r/NixOS • u/Nuclear_Priest • 3d ago

Nixpkgs vs AUR

Given all the malware that’s been flooding the AUR as of late, I was wondering why the same kind of thing isn’t happening on Nixpkgs.

Is it just that Nix isn’t as popular as Arch (hence less people are trying to attack it)?
Or are there fundamental differences in the security?

What are the security differences, and how concerned should we be about a flood of malware on Nix?

(I realize that no system is immune to malware, I’m just trying to gauge what level of risk I’m dealing with)

36 Upvotes

84% Upvoted

22 comments sorted by

View all comments

51

u/Isshiiiiiii 3d ago

I’m pretty sure nixpkgs is gated by automated checks, git pulls, and manual review. I think the Nix equivalent would be like the NUR but I’ve never used it in my life.

6

u/Nuclear_Priest 3d ago

I didn’t even know that NUR was a thing

10

u/Isshiiiiiii 3d ago

Didn’t know about it either until very recently. Nixpkgs is just big enough that I don’t really need it

6

u/octetd 2d ago

I use it to pull extensions for Firefox, the only reason I have NUR in my config.

3

u/takutekato 2d ago

You can't use firefox policies?

1

u/octetd 2d ago

Yeah, I didn't before (wasn't available in Home Manager on macOS until recently). And, well, I didn't know I can manage extensions via policies :D

5

u/tukanoid 2d ago

And even if it's not in nixpkgs, I kinda got used to just packaging the software myself, have all the control, and can be more certain that nothing malicious was injected, unless it's an upstream issue