Nix lets you go back, and you and even mix channels. Pulling one package from a different version.
That's true, but you have to know there was a backdoor first. If someone doesn't know, and they use the latest version, they're vulnerable to attack
If the issue had been critical, then the branch head could be rolled back, causing everyone to downgrade
That's a nice idea in theory but not possible in practice as the last Nixpkgs revision without a tainted version of xz is many months old. You'd trade one CVE for dozens of others.
Nix lets you go back, and you and even mix channels. Pulling one package from a different version.
That's true, but you have to know there was a backdoor first. If someone doesn't know, and they use the latest version, they're vulnerable to attack
If the issue had been critical, then the branch head could be rolled back, causing everyone to downgrade
That's a nice idea in theory but not possible in practice as the last Nixpkgs revision without a tainted version of xz is many months old. You'd trade one CVE for dozens of others.