Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Nix and NixOS get so close to perfect

christine.website

Post reply on HN
Print view View original

31–40 of 183 posts

Re: How Nix and NixOS get so close to perfect

#31

Post by phaer »

k__ wrote: post #21
microtonal wrote: post #19

Earlier quoted context omitted.

Compared to Nix, every other package manager is a security liability. Nix is great, but I don't see much difference with respect to security. In fact, Nix encourages and flakes formalize pinning of nixpkgs versions. I am sure that there are a bazillion repositories/configurations out there that use a pinned nixpkgs version with known vulnerabilities in glibc, libxml, or whatever. Besides that, packages in nixpkgs oft…

"packages in nixpkgs often have known vulnerabilities for months" Garbage in, garbage out. It would be nice if Nix could make vulns go away entirely, but you can't keep people from creating buggy packages.

You can't make them go away, but you can follow upstream for security fixes as close as possible and communicate them as good as possible.

Nixpkg does quite a good job in tracking those issues, imho. https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aiss... is a list of security issues. Most of them generated by automated scans of nixpkgs-unstable.

But as far as I am aware, there's no mailing list or so for receiving notifications upon critical vulnerabilities(?). https://nixos.org/community/teams/security.html mentions github issues, discourse and matrix. Triaging security issues requires significant work and it's a task even more traditional distros like Debian often struggle with.

One thing I'd like to see eventually is an option to nixos-rebuild and other to emit warnings if installed packages are affected by known vulnerabilities. I think that should be doable and would maybe raise awareness and provide most visibility to the issues affecting most users.

https://github.com/flyingcircusio/vulnix does something like this, but it's currently a third-party tool

Re: How Nix and NixOS get so close to perfect

#32

Post by encryptluks2 »

I'm starting to see more of a cult attitude with Nix. It is like the Arch Linux crowd (I use Arch) but much worse. I think is is great that Nix has provided something valuable to a lot of people, but so does a lot of software and tools.

Nix fills a void in package management. It is like Ansible or Terraform for a semi-idempotent distro. It is probably quicker in most ways than building something similar with other configuration management tools, but I still prefer other tools because the language for Nix is just bleh. Had they went with a simple YAML format or HCL, then I'd give it a chance, but because they didn't I'm certain eventually someone will create something better learning from the mistakes of Nix.

Re: How Nix and NixOS get so close to perfect

#33

Post by yakak »

KronisLV wrote: post #11
mananaysiempre wrote: post #6

Earlier quoted context omitted.

> Using Haskell as a base for the syntax I don’t really think this is a problem at all? I mean, at the particular design point the language occupies there are basically three possibilities: - Kind of like Lisp (parens everywhere, painful with pervasive currying); - Kind of like ML (var and fun everywhere); - Kind of like Haskell. Nix is chooses the last of those, and it does not have most of Haskell’s funkiness: no “…

> I don’t really think this is a problem at all? I mean, at the particular design point the language occupies there are basically three possibilities: How so? Where's the Java/Python-like languages in this consideration, why wouldn't those work? Or something more like Ansible? I'm pretty sure that you can express the same concepts for the most part in something imperative as well.

> Or something more like Ansible?

This seems to be the argument that comes up over and over with go, JavaScript, Ansible, etc. Sure one can take an imperative language and try to follow FP principles to emulate good things. Then one is comfortable with how it works while not really understanding FP and when it trashes the system by being implemented as a sequence of trashes of the state it is just a learning experience of user error.

Re: How Nix and NixOS get so close to perfect

#35

Post by danmur »

mananaysiempre wrote: post #6
atoav wrote: post #3

As someone who really would like to have something like nix the thing that scares me away every time is the fact that the people creating this aparently did not think a lot about how to onboard users. And I don't mean a lack of documentation — what I mean is that the obvious decisions that have been taken (naming everything "Nix", using Haskell as a base for the syntax, ...) don't really fill me with confidence that…

> Using Haskell as a base for the syntax I don’t really think this is a problem at all? I mean, at the particular design point the language occupies there are basically three possibilities: - Kind of like Lisp (parens everywhere, painful with pervasive currying); - Kind of like ML (var and fun everywhere); - Kind of like Haskell. Nix is chooses the last of those, and it does not have most of Haskell’s funkiness: no “…

I love many aspects of Nix but for me at least the language is a barrier. I spend time and get better at it but there's a fine number of things people can spend that time on.

Re: How Nix and NixOS get so close to perfect

#36

Post by tracnar »

colordrops wrote: post #13
KronisLV wrote: post #11

Earlier quoted context omitted.

> I don’t really think this is a problem at all? I mean, at the particular design point the language occupies there are basically three possibilities: How so? Where's the Java/Python-like languages in this consideration, why wouldn't those work? Or something more like Ansible? I'm pretty sure that you can express the same concepts for the most part in something imperative as well.

I don't see how you could maintain purity and reproduceability with something imperative. I used ansible for a while and it was a mess that broke half the time and was difficult to maintain.

Doesn't Bazel do exactly that with their Starlark language based on Python?

https://bazel.build/rules/language#mutability

Re: How Nix and NixOS get so close to perfect

#37

Post by espadrine »

colordrops wrote: post #14
goodpoint wrote: post #9

Earlier quoted context omitted.

Guix seems to be a better bet.

Maybe a better design. Bet? Not so sure. Guix is Betamax to Nix's VHS.

I wouldn’t call it that way. Nix has a better design, but a worse UX. On its own, this would make Guix win.

But VHS is apt, in the way that matters most: the number of apt package maintainers is staggeringly larger than even both combined. More maintainers mean two things:

1. If you want to install something, it has a one-liner install with much higher probability.

2. If you have a bug, or the package has a security flaw fixed upstream, updating your system will yield the version that fixes that with much higher likelihood.

I try to use Guix alongside APT (because using only Guix is tying two hands behind your back). But:

• The shared objects management (libc and the like) is a pain with no guidance; APT binaries expect the .so somewhere, while Guix binaries expect it somewhere else.

• What remains as usable are self-contained binaries, which are frequently severely out of date. For instance, I had installed the fish shell with Guix, but by now an APT-installed binary that detects fish assumes a more recent version than what Guix offers, causing errors. The Guix community cannot figure out why upgrading the fish package trips up some tests fast enough to keep up with APT: https://issues.guix.gnu.org/51064

Re: How Nix and NixOS get so close to perfect

#38

Post by bspammer »

dmitriid wrote: post #2

Somehow 60% or more of the presentation is spent on what is charitably called "papercuts": bad tooling, bad documentation. It's not "getting so close to perfect". A jet-powered cart (from the comic in the presentation) is not "close to perfect" by any imaginable criteria. Well, unless your idea of perfect is "a jet-powered cart".

Doesn’t it say something about how useful nix is when you have all these smart people complaining about its warts (and it definitely has quite a few) but still using it?

It is the way I’ve always wanted a package manager to work, and it really does work. It feels insane to use anything else now, I can’t go back.

Re: How Nix and NixOS get so close to perfect

#39

Post by tjoff »

cwp wrote: post #18
KronisLV wrote: post #11

Earlier quoted context omitted.

> I don’t really think this is a problem at all? I mean, at the particular design point the language occupies there are basically three possibilities: How so? Where's the Java/Python-like languages in this consideration, why wouldn't those work? Or something more like Ansible? I'm pretty sure that you can express the same concepts for the most part in something imperative as well.

Yes and no. Yes, because Turing completeness. But no, because if you tried to do something like the Nix package manager with a language like Python or Java or even Scheme (yeah, I'm looking at you Guix), you'd end up with a worse system. What's great about Nix the language is that its design matches beautifully with its purpose. Nixpkgs is a single giant program, the output of which is a set of 70,000 package definit…

I really struggle with selling argument of lazy evaluation in the nix context, it is not a big deal. Sure, nix has been built around it, but it could just as well have been built around something else. And most certainly can't see how that would influence the number of packages.

And honestly, the package situation is the biggest downfall of nix(os), there are tons of packages, yes. But they are often buggy (simply because nix is so different), not maintained (understandable, people move on), or plainly missing (because the few maintainers don't cover even popular niches). Of course that is going to be the case for a new system, but I'm flabbergasted every time it is being touted as an advantage of nix(os). And I feel that it is quite counter-productive tricking people into the ecosystem and giving the impression that it is on par or even better than any mainstream OS. It is making great progress, but it has a long way to go.

Re: How Nix and NixOS get so close to perfect

#40

Post by 0des »

danmur wrote: post #35
mananaysiempre wrote: post #6

Earlier quoted context omitted.

> Using Haskell as a base for the syntax I don’t really think this is a problem at all? I mean, at the particular design point the language occupies there are basically three possibilities: - Kind of like Lisp (parens everywhere, painful with pervasive currying); - Kind of like ML (var and fun everywhere); - Kind of like Haskell. Nix is chooses the last of those, and it does not have most of Haskell’s funkiness: no “…

I love many aspects of Nix but for me at least the language is a barrier. I spend time and get better at it but there's a fine number of things people can spend that time on.

JSON would be a nice way to make a config file. I say this as an xmonad user too, which does its configs in Haskell as well. I love Haskell its just I don't want it to be my config language
Post reply on HN