diff --git a/Technology b/Technology index 2f7d631..074529b 100644 --- a/Technology +++ b/Technology @@ -107,10 +107,18 @@ security breaches are contained to the information the unikernel contains. ### Secure updates -If an OCaml library introduces security flaws or information leakage, all -unikernels depending on that library need to be updated. Updating an OCaml -library can safely be done via its package manager opam, which uses signed -repositories. +If a security flaw is found in a library, and the library gets a security update, +all unikernels depending on this library need to be updated as well. +This can be done with the OCaml package manager. +It resolves dependencies and lets authors sign their releases, +so there is no need for a central package repository server. + +These servers are known targets for attackers. +Various servers hosting open source software have been breached, amongst them +are [Linux kernel](https://lwn.net/Articles/57135/), [FreeBSD +infrastructure](https://www.freebsd.org/news/2012-compromise.html), +[Debian](https://www.debian.org/News/2003/20031202), +[php](http://php.net/archive/2013.php#id2013-10-24-2). TODO: For example ..