Posted Jun 25, 2007 23:05 UTC (Mon) by flewellyn
In reply to: Minimizing packages
Parent article: Counting vulnerabilities
But the trade-off is that every box ends up running its own unique mix of code. Security-wise, this is good in that it increases diversity (so it's less likely someone will be able to pwn *all* Gentoo boxes), but reduces scrutiny on the actual code and interactions present on any particular box (so it's more likely that any particular Gentoo box *can* be pwned, which is probably what most sysadmins care about more).
Actually, Gentoo does support binary packages, stored on a repository server that can be used to update the other machines in the cluster. I know of several clusters that do exactly this: one machine builds the updates, and then serves the binaries to the other machines. Obviously this really only works if you have a cluster of identical machines, but that's not unusual in a decent-sized server farm. Or a cluster of workstations.
to post comments)