4 ms·

solution: use nix as your package manager

ben_w 6y ago
Helps in this specific case, but will not eliminate the broader issue. The broader issue is how can you trust 3rd party code to not do anything harmful, and it’s not like we can even perfectly trust our own fingers in that regard.
- croon 6y ago
  But the broad issue will never be resolved. The entire foundation of society is built around some trust. What has proven to work is that we trust actors who are identifiable and have something to lose. This goes with everything from your bank, to government, to name brands, to your local restaurant. Nix package managers/repositories have a level of scrutiny to get into, and highly dedicated people in charge of. Random github repos (or npm packages) are extremely low effort/risk to set up. Of course the former can be abused, but the incentives are at least in its favor to likely be more trustworthy. And we have to make assumptions of trust everytime we sit down in our chair or turn on our computer, or plug in a space heater. We will never get around trust, but there are differences in levels of trust and trustworthiness.
  - Foxboron 6y ago
    >Nix package managers/repositories have a level of scrutiny to get into, and highly dedicated people in charge of. Random github repos (or npm packages) are extremely low effort/risk to set up. That's not really true though. Nix doesn't support signed sources, there are no signatures in the package repository and in theory "John Doe" with no information can add packages and send pull-requests. In practise nixpks is just a well moderated user repository and the level of scrutiny is less then the enterprise distros can offer. https://discourse.nixos.org/t/trust-model-for-nixpkgs/9450 https://discourse.nixos.org/t/trust-model-for-nixpkgs/9450 https://github.com/NixOS/nixpkgs/issues/20836 https://github.com/NixOS/nixpkgs/issues/20836
    - croon 6y ago
      Oh, I'll really show my ignorance here. You're right. I was interpreting Nix as *nix, and your average enterprise distro of linux.
      - Foxboron 6y ago
        Yes, it's not really easy when people use these ambiguous names and talk about them in ambiguous ways.
medecau 6y ago
lol has if the nix peeps are reading the code nix is wget'ing

Helps in this specific case, but will not eliminate the broader issue. The broader issue is how can you trust 3rd party code to not do anything harmful, and it’s not like we can even perfectly trust our own fingers in that regard.

croon 6y ago
But the broad issue will never be resolved. The entire foundation of society is built around some trust. What has proven to work is that we trust actors who are identifiable and have something to lose. This goes with everything from your bank, to government, to name brands, to your local restaurant. Nix package managers/repositories have a level of scrutiny to get into, and highly dedicated people in charge of. Random github repos (or npm packages) are extremely low effort/risk to set up. Of course the former can be abused, but the incentives are at least in its favor to likely be more trustworthy. And we have to make assumptions of trust everytime we sit down in our chair or turn on our computer, or plug in a space heater. We will never get around trust, but there are differences in levels of trust and trustworthiness.
- Foxboron 6y ago
  >Nix package managers/repositories have a level of scrutiny to get into, and highly dedicated people in charge of. Random github repos (or npm packages) are extremely low effort/risk to set up. That's not really true though. Nix doesn't support signed sources, there are no signatures in the package repository and in theory "John Doe" with no information can add packages and send pull-requests. In practise nixpks is just a well moderated user repository and the level of scrutiny is less then the enterprise distros can offer. https://discourse.nixos.org/t/trust-model-for-nixpkgs/9450 https://discourse.nixos.org/t/trust-model-for-nixpkgs/9450 https://github.com/NixOS/nixpkgs/issues/20836 https://github.com/NixOS/nixpkgs/issues/20836
  - croon 6y ago
    Oh, I'll really show my ignorance here. You're right. I was interpreting Nix as *nix, and your average enterprise distro of linux.
    - Foxboron 6y ago
      Yes, it's not really easy when people use these ambiguous names and talk about them in ambiguous ways.

medecau 6y ago

lol has if the nix peeps are reading the code nix is wget'ing