Hi Ludo,
On Sun, 16 Feb 2020 at 11:59, Ludovic Courtès <ludo@gnu.org> wrote:
Toggle quote (14 lines)
> zimoun <zimon.toutoune@gmail.com> skribis:> > On Fri, 14 Feb 2020 at 22:34, Ludovic Courtès <ludo@gnu.org> wrote:
> >> Also, one could argue that we’d steer users towards downloading from our> >> server, which could be a privacy concern (probably not a strong argument> >> since one can easily change the substitute URLs.)> >> > I am not following the privacy concern.> > What do you mean?>> I mean that by default, someone who’s disabled substitutes (presumably> out of security or privacy concerns) would find themself downloading> source code from ci.guix.gnu.org instead of various upstream sites.
I do not see the difference between mirroring and traveling back intime with missing upstream sources.And because it is content-addressed, it seems even more secure thandownloading from a upstream URL, IMHO.If one trusts Guix, then an attacker needs to corrupt in the same timethe Guix history and Berlin (and/or any other farm).If one does not trust Guix, why does they use the recipe coming fromGuix? To be precise, this person has to check all the recipes of allthe dependencies.
Well, I do not see a security concern because we are talking aboutserving the sources.It is another story when the substitutes serve the results of thebuild (binaries); because one does not have any strong guarantee thatthe substitute serves the expected binaries.
By privacy concern, do you mean that Guix could collect who downloadswhat; in a central fashion? Which is not the case when one downloadsfrom several distributed upstream sources. Right?Well, I am not convinced because the case of missing upstream sourceis rare. And it is easy to protect against such collecting dataprocess.In paranoid mode, traveling back in time is becoming difficult becauseof the reliability of the sources; I mean if the sources werereliable, SWH would not exist. ;-) The solution should be an IPFS /GNUnet / full distributed archive... which is not ready... yet! :-)
Well, maybe for the TODO list of the time-machine: add an option toallow substitutes *only* for the sources (substitutes meaningci.guix.gnu.org and/or SWH). If this option does not exist yet. ;-)
Cheers,simon