3 ms·
If I get breached as a result of using gentoo, it looks bad. If I get breached using Ubuntu it’s at least along the lines of ‘well everyone else is using it any
by Bnshsysjab 6y ago
If I get breached as a result of using gentoo, it looks bad. If I get breached using Ubuntu it’s at least along the lines of ‘well everyone else is using it anyway’. Semi safety in numbers, semi ‘nobody got fired for buying an IBM’.
It wasn’t my call, and it’s a defense move rather than an opinion on the state of Gentoos security. I know they take things very seriously, but my assertions aren’t enough to make my employer feel comfortable.
- _emacsomancer_ 6y agoAmusing, in this context, that Google decided to base ChromeOS on Gentoo.
- Bnshsysjab 6y agoSure, but I’m sure they leverage portage due to its sheer power and additional scrutiny over any ebuilds they source from upstream. Which, to be clear, the threat model assessed internally is intentionally malicious packages which are unintentionally merged into the portage tree by legitimate and well meaning developers. There’s no immediate issue with the portage or gentoo developers and package maintainers themselves.