Re:Setting up my new laptop: Nix style
by the_gipsy on Sunday December 25, 2022 @03:46AM
(#34125488)
Nothing would happen. Like the other commenter said, you trust your package repo like with any other distro.
So, basically, you're saying that Nix is insecure, because you need hash collision + signature forgery + malicious access to repos; whereas in a standard distro, you only need signature forgery + malicious access to repos?
I really don't get your point.
> thanks to all that research on primes that's been released recently, assume a more efficient search is found.
That's just trolling. Primes have nothing to do with sha256 beyond the initial value. It's just bitwise operations and additions.
As a thought experiment, say a collision is found for libc or the standard library, thanks to all that research on primes that's been released recently, assume a more efficient search is found.
What would the failure domains be for those two libraries if, a) the library was non-functional suddenly, or b) the library remained functional but malicious.
Would Nix detect the collision, or would Nix simply recreate the dependency graph overwriting the old but secure with this new malicious software.
Almost all of the security primitives are implemented at domain edges, which means local access, or remote exploitation would have equal effect, and a watering hole/supply chain attack may not even be necessary.