- cross-posted to:
- linux@lemmy.ml
- cross-posted to:
- linux@lemmy.ml
- GarlicToast ( @GarlicToast@programming.dev ) English5•6 months ago
Nix lets you go back, and you and even mix channels. Pulling one package from a different version.
That’s true, but you have to know there was a backdoor first. If someone doesn’t know, and they use the latest version, they’re vulnerable to attack
- Dan MacLeod :PUA: ( @danmac@aus.social ) 8•6 months ago
@starman @GarlicToast true but I don’t think you can use nix and not know about the xz exploit within minutes of it being found out.
- onlinepersona ( @onlinepersona@programming.dev ) English4•6 months ago
Do you have an RSS feed of CVEs impacting Nixos?
Anti Commercial AI thingy
- λλλ ( @lambda@programming.dev ) English1•6 months ago
I believe the point they were making is that if you are techy enough to use nix, they are likely the type to keep up to date with news like this.
- GarlicToast ( @GarlicToast@programming.dev ) English3•6 months ago
NixOS is aimed at highly technical people. You literally code your system structure.
- pbsds ( @pbsds@lemmy.ml ) English2•6 months ago
If the issue had been critical, then the branch head could be rolled back, causing everyone to downgrade
- Atemu ( @Atemu@lemmy.ml ) English2•6 months ago
That’s a nice idea in theory but not possible in practice as the last Nixpkgs revision without a tainted version of xz is many months old. You’d trade one CVE for dozens of others.
- Atemu ( @Atemu@lemmy.ml ) English1•6 months ago
That works for leaf packages but not for core node packages. Every package depends on xz in some way; it’s in the stdenv aswell as bootstrap.
- GarlicToast ( @GarlicToast@programming.dev ) English1•6 months ago
You are right, it will be a mess to pull xz from a different hash. This is why you go back to an older build, and keep only packages you need on the newer version.
- Atemu ( @Atemu@lemmy.ml ) English1•6 months ago
Those packages themselves depend on xz. Pretty much all of them.
What you’re suggesting would only make the
xz
executable not be backdoored anymore but any other application using liblzma would still be as vulnerable as before. That’s actually the only currently known attack vector; inject malicious code into SSHD via liblzma.