Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nix as OS X Package Manager

ariya.ofilabs.com

Post reply on HN
Print view View original

11–20 of 209 posts

Re: Nix as OS X Package Manager

#11

Post by bydo »

nickysielicki wrote: post #5

> curl https://nixos.org/nix/install | sh Stop doing this. Look, even if you are rolling your eyes and thinking, "it's https and I'm not Ed Snowden, I think I can afford the risk for the benefit of an easy install process", what happens if curl is interrupted? Are you excited at the prospect of a half-ran install script that you didn't even look at?

The install script (for Nix, at least) is written such that it will not execute if partially downloaded, so that is less of an issue.

Though I do agree wholeheartedly that piping scripts to shell, sight unseen, is a remarkably awful idea.

Re: Nix as OS X Package Manager

#12

Post by hso1 »

schneidmaster wrote: post #9
hso1 wrote: post #7

Earlier quoted context omitted.

For me the biggest benefit is reproducibility. I can get a package to build on any machine exactly the same and with no hidden dependencies.

That does seem pretty cool, and I also see it works out-of-the-box on Linux machines. It doesn't seem to have a homebrew-cask equivalent though, which is a bit of a bummer. (Makes sense though since GUI applications aren't really cross-platform.) How does it handle OS-specific dependencies/distinctions? Or if e.g. a package requires ruby or python to be installed?

We use it on Python projects instead of virtualenv. A problem that you sometimes have with virtualenv is that you must install libpq-dev and python headers and what not to install from pip if the package has native extensions.

With Nix you just declare postgresql as your package inputs and you are done. All needed parts to build and install psycopg2 are there.

Your package/project is completely isolated from your OS libs.

Re: Nix as OS X Package Manager

#13

Post by vertex-four »

nickysielicki wrote: post #5

> curl https://nixos.org/nix/install | sh Stop doing this. Look, even if you are rolling your eyes and thinking, "it's https and I'm not Ed Snowden, I think I can afford the risk for the benefit of an easy install process", what happens if curl is interrupted? Are you excited at the prospect of a half-ran install script that you didn't even look at?

The script doesn't run if it downloads. Go read it yourself.

What attack vector would you actually be protecting against if you downloaded a .tar.gz full of binaries and extracted it to /, then started installing things with it?

Re: Nix as OS X Package Manager

#14

Post by wired_devil »

nickysielicki wrote: post #5

> curl https://nixos.org/nix/install | sh Stop doing this. Look, even if you are rolling your eyes and thinking, "it's https and I'm not Ed Snowden, I think I can afford the risk for the benefit of an easy install process", what happens if curl is interrupted? Are you excited at the prospect of a half-ran install script that you didn't even look at?

Take a look at the install script. It's not so complicated, pretty much only download a tar.gz. So why using curl?

Re: Nix as OS X Package Manager

#15

Post by rdtsc »

When I first heard about Docker, I thought it did what Nix does.

Then someone handed me a docker image saying, "I got this working on my laptop, deploy this. Isn't this great!". I had no idea how they arrived at that configuration. If something happened to them or that image, I wouldn't have known how to reproduce that "working state".

So I am happy to see Nix / Guix become popular. It is what I imagined package management to be.

Before that we just used rpm and deb packages. For all the hate they get, they are actually well thought out, tested, stable format. With {pre/post}-{install/uninstall} script support, dependency resolution and so on.

But Nix / Guix is a qualitatively different things. Hope it becomes popular.

Re: Nix as OS X Package Manager

#16

Post by hso1 »

wired_devil wrote: post #14
nickysielicki wrote: post #5

> curl https://nixos.org/nix/install | sh Stop doing this. Look, even if you are rolling your eyes and thinking, "it's https and I'm not Ed Snowden, I think I can afford the risk for the benefit of an easy install process", what happens if curl is interrupted? Are you excited at the prospect of a half-ran install script that you didn't even look at?

Take a look at the install script. It's not so complicated, pretty much only download a tar.gz. So why using curl?

Did you know that a malicious server can detect if you are piping to a shell and serve a completely different thing? D:

Re: Nix as OS X Package Manager

#17

Post by bydo »

vertex-four wrote: post #13
nickysielicki wrote: post #5

> curl https://nixos.org/nix/install | sh Stop doing this. Look, even if you are rolling your eyes and thinking, "it's https and I'm not Ed Snowden, I think I can afford the risk for the benefit of an easy install process", what happens if curl is interrupted? Are you excited at the prospect of a half-ran install script that you didn't even look at?

The script doesn't run if it downloads. Go read it yourself. What attack vector would you actually be protecting against if you downloaded a .tar.gz full of binaries and extracted it to /, then started installing things with it?

On that note, is there some valid reason Nix absolutely needs access to / to create /nix? Why can't it live somewhere else? I believe some parts can go anywhere, but /nix is hard coded for the rest, which I'm not entirely comfortable with.

Re: Nix as OS X Package Manager

#18

Post by nickysielicki »

vertex-four wrote: post #13
nickysielicki wrote: post #5

> curl https://nixos.org/nix/install | sh Stop doing this. Look, even if you are rolling your eyes and thinking, "it's https and I'm not Ed Snowden, I think I can afford the risk for the benefit of an easy install process", what happens if curl is interrupted? Are you excited at the prospect of a half-ran install script that you didn't even look at?

The script doesn't run if it downloads. Go read it yourself. What attack vector would you actually be protecting against if you downloaded a .tar.gz full of binaries and extracted it to /, then started installing things with it?

Good point, I didn't look at the script. My point about half-downloads is bogus.

Kind of a funny situation. If you look at the script first, you'll notice that it would have been okay for the download to be interrupted and so, assuming everything else is kosher with you, the '| sh' would have been "safe".

And if you don't look at the script first, you'd never know that what you just did was "safe."

Schroedinger's-pipe-to-sh.

Re: Nix as OS X Package Manager

#19

Post by oconnore »

nickysielicki wrote: post #5

> curl https://nixos.org/nix/install | sh Stop doing this. Look, even if you are rolling your eyes and thinking, "it's https and I'm not Ed Snowden, I think I can afford the risk for the benefit of an easy install process", what happens if curl is interrupted? Are you excited at the prospect of a half-ran install script that you didn't even look at?

No [1].

If you are installing software from scratch, you must trust the https server that serves it to you.

They could publish sha256 check sums to https://nixos.org/hashes, but you would have to trust the https server.

They could publish their gpg key to https://nixos.org/gpg, but you would have to trust the https server.

Things would be better if we had a reasonable certificate system for verifying open source software, but we don't. There is no gpg web of trust. There is no hierarchical CA system for code signing that open source authors can easily plug into, and expect their users to verify.

If you care this much, stop astroturfing and go build a system that does better. It will be very hard work, and you will have to distribute the first version of your solution with an https server that your users will have to trust.

[1]: Ok, so maybe the instructions could be "curl -o install.sh && sh install.sh".

Re: Nix as OS X Package Manager

#20

Post by mhd »

AceJohnny2 wrote: post #6

I was forcefully relocated from my comfortable decade-old Debian home into OS X, and the package management here in unsatisfying. I'm looking forward to future posts that show how Nix is better than Homebrew or MacPorts, because that hasn't been demonstrated so far. And as a bikeshed nitpick, I was always unhappy with the meaningless rpm options, preferring apt's clearer options (rpm -qa vs aptitude search). I'm a bi…

To continue picking nits, that's apples/apple pie, not tomatoes. rpm's equivalent is dpkg, not aptitude (whose match would be yum/dnf/zypper).
Post reply on HN