3 ms·
> Whatever package is thrown your way, you can rebuild it locally and check whether you have the expected build output Isn't this just security theater? If you
by gizzlon 5y ago
> Whatever package is thrown your way, you can rebuild it locally and check whether you have the expected build output
Isn't this just security theater? If you trust the source and build everything yourself you already have trusted binaries?
For more see https://news.ycombinator.com/item?id=30395361 https://news.ycombinator.com/item?id=30395361 and their link
- southerntofu 5y agoUsing a distro like nixos highers the bar for attackers since more eyes might be looking at upstream updates for malicious codes (not an obligation though). Moreover, i don't know about nix but in the guix ecosystem there's the guix challenge command which enables to query different build servers for the same build hash so you don't have to build it yourself but can split trust among several trustworthy actors. So one build server getting compromised would quasi-instantly raise alarms.