3 ms·
Pulling directly from github is probably not a good thing either way. Maybe nixos should have its own mirror. Or maybe there should be an ipfs mirror that some
by nextaccountic 3y ago
Pulling directly from github is probably not a good thing either way. Maybe nixos should have its own mirror. Or maybe there should be an ipfs mirror that some distros and other projects could seed
Anyway I think that a new release that fixes the known vuln isn't enough. There should be a release without all contributions from the malicious dude
- deleted 3y ago[deleted]
- rurban 3y agoPulling directly from github is the good thing. The release tar was compromised, the sources not.
- nextaccountic 3y agoIn this specific case this is true, but generally speaking Github can remove repositories for any reason (and for no reason). They provide free bandwidth so it gets used for that, it's just not trustworthy. One option for distros that compile from source (such as Gentoo, NixOS without the package cache, of Arch Linux's AUR) is to make the package system to either download from Github, or download from a distro-provided mirror if Github is down. Distros could pool together to offer a source code mirror that is common for all their users. That would be a good thing.