDN and shitty ADSL, Ubuntu went suddently to be the number one distro installed. A friend, family member or coworker was curious about Linux? You'd hand him one of the fifty Ubuntu CDs you had lying around. I know I was one of those handing out CDs left and right. It was a time when to get an install CD without broadband you'd have to buy a magazine, and you didn't get to choose which distro was featured each month, a book or a boxset (not available everywhere). Later all those many early ubuntu adopters became ubuntu evangelists.

But bar a few exceptions like slackware, debian with the default vanilla installer or gentoo, there was nothing particular about the ubuntu install experience compared to other distros. Mandrake, Corel Linux ans Xandrows for example provided super easy install experience even before Ubuntu became a thing.

silisili 8 hours ago|||
I'd largely forgotten about Mandrake/Mandriva, did they offer a live environment with installer as a GUI application? I'd tried to install Mandrake probably closer to the year 2000 and it certainly did not, but, there's a 4 year gap there that's a blind spot for me pre-Ubuntu.

Never messed with Corel as it wasn't around long, so can't speak for that one.

Focusing more on say, 2005ish, can you think of other examples?

necovek 19 hours ago|||
While Ubuntu did build on Debian testing/unstable, they did invest in building the GUI on top of everything, paying salaries for a few Debian developers.

With a very slim team (I am guessing 15-30 in the first couple of years), they picked Python as the go to language and invested heavily in development tooling making it possible for them to innovate and pivot quickly. Yes, they grew to a mid size company of 500-1000 over time, but also expanded into many different areas.

Perhaps one can also make a case for them effectively starting and killing a number of projects akin to Google, except they usually made them open source, and some live on as volunteer efforts (eg. ubuntu touch).

dizhn 19 hours ago|||
The free CDs they sent worldwide to whoever asked was huge too.
egorfine 16 hours ago|||
> You'd think by now they'd have learned, but apparently not.

No. Suffering is the crucial part of virtue signaling, so bugs in slop rewrites are a feature, not a bug.

CodeCompost 21 hours ago|||
How can you stop it asking your password every single time? I asked my LLM and it hallucinated Javascript at me.
bblb 20 hours ago||

  echo "$USER ALL=(ALL) NOPASSWD:ALL" | sudo tee "/etc/sudoers.d/$USER"; sudo chmod 0600 "/etc/sudoers.d/$USER"

  sudo mkdir -p /etc/polkit-1/rules.d

  echo 'polkit.addRule(function(action, subject) { if (subject.isInGroup("sudo") || subject.isInGroup("wheel")) { return polkit.Result.YES; }});' | sudo tee /etc/polkit-1/rules.d/00-nopasswd.rules
Elhana 20 hours ago|||
Gnome is known for shitty UX, breaking stuff every release and refusing to fix stuff since Gnome3.
gzread 21 hours ago|||
Is "GNOME OS" really a leading distro?
LeoPanthera 21 hours ago||
I think they mean "leading edge".
mikkupikku 20 hours ago||
Losing edge.
b112 20 hours ago||
For more than four decades, typing a password after a sudo prompt in a Linux terminal

What?!

2026 minus 46 is 1980. There was no Linux, at all, in 1980.

Someone is quite confused.

throawayonthe 20 hours ago|
sudo is from 1980, that's probably what they meant

https://www.sudo.ws/about/history/

b112 9 hours ago||
No, they simply don't understand the history of the very thing they report on. If you look at the quoted text, they easily could have said 'Unix" terminal.

They also repeatedly talk about a 'half century' of Linux terminals in other parts of the article. This site seems to cater to Linux specifically in many respects, so it's quite reasonable to call them out on super-simple stuff.

devnotes77 9 hours ago||
[dead]
chmorgan_ 10 hours ago||
[dead]
gzread 22 hours ago||
Good. It's terrible UX.

The security argument is a red herring. It was originally built with no echo because it was easier to turn echo on and off than to echo asterisks. Not for security.

zenethian 21 hours ago||
You got some sources or did you just make that up?

Because to hell with UX when it comes to security. Knowing the exact length of a password absolutely makes it significantly less secure, and knowing the timing of the keystrokes doubly so.

9dev 21 hours ago|||
Yet somehow, none of the other high security tools I have ever interacted with seem to do this for some reason. No auditor flags it. No security standard recommends hiding it.

But SUDO is the one bastion where it is absolutely essential to not offer hiding keystrokes as an obscure config option, but enable for everyone and their mother?

creatonez 20 hours ago|||
And once you start adding these accessibility problems, people will respond by using weaker passwords.
hrmtst93837 7 hours ago||||
This is security theater. Masking sudo input does nothing against keyloggers, shoulder-surfing, or anyone reading your terminal, and pretending password length is the deciding leak ignores the much larger attack surface around a compromised box. If password length is where your threat model gets scary you've already lost.
baq 19 hours ago||||
> Because to hell with UX when it comes to security.

I don’t think you have any idea how wrong you are.

plorkyeran 13 hours ago|||
Bad security UX that results in users bypassing security mechanisms entirely is probably the single biggest source of real-world security problems.
themafia 21 hours ago||
> easier to turn echo on and off than to echo asterisks.

One implies the other. You turn echo off. Then you write asterisks.

> Not for security.

Consider the case of copy and pasting parts of your terminal to build instructions or to share something like a bug report. Or screen sharing in general. You are then leaking the length of your password. This isn't necessarily disastrous for most use cases but it is a negative security attribute.

mikkupikku 20 hours ago|||
> One implies the other. You turn echo off. Then you write asterisks.

That's not how it works. Sudo turns off echo but otherwise keeps the terminal in it's normal cooked canonocal mode, meaning sudo only sees what you've entered after you hit enter. To print asteriks as you type requires putting the terminal in raw mode, which has the addition consequence of needing to implement shit like backspace yourself. Still a UX win worth doing, but it's pretty clear that skipping that and just disabling echo is an easier lazier implementation.

themafia 18 hours ago||
You're correct, but, the echo and canonical mode flags are literally in the same termios structure member. One is no more complicated to change than the other. You can also easily switch to character at a time read() which makes handling backspace, erase or kill exceedingly simple.

I still doubt the claim the scheme employed by sudo was done because it "was easier."

mikkupikku 13 hours ago||
The first is like 3 lines of code, to get the attrs, disable the echo flag then set the attrs again. The second is.. I don't know probably about twenty lines of code to handle the primitive line editing yourself and also asterisk printing. In my view, this is enough of a difference to motivate a conclusion that the first is good enough. Also note that this decision was made back in the early 70s when login was first implemented, and it established a convention which was very easy and convienent to carry forward to su and later sudo.
uecker 21 hours ago||||
I would be worried more about leaking the timing of the key presses.
gzread 21 hours ago|||
Leaking the length of your password is about as bad for security as leaking the fact that you have a password, or that you use sudo.
ikari_pl 21 hours ago||
It narrows down the brute force domain by several orders of magnitude
emil-lp 21 hours ago||||
That's obviously false. It narrows it down less than a factor the length of the password, so unless your password is several orders of magnitude, it lowers narrows by a factor of ~8.
adrian_b 18 hours ago||
That is obviously true, not false.

If you know that a password is no longer than, e.g., 10 characters, that narrows down the search domain by many, many orders of magnitude, in comparison with the case when you did not know this and you had to assume that the password could have been, e.g. 18 characters long.

If you test the possible passwords in increasing length, then knowing the length would not shorten much the search, but not knowing the length may prevent an attempt to search the password by brute force, as such an attempt would fail for longer passwords, so it is not worthwhile to do unless success is expected.

With modern hashing schemes, which require both a lot of time and a lot of memory for each tested password, even one extra character in the password can make the difference between a password that can be cracked in a useful time and one that would take too much time to crack, so knowing the length can be very important for the decision of an attacker of trying the exhaustive search approach.

Knowing the length is less important only for the users who are expected to choose easy to guess passwords, as there are much less of those than the possible random passwords.

hananova 1 hour ago||
Well yes, but now that you get feedback while you type, it's much easier to have a longer password, because typos are much easier to spot and fix.

I generally use a (unique) 50-ish character passphrase anywhere I need to actually type it myself (and 64-character completely random ones elsewhere) and before this change, the passwords on my linux machines were shorter than that because it was impossible to spot/fix typos.

gzread 21 hours ago|||
No, it doesn't. The set of all passwords of exactly length N is about 1% smaller than the set of all passwords up to and including length N.
adrian_b 19 hours ago|||
The point is that you know that the password is not longer than N.

This indeed reduces the search domain by many orders of magnitude, i.e. by more than an order of magnitude for each character that you now know that it is not used by the password.

Knowing the length of the password does not matter only in antediluvian systems, which had severe restrictions on the length of a password, so you already knew that the password is no longer than, e.g., 8 characters.

gzread 18 hours ago||
Bruteforce search in increasing length order will find the password in within 1% of the same amount of time
themafia 18 hours ago|||
> is about 1% smaller

Isn't it 10%?

gzread 18 hours ago||
If there are 9 different characters that can be in a password.
exac 20 hours ago||
Could we not have used braille patterns? Start on a random one and you can just replace the character with the next one so it is possible for the user to see something was entered, but password length isn't given to someone looking over the user's shoulder?

⣾, ⣽, ⣻, ⢿, ⡿, ⣟, ⣯, ⣷

jurf 20 hours ago||
That seems like it would be hard to see, even for the person sitting right in front of it.
imjustmsk 20 hours ago||
why can't they just look at the keyboard...
childintime 20 hours ago|
46 years of silent sudo passwords.. it just demonstrates how crazy this world is, if this is considered news. It means the code is a living fossil and people live with that fact, instead of demanding (infinite and instant) control over their systems.

This reminds me. Linux was already a fossil, except for some niches, but now in the age of AI, the fact that code can't be updated at will (and instead has to go through some medieval social process) is fatal. Soon the age will be here where we generate the necessary OS features on the fly. No more compatibility layers, no more endless abstractions, no more binaries to distribute, no more copyright, no need to worry about how "the others" use their systems, no more bike shedding. Instead, let the system manage itself, it knows best. We'll get endless customization without the ballast.

It's time to set software free from the social enclosures we built around it.

Retr0id 20 hours ago|
I'm excited about the future of mutable software, but sudo isn't exactly the kind of thing you want to be patching on-the-fly.