Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NixOS 21.05

nixos.org

Post reply on HN
Print view View original

131–140 of 234 posts

Re: NixOS 21.05

#131

Post by adkadskhj »

acgkmopvvgvmgv wrote: post #87
sph wrote: post #21

Earlier quoted context omitted.

The documentation and the nix language are the worst things about the project IMO. I really hope Guix succeeds because Scheme is, in my opinion, a better DSL and language than this weird, not very well documented, Haskell-like derivative. Unless you've drank the kool-aid, you have to learn a completely new operating system and way of doing things, a weird language that's lacking on documentation, and a ton of system…

Nix and similar projects are all going to be eaten alive by immutable distributions, Flatpak and new projects - that might work just like Nix but get the user experience right, and make packaging and maintenance easier. And no I'm not saying they do the exact same thing, have all the same features or target the same type of users. For the developer tools side I like what Shopify did but I would never recommend that t…

As a new NixOS user currently set up with home manager and flakes - i'd probably switch in a heartbeat if someone gave me a nice nix-like package manager that also handled dotfiles.

As much as i love the feeling of NixOS, i really want something like a Lockfile as seen in Rust (and other languages).

Ie if i could define a `Cargo.toml`, which includes versions of packages or `*` if i don't care - and then it gets built into a `Cargo.lock`, i'd be in heaven. Combine that with a great language backing the distro and i'd switch immediately.

As it stands, I hate nixlang, and while flakes is amazing i still dislike the single primary input approach to NixOS _(ie all the packages bundled together)_.

As an example of why i dislike that, i'm stuck on an old version of NixOS currently because when i tried to update the repo date - lots of packages changed in difficult to manage ways. X was crazy slow, Firefox was being wonky, XFCE was janky, etc. All my flakes.lock told me was that the hash of the repo was different.. yay.. hundreds of dependencies were different i'm sure, but no clue which ones, and no easy way to isolate the problems and just incrementally update.

Luckily flakes allowed me to rollback perfectly. Well, i still had some userland state from the newer applications that i needed to nuke, but i'm ignoring that for now.

Being able to more easily incrementally update specific dependencies would be amazing for me. As it stands i have no clue when or how i'll update my NixOS input version. Which is not a promising sign for my continued usage of NixOS.

Re: NixOS 21.05

#132

Post by pxc »

flatiron wrote: post #94
Sleepytime wrote: post #60

Earlier quoted context omitted.

>Is there some way I can boot-to-git-configuration? Yes, the NixOS installer is a live disk with all the features of NixOS. I have booted configurations directly from IPFS in the installer, and many nix commands and functions support git (or GitHub) natively. You can declaratively specify your whole infrastructure from software configuration to remote machines with their own VMs. For example here's my nix function fo…

i hope you aren't still using that shared secret

Nix's IPFS support is for everything in the Nix store, which is world-readable and in which NixOS places no secrets. Options for managing secrets in/with Nix projects either encrypt them in the store or never have them touch the store (encrypted or otherwise).

Mutable state like database contents, including their password databases, don't go in the Nix store either.

Re: NixOS 21.05

#133

Post by pxc »

kaba0 wrote: post #111
Nullabillity wrote: post #37

Earlier quoted context omitted.

> So if I understand correctly, I could declaratively specify my workstation, say I want vim, podman, codium, kubectl, curl, tmux, firefox, zettlr. I could put this in a configuration and have my workstation anywhere I can grab that from? Kind of. It works very well if you own multiple computers that you want to be configured similarly (like a dotfiles repo on steroids). It doesn't work so well for I borrowed my cowo…

> However, Nix does also supply the "nix run" command, which allows you to use software without installing it permanently (but without NixOS' configuration support). What do you mean without config support? It runs a nix derivation which can be arbitrarily complex. Do you mean your /etc/nixos/configuration.nix file? Because you are not really using it either, only for creating a derivation that will become your syste…

Yeah, I think they just mean without the conveniences of the NixOS module system. You can definitely bundle config with an app and store it in a repository's shell.nix or a flake or whatever.

Re: NixOS 21.05

#134

Post by hollerith »

soraminazuki wrote: post #109
hollerith wrote: post #66

I ran Nixos for a few months from Dec 25 to Mar 12 of this year. During that time there were 2 zero-day exploits published for Chrome that went unpatched for weeks on Nixos. (Specifically the package named google-chrome went unpatched.) This was on the "unstable" branch of Nixos, the branch that became the stable branch today, which is the occasion of this story on HN we are commenting on. Digression: the reason I ch…

For anyone willing to help the Nix project, there's a script[1] you can use in the Nixpkgs repo to update the official Nix package for Chrome. If you ever feel that Chrome needs to be updated immediately, you can help out by running this script and opening a PR. [1]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/applicatio... --- Now, back to point, security issues are not "neglected" in NixOS, and most of the po…

>I don't believe it's fair to spread doubts

I think it is fair as long as I make it clear (which I hope I have) that I didn't investigate fully after I saw some warning signs.

>spread doubts just because they don't get fixed in a day or two.

I am not a security expert, but tptacek is, and in 2017 he wrote that "You don't want your browser to be any number of days behind the Chromium patch cycle."[1] IIRC, tptacek or someone of similar credibility said that the browser and the kernel are the primary targets of zero-days exploits on a desktop Linux install.

[1] https://news.ycombinator.com/item?id=13517227

Also let's see how another party handles patches for Chrome: the Arch User Repository's Chrome package (not an official part of Arch Linux) "will automatically get updated as soon as the Debian package is available. This is checked at least once per hour."[2]

There are many many things a distro needs to get right to compete with, e.g., Debian or Fedora on all the criteria desktop Linux users care about. It is not easy. My thanks to Nixos's maintainers for investing their time in trying to advance the state of the art. But Linux users invest a lot of time, too, and in chiming in today I did so because I thought I could save Linux users some time by presenting my conclusions after spending many 10s of hours installing and exploring Nixos.

[2] https://aur.archlinux.org/packages/google-chrome/

>Installing your preferred version of Chrome using Nix is as simple as supplying an alternative upstream URL for the google-chrome package.

Please correct me if I am wrong: this requires building Chrome from source, which will spike the user's CPUs for hours and is impossible with less than 8 megs of RAM ("More than 16GB is highly recommended")[3]

[3] https://chromium.googlesource.com/chromium/src/+/HEAD/docs/l...

Re: NixOS 21.05

#135

Post by alias_neo »

Sleepytime wrote: post #60
alias_neo wrote: post #12

Earlier quoted context omitted.

So if I understand correctly, I could declaratively specify my workstation, say I want vim, podman, codium, kubectl, curl, tmux, firefox, zettlr. I could put this in a configuration and have my workstation anywhere I can grab that from? Is there some way I can boot-to-git-configuration? So I could do this in RAM on someone else's hardware, like a network boot?

>Is there some way I can boot-to-git-configuration? Yes, the NixOS installer is a live disk with all the features of NixOS. I have booted configurations directly from IPFS in the installer, and many nix commands and functions support git (or GitHub) natively. You can declaratively specify your whole infrastructure from software configuration to remote machines with their own VMs. For example here's my nix function fo…

Thanks I'll have a read through it, I can lots of uses for this already!

Re: NixOS 21.05

#136

Post by pxc »

Blikkentrekker wrote: post #34
alias_neo wrote: post #12

Earlier quoted context omitted.

So if I understand correctly, I could declaratively specify my workstation, say I want vim, podman, codium, kubectl, curl, tmux, firefox, zettlr. I could put this in a configuration and have my workstation anywhere I can grab that from? Is there some way I can boot-to-git-configuration? So I could do this in RAM on someone else's hardware, like a network boot?

Almost any system can do that. Package managers typically have a concept of a “selected set” or something o that nature which is often simply a file that contains all the packages the user wants to install on a new line at some places. Simply copy that file and do a world update with the package manager and it will install all those packages an their dependencies and typically uninstall what is not needed.

*Almost any system can attempt that.

Nix lets you pin your whole dependency tree, and Nixpkgs includes facilities for managing the configurations of many applications, including integrations with their plugin systems that explicitly manage external runtime dependencies, like stuff your vim configuration might call at the CLI. Without that stuff, reproduction can often fail in practice.

And in the case of NixOS, you can also reproduce things like running services and their configurations, which users exist, etc. Those are OS and configuration management features, not package management.

Re: NixOS 21.05

#137

Post by alias_neo »

Nullabillity wrote: post #37
alias_neo wrote: post #12

Earlier quoted context omitted.

So if I understand correctly, I could declaratively specify my workstation, say I want vim, podman, codium, kubectl, curl, tmux, firefox, zettlr. I could put this in a configuration and have my workstation anywhere I can grab that from? Is there some way I can boot-to-git-configuration? So I could do this in RAM on someone else's hardware, like a network boot?

> So if I understand correctly, I could declaratively specify my workstation, say I want vim, podman, codium, kubectl, curl, tmux, firefox, zettlr. I could put this in a configuration and have my workstation anywhere I can grab that from? Kind of. It works very well if you own multiple computers that you want to be configured similarly (like a dotfiles repo on steroids). It doesn't work so well for I borrowed my cowo…

Ive seen mention to "switching" to a configuration a few times now, what does that mean technically? Is it a reboot and select a different grub option, does it take time/have to download things? What really is "switching"?

Re: NixOS 21.05

#138

Post by Ericson2314 »

Ericson2314 wrote: post #59
e3bc54b2 wrote: post #25

I've been smitten by NixOS ever since I first tried it 2 years ago. Its the first carefree experience I've had with my system. As a side note, this result includes first tiny contributions of mine! That said, I really hope the community gets their stuff together on Flakes. They're designated as experimental and official document doesn't recommend them, but all the cool kids are already using them everywhere and it is…

I'm glad we didn't yet stabilize because I am skeptical of a number of aspects to Nix. I suspect it's unduly popular because pure eval mode is a food idea, but there is little way to use it outside of flakes.

s/to nix/of flakes/, to be clear

Re: NixOS 21.05

#139

Post by sorbits »

nitsky wrote: post #4

I recently moved my laptop, desktop, and a few servers from Arch Linux to NixOS with flakes and home-manager. It is amazing! The complete configuration for all machines is in a single git repository, I can share configuration between them, and a `flake.lock` file guarantees all machines are using the same version of everything. No more trying to remember what command I need to run to install and configure software an…

> and a few servers

The problem I see with NixOS on a typical personal server is that you have to setup all these things using nix expressions, from which the actual configuration files are generated.

That means if you e.g. want to install postfix, instead of learning about main.cf you have to learn the syntax of the nix configuration wrapper for postfix, and postfix having hundreds if not thousands of options, many referring to external files/databases, you have to hope that whoever did this configuration wrapper, supported all the features of postfix that you want to use.

I am using nixpkgs on macOS, and I run a personal server with mail (for a bunch of people), web (for a bunch of sites), DNS (for a bunch of domains), etc. and while I would love to switch to declarative configuration, I fear I would run into shortcomings with the configuration wrappers for the various software packages I use.

I am curious if anyone have experience to share?

Re: NixOS 21.05

#140

Post by dnr »

hollerith wrote: post #134
soraminazuki wrote: post #109

Earlier quoted context omitted.

For anyone willing to help the Nix project, there's a script[1] you can use in the Nixpkgs repo to update the official Nix package for Chrome. If you ever feel that Chrome needs to be updated immediately, you can help out by running this script and opening a PR. [1]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/applicatio... --- Now, back to point, security issues are not "neglected" in NixOS, and most of the po…

>I don't believe it's fair to spread doubts I think it is fair as long as I make it clear (which I hope I have) that I didn't investigate fully after I saw some warning signs. >spread doubts just because they don't get fixed in a day or two. I am not a security expert, but tptacek is, and in 2017 he wrote that "You don't want your browser to be any number of days behind the Chromium patch cycle."[1] IIRC, tptacek or…

That's wrong. The google-chrome packages in nixpkgs are "built" by downloading the official releases (in .deb format I think) and massaging them a little. It takes a few seconds.

When the zero-days came out, I just updated the upstream-info.json file in my local nixpkgs checkout (look at previous chrome version bump commits for how to do it) and rebuilt my system. I didn't have to wait for any PRs or merges or CI/hydra. Granted, it requires a little nix knowledge, but if you've been running nixos you can probably figure out how to do it in a few minutes.

Post reply on HN