4 ms·
When you sandbox your apps on debian already, there should be no security difference doing so on nixos, no? The globally accessible /nix/store is frigthening,
by throwawayqqq11 7mo ago
When you sandbox your apps on debian already, there should be no security difference doing so on nixos, no?
The globally accessible /nix/store is frigthening, but read-only. Same applies to the nixos symlinks pointing there. This vulnerability was enabled by a writable /tmp and a root process reaching into it. This would be bad on debian and nixos.
- fc417fc802 7mo agoI'm not suggesting the presence of a vulnerability just that I'm not comfortable switching to a complex system where I have little to no understanding of the logic behind the design. My remarks were nothing more than a tangential gripe.