judo

You're right, once an adversary gains physical access (or even remote access as your main login account), all bets are off. This is the area where the traditional UNIX security model has failed to adapt at all: you need a password to install a random game from apt (a vetted and trusted source), but you don't need a password to install a cryptolocker, or exfiltrate personal data. However I like having a password (or some other form of confirmation), just so that I can stop to think for a second, whether what I'm about to do is a good idea. What's annoying is that I effectively need two different policies on workstations and on servers, since I still want to be able to escalate privileges from maintenance scripts[1]. [1]: https://github.com/rollcat/judo/issues/9

> https://github.com/rollcat/judo#passing-arguments-to-scripts implies that project is for sure not for me, but I wish you all the best with it! That's one of the design decisions, there should ideally be only one "obvious" way of achieving a certain goal. Per-invocation parameters can already be passed via environment variables ("-e FOO" to pass from your local environment; "-e BAR=42" to set explicitly); I'm also considering using envdir (or a similar scheme) to set per-host parameters (https://github.com/rollcat/judo/issues/11). I could allow specifying command line arguments somehow with the -s flag, but that would complicate parsing, quoting/unquoting, etc. I would have to teach the user about quoting rules, and probably shoot myself in the foot at least once in the process. I try to actively avoid creating hard problems by solving a

You're welcome to plug it, although the top-level thread is likely where you'll get more of the kind of exposure you're looking for: https://news.ycombinator.com/item?id=31399719 https://github.com/rollcat/judo#passing-arguments-to-scripts implies that project is for sure not for me, but I wish you all the best with it!

https://github.com/rollcat/judo - my side project.

I hope you don't mind me stealing your comment to plug my side project, Judo. It was created in 2016, out of my frustration with Ansible. Judging by the state of affairs, that motivation continues to be relevant. https://github.com/rollcat/judo

I wrote judo[1] because I was frustrated with Ansible. I wanted a very basic tool that could do 80% of the work in 1% of the code. It has one or two bugs, but I've been using it for personal and work stuff since 2016 and I'm not looking back. [1]: https://github.com/rollcat/judo