Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nix as OS X Package Manager

ariya.ofilabs.com

Post reply on HN
Print view View original

111–120 of 209 posts

Re: Nix as OS X Package Manager

#111

Post by [deleted] »

falcolas wrote: post #77
oconnore wrote: post #19

Earlier quoted context omitted.

No [1]. If you are installing software from scratch, you must trust the https server that serves it to you. They could publish sha256 check sums to https://nixos.org/hashes , but you would have to trust the https server. They could publish their gpg key to https://nixos.org/gpg , but you would have to trust the https server. Things would be better if we had a reasonable certificate system for verifying open source so…

> If you are installing software from scratch, you must trust the https server that serves it to you This is incorrect - you are forced by `curl | sh` to trust all of the 1000+ CAs in your OS' keystore. And if you can't trust all of them (since some have given out Google certs before, you can't), how can you trust what you're getting over HTTPS? With hashes, they are not typically served from the same domain. That's…

[deleted]

Re: Nix as OS X Package Manager

#112

Post by oconnore »

falcolas wrote: post #71
__david__ wrote: post #37

Earlier quoted context omitted.

So you pull the package down and the signature checks out to some key on a pgp key server. How do you know it's the correct key?

Generally, the key already exists on your system, as it's coming through the official channels. If you decide to add the cert manually, you can inspect the key and see who has signed it, and decide your level of trust. With HTTPS, you only ever have the choice of trusting the 1000+ CAs in your keyring.

> If you decide to add the cert manually, you can inspect the key and see who has signed it, and decide your level of trust.

No one has signed it, because the mythical web of trust does not exist. What now?

Re: Nix as OS X Package Manager

#113

Post by tvon »

j1vms wrote: post #46

Could someone post (or link to) the history of Nix, the package manager? Who developed it, key project milestones, etc.? I understand it comes from, or led to, NixOS Linux distribution which uses Nix of course. The nixos.org website is a bit sparse on the Nix project's history, and same with wikipedia (though separately mentions that NixOS was a research project started by Eelco Dolstra in 2003).

I don't know if it's useful to you, but I can link you to Eelco Dolstra’s PhD Thesis (2006):

http://nixos.org/~eelco/pubs/phd-thesis.pdf

He also wrote this InfoQ article on the subject of Nix and NixOS which may have some useful information (2014):

https://www.infoq.com/articles/configuration-management-with...

The Wikipedia pages for Nix and NixOS also have some interesting references.

https://en.wikipedia.org/wiki/NixOS

https://en.wikipedia.org/wiki/Nix_package_manager

Edit: I have been playing with NixOS at home for a few months and I think it's very interesting, but I'm a bit surprised I haven't heard more about it over the past decade or so. I'm thinking that the recent industry focus on deployments and provisioning has caused more people to come across it.

Re: Nix as OS X Package Manager

#114

Post by [deleted] »

j1vms wrote: post #46

Could someone post (or link to) the history of Nix, the package manager? Who developed it, key project milestones, etc.? I understand it comes from, or led to, NixOS Linux distribution which uses Nix of course. The nixos.org website is a bit sparse on the Nix project's history, and same with wikipedia (though separately mentions that NixOS was a research project started by Eelco Dolstra in 2003).

[deleted]

Re: Nix as OS X Package Manager

#115

Post by lilyball »

SwellJoe wrote: post #100
AceJohnny2 wrote: post #6

I was forcefully relocated from my comfortable decade-old Debian home into OS X, and the package management here in unsatisfying. I'm looking forward to future posts that show how Nix is better than Homebrew or MacPorts, because that hasn't been demonstrated so far. And as a bikeshed nitpick, I was always unhappy with the meaningless rpm options, preferring apt's clearer options (rpm -qa vs aptitude search). I'm a bi…

"I'm looking forward to future posts that show how Nix is better than Homebrew or MacPorts, because that hasn't been demonstrated so far." Homebrew is downright dangerous (I've written about why: http://inthebox.webmin.com/homebrew-package-installation-for... ). MacPorts is fine. Not wonderful, but OK. Not reproducible in the way Nix is. PkgSrc is also pretty good. Also not reproducible the way Nix is. But, the packa…

Homebrew is not dangerous. Please don't spread FUD.

Your link specifically covers the case of Homebrew on the server. But Homebrew isn't meant to be a server package manager. It's an OS X package manager, and OS X is a desktop operating system, not something that most people choose to use as a server (OS X Server exists but is primarily used for intranet stuff rather than as a production server). The complaints that your link has are only problems for an external-facing server. They're not problems for desktop use. And the simple answer to that is: don't use a desktop package manager on your server.

Re: Nix as OS X Package Manager

#116

Post by chrismonsanto »

nefariousoctopi wrote: post #27
nickysielicki wrote: post #5

> curl https://nixos.org/nix/install | sh Stop doing this. Look, even if you are rolling your eyes and thinking, "it's https and I'm not Ed Snowden, I think I can afford the risk for the benefit of an easy install process", what happens if curl is interrupted? Are you excited at the prospect of a half-ran install script that you didn't even look at?

There is even timing server side attack exploiting "curl |bash" recently posted on HN [1]. [1]: https://news.ycombinator.com/item?id=11532599

This is an irrelevant "attack." If you don't trust the site to serve you a safe installer, then you shouldn't trust the site to serve you a safe program either. Do you regularly verify the entire source code of programs you install?

Re: Nix as OS X Package Manager

#117

Post by ghshephard »

lilyball wrote: post #115
SwellJoe wrote: post #100

Earlier quoted context omitted.

"I'm looking forward to future posts that show how Nix is better than Homebrew or MacPorts, because that hasn't been demonstrated so far." Homebrew is downright dangerous (I've written about why: http://inthebox.webmin.com/homebrew-package-installation-for... ). MacPorts is fine. Not wonderful, but OK. Not reproducible in the way Nix is. PkgSrc is also pretty good. Also not reproducible the way Nix is. But, the packa…

Homebrew is not dangerous. Please don't spread FUD. Your link specifically covers the case of Homebrew on the server . But Homebrew isn't meant to be a server package manager. It's an OS X package manager, and OS X is a desktop operating system, not something that most people choose to use as a server (OS X Server exists but is primarily used for intranet stuff rather than as a production server). The complaints that…

Totally agreed. Homebrew is not an appropriate tool for server package management (It assumes everything should be installed under a single user account)- but 98-99%+ of the people that use OS X and servers are not running OS X on their servers, macmini colo users excepted.

The wording dangerous was poorly used, inappropriate for server package management would have been better.

Re: Nix as OS X Package Manager

#118

Post by drewcrawford »

rdtsc wrote: post #15

When I first heard about Docker, I thought it did what Nix does. Then someone handed me a docker image saying, "I got this working on my laptop, deploy this. Isn't this great!". I had no idea how they arrived at that configuration. If something happened to them or that image, I wouldn't have known how to reproduce that "working state". So I am happy to see Nix / Guix become popular. It is what I imagined package mana…

But how do you reproduce the dpkg packages? When your friend hands you a deb, instead of a docker image, what have you accomplished as far as knowing how they arrived at their configuration? Debs are also binary blobs, just more of them, and separately.

From what I can see, there are two philosophically pure approaches to software packaging. Either we can build everything from source, so that we have reproducibility (see e.g. emerge for a practical system, although it is still not bit-for-bit reproducible) or else we can ship everything as a blob so we have total consistency (e.g. Docker, Go).

The other approaches, apt and nix, seem to me to be compromise positions. They may even be practical or useful compromises. But they are ultimately about the degree to which we allow binary blobs, not whether we do.

But it seems to me that once you have accepted installing binaries via apt then installing them from Docker is a question of degree, not of kind. It seems very hard to me to argue that distributing binaries via Docker is really worse than via nix.

Re: Nix as OS X Package Manager

#120

Post by falcolas »

oconnore wrote: post #112
falcolas wrote: post #71

Earlier quoted context omitted.

Generally, the key already exists on your system, as it's coming through the official channels. If you decide to add the cert manually, you can inspect the key and see who has signed it, and decide your level of trust. With HTTPS, you only ever have the choice of trusting the 1000+ CAs in your keyring.

> If you decide to add the cert manually, you can inspect the key and see who has signed it, and decide your level of trust. No one has signed it, because the mythical web of trust does not exist. What now?

Contact the developer (say, over IRC, Slack, email, GitHub, etc), and ask them to sign a sentence you provide with it. Then you can sign their key.
Post reply on HN