In reply to @andi:kack.it
One thing you could probably look into more: Time to rollout of fixes after they have been committed. How long does a rebuild of the closure take for an "average" user? Is that a huge downside? How much that this increase the risk of someone exploiting your systems?

I also have a 'topic list' for now, maybe this will generate even more ideas if I share it:

okay so something about atomic Upgrades def.
The Potential of supply chain attacks
I thought about mentioning security of NixOS containers where root in container is root on the host
The problem with pre-compiled binaries
/nix/store paths and not /bin for software
I wanted to mention dependency confusion as well in the topic of sca in Nix/NixOS
i only use the original version of any software i have installed
I wanted to mention nixos-infect which can turn AWS instance into NixOS install
And maybe the state of security tools for Nixos
unpriviliged users can install packages

in the meantime, I made a PoC of interpreter/loader/library hijack, which I'll also try to cover

I also have a 'topic list' for now, maybe this will generate even more ideas if I share it:

okay so something about atomic Upgrades def.
The Potential of supply chain attacks
I thought about mentioning security of NixOS containers where root in container is root on the host
The problem with pre-compiled binaries
/nix/store paths and not /bin for software
I wanted to mention dependency confusion as well in the topic of sca in Nix/NixOS
i only use the original version of any software i have installed
I wanted to mention nixos-infect which can turn AWS instance into NixOS install
And maybe the state of security tools for Nixos
unpriviliged users can install packages

in the meantime, I made a PoC of interpreter/loader/library hijack, which I'll also try to cover as a topic in that paper of mine

I also have a 'topic list' for now, maybe this will generate even more ideas if I share it:

okay so something about atomic Upgrades def.
The Potential of supply chain attacks
I thought about mentioning security of NixOS containers where root in container is root on the host
The problem with pre-compiled binaries
/nix/store paths and not /bin for software
I wanted to mention dependency confusion as well in the topic of sca in Nix/NixOS
(lol, someone's other msg was in here, haven't noticed that before)
I wanted to mention nixos-infect which can turn AWS instance into NixOS install
And maybe the state of security tools for Nixos
unpriviliged users can install packages

in the meantime, I made a PoC of interpreter/loader/library hijack, which I'll also try to cover as a topic in that paper of mine

I thought about mentioning security of NixOS containers where root in container is root on the host
This was mitigated some time ago IRRC?

I thought about mentioning security of NixOS containers where root in container is root on the host

This was mitigated some time ago IRRC?

In reply to @philipp:xndr.de
about unpriviliged users can install packages: That is true on any normal linux desktop/server. Even if the package manager doesn't help you, local users will be able to execute all the code they want to.

I thought about mentioning security of NixOS containers where root in container is root on the host

This was mitigated some time ago IRRC?

In reply to @andi:kack.it

I thought about mentioning security of NixOS containers where root in container is root on the host

This was mitigated some time ago IRRC?