Embed Notice

@publicvoit @raboof Mitigations to avoid that initial foothold include:
- Having most systemd services configured via NixOS options run with DynamicUser set, enabling lots of system isolation: https://unix.stackexchange.com/questions/635027/systemd-dynamicuser-vs-user#635036
- The nature & implementation of the nix store precludes whole classes of common exploits like library/dll injection and malicious patching.
- You can comparatively easily add further isoation to potential entry points by declaring them in NixOS containers.