News for hackers. Stuff that matters.

A comment on Oasis: Small statically-linked Linux system. Parent comment

Re:Oasis: Small statically-linked Linux system by gravypod on Sunday August 14, 2022 @10:55AM (#32459772)
> Flatpaks won't be automatically recompiled though. It might take years before they bump whatever vulnerable thing they are using.

If we made all builds reproducible (like oasis) we could setup an automated trusted system that does builds verifiably automatically (like what Nix has).

[ Parent | on HN ]
Re:Oasis: Small statically-linked Linux system by goodpoint on Sunday August 14, 2022 @02:56PM (#32461846)
There are already trusted sources of software packages that provide security updates: traditional Linux distributions.

Doing automated, local patching and rebuilding is far from enough. You need experts to correctly backport patches and test them thoroughly.

[ Parent | on HN ]
Re:Oasis: Small statically-linked Linux system by bayindirh on Sunday August 14, 2022 @04:15PM (#32462532)
No, no… We need to move very fast, and break all the things. Tradition and conservatism is not the way. We need to compile everything and anything. Change the paradigm, break the status quo!

Oh, just like Gentoo, Slackware and LFS. ;)

Seriously, maybe we shouldn’t ignore history and learn why things are like this today.

[ Parent | on HN ]
Re:Oasis: Small statically-linked Linux system by LtWorf on Sunday August 14, 2022 @04:39PM (#32462741)
People bashing distributions seem to ignore that the alternative is the google play store.
[ Parent | on HN ]
Re:Oasis: Small statically-linked Linux system by bayindirh on Sunday August 14, 2022 @04:12PM (#32462512)
Which reproducible builds project is striving to do for quite some time.

It’s not just a simple switch you flick and recompile.

[ Parent | on HN ]