Garnix Blog: Stop trusting Nix caches
With most caches, you are giving a lot of people a lot of access
If you've been using Nix for any length of time, you've probably used projects
that
recommend
adding their cache, and their signing key, to your Nix configuration. Or they
do that sort-of-automatically, by setting the substituter
in the flake.nix, so you are prompted to accept their cache when building anything.
?
We strongly recommend against that. External caches give people with access
to the cache an easy path to replacing most...
Read more at garnix.io