Atemu

This would better be done in the front-end rather than a comment bot.

Those packages themselves depend on xz. Pretty much all of them.

What you're suggesting would only make the xz executable not be backdoored anymore but any other application using liblzma would still be as vulnerable as before. That's actually the only currently known attack vector; inject malicious code into SSHD via liblzma.

The settings layout is a big step up but I'm not such a great fan of the theme changes. The new "Royal Blue" theme has lost quite a bit of contrast.

That works for leaf packages but not for core node packages. Every package depends on xz in some way; it's in the stdenv aswell as bootstrap.

That's a nice idea in theory but not possible in practice as the last Nixpkgs revision without a tainted version of xz is many months old. You'd trade one CVE for dozens of others.

This blog post misses entirely that this has nothing to do with the unstable channel. It just happened to only affect unstable this time because it gets updates first. If we had found out about the xz backdoor two months later (totally possible; we were really lucky this time), this would have affected a stable channel in exactly the same way. (It'd be slightly worse actually because that'd be a potentially breaking change too but I digress.)

I see two way to "fix" this:

• Throw a shitton of money at builders. I could see this getting staging-next rebuild times down to just 1-2 days which I'd say is almost acceptable. This could even be a temporary thing to reduce cost; quickly renting an extremely large on-demand fleet from some cloud provider for a day whenever a critical world rebuild needs to be done which shouldn't be too often.
• Implement pure grafting for important security patches through a second overlay-like mechanism.

It was not vulnerable to this particular attack because the attack didn't specifically target Nixpkgs. It could have very well done so if they had wanted to.

This has nothing to do with "unstable" or the specific channel. It could have happened on the stable channel too; depending on the timing.

AFAIK, affected versions never made it to stable as there was no reason to backport it.

xz is necessarily in the stdenv. Patching it means rebuilding the world, no matter what you optimise.

No.

That's not what flakes are important for at all.

Though unless you already know what flakes could do for you, I agree, you don't need to even think about flakes. They only concern one specific aspect of Nix and aren't even the only solution to that problem.