• 3 Posts
  • 105 Comments
Joined 10 months ago
cake
Cake day: September 7th, 2024

help-circle












  • It’s the first time I see the concept of bootstrappability in the context of security.

    Is it really worth the effort?

    There are multiple ways to run a supply chain attack. With bootstrappability, one can be sure that the compiler is trusted, but what about the code that the compiler compiles? There was this recent attack to XZ utils, which shows that more attention is needed on the code being merged and compiled.

    I think that this just creates a false sense of security.

    Contrary to that, I had read about a BSD team (I think FreeBSD) that reviews all the code before each release. This way they have achieved ~5 RCE exploits throughout their entire history.


  • I don’t have any experience with guix, so I will not express any opinions towards that.

    However, regarding NixOS:

    • Yes, as a person with experience in the Nix language, I can confirm it’s awful
    • The documentation of NixOS is a known issue, and there are currently efforts to improve it
    • Talking about the trustability of binaries, by doing a quick search, I read that Guix builds are reproducible. This is true for NixOS as well. All upstreamed packages must have their version and the hash of the code (or artifact), to allow verification
    • The community of NixOS is opting to maintaining flakes, because:
      • Some applications can simply not be built following the Nix guidelines. Examples are some electron apps (like Falkor) and apps that have weird toolchains (like bubblejail)
      • The reviewing process takes way too long, and PRs for upstreaming are often ignored. This forces a lot of people to just PR a flake.nix to the application, or maintain their own overlays (overlays are like overriding the available packages, while flakes are more like distributing Nix code in general)




  • What would happen if all users start using adblockers, or the value of ads starts to fall?

    I do not support the current, ad-driven, model of the internet. However, since the costs of subscriptions are increasing, while salaries are going downhill, it is apparent that ads is (seemingly) the only viable choice for now.

    In the economy we currently live in, all of world’s wealth is slowly moving to ad networks.

    Even donation driven models are currently straggling. Just look at the fediverse. The people donating to their instances are not enough to sustain them.

    Capitalism has absolutely destroyed everything. The greed of stakeholders has milked most people. At some point people will stop buying the useless things or services promoted via advertisements, just because they will not be able to afford them. Then, no subscriptions, no point of advertising, no donators, no people hosting fediverse instances, just world hunger.