Hacker News Reader

One place I worked (some 20 years ago) had a policy that any time you run a sudo command, another person has to check the command before you hit enter. Could apply the same kind of policy/convention for anything in production.

View on HN

I'm not sure this doesn't just lead to blind rubber-stamping unless this is done very very rarely

The trick is to have good access controls so confirmations happen often enough to be useful, but not so often to be rubber-stamped

I guess most of the common task are scripted / automated. Running a "raw" sudo command should be very very rare.

That's not a good advice IMO, as most sudo commands will mess-up just one host, and it's something you should generally be prepared for. You're more likely to develop a culture where engineers think about hosts as critical resources whereas they should be generally considered as instances that can be thrown away. It's better to identify hosts that are SPOF and be cautious on those only.

I can think of a larger blast radius when deleting files on a shared mount point for example but it's not representative to the regular use of sudo.

Reply on news.ycombinator.com