Further validation of our decision to move to Debian (as if the sluggish kernel updates and ramming of snaps down our throats weren’t enough). We migrated a few hundred lab machines this summer, and have around half of our servers and containers switched over. It has gone very smoothly.
We're an redhat (originally) and derivatives based shop for 30 years now, but if I was going to choose a different stable enterprise level distro to base a fleet on, there's a very good chance it would be Debian.
The Rustaceans will come for you too. While you’re asleep, they’re watching Claude port the entire Debian userspace to Rust in the name of Jesus Christ amen.
I honestly don't understand why there isn't more people talking about debian. Ubuntu is always mentioned, but it's going down hill, and debian is the obvious alternative. When I went from Ubuntu to debian, I got way more recent versions of my software. That used to be the only complaint people had with debian.
I used to use ubuntu for most everything. This year I'm trying arch a la cachyos. It's actually super nice to not have to wait for hardware support and security patches. Has anything broken? Nope. In fact, things that I would just have to deal with as "teehee isn't linux quirky?" shit is mostly gone. Turns out that it really is as simple as canonical and gnome being the problem.
You can perfectly write a replacement with advanced features w/o breaking anything. Best example breadth-first implementation of find. It mostly exists because find can't handle statx and so doesn't have access to all file properties like their birthtime.
It's 100% compatible to find plus some additional features. That's why it mentions find's manual for the basics and only points out what was added on top in its own manual.
If you read the article you would know this is a regression, not an improvement. Stuff breaking silently is never good. If you change config options error when you read the config file that no longer works.
It's not a regression, it's a documented, deliberate decision to change the behaviour of the program.
The sudo-rs 'sudoers' manual page suggests that this is a deliberate decision, which makes the Rust version of sudo very definitely not a compatible implementation. The manual page has a nice full section and description of 'Wildcards', and then at the end casually says:
> Wildcards in command line arguments are not supported—using these in original versions of sudo was usually a sign of mis-configuration and consequently sudo-rs simply forbids using them. The only supported use is ‘*’ as the final argument to indicate “zero or more subsequent arguments as noted above.
The manual should probably drop the wildcards section it's not implementing anyway, though.
To many of us it's not about the features which you obliquely refer to when you say "evolve" but about licensing. It's extremely concerning that we're replacing GPL stuff for non GPL, and just as concerning that so many folks don't recognise this point.
Well, in the AI-powered future, you can reverse engineer and patch about anything without the source, too. That's not an argument against the GPL, but everything you can download is now effectively source-available for a modest fee to an inference provider.
MIT is a source code license. If you have MIT licensed source code then you already have the source code and can fix it yourself. No different than GPL.
Licensing is downstream of software existing. The person who actually writes software gets to make the license. If you want a GPL one you have to make that.
Maybe the GPL people need to get with the times, then. LLVM exists largely because the GCC people were so obstinate. I'm a big believer in copyleft software, but it only works if people want to use your software with their projects.
LLVM was supposed to be a virtual machine initially, hence the (original) name: Low-level virtual machine. The direction that it took, and especially the development of Clang: that was at least partially because of GCC's intentional anti-modularity.
> At least the command is still called sudo or run0
You're happy it's a knockoff?
> would have been a much more breaking change
All these "Rust rewrite" projects are creating breaking changes all over the place, whilst solving no real problems. They can shove them up their arses.
It’s not a knockoff. They have a friendly relationship with the original creator of sudo. And their work helps uncover bugs of the original sudo so they send fixes upstream.
Friendly relationship or not, the end user experience is that something that was working, no longer is, because it's not feature compatible. This is despite it being used to replace it under the same name. If it had been `runas` or anything else it'd be fine.
There's a strong principle in upstream Linux kernel about "You don't break userspace"[1], that I really wish more folks would get into their heads, but most especially a variant "You don't subtly break userspace".
If you're going to replace an existing binary, under the same name, you need to be like-for-like in commands, even if your guts are completely different. Very few people give a damn about how it's actually implemented, just does it do what they need it to do.
If you want to do things differently, do it under a different name and have it be an explicit break for an end user by not shipping with the original and let people choose to install it if they really don't want the new thing. Breaking things subtly is completely unacceptable.
Yeah "You don't break userspace" refers to the kernel <-> userspace interface (libc) because that's the smallest common denominator and the reason why stuff like snap works.
Besides that userspace has been incompatible between distros for at least 30 years because everyone has that one special patch the library needs on their distro that isn't accepted upstream and breaks things beyond repair.
This was already the case in the 1990s when Applixware shipped 30 different versions of their software on one CD-Rom because it should run on different distros and their versions.
And back then there weren't that many, mostly Red Hat, SuSE and Debian.
I can’t stress this enough: there are—rightfully—a whole bunch of people that simply do not want to work on C codebases, because in the typical case, working wIth C sucks. Your outbursts are never going to change this, no matter how petulant or vitriolic. Amazing how a group of people has made “[aversion to{ languages with far fewer footguns” into some sort of culture war issue. Sorry that the industry is forcing you to read a book or whatever.
>Tools have to be allowed to evolve. Half the Linux ecosystem's problems are caused by sticking on some design that made sense in 1980.
the other half of the problems are from people who think redesigning the wheel is a good idea and try to wedge conformity-breaking tools into the thing.
Sudoers glob expressions are a horrible footgun and I have little empathy for anyone complaining about their removal, especially when it’s trivial to fix with 3 extra (explicit) lines.
I do manage more than a handful of machines, and that means using automation tools and IaC as much as possible, while avoiding humans using shells as much as possible. I’m struggling to enumerate a lot of use cases for a bespoke sudo configuration that shouldn’t be a proper setup.
If you're not in the user community of a tool, having an opinion on whether or not the replacement should work doesn't seem like it should matter to you at all.
With NOPASSWD you would also invite someone pulling a `.deb` via `curl` as part of a supply chain attack in a some non-descript NPM package via a git hook or something.
Theress a bug. That happens. Reporting it should take way less time than writing a sarcastic blog post ("I haven't filed a bug because we aren't Canonical's free debugging resource"). It's open source, so I think reporting bugs or submitting a PR is just good citizenship.
It works fine, has broad support for many packages from Canonical, has well over a decade of kernel and core program updates (up to 15 years for free up to five computers with a personal account!) and is often the target distribution for third-party packages. Most guides for professional software target either Red Hat or Ubuntu, and many driver packages for platforms like Arch are just the Ubuntu .debs that are extracted and shoved back into a different format.
If you need to run a five year old version of [PHP|Apache|Nginx|Caddy|whatever], Ubuntu is a solid bet. None of that "we need to update our configuration to a new format to solve a criticial CVE issue" nonsense, for much longer than Debian is offering free labour.
Debian has its own flaws, like its controversial patches, lack of real LTS releases, and lack of business contracts guaranteeing support directly from the source if you're a business.
I have yet to encounter any issues with either sudo-rs or their coreutils rewrite. From what I've come to expect from utcc.utoronto.ca, I'm not surprised they're using some obscure feature that Canonical chose to remove, though. I'm surprised they're even running Ubuntu.
I'm answering the question "why do people use Ubuntu".
I'm also of the opinion that sometimes change is good. The Linux world is held back by design decisions and quirks coded into ancient operating systems that have long since died.
Luckily for the people on old Ubuntu versions, Ubuntu 24.04 without the sudo-rs rewrite will be supported until May 2034 or May 2039 if you pay up. The sudo-rs people have about 7-8 years to fix any problems that might exist before you have to think about doing `sudo do-release-upgrade`.
Ayenertia, 'tis not to be under-estimated. Tis why, with certainty, many a hacker here maintain some rudimentary Facebook account despite an open disdain for Meta.
I started off with Ubuntu in the 2010s because I wanted to try out Linux but was sure as hell didn't have the patience nor resources to make consumer conveniences like WiFi just work. The local LUG was also heavily promoting it; that's even more inertia.
Then I got fancy and started really customizing my configuration---I got a dotfiles repo. The oldest commit touching a top-level file in my dotfiles is 11 years ago (almost unthinkable to me!). I haven't really tried it out on any other distro but I'm pretty sure I've written some shim or personal bash command relying on something Ubuntu-specific.
I happen to be in the market for a new laptop right now. I'm looking at Starlabs but unfortunately they do not ship with Debian. Today, however, I saw a random woman in a cafe with Linux Mint so that might be my sign to investigate that ecosystem.
Ubuntu typically has more packages available and newer versions of them, besides supporting PPAs and Snaps to expand the easily available software.
Also, Gnome and KDE are both horribly unintuitive for newcomers. Ubuntu makes a several tweaks to Gnome to make it more user-friendly. Debian just gives a list of names and says to choose one or more.
From my experience, Kubuntu barely changes anything about KDE these days, and that's a good thing, too. I compile my own KDE on my usual machines, but I also have stock Kubuntu on one, and it's pretty much the same.
I run Ubuntu on my framework laptop. I still run Win11 on my desktops to play games and to have less faff when remoting into work.
I want the simplest possible experience. There is more documentation for Ubuntu, which means things are more likely to work. Or if they don’t work, someone might have posted about the issue.
sudo being slightly different doesn’t make a difference for me when my laptop experience of sudo is “sudo apt …”.
There's a lot of inertia. That is leading to various major companies shipping their software for, and only supporting, Ubuntu, and if you're lucky Red Hat.
One reason is that we have a lot of developers who get into programming in the last 10 years. Ubuntu was catering directly to "beginners". Many people who only used Ubuntu because they wanted "a linux" never really reconsidered and just use what they know (and often don't even know there are other options).
Debian releases lag behind quite considerably. Debian 13 for instance comes out of the box with Python 3.13, whereas Ubuntu 26.04 LTS comes with Python 3.14.
I should note I am a Debian diehard been using it 20 years my main workstation is still on deb12 lol. But recently I have been pivoting away from Debian and towards Fedora. Running Fedora 44 on my Framework 13 Pro and my Chuwi N150 netbook and it has been very stable and pleasant. Relatively cutting edge, too. I am on KDE 6.8 for instance.
PLEASE don't spread misinformation. Debian releases every 2 years (usually summer of odd years). During the summer of even years, Ubuntu takes what is in debian, makes a copy, and calls it their release. Thus they leapfrog. For python specificall, the main maintainer is even the same person in both. It's not possible for Debian to "lag behind quite considerably". Here's the current situation:
The ubuntu server reporting this is super slow (one of a million paper cuts you suffer when you use ubuntu instead of debian). The latest Debian stable has 3.13.5 as you say. The latest ubuntu lts release (i.e. what anybody actually uses) was released a year later, and has 3.14.3. Next summer, Debian will be ahead. Also note that the current bleeding-edge ubuntu is 3.14.8-1, which is exactly the same as the bleeding-edge debian. Because they're copies of one another
And this is why you don't just jump to rust-written alternatives because they're supposedly "safer": the "safer" implementation might actually be incompatible (intentionally or otherwise) from the original, which for something like sudo or coreutils is... Erm, kinda important. Maybe "rewrite it in Rust" was a bad idea after all...
Seems in Linux land, compatibly, even between distros, is going out the window. :(
Individuals can deal with that, but companies will have a hard time. You would think the Linux Foundation (LF) would chime in with all these differences. But they seem more concerned with AI than Linux these days.
If it was up to me, I would standardize on OpenBSD's doas, but me doing that would make for more incompatibilities.
my weekend project is moving them over to debian.
it pains me, ubuntu used to be “the” linux i would point people to. the “un-fuckup-able” thing people should try if they’re switching.
Are you know running debian with testing or unstable?
At least the command is still called sudo or run0. Changing it to doas would have been a much more breaking change.
Alas, TFA blocks me with no workaround because I'm using Tor Browser so I can't read about the nature of the changes.
It's 100% compatible to find plus some additional features. That's why it mentions find's manual for the basics and only points out what was added on top in its own manual.
sudo-rs is MIT-licensed: https://github.com/trifectatechfoundation/sudo-rs/blob/main/...
Perhaps you are thinking of uutils? https://github.com/uutils/coreutils/blob/main/LICENSE
GPL would be ideal, MIT is okay, but in our new AI-powered future, we may not even need the source code:
https://bramble-apps.github.io/
Maybe all software will become open source or free software?
They are slow-rolling the cancellation of Stallman's connection to the OS because their first attempt failed.
In 10 years, no one will have heard of GNU after all components have been replaced with corporate clones.
Where is this GPL-licensed sudo that already exists?
"if you want people to use open chat protocols, you need to make user-friendly clients"
"we already have irssi"
the vast majority of people abandon IRC for discord
shocked Pikachu face from the free software community
Great, then give it a new name.
> At least the command is still called sudo or run0
You're happy it's a knockoff?
> would have been a much more breaking change
All these "Rust rewrite" projects are creating breaking changes all over the place, whilst solving no real problems. They can shove them up their arses.
There's a strong principle in upstream Linux kernel about "You don't break userspace"[1], that I really wish more folks would get into their heads, but most especially a variant "You don't subtly break userspace".
If you're going to replace an existing binary, under the same name, you need to be like-for-like in commands, even if your guts are completely different. Very few people give a damn about how it's actually implemented, just does it do what they need it to do.
If you want to do things differently, do it under a different name and have it be an explicit break for an end user by not shipping with the original and let people choose to install it if they really don't want the new thing. Breaking things subtly is completely unacceptable.
[1] espoused really clearly, as part of an infamous rant https://lore.kernel.org/all/CA+55aFy98A+LJK4+GWMcbzaa1zsPBRo...
Besides that userspace has been incompatible between distros for at least 30 years because everyone has that one special patch the library needs on their distro that isn't accepted upstream and breaks things beyond repair.
This was already the case in the 1990s when Applixware shipped 30 different versions of their software on one CD-Rom because it should run on different distros and their versions.
And back then there weren't that many, mostly Red Hat, SuSE and Debian.
Starting anew WILL introduce new bugs. This is a statistical certainty.
Most Rust rewrites are justified upon imaginary boogeymen. The complex security nightmares of 'cp' 'ls' and 'rm' were begging for a new design.
the other half of the problems are from people who think redesigning the wheel is a good idea and try to wedge conformity-breaking tools into the thing.
I hope this copy works https://pastebin.com/mxAZyQJL (I was surprised the website even blocked archive.ph with "suspicious old browser")
You can install it in replacement as sudo on Linux.
> That being said there definitely should be an automated way to check for incompatibilities between normal and rust sudo.
yes. it’s called the bare minimum.
With NOPASSWD you would also invite someone pulling a `.deb` via `curl` as part of a supply chain attack in a some non-descript NPM package via a git hook or something.
Yeah, no.
You either use `sudo` when you want full root access or for something completely trivial.
I remember 20 years ago Ubuntu was marginally more user friendly. Is it the power of inertia? Ubuntu is just Debian actively made worse.
If you need to run a five year old version of [PHP|Apache|Nginx|Caddy|whatever], Ubuntu is a solid bet. None of that "we need to update our configuration to a new format to solve a criticial CVE issue" nonsense, for much longer than Debian is offering free labour.
Debian has its own flaws, like its controversial patches, lack of real LTS releases, and lack of business contracts guaranteeing support directly from the source if you're a business.
I have yet to encounter any issues with either sudo-rs or their coreutils rewrite. From what I've come to expect from utcc.utoronto.ca, I'm not surprised they're using some obscure feature that Canonical chose to remove, though. I'm surprised they're even running Ubuntu.
I feel like this is just ignoring the issues raised in the post, or saying “well, I didn’t use those features so I don’t care”.
You personally not caring is ok. The distro not caring is generating some hate.
I'm also of the opinion that sometimes change is good. The Linux world is held back by design decisions and quirks coded into ancient operating systems that have long since died.
Luckily for the people on old Ubuntu versions, Ubuntu 24.04 without the sudo-rs rewrite will be supported until May 2034 or May 2039 if you pay up. The sudo-rs people have about 7-8 years to fix any problems that might exist before you have to think about doing `sudo do-release-upgrade`.
I started off with Ubuntu in the 2010s because I wanted to try out Linux but was sure as hell didn't have the patience nor resources to make consumer conveniences like WiFi just work. The local LUG was also heavily promoting it; that's even more inertia.
Then I got fancy and started really customizing my configuration---I got a dotfiles repo. The oldest commit touching a top-level file in my dotfiles is 11 years ago (almost unthinkable to me!). I haven't really tried it out on any other distro but I'm pretty sure I've written some shim or personal bash command relying on something Ubuntu-specific.
I happen to be in the market for a new laptop right now. I'm looking at Starlabs but unfortunately they do not ship with Debian. Today, however, I saw a random woman in a cafe with Linux Mint so that might be my sign to investigate that ecosystem.
Never been happier.
Also, Gnome and KDE are both horribly unintuitive for newcomers. Ubuntu makes a several tweaks to Gnome to make it more user-friendly. Debian just gives a list of names and says to choose one or more.
It is mostly just inertia though.
I want the simplest possible experience. There is more documentation for Ubuntu, which means things are more likely to work. Or if they don’t work, someone might have posted about the issue.
sudo being slightly different doesn’t make a difference for me when my laptop experience of sudo is “sudo apt …”.
The GPU and unified memory is great though.
I should note I am a Debian diehard been using it 20 years my main workstation is still on deb12 lol. But recently I have been pivoting away from Debian and towards Fedora. Running Fedora 44 on my Framework 13 Pro and my Chuwi N150 netbook and it has been very stable and pleasant. Relatively cutting edge, too. I am on KDE 6.8 for instance.
Despite that it was just upgrade to new OS version and SSD replacement.
Though one of servers is getting upgraded to Debian from Ubuntu adware.
Individuals can deal with that, but companies will have a hard time. You would think the Linux Foundation (LF) would chime in with all these differences. But they seem more concerned with AI than Linux these days.
If it was up to me, I would standardize on OpenBSD's doas, but me doing that would make for more incompatibilities.