Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Nix and NixOS get so close to perfect

christine.website

Post reply on HN
Print view View original

41–50 of 183 posts

Re: How Nix and NixOS get so close to perfect

#41

Post by viraptor »

microtonal wrote: post #19
k__ wrote: post #16

It's kinda ironic, the biggest innovation in package management and OS design is basically unusable for the average tech person. Compared to Nix, every other package manager is a security liability.

Compared to Nix, every other package manager is a security liability. Nix is great, but I don't see much difference with respect to security. In fact, Nix encourages and flakes formalize pinning of nixpkgs versions. I am sure that there are a bazillion repositories/configurations out there that use a pinned nixpkgs version with known vulnerabilities in glibc, libxml, or whatever. Besides that, packages in nixpkgs oft…

> because of a lack of volunteers to maintain all of nixpkgs

They need some serious shakeup from that side in my opinion. I've had PRs open for trivial things for >1mth. Issues, security stuff, new packages. They don't even document how to mark something as a security issue. PRs that mention CVE do that, but otherwise I couldn't find anything so for example https://github.com/NixOS/nixpkgs/pull/161198 which includes a security fix is still waiting.

If they can't pull off the reviews with 577 people (https://github.com/orgs/NixOS/people), then they need to start rejecting new ones or relaxing the automerge rules - at the very least on simple version bumps. Flakes at least provide some solution for easily including the 3rd party software without merging.

Re: How Nix and NixOS get so close to perfect

#44

Post by stavros »

0des wrote: post #40
danmur wrote: post #35

Earlier quoted context omitted.

I love many aspects of Nix but for me at least the language is a barrier. I spend time and get better at it but there's a fine number of things people can spend that time on.

JSON would be a nice way to make a config file. I say this as an xmonad user too, which does its configs in Haskell as well. I love Haskell its just I don't want it to be my config language

I don't think JSON is a nice way to write config files at all. You can't even add comments. I'd much prefer something like Cue.

Re: How Nix and NixOS get so close to perfect

#45

Post by 0des »

phaer wrote: post #31
k__ wrote: post #21

Earlier quoted context omitted.

"packages in nixpkgs often have known vulnerabilities for months" Garbage in, garbage out. It would be nice if Nix could make vulns go away entirely, but you can't keep people from creating buggy packages.

You can't make them go away, but you can follow upstream for security fixes as close as possible and communicate them as good as possible. Nixpkg does quite a good job in tracking those issues, imho. https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aiss... is a list of security issues. Most of them generated by automated scans of nixpkgs-unstable. But as far as I am aware, there's no mailing list or so for rec…

Upstream doesn't matter if they aren't merging fixes for over a month.

Re: How Nix and NixOS get so close to perfect

#47

Post by xena »

colordrops wrote: post #8

I'm curious what was used to make the avatar in that presentation.

Author here. That was VSeeFace. I have been doing a lot of research and iteration on using vtubing avatar software to try and make it feel more "natural" without getting too far into the uncanny valley. I think I'm almost as a happy spot, but I'd love to have hand tracking so I can gesture around. I need to get my hands on a leap motion and 3d print a stand for it.

Re: How Nix and NixOS get so close to perfect

#48

Post by tjoff »

colordrops wrote: post #13
KronisLV wrote: post #11

Earlier quoted context omitted.

> I don’t really think this is a problem at all? I mean, at the particular design point the language occupies there are basically three possibilities: How so? Where's the Java/Python-like languages in this consideration, why wouldn't those work? Or something more like Ansible? I'm pretty sure that you can express the same concepts for the most part in something imperative as well.

I don't see how you could maintain purity and reproduceability with something imperative. I used ansible for a while and it was a mess that broke half the time and was difficult to maintain.

How does that have anything to do with it being imperative and not the fundamental design of the system?

How nix is architectured is exactly why it achieves purity and reproducibility, not the configuration language. It isn't even a goal of ansible in the same sense, per design.

The building blocks of nix is simple, of course it can be implemented in something imperative.

Re: How Nix and NixOS get so close to perfect

#49

Post by ris »

tjoff wrote: post #39
cwp wrote: post #18

Earlier quoted context omitted.

Yes and no. Yes, because Turing completeness. But no, because if you tried to do something like the Nix package manager with a language like Python or Java or even Scheme (yeah, I'm looking at you Guix), you'd end up with a worse system. What's great about Nix the language is that its design matches beautifully with its purpose. Nixpkgs is a single giant program, the output of which is a set of 70,000 package definit…

I really struggle with selling argument of lazy evaluation in the nix context, it is not a big deal. Sure, nix has been built around it, but it could just as well have been built around something else. And most certainly can't see how that would influence the number of packages. And honestly, the package situation is the biggest downfall of nix(os), there are tons of packages, yes. But they are often buggy (simply be…

> And honestly, the package situation is the biggest downfall of nix(os), ... but it has a long way to go.

I have a big problem with "it has a long way to go" arguments. "It has a long way to go" in comparison to what? Every project I know of could be described as having "a long way to go".

If we're comparing it with ubuntu/debian, there are few packages that ubuntu/debian have that nixpkgs is missing. On the other hand, what's the status of getting kubernetes in ubuntu/debian? Last I heard it was mired in https://lwn.net/Articles/835599/. And what happens if you use the ubuntu/debian prometheus package? You currently get a version that many people would consider "too ancient to be useful". I could easily use these points to argue that debian has "a long way to go".

The real answer is "they're different". It's a mistake to think the two are just trying to replicate each other piece for piece.

The same goes for people arguing that the linux desktop has "a long way to go", whether they were making that argument in 2001 or 2021.

Re: How Nix and NixOS get so close to perfect

#50

Post by xena »

stavros wrote: post #44
0des wrote: post #40

Earlier quoted context omitted.

JSON would be a nice way to make a config file. I say this as an xmonad user too, which does its configs in Haskell as well. I love Haskell its just I don't want it to be my config language

I don't think JSON is a nice way to write config files at all. You can't even add comments. I'd much prefer something like Cue.

I think the hard part here is using enough of a type system to ensure data sanity but not so much of one that you drown in metadata. I'm not really sure of a proper compromise like that.
Post reply on HN