Re: server and client in one package -> security issue (was: Add murmur)

[Danny Milosavljevic]

Hi,

I think the argument that things that don't exist can't be abused is a good one.

However, a regular user can install it anyway. I don't remember when I last ran 
"guix package -i" as root. I just run it using my regular user account.

So to separate the outputs adds just a miniscule step.

In the end, there's a trade-off to be made. Either we trust users to develop, 
too, or not. Obviously they can use it for good or bad, then. 

I myself am a free software hacker and I'd prefer if systems automatically had 
the development stuff installed so others can be free software hackers, too.

And an experienced hacker doesn't need header files either. I made up some of 
my own just searching Google - it's not difficult and takes about 30 min at 
most.

If we want hardened critical production systems, I agree it should only contain 
absolutely required files with programs as simple as one can get them, use 
SELinux and use hardened gcc and someone should have reviewed the base 
libraries and any other stuff that runs (basically until a reasonable 
confidence level is reached).

I don't think Guix should do that, though. IMO locking down everything for 
users is basically the antithesis of the FSF.