Quote from Website: "For the past 30+ years I’ve been the maintainer of sudo. I’m currently in search of a sponsor to fund continued sudo maintenance and development. If you or your organization is interested in sponsoring sudo, please let me know."
This is why Big Tech is so desperate for AI to work as a wholesale replacement for software developers: they do not pay for their Open Source consumption as-is, and new maintainers aren’t stepping up because they can’t afford rent, let alone to devote their full time to FOSS work free of charge like a lot of older project maintainers do.
The fact that sudo is a critical security pillar for trillions of dollars of global infrastructure but this guy gets bupkis for it screams volumes about the current state of technology.
We must do better, or it’ll be closed systems (OpenAI, Microsoft, Apple, Google, Oracle) all the way down as maintainers age out, go bankrupt, or die without succession plans in place.
Have used sudo millions of times. It's so smooth I don't even consider it software. Thinking that sudo could give me bug one day haunts me now. Thanks Miller for your work!
I would love to know were IBM is on this. They use sudo everywhere, even on AIX. Not to mention IBM owns Red Hat Linux.
IBM should be able to send a decent amount to Todd once in a while, but based upon how much IBM supports ssh ($0), all they are proving is they are very cheap and only wants be a parasite living off other's work.
But today people can just vibe code their own sudo "with blackjack and hookers!"
/s
Really though, it is remarkable just how high we've built this towering house of cards on the selfless works of individuals. The geek in me immediately begins meditating on OSS funding mechanisms I've seen in the past, and what might work today. Then I remember that I don't believe it can work, but hope desperately that people like Todd can keep paying rent and continue getting some satisfaction from the efforts.
30+ years maintaining one of the most critical pieces of infrastructure on nearly every Linux and Unix system, and he's currently looking for a sponsor to fund continued development. Every company running sudo in production owes this man. Someone should fix that
I disagree on "the most critical" part. You can be superuser at all times. I understand the arguments why not; I am pointing out that this is possible. Despite people claiming aliens will arrive and nothing will work, everything works fine when the superuser account is used too.
Also, I disagree that every company needs to pay the man. Funding is important, yes, but a *nix system is not crippled without sudo. You can change the permission systems. The superuser can do so too. It is not black magic. The permission system is trivial. sudo is simply a feature of convenience, not a "if sudo does not exist, nothing works" - that just makes no sense.
You can only fix that with leverage. The sudo maintainer doesn't have it. sudo is valuable, but if Todd stepped away, you could (and would) find other maintainers because it's so important.
If you want to fix it, you need organizational heft comparable to the companies using it, and the ability & willingness to make freeriding a more painful experience.
I guess I don’t understand. Take RHEL. The sudo maintainer seeking a new sponsor affects upstream velocity and stewardship, not the deployed trust model of enterprise distributions. RHEL does not “follow HEAD.” It vendors a known-good snapshot and assumes long-term responsibility for it.
Core tools like sudo have survived things like this before
I wonder how many guys who have have written or significantly maintained "household name" level FOSS products just earn a corporate sinecure somewhere as hypercompetent remote sysadmins or ICs or something. Folks who don't necessarily care to earn top dollar, with all the headaches that entails, but also almost never have to actually work more than 2 hours in a given day to keep the ship going, and the arrangement is just so cozy and gives them enough time to themselves to work on their actual passion that they accept the arrangement.
I know of at least one recruiter who does something like this and specializes in greybeard hiring, and it seems like a steady niche if you have the network to pull it off.
I've said it before, open source works poorly in this area. It's great if everyone's getting paid fat money in a day job and can maintain their pet project a few days a month, but that's just not true for a lot of people.
It's disgusting that maintainers of critical projects have to go through the humiliation of begging for money, and absurd to suggest they all hang out Kofi or PAtreon banners. Realistically nobody is going to go through their bash history working out what utilities they use in order of frequency and allocating funds to the maintainers proportionally. I'm baffled that some entity like the Linux Software Foundation isn't administering this already.
> Realistically nobody is going to go through their bash history working out what utilities they use in order of frequency and allocating funds to the maintainers proportionally.
Not if we don't make it easy for them. I had Claude whip up fundcli a while ago, but this post got me to finally upload it. It goes through your http://atuin.sh/ history (raw .bash_history/.*history doesn't have enough information) and generates links to projects for you to donate to.
git clone https://github.com/fragmede/fundcli
uv run src/fundcli/cli.py analyze
uv run ./src/fundcli donate --amount 100
to get links to donate $100 for last month's usage. There's also http://thanks.dev if you're looking for other places to donate to based on your open source usage.
I feel like this should have been the responsibility of investors and venture capitalists. In a normal society, the moneyed folks should give special treatment to the folks who have proven themselves to be effective givers.
Unfortunately, it seems like either the moneyed folks don't care or the current financial structure simply does not support this.
I wonder if a few people going beyond what is reasonable, is representative of open source projects.
For a lot of open source projects, if you have a normal day job and spend a few hours per week on a project, then the project just never gets very big. It exists, may have a few users. But on a larger scale, nobody knows it exists.
The exceptions are projects where developers spend a lot of time on the project at the expense of a day job. Though there is the possibility that they may have a hard time having a day job in the first place, which may have let to the situation with the open source project.
In general, I think we do have a culture problem where we think projects need to be successful. And people working on a project 'need' to support users (who in general don't pay).
And that expectation of free work happens throughout the open source ecosystem as well. Distributions expect projects to fix bugs for free. Open source projects expect libraries and compilers to be maintained.
Ultimately, change has to come from people who refuse to work for free. Doing something as a hobby for free is perfectly fine. As long as it stays within the scope of a hobby project.
Reading the release history[1]. I'm kind of shocked that sudo gets active development and monthly releases. I would have thought that something this old and venerated would have been "done" long ago.
I think the rise of the open-source redistributor groupie has been an interesting cultural revolution. I wonder if it will persist. Even 10 years ago, the idea of Free As In Speech dominated the idea of Free Software. Today, the greatest enthusiasm on Hacker News and Reddit is for something like Meta's Llama license (which cannot be used by people or corps with sufficient numbers of users). It certainly seems like someone out there could go out and propose the Microfree License which only applies to sufficiently non-rich people.
For my part, I want none of it. I find this reduction of a significant philosophy to some kind of base tax-and-distribute mechanism distasteful. I don't like communities were this stuff is big and they always want to run some taxation scheme where they redirect money to their own personal pet projects. It is fortunate that modern tools are good enough to build personal insulation from this stuff.
Imagine the farce of Apply HN repeated continuously. Simply awful.
57 comments
[ 2.0 ms ] story [ 76.0 ms ] threadThe fact that sudo is a critical security pillar for trillions of dollars of global infrastructure but this guy gets bupkis for it screams volumes about the current state of technology.
We must do better, or it’ll be closed systems (OpenAI, Microsoft, Apple, Google, Oracle) all the way down as maintainers age out, go bankrupt, or die without succession plans in place.
IBM should be able to send a decent amount to Todd once in a while, but based upon how much IBM supports ssh ($0), all they are proving is they are very cheap and only wants be a parasite living off other's work.
/s
Really though, it is remarkable just how high we've built this towering house of cards on the selfless works of individuals. The geek in me immediately begins meditating on OSS funding mechanisms I've seen in the past, and what might work today. Then I remember that I don't believe it can work, but hope desperately that people like Todd can keep paying rent and continue getting some satisfaction from the efforts.
Also, I disagree that every company needs to pay the man. Funding is important, yes, but a *nix system is not crippled without sudo. You can change the permission systems. The superuser can do so too. It is not black magic. The permission system is trivial. sudo is simply a feature of convenience, not a "if sudo does not exist, nothing works" - that just makes no sense.
Only humans should have freedom zero. Corporations and robots must pay.
If you want to fix it, you need organizational heft comparable to the companies using it, and the ability & willingness to make freeriding a more painful experience.
Isn't it done and finished, after 30 years of development?
Core tools like sudo have survived things like this before
I know of at least one recruiter who does something like this and specializes in greybeard hiring, and it seems like a steady niche if you have the network to pull it off.
And they start making videos about, mentioning the sponsors. There are better options to get money.
It's disgusting that maintainers of critical projects have to go through the humiliation of begging for money, and absurd to suggest they all hang out Kofi or PAtreon banners. Realistically nobody is going to go through their bash history working out what utilities they use in order of frequency and allocating funds to the maintainers proportionally. I'm baffled that some entity like the Linux Software Foundation isn't administering this already.
Not if we don't make it easy for them. I had Claude whip up fundcli a while ago, but this post got me to finally upload it. It goes through your http://atuin.sh/ history (raw .bash_history/.*history doesn't have enough information) and generates links to projects for you to donate to.
to get links to donate $100 for last month's usage. There's also http://thanks.dev if you're looking for other places to donate to based on your open source usage.Unfortunately, it seems like either the moneyed folks don't care or the current financial structure simply does not support this.
For a lot of open source projects, if you have a normal day job and spend a few hours per week on a project, then the project just never gets very big. It exists, may have a few users. But on a larger scale, nobody knows it exists.
The exceptions are projects where developers spend a lot of time on the project at the expense of a day job. Though there is the possibility that they may have a hard time having a day job in the first place, which may have let to the situation with the open source project.
In general, I think we do have a culture problem where we think projects need to be successful. And people working on a project 'need' to support users (who in general don't pay).
And that expectation of free work happens throughout the open source ecosystem as well. Distributions expect projects to fix bugs for free. Open source projects expect libraries and compilers to be maintained.
Ultimately, change has to come from people who refuse to work for free. Doing something as a hobby for free is perfectly fine. As long as it stays within the scope of a hobby project.
We need to find better models. Even if it is just "low(er)" payment; that would still be better than zero or near zero payment.
but the mascot for sudo is terrifying
The Largely Untold Story Of How One Guy In California Keeps The World’s Computers Running On The Right Time Zone: https://onezero.medium.com/the-largely-untold-story-of-how-o...
https://xkcd.com/2347/
1: https://www.sudo.ws/releases/devel/
For my part, I want none of it. I find this reduction of a significant philosophy to some kind of base tax-and-distribute mechanism distasteful. I don't like communities were this stuff is big and they always want to run some taxation scheme where they redirect money to their own personal pet projects. It is fortunate that modern tools are good enough to build personal insulation from this stuff.
Imagine the farce of Apply HN repeated continuously. Simply awful.
https://xkcd.com/149/
https://www.freedesktop.org/software/systemd/man/256/run0.ht...
https://www.millert.dev/images/photos/todd_ducktape_man.gif
Uhm, how did Todd relieve himself in that costume?