> I think the xz backdoor did not work on NixOS because its unusual non FHS-compliant filesystem structure. Right, but this is not part of the security model,

> I think the xz backdoor did not work on NixOS because its unusual non FHS-compliant filesystem structure. Right, but this is not part of the security model, it's an incidental attribute of the OS that's there for other reasons and easily solved for if the attacker had prioritized it. The only reason why it didn't work is because the attacker didn't bother making it work on NixOS, not because he couldn't have if he'd wanted to.