Hector Martin

You also mention "arbitrary commands" while any config that allows "arbitrary commands" as ALL, !root is already almost certainly vulnerable per se and a terrible idea and nobody should be doing that.

If nobody should be doing that then hopefully nobody is doing that, which makes the impact minimal, which means it's your job to minimize confused panic from those who might misunderstand otherwise.

I had at least 5 people link me the sudo bug, some directly via your article, because they though it was some huge security hole affecting many Linux systems.

Some of them even ran their own confused tests and thought it was really that bad, because sudoers is confusing and they didn't understand exactly what config they needed to have. They often accidentally gave themselves ALL outright.

Honestly, you didn't do a great job of conveying the details. The most confusing bit is where you go straight from ALL to "in a specific scenario where you have been allowed to run a specific, or any, command as any other user except the root"