Nix as OS X Package Manager

Re:Nix as OS X Package Manager by falcolas on Wednesday May 25, 2016 @07:03PM (#11773869)

> If you are installing software from scratch, you must trust the https server that serves it to you

This is incorrect - you are forced by `curl | sh` to trust all of the 1000+ CAs in your OS' keystore. And if you can't trust all of them (since some have given out Google certs before, you can't), how can you trust what you're getting over HTTPS?

With hashes, they are not typically served from the same domain. That's the minimum level of protection for the user.

Signing with a key is another level of protection; it lets the user (not the OS) decide the level of trust, and even verify the key with the author of the package via a completely separate channel.

Now the question really becomes, why doesn't the provider use the existing (secure) channels of software distribution? RPMs, DEBs, installer packages for Macs, MSAs for Windows?

[ Parent | on HN ]

Re:Nix as OS X Package Manager by danpalmer on Wednesday May 25, 2016 @07:29PM (#11774002)

> you are forced by `curl | sh` to trust all of the 1000+ CAs in your OS' keystore. And if you can't trust all of them

If you don't trust them, they should not be in your certificate store. That's not a problem with using `curl | sh`, it's a problem with the certificate store and what the user is trusting.

[ Parent | on HN ]