this post was submitted on 22 Jun 2026
7 points (81.8% liked)
Linux Questions
3981 readers
2 users here now
Linux questions Rules (in addition of the Lemmy.zip rules)
- stay on topic
- be nice (no name calling)
- do not post long blocks of text such as logs
- do not delete your posts
- only post questions (no information posts)
Tips for giving and receiving help
- be as clear and specific
- say thank you if a solution works
- verify your solutions before posting them as facts.
Any rule violations will result in disciplinary actions
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
The size of the code base and therefore attack surface.
The sudo source code is approximately 160,000 lines of C.
Doas was written for OpenBSD (after the OpenBSD project decided sudo was too large to ship in the system base) with a source code of roughly 500 lines of C.
Obviously those extra lines of code bring features to sudo that doas doesn't have.
Is there any particular features that are noticeably missing, right off the bat?
The list of functional differences is too long to write here. I'm sure you can ask some llm to do the google search for you and it will shit out an ungodly amount of differences.
But I'd say roughly they are about:
doas on OpenBSD caches via a kernel API.
The slicer69 portable doas port has no persist on Linux/FreeBSD - you re-enter your password every invocation.
OpenDoas implements persist via timestamp files, similar to sudo but with fewer tuning options.
You explained very well, this being an intensely technical subject. And you're absolutely correct about LLMs.
Now, which one do you think would be better, considering the fact that l wish to challenge my learning curve ???
"better" always depends on the usecase
I use sudo cause it's less hassle and I just want to use my pc without the OS being in the way.
If you want security: ofc. doas.
But if your goal is tinkering, then you can switch anytime anyway, so try all the options.
Plus
doasdoes not have insults (?)For an LLM comparison, this is what I get from haiku
sudois older, more complex, and feature-rich, whiledoasis newer, simpler, and security-focused.Core distinctions:
Code size & complexity:
doashas roughly 700 lines of code versussudo's 100,000+ lines, makingdoaseasier to audit and maintain.Configuration:
sudouses the complexsudoersfile with intricate syntax;doasuses a simplerdoas.conffile that's more straightforward to read and write.Security philosophy:
doaswas designed with security-first principles, minimizing potential attack surface.sudoaccumulated features over decades, increasing complexity and potential vulnerabilities.Feature set:
sudohas advanced features like session recording, plugins, authentication caching, and detailed logging.doasis minimalist—it handles the essential privilege escalation task without extras.Adoption:
sudois ubiquitous across Linux and Unix systems.doasis less common but gaining traction, particularly on OpenBSD (where it originated) and among security-conscious users.Performance:
doasis faster and lighter, whilesudocarries more overhead.In practice,
doasworks well for straightforward privilege escalation needs, whilesudois better if you need advanced features or broader compatibility.I personally think the security concerns with sudo are way overblown. If it was getting hit with CVEs left and right it would be different but there have only been a handful of bad CVEs in its history.
Attack surface means ?
More code means there's more room for bugs and security flaws that can be exploited, and it's more difficult to reason about the code to find those flaws.
The general security jargon for that concept is 'attack surface'.