Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by cel1ne | Hacker News Reader

Parent Full thread

cel1ne·

I did this 15 years ago, before I gave gentoo a spin. I compiled my kernel for many years (make menuconfig).

Bottom line: It's not worth it.

I use debian now.

View on HN

I put off doing LFS for several years: Ubuntu, then Debian, then OSX. I discovered NixOS a couple of years ago and never looked back.

I moved to Ubuntu for political reasons outside the fault of gentoo. I really miss the ability to easily patch core libs with custom patches, and portage (when it worked) was a lot easier to deal with than apt.

Care to elaborate on the "political reasons"? I've never heard of someone moving _to_ Ubuntu for political reasons.

If I get breached as a result of using gentoo, it looks bad. If I get breached using Ubuntu it’s at least along the lines of ‘well everyone else is using it anyway’. Semi safety in numbers, semi ‘nobody got fired for buying an IBM’.

It wasn’t my call, and it’s a defense move rather than an opinion on the state of Gentoos security. I know they take things very seriously, but my assertions aren’t enough to make my employer feel comfortable.

Amusing, in this context, that Google decided to base ChromeOS on Gentoo.

Sure, but I’m sure they leverage portage due to its sheer power and additional scrutiny over any ebuilds they source from upstream. Which, to be clear, the threat model assessed internally is intentionally malicious packages which are unintentionally merged into the portage tree by legitimate and well meaning developers. There’s no immediate issue with the portage or gentoo developers and package maintainers themselves.

Reply on news.ycombinator.com