21–30 of 209 posts
Earlier quoted context omitted.
Take a look at the install script. It's not so complicated, pretty much only download a tar.gz. So why using curl?
Did you know that a malicious server can detect if you are piping to a shell and serve a completely different thing? D:
Earlier quoted context omitted.
The script doesn't run if it downloads. Go read it yourself. What attack vector would you actually be protecting against if you downloaded a .tar.gz full of binaries and extracted it to /, then started installing things with it?
On that note, is there some valid reason Nix absolutely needs access to / to create /nix? Why can't it live somewhere else? I believe some parts can go anywhere, but /nix is hard coded for the rest, which I'm not entirely comfortable with.
Anyone who's used Nix for a while -- how does package availability compare to Homebrew or Macports? Other than the default.nix thing (which Homebrew also has a version of [1]) are there any other clear benefits to switching from Homebrew? [1]: https://robots.thoughtbot.com/brewfile-a-gemfile-but-for-hom...
From my few days of trying to replace Homebrew with Nix, being able to rollback the environment to last known good state (`nix-env --rollback`), ability to keep track of package changes (`nix-env --list-generations`), ability to try a package without installing it (`nix-shell`, well, technically it's installed on the machine, but nothing is linked in the profile, and you can nuke them with `nix-collect-garbage`) are very nice additions.
Apart from these features, the fact that it doesn't chown `/usr/local/` to my user is a big plus. Nix will also not linking anything not explicitly installed by user to their profile (e.g. if package A has B as dependency, B won't be linked until user actually choose to install it, which is then managed separately from B that were explicitly installed as A's dependency).
That said, I've since revert back to Homebrew because there are few packages broken that are crucial to what I'm working on. Creating and fixing package is not too hard (I did with aria2c), although time didn't allow me to do it back then. I would love to try to switch to Nix again sometimes.
People in ##nix-darwin are super-nice, also! :-)
[1]: https://github.com/NixOS/nixpkgs/pull/15029
[2]: https://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell...
> curl https://nixos.org/nix/install | sh Stop doing this. Look, even if you are rolling your eyes and thinking, "it's https and I'm not Ed Snowden, I think I can afford the risk for the benefit of an easy install process", what happens if curl is interrupted? Are you excited at the prospect of a half-ran install script that you didn't even look at?
No [1]. If you are installing software from scratch, you must trust the https server that serves it to you. They could publish sha256 check sums to https://nixos.org/hashes , but you would have to trust the https server. They could publish their gpg key to https://nixos.org/gpg , but you would have to trust the https server. Things would be better if we had a reasonable certificate system for verifying open source so…
Earlier quoted context omitted.
The script doesn't run if it downloads. Go read it yourself. What attack vector would you actually be protecting against if you downloaded a .tar.gz full of binaries and extracted it to /, then started installing things with it?
On that note, is there some valid reason Nix absolutely needs access to / to create /nix? Why can't it live somewhere else? I believe some parts can go anywhere, but /nix is hard coded for the rest, which I'm not entirely comfortable with.
Earlier quoted context omitted.
Did you know that a malicious server can detect if you are piping to a shell and serve a completely different thing? D:
How so? By looking for a curl UA?
> curl https://nixos.org/nix/install | sh Stop doing this. Look, even if you are rolling your eyes and thinking, "it's https and I'm not Ed Snowden, I think I can afford the risk for the benefit of an easy install process", what happens if curl is interrupted? Are you excited at the prospect of a half-ran install script that you didn't even look at?
Earlier quoted context omitted.
The script doesn't run if it downloads. Go read it yourself. What attack vector would you actually be protecting against if you downloaded a .tar.gz full of binaries and extracted it to /, then started installing things with it?
On that note, is there some valid reason Nix absolutely needs access to / to create /nix? Why can't it live somewhere else? I believe some parts can go anywhere, but /nix is hard coded for the rest, which I'm not entirely comfortable with.
I understand this path is configurable, but you'll be compiling everything yourself, unable to use Nix's binary cache. You also risk running into unique problems since everyone else is using /nix
Anyone who's used Nix for a while -- how does package availability compare to Homebrew or Macports? Other than the default.nix thing (which Homebrew also has a version of [1]) are there any other clear benefits to switching from Homebrew? [1]: https://robots.thoughtbot.com/brewfile-a-gemfile-but-for-hom...
The last time I tried (a month ago), I could reproduce most of my current Homebrew packages. There are few that are broken (e.g. rust, which has since been fixed), or do not have Darwin support (aria2c, which I have a PR open[1]). There are also packages that are a little bit hard to discover, e.g. those that are imported from Haskell's Hackage where it is not listed by default[2] when you do `nix-env -i ` (e.g. shel…