274
Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Affected Packages (www.phoronix.com)
submitted 4 months ago by to c/technology@lemmy.world
33 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 7 points 4 months ago (1 child)

Does anyone know if the NixOS packages are safer from these types of attacks? As far as I know many packages are missing maintainers.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
  • [–] 2 points 4 months ago

    I read a reddit thread about this.

    Basically they are significantly safer because the review process is tedious and the PRs take ages to get reviewed. More over the read-only nature of the nix store make most of those techniques useless. You cannnot just take over packages the AUR way.

    Moreover, if you use third party nix flakes, you are still safer because they are tied to a specific github repo, so if it gets forked by malicious actor you won't get that update.

    However you are still prone to upstream malware. That is nixpkgs probably won't add malware but it could be there before packaging.

  • permalink
  • fedilink
  • source
  • parent