3 ms·
I still like the blogpost, because NixOS bills itself as a technical solution to prevent build artifacts that are decoupled from the source code (i.e. not repro
by jjmarr 2y ago
I still like the blogpost, because NixOS bills itself as a technical solution to prevent build artifacts that are decoupled from the source code (i.e. not reproducible), and the xz backdoor was hidden in build artifacts.
- lolinder 2y agoYeah, it's a good blog post in part because it gets into the details of how it was possible that this vulnerability made it into NixOS, which purports to solve the problem. Also, I'm not a NixOS critic either: I'm writing this from NixOS! I just don't think there's such a thing as a security cure-all as long as humans are in the loop anywhere.
- crote 2y agoSure, but you could achieve the same thing by requiring that the build artifacts are generated by a Github Actions runner.
- tomjakubowski 2y agoThat would only make the xz attack harder, not make it impossible. Just add some step to the action run that fetches blobs from an internet resource you control, then swap out the blobs for malicious ones.
- deleted 2y ago[deleted]