{"slug": "doas", "name": "doas", "category": "terminal", "category_name": "Terminal and shell", "description": "", "recommenders": 4, "commenters": 5, "warners": 0, "score": 3.754, "rising": -1.31, "first": "2025-11-12", "latest": "2026-07-13", "why": "doas is ~1k lines vs 160k for sudo. That surely means a smaller attack surface.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 4, "neutral": 1, "compare": 0, "warn": 0}, "spark": [1, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "doas is ~1k lines vs 160k for sudo. That surely means a smaller attack surface.", "kind": "", "icon": false, "domain": "openbsd.org", "github_repo": null, "official_url": "https://man.openbsd.org/doas", "pricing": "", "aliases": ["doas"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 782290289, "item_id": 48893143, "url": "https://news.ycombinator.com/item?id=48893143", "by": "titularcomment", "date": "2026-07-13", "stance": "recommend", "quote": "I use doas for its low footprint on my Linux machine", "excerpt": "Personal laptop use with Ada Lovelace or Ampere family NVIDIA GPUs (did you mean this or CUDA, i couldnt tell), personal desktop use with unusual peripherals, dependency on ports, existence and competition of FreeBSD etc. I love OpenBSD's code philosophy (they were the first to introduce a lot of security techniques[1]) and the programs they produce, OpenSSH is a lifesaver, and I use doas for its low footprint on my ", "context": "Linux user", "use_case": "privilege escalation on Linux", "switched_from": "", "story": "GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years"}, {"id": 774743617, "item_id": 48421476, "url": "https://news.ycombinator.com/item?id=48421476", "by": "MYEUHD", "date": "2026-06-05", "stance": "recommend", "quote": "doas is ~1k lines vs 160k for sudo. That surely means a smaller attack surface.", "excerpt": "I have already been using openrsync even before the recent AI drama. Just like I have been using doas for several years. All I need is `rsync -urvP` and I suspect the majority of users don't need the advanced features either. The smaller code base also means less bugs and vulnerabilities. As an example doas is ~1k lines vs 160k for sudo. That surely means a smaller attack surface. The same is true for openrsync and r", "context": "", "use_case": "privilege escalation", "switched_from": "sudo", "story": "Did Claude Increase Bugs in Rsync?"}, {"id": 755269776, "item_id": 47204361, "url": "https://news.ycombinator.com/item?id=47204361", "by": "sherr", "date": "2026-02-28", "stance": "recommend", "quote": "is a smaller (LOC) tool, easier to audit and keep secure (supposedly)", "excerpt": "There are alternatives to sudo other than the new Rust version here. \"doas\" [1] comes from OpenBSD and is a smaller (LOC) tool, easier to audit and keep secure (supposedly). Also available for Linux. Also \"run0\" [2], another alternative that comes from the Linux/Systemd camp, using \"polkit\" and is similar to \"systemd-run\". [1] https://man.openbsd.org/doas.1 [2] https://www.freedesktop.org/software/systemd/man/257/run", "context": "", "use_case": "", "switched_from": "", "story": "Ubuntu 26.04 ends a 40-year old sudo tradition"}, {"id": 734389456, "item_id": 45899341, "url": "https://news.ycombinator.com/item?id=45899341", "by": "ciupicri", "date": "2025-11-12", "stance": "recommend", "quote": "A fresh look would be perhaps doas", "excerpt": "A fresh look would be perhaps doas [1] from the OpenBSD project. [1]: https://man.openbsd.org/doas.1", "context": "", "use_case": "Run commands as root", "switched_from": "", "story": "Security issues discovered in sudo-rs"}]}], "caveats": [], "who": [{"by": "titularcomment", "context": "Linux user", "url": "https://news.ycombinator.com/item?id=48893143", "date": "2026-07-13"}], "tags": [], "use_cases": ["privilege escalation", "privilege escalation on linux", "run commands as root"], "compared": [{"slug": "sudo", "name": "sudo", "co": 3, "switched_from": 1, "switched_to": 0}, {"slug": "openssh", "name": "OpenSSH", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=48834309", "title": "GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48411635", "title": "Did Claude Increase Bugs in Rsync?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47202508", "title": "Ubuntu 26.04 ends a 40-year old sudo tradition", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46967772", "title": "The Day the Telnet Died", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=45898377", "title": "Security issues discovered in sudo-rs", "mentions": 1}], "sentiment_by_month": {"2025-11": {"recommend": 1}, "2025-12": {}, "2026-01": {}, "2026-02": {"neutral": 1, "recommend": 1}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {"recommend": 1}, "2026-07": {"recommend": 1}, "2026-08": {}, "2026-09": {}, "2026-10": {}}, "quotes": [{"id": 782290289, "item_id": 48893143, "url": "https://news.ycombinator.com/item?id=48893143", "by": "titularcomment", "date": "2026-07-13", "stance": "recommend", "quote": "I use doas for its low footprint on my Linux machine", "excerpt": "Personal laptop use with Ada Lovelace or Ampere family NVIDIA GPUs (did you mean this or CUDA, i couldnt tell), personal desktop use with unusual peripherals, dependency on ports, existence and competition of FreeBSD etc. I love OpenBSD's code philosophy (they were the first to introduce a lot of security techniques[1]) and the programs they produce, OpenSSH is a lifesaver, and I use doas for its low footprint on my ", "context": "Linux user", "use_case": "privilege escalation on Linux", "switched_from": "", "story": "GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years"}, {"id": 774743617, "item_id": 48421476, "url": "https://news.ycombinator.com/item?id=48421476", "by": "MYEUHD", "date": "2026-06-05", "stance": "recommend", "quote": "doas is ~1k lines vs 160k for sudo. That surely means a smaller attack surface.", "excerpt": "I have already been using openrsync even before the recent AI drama. Just like I have been using doas for several years. All I need is `rsync -urvP` and I suspect the majority of users don't need the advanced features either. The smaller code base also means less bugs and vulnerabilities. As an example doas is ~1k lines vs 160k for sudo. That surely means a smaller attack surface. The same is true for openrsync and r", "context": "", "use_case": "privilege escalation", "switched_from": "sudo", "story": "Did Claude Increase Bugs in Rsync?"}, {"id": 755269776, "item_id": 47204361, "url": "https://news.ycombinator.com/item?id=47204361", "by": "sherr", "date": "2026-02-28", "stance": "recommend", "quote": "is a smaller (LOC) tool, easier to audit and keep secure (supposedly)", "excerpt": "There are alternatives to sudo other than the new Rust version here. \"doas\" [1] comes from OpenBSD and is a smaller (LOC) tool, easier to audit and keep secure (supposedly). Also available for Linux. Also \"run0\" [2], another alternative that comes from the Linux/Systemd camp, using \"polkit\" and is similar to \"systemd-run\". [1] https://man.openbsd.org/doas.1 [2] https://www.freedesktop.org/software/systemd/man/257/run", "context": "", "use_case": "", "switched_from": "", "story": "Ubuntu 26.04 ends a 40-year old sudo tradition"}, {"id": 751511314, "item_id": 46969457, "url": "https://news.ycombinator.com/item?id=46969457", "by": "accrual", "date": "2026-02-10", "stance": "neutral", "quote": "I use use sudo or doas as a regular user once logged in.", "excerpt": "> ssh needs a capability to let root logins One can disable root login via SSH in /etc/ssh/sshd_config. sshd also drops root priviledges once it's running IIRC. I use use sudo or doas as a regular user once logged in.", "context": "", "use_case": "Privilege escalation", "switched_from": "", "story": "The Day the Telnet Died"}, {"id": 734389456, "item_id": 45899341, "url": "https://news.ycombinator.com/item?id=45899341", "by": "ciupicri", "date": "2025-11-12", "stance": "recommend", "quote": "A fresh look would be perhaps doas", "excerpt": "A fresh look would be perhaps doas [1] from the OpenBSD project. [1]: https://man.openbsd.org/doas.1", "context": "", "use_case": "Run commands as root", "switched_from": "", "story": "Security issues discovered in sudo-rs"}]}