3 ms·
Nix won't help you secure your system from untrusted code written by internet script kiddies. It's a build tool and simply isn't designed for such things.
by soraminazuki 7y ago
Nix won't help you secure your system from untrusted code written by internet script kiddies. It's a build tool and simply isn't designed for such things.
- Ericson2314 7y agoUm, yes it will? Linux namespeaces are linux namespaces; if you don't trust them we have bigger problems than Nix. It will certainly make sure the skids cannot do `#include </etc/password>` and get useful information, for example.
- soraminazuki 7y agoThat only works if you can turn your entire web application into a Nix build process, which is unrealistic at best. Nix is wonderful as a build tool, but it's quite a stretch to assume it's adequate for securing running applications. Plain containers, or even better, VMs are more suited for that purpose.
- Ericson2314 7y agoYour unsandboxed web application can perform a sandboxed nix build based on user input used in a very specific way. This contains the dangerous bit.