Post B5UoTBNAcqcDWcBJlA by civodul@toot.aquilenet.fr
 (DIR) More posts by civodul@toot.aquilenet.fr
 (DIR) Post #B5Uo3j48jVlyUd8q12 by zimoun@sciences.re
       0 likes, 0 repeats
       
       « The politics of language design » by Pierre-Étienne Meunier🤔 and again 🤔Although, I’m not sure to follow the “stir up a hornet's nest”, the talk raises some core questions about governance or the social impact of technical choices.Damned, I’m sad that although living in Paris my schedule hasn’t let me the opportunity for attending to #LixCon2026 in Paris. Next time, maybe…1/6
       
 (DIR) Post #B5Uo3jLrfbx1NbQzdw by zimoun@sciences.re
       0 likes, 0 repeats
       
       The politics of language design by Pierre-Étienne Meunier in #LixCon2026« Fake supply chain security, even worse than no supply chain security at all? »Indeed, it’s a question for #Nix and #Guix. Yeah 1. … and then 2. …2/6
       
 (DIR) Post #B5Uo3jYGvTsM05Etyy by zimoun@sciences.re
       0 likes, 0 repeats
       
       The politics of language design by Pierre-Étienne Meunier in #LixCon2026« Fake supply chain security, even worse than no supply chain security at all? »…Yeah:1. The builds aren’t guaranteed reproducible by design, I mean, it’s the exactly same as Debian, etc. About Nix I don’t know the details, please read Nix’s expert @luj blog post: https://luj.fr/blog/is-nixos-truly-reproducible.htmlAbout Guix, it’s currently poorly monitored, to my knowledge.3/6
       
 (DIR) Post #B5Uo3jlk7OeQfrXeym by civodul@toot.aquilenet.fr
       0 likes, 0 repeats
       
       @zimoun Build reproducibility is monitored per package, per commit, and per architecture, and all that is stored in the Data Service.  We can get a glimpse of it at https://qa.guix.gnu.org/branch/masterThe downside is that there’s currently “only” two build farms to compare.@luj
       
 (DIR) Post #B5Uo3jttd5An59MAgi by zimoun@sciences.re
       0 likes, 0 repeats
       
       The politics of language design by Pierre-Étienne Meunier in #LixCon2026« Fake supply chain security, even worse than no supply chain security at all? »…Yeah:2. Guix/Nix packages stuff: it means it provides tooling for auditing and verifying if the binary matches the identified source; and for the whole chain of dependencies. But there is no guarantee it’s fully error-free – we’re able to point where the error if any comes from. It’s already a lot!Guix is like the indian Dabbawala service using “barecodes” everywhere. It doesn’t prevent stories as The Lunchbox. 😉https://en.wikipedia.org/wiki/Dabbawalahttps://en.wikipedia.org/wiki/The_Lunchbox4/6
       
 (DIR) Post #B5Uo3kDkRH3K4ie1dA by zimoun@sciences.re
       0 likes, 0 repeats
       
       The politics of language design by Pierre-Étienne Meunier in #LixCon2026« Create your own language only if you need something new in language design »« OCaml already exists and is the best language for that particular job »Yeah, I would have loved instead of Nix language 😱 and Guix Scheme DSL 🤨 to have OCaml. 🤩5/6
       
 (DIR) Post #B5Uo3kXbFSvr4HvsZc by zimoun@sciences.re
       0 likes, 0 repeats
       
       🤔 To some extent, ideas behind Elpe reminds me propellor (Haskell)Joey Hess’s talk in linux conf au 2017: https://youtu.be/kzXXcr8TyJYhttps://nest.pijul.com/pmeunier/elpe6/6
       
 (DIR) Post #B5UoTB8dUszOnXNi6a by raito@nixos.paris
       0 likes, 0 repeats
       
       @zimoun @luj I think this is a very interesting question we should definitely go into more details, supply chain security is not only bit to bit reproducibility right? What is our threat model?
       
 (DIR) Post #B5UoTBNAcqcDWcBJlA by civodul@toot.aquilenet.fr
       0 likes, 0 repeats
       
       @raito Supply chain security has been addressed from different angles in Guix, which I tried to explain in https://doi.org/10.22152/programming-journal.org/2023/7/1Probably not the end of the story (we’re still tackling sometimes ridiculous issues, like avoiding “source” tarballs that contain pre-built artifacts), but a good start.@luj @zimoun
       
 (DIR) Post #B5W7nJVECVdmooDtk8 by raito@nixos.paris
       0 likes, 0 repeats
       
       @civodul @luj @zimoun I skimmed through the paper but I did not find what I was interested in. How do you address the committer trust layer? I get that Guix authenticates Git checkouts and verifies signatures of committers.How does Guix work towards coercion resistance against backdooring, suspicious behavioral attacks, compromised forge accounts/authoring systems, etc. ?I suspect this is the point that has been the least addressed among all modern supply chain solutions.
       
 (DIR) Post #B5WNmAfz89euQ8jR32 by civodul@toot.aquilenet.fr
       0 likes, 0 repeats
       
       @raito Compromised forges are not a problem: one needs access to a committer’s key to get code in Guix.Coercion? The only way I can think of to mitigate this is canaries.But this is hard to counter by definition, and I’d say beyond our threat model (for now).@zimoun @luj
       
 (DIR) Post #B5WNqSwr8ZCsFUffH6 by raito@nixos.paris
       0 likes, 0 repeats
       
       @civodul @zimoun @luj Compromised committer laptops I meant.
       
 (DIR) Post #B5WNtNk0xBTuy53St6 by raito@nixos.paris
       0 likes, 0 repeats
       
       @civodul @zimoun @luj For Nixpkgs, I think this is not, alas, out of the scope.People run many workloads at the same time, it's very easy to do `npm install worm` on one window and have it lateralize their access to a commit bit.