Re: Getting started with GWL 0.3.0

[Konrad Hinsen <konrad.hinsen@fastmail.net>]

zimoun <zimon.toutoune@gmail.com> writes:

> The user has to explicitly set GUIX_EXTENSIONS_PATH or explicitly
> install a package (or a channel, as "guix home").  I do not see where
> there is a security flaw, I mean it is the same vulnerability as for
> "guix repl -- foo.scm" or as for "guix install foo && foo".

The vulnerability level is the same, but a typical user's expectations
are not. When I run a script via "guix repl", it is perfectly obvious to
me that that script is not part of Guix. When I run the command "foo",
it is also perfectly obvious to me that "foo" is not part of Guix. But
"guix workflow" looks as if it were part of Guix.

Guix users need a significant level of trust in Guix and its developers
in order to use Guix. Attackers could exploit this trust by tricking
users into adding malicious code (via a channel, for example) that takes
the form of a Guix extension. People do run downloaded bash scripts
with root permissions, after all (e.g. for installing Guix ;-).

> And if you worry, I guess you can run GWL in a container, something like;
>
>   guix environment -C --ad-hoc gwl -- guix workflow

Sure, but that's not the issue. The issue is being aware that I have no
particular reason to trust "guix workflow" as much as I trust "guix
package".

Of course GWL is a bad example because its developers are a subset of
Guix developers. But the extension mechanism looks open to everyone.

Imagine a package "bitcoin-utils" that installs, among lots of other
stuff, an extension "guix pul" that starts a bitcoin-mining background
process whenever an unsuspecting user mistypes a frequent Guix command.

Cheers,
  Konrad.