cross-posted from: https://lemmy.ml/post/31718711
Always wanted to selfhost your Fediverse instance but were always worried about system administration trauma?
Do you ever have to run around your flat, picking up all the leftover parentheses from yesterday’s party with your hosting coop coworkers?
Then you are probably the right person, check out this post about fearless Bonfire hosting on a Guix System. You’ll learn that taking care of a community is much more manageable when you let computer do the boring work for you.
Set up HTTPS, automatic backups, automatic nightly upgrades and join the awesome Bonfire community without a single worry on losing data from your instance.
It’s the first time I see the concept of bootstrappability in the context of security.
Is it really worth the effort?
There are multiple ways to run a supply chain attack. With bootstrappability, one can be sure that the compiler is trusted, but what about the code that the compiler compiles? There was this recent attack to XZ utils, which shows that more attention is needed on the code being merged and compiled.
I think that this just creates a false sense of security.
Contrary to that, I had read about a BSD team (I think FreeBSD) that reviews all the code before each release. This way they have achieved ~5 RCE exploits throughout their entire history.
I think it’s worth the effort since it prevents numerous risks at the root, for sure it’s not enough. I agree that bootstrapping wouldn’t necessarily solve the XZ attack, but I think that should be solved by big tech paying FOSS maintainers enough or at all to prevent them from burning out.
About the BSD experience that looks like a big amount of work but definitely worth it, I’m sure they didn’t ship many packages as Guix ships but I guess the projects have different goals and requirements.
XZ was made possible largely because there was unaudited binary data. One part as test data in the repo, and the other part within the pre-built releases. Bootstrapping everything from source would have required that these binaries had an auditable source, thus allowing public eyes to review the code and likely stopping the attack. Granted, reproducibility almost certainly would have too, unless the malware wasn’t directly present in the code.
Pulled from here:
Sure you might have the code that was input into GCC to create the binary, and sure the code can be absolutely safe, and you can even compile it yourself to see that you arrive at the same bit-for-bit binary as the official release binary. But was GCC safe? Did some other compilation dependency infect the compiled binary? Bootstrapping from an auditable seed can answer this question.