[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: should auto updaters be disabled?

From: Leo Famulari
Subject: Re: should auto updaters be disabled?
Date: Sat, 29 Feb 2020 17:00:48 -0500

On Sat, Feb 29, 2020 at 09:41:17PM +0100, Bengt Richter wrote:
> IMO auto-update is like buying an appliance and giving
> the install crew a permanent key to the kitchen door.

I don't think this metaphor is wrong, but it's not very exact. Short of
auditing every single line of code in a package, and skillfully
detecting obfuscated malware, all of our packages may try to download
and execute software at run-time. It's just the nature of computers with
network access.

In any case, it's extremely unlikely that a package autoupdater will
work in Guix because they usually target the executable's directory and
that is read-only in /gnu/store. But we should still try to disable them
as a matter of Guix policy.

reply via email to

[Prev in Thread] Current Thread [Next in Thread]