Re: server and client in one package -> security issue (was: Add murmur)

[David Craven]

> And from my point of view Guix already has a medium problem of acceptance
> since it munges development-files and run-time files into one package - as we
> do for all libraries.

By development files I assume you mean header files? I don't see how those can
pose a security problem. Can you elaborate?

> Now if Guix starts munging server and client components into one
> package, this plain disqualifies GuixSD from any security sensitive
> system. [*]

> [*] OTOH it opens up chances for big business: selling "Secure GuixSD"
> to customers.

I think that we provide security on a best effort basis. A high profile target
like a bank or credit card payment service will likely have their own security
team and will use guixsd as a basis for their deployment. We can not do the
work that is the responsibility of an in house sysops team.