Re: Retiring lpr and lpd

On 2/20/26 12:51, Dag-Erling Smørgrav wrote:
> Slawa Olhovchenkov <[email protected]> writes:
>> Dag-Erling Smørgrav <[email protected]> writes:
>>> The lp* family of printing utilities have received practically no
>>> maintenance in two decades and are showing their age.  What's worse,
>>> most of them are setugid, and lpd(8) is a network-facing daemon with
>>> IP-based authentication and little to no input validation.  Furthermore,
>>> better-maintained alternatives are available from ports: print/lprng is
>>> a drop-in replacement derived from the same code base, while print/cups
>>> provides far more functionality and a compatible command-line interface.
>> I am regulary using this.
>> What is problem?
>> Don't fix what isn't broken
> 
> The lp* family of printing utilities have received practically no
> maintenance in two decades and are showing their age.

Did you miss the "What is the problem? Don't fix what isn't
broken."  I've been using lp* since I've started using
386BSD+patchkit some 3 decades ago.  The ability to set up
printing without the idiosyncrasy of the ports collections
is a blessing.

> What's worse, most of them are setugid, and lpd(8) is a network-facing
 > daemon with> IP-based authentication and little to no input validation.

Is there an open CVE that we need to worry about?

   Furthermore,
> better-maintained alternatives are available from ports: print/lprng is
> a drop-in replacement derived from the same code base, while print/cups
> provides far more functionality and a compatible command-line interface.

Better alternative are available for many things that are installed
as part of a FreeBSD base distribution (e.g., editors and shells).
Should remove all of those things as well?

-- 
steve