 | NixOS Security Triage | 699 Members |
| Coordination and triage of security issues in nixpkgs | 216 Servers |
| NixOS Security Triage | 699 Members |
| Coordination and triage of security issues in nixpkgs | 216 Servers |
| Sender | Message | Time |
|---|---|---|
| 22 Jul 2021 | ||
 andi- | On an enterprise scale you might what to look into the CIS benchmarks (there is a discourse thread on that). You'll probably not be very happy as they talk about many things that simply do not apply for NixOS. | 15:57:50 |
| andi- | https://discourse.nixos.org/t/nixos-in-cis-benchmark-level-1/2189 | 15:58:13 |
 das_j | Currently reading that document and it does have some weird stuff in it | 16:05:13 |
| das_j | Like adding to the score when you have cron enabled (??) | 16:05:40 |
 ryantm | This could be another crude benchmark: https://repology.org/repositories/statistics/pvulnerable | 16:05:42 |
 Linux Hackerman | There's also lynis, which is also in nixpkgs (but not that well adapted to NixOS) | 16:06:18 |
| ryantm | Cool lynis runs systemd-analyze security as one of its tests. | 16:11:52 |
 Elliot | Yeah lynis looks really cool | 16:12:02 |
 j-k | In reply to @noch3:matrix.org There's currently some interest in using nix for high security environments from orgs such as the CNCF https://discourse.nixos.org/t/generating-software-bill-of-materials-from-derivation/14089 building containers with nix without a container daemon is very desirable a full tree of dependencies is super nice (see the SBOM discourse post above) nix + trustix is a super interesting project for zero/low trust software supply chains and "software factories", promising for governments, financial orgs, people on the cutting edge of "DevSecOps") https://software.af.mil/software-factories/ | 16:45:03 |
 Michael Lieberman joined the room. | 16:50:34 | |
| j-k | o/ | 16:51:21 |
| Michael Lieberman | In reply to @j-k:matrix.orgJust wanted to throw it out there, I'm the chief architect of that CNCF secure supply chain project. Recently spoke to grahamc (he/him) about some of this as well. Definitely looking to involve the Nix community in some of this as I think Nix is doing a lot of awesome work in this space. Definitely interested in figuring out how we can collaborate in this space. | 16:54:16 |
| Michael Lieberman | Personally I'm looking at building a tool that can generate SPDX and/or CycloneDX formatted SBOMs based on Nix derivations. I have some thoughts on it but would definitely be interested in bouncing my ideas off of some folks who have more experience in the Nix derivation space. | 16:56:40 |
 disrupt_the_flow | Hello. Any1 using the hardened profile and Wayland? It seems scudo doesn't let shit to run. Like Firefox or telegram-desktop. Changing it to graphene-allocator which works way better? And way the fuck less loc. I think hardened_malloc has 18k and scudo 400k. | 19:44:53 |
 Mic92 joined the room. | 19:57:52 | |
 Sushi Dude | In reply to @disrupt_the_flow:matrix.orghttps://github.com/NixOS/nixpkgs/issues/100799#issuecomment-728935064 | 20:05:47 |
| disrupt_the_flow | In reply to @sushi_dude:matrix.orgYeah thanks. I've seen such mentions. But it's very very weird that Firefox for example crashes. | 20:18:31 |
 hexa | ris_: are you up for some curl shenanigans? | 23:00:53 |
 ris_ | not tonight | 23:01:09 |
| hexa | no problem, the issues are not going anywhere | 23:01:32 |
| hexa | https://github.com/NixOS/nixpkgs/pull/124502#issuecomment-881944444 | 23:02:12 |
| hexa | that comment is the most intriguing | 23:02:29 |
| ris_ | yeah i saw it - it's probably a good idea all in all | 23:03:07 |
| 23 Jul 2021 | ||
 nixinator | In reply to @mlieberman85:matrix.orgwhat do you need? | 02:08:37 |
 Gytis Ivaskevicius | Does nixos have some sort of security newsletter? Currently I am subscribing to manjaro one and I feel ashamed for it :D | 07:04:13 |
 Sandro | No | 07:07:15 |
| Mic92 | There was one on google groups quite some time ago | 07:49:41 |
 Samæ joined the room. | 08:26:07 | |
| Samæ | Hi everyone. How can I check that my system (kernel) is patched against CVE-2021-33909? I found this PR https://github.com/NixOS/nixpkgs/pull/131113 related to zen-kernels, but it doesn't clearly answer my question. | 08:27:59 |
| das_j | Samæ: It's patched if you updated and rebooted recently. But you could try the exploit from the oss mailing lsit | 08:28:45 |