Said it downthread, but saying it again because it bears repeating:
This is a product whose major contributors live in a state prone to very persuasive forms of coercion. Worse, this is a _build system_. Moreover, it's one of the most reticulate build systems on the planet -- I doubt more than a few hundred senior engineers would be able to spot a Jia-Tan-style compromise in the Nix machinery, let alone a remix/workalike of it.
There is currently a war going on. Not a 'war on' drugs, or cancer, or a 'culture war', or any of the other phenomena that Americans routinely nowadays call a 'war', but an actually-actual conflagration involving grads, kinzhals, and, easily, the futures of a couple of well-intentioned engineers in Moscow.
I expect the creators of this product are sincere, serious, smart, kind, generous, funny, honorable people. Yet it is simply too plausible that the FSB could come by and lean on them (or their uncle, or mother, or sister, or...) and have a little something extra put at the very root of the tree, from where it could be folded into any (or every) part of the system.
Open source across international borders is a peacetime phenomenon, as we are all about to discover, methinks. I hope I'm wrong.
I really don't want to start irrelevant discussions in this thread, but if you think an extrajudicial secret service can't lean on any open source developer regardless of the country and your side relative to it, please think again. "This can't happen here" is not a helpful attitude, and also you are on the slippery slope here. Paranoia can disintegrate the community far quicker than any actual spooks. Without a certain amount of trust (backed by reputation and verification) nothing useful could be possibly done.
there are plenty of people with commit bits (me included) who don't reside in Russia, and would (I hope) be pretty alert to the Russian state coercing tazjin (the only committer currently residing in Russia) into introducing some form of backdoor.
Comments
Said it downthread, but saying it again because it bears repeating:
This is a product whose major contributors live in a state prone to very persuasive forms of coercion. Worse, this is a _build system_. Moreover, it's one of the most reticulate build systems on the planet -- I doubt more than a few hundred senior engineers would be able to spot a Jia-Tan-style compromise in the Nix machinery, let alone a remix/workalike of it.
There is currently a war going on. Not a 'war on' drugs, or cancer, or a 'culture war', or any of the other phenomena that Americans routinely nowadays call a 'war', but an actually-actual conflagration involving grads, kinzhals, and, easily, the futures of a couple of well-intentioned engineers in Moscow.
I expect the creators of this product are sincere, serious, smart, kind, generous, funny, honorable people. Yet it is simply too plausible that the FSB could come by and lean on them (or their uncle, or mother, or sister, or...) and have a little something extra put at the very root of the tree, from where it could be folded into any (or every) part of the system.
Open source across international borders is a peacetime phenomenon, as we are all about to discover, methinks. I hope I'm wrong.
I really don't want to start irrelevant discussions in this thread, but if you think an extrajudicial secret service can't lean on any open source developer regardless of the country and your side relative to it, please think again. "This can't happen here" is not a helpful attitude, and also you are on the slippery slope here. Paranoia can disintegrate the community far quicker than any actual spooks. Without a certain amount of trust (backed by reputation and verification) nothing useful could be possibly done.
there are plenty of people with commit bits (me included) who don't reside in Russia, and would (I hope) be pretty alert to the Russian state coercing tazjin (the only committer currently residing in Russia) into introducing some form of backdoor.
Cool, now do Israel.