this post was submitted on 08 Apr 2024
108 points (87.5% liked)
Linux
47929 readers
1217 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
You're using the unstable channel.
You could literally build it on your own, or patch your own change without having to wait - all you have to do is update the SHA256 hash and the tag/commit hash.
You can use slightly older official channels, as well as patched unofficial channels.
You can go back to using older binary, while running GC on suspected, newer malware binary, assuming that it hasn't been executed yet.
If you're not using Nix the way it is intended to be, it is on you. Your over-reliance on Hydra is not the fault of Nix in any way.
First of all, I'm not the author of the article, so you're barking up the wrong tree.
That doesn't matter in the big scheme of things - it doesn't solve the fundamental issue of slow security updates.
Do you seriously expect people to do that every time there's a security update? Especially considering how large the ecosystem is? And what if someone wasn't aware of the issue, do you really expect people to be across every single vulnerability across the hundreds or thousands of OSS projects that may be tied to the packages you've got on your machine?
The rest of your points also assume that the older packages don't have a vulnerability. The point of this post isn't really about the xz backdoor, but to highlight the issue of slow security updates.
Citation needed. I've never seen the Nix developers state that in any official capacity.
After thinking a lot, your stance does make sense. However, it is not for the points you've raised in your defense - they're not strong reasons that support Nix's flaw, if we are talking about a generic trojan. The store-based file hierarchy would serve as a sort of defense, however, it isn't a fool proof security.
However, if its solely targeted keeping Nix in mind, then yes, it's a pile of stinking mess, with how the entire nixpkg file is filled with diff files. Diff files are not only difficult to read, it is also very easy to inject code without anyone finding out. It's a ticking bomb waiting to explode.