patch the planet

I don't know if you've seen this, but a CA just got popped. Their keys got leaked, which means the industry as a whole now has some pretty major problems. It was revealed two hours ago.eMudhra Intermediate CA CompromiseeMudhra Intermediate CA CompromiseNow you're probably wondering why I'm writing up this blog post. It's simple. This is perhaps one of the easiest security patches I've ever done, and I've discovered a few new tricks. First, understand that fixing this with ease without Nix is almost impossible. Tens of millions of dollars (if not more) in productivity are being lost worldwide right now as everyone tries to patch their transitive dependencies. Meanwhile, because I've used Nix, I can patch the planet, since the ideas behind the blog post below extend into security as well.a new model for open source: closed to pull requests, open to remix.All right, I'm going to open up a history lesson because it's been a couple of generations of software engineers since this essay, and…