Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NixOS 25.11 released

nixos.org

Post reply on HN
Print view View original

41–50 of 67 posts

Re: NixOS 25.11 released

#41

Post by endgame »

gf000 wrote: post #31
gouggoug wrote: post #15

Earlier quoted context omitted.

This past month, I have spent a decent amount of hours (7+) trying to setup nix on my mac with nix-darwin, and failed. Most tutorial out there encourage you to download someone else's configuration to get going. I don't want to do that. I want to understand at its core how this thing works. I've read the official nix language documentation, watched YouTube tutorials, read 3rd party tutorials, and still couldn't get g…

> The nix language is also really unpalatable to me. It may not really help the case, but I firmly believe that it is not the language , but the ecosystem, and is more of a fundamental issue. But maybe putting the blame elsewhere could help accept the situation. So anyways, the language is pretty much a lazily evaluated JSON. But even if it were something else (insert your favourite language), the problem ultimately…

I've used Nix for at least seven years, and I firmly believe that the language is a large part of the problem. Yes, the Nix language is "just another lazily-evaluated pure FP language in the ML tradition" and "it's like a lazily-evaluated JSON", but it has several large footguns. The biggest one is that spaces are use to separate elements in list literals as well as for function application. The second is the lack of a usable type system, in the sense that the programmer cannot assert the types of values in a useful way. Instead, you have to rely on comments and convention to know what a function's arguments are.

These two design warts also interact with each other really badly: If you try to put a function application into a list and forget to enclose it in parentheses, you instead insert the function as one element in the list and its arguments as successive elements. The usual result is "expected an X but got a function" error in some completely unrelated part of the code.

Re: NixOS 25.11 released

#42

Post by foxheadman »

rkomorn wrote: post #6
foxheadman wrote: post #5

Reading the NixOS release notes every 6 months is how I learn about new software that I might want to try: https://nixos.org/manual/nixos/stable/release-notes#sec-rele... For my first few years of NixOS I didn't understand the point of the NixOS stable releases, since even on "nixos-unstable" I found that if my nix config evaluates, then it'll work. And in the very rare case things broke, I could easily rollback. Nix…

Indeed. As soon as lanzaboote works with stable, I'll go back to stable (but I think that is not the case yet, sadly). Lowkey plug for lanzaboote though. Getting secure boot working went pretty well for me thanks to it.

+1.

I'm keen for secure boot and TPM FDE, and would like to see lanzaboote in nixpkgs.

Re: NixOS 25.11 released

#43

Post by xyzzy_plugh »

dayjah wrote: post #29
xyzzy_plugh wrote: post #7

Earlier quoted context omitted.

I'm not conflicted. Nothing compares to nix. I've been using it on macOS, for Linux hosts, for years now, and it's been incredibly rock solid. I stopped using homebrew years ago and I couldn't be happier about that. > Consistently through the 25.05 period nix-darwin and nixpkgs would fall out of sync. I learned not to `nix flake update` too often as a result. I find using a singular nixpkgs version is almost always a…

This is all great feedback, thanks! I got here through devenv, I was fully bought in on its proposal and once I found its edges I started peeking under the covers to understand how it worked. At that point I was pretty deep in mise for everything that wasn’t using devenv. This perhaps help frame why I see them solving the same problem. I definitely had my “aha!” and ditched mise because nix seemed it had solved my pr…

mise will be a better mise than nix will. You should use mise.

Especially because installing Nix is still a pain for most users.

Re: NixOS 25.11 released

#44

Post by jchw »

rkomorn wrote: post #6
foxheadman wrote: post #5

Reading the NixOS release notes every 6 months is how I learn about new software that I might want to try: https://nixos.org/manual/nixos/stable/release-notes#sec-rele... For my first few years of NixOS I didn't understand the point of the NixOS stable releases, since even on "nixos-unstable" I found that if my nix config evaluates, then it'll work. And in the very rare case things broke, I could easily rollback. Nix…

Indeed. As soon as lanzaboote works with stable, I'll go back to stable (but I think that is not the case yet, sadly). Lowkey plug for lanzaboote though. Getting secure boot working went pretty well for me thanks to it.

Does Secure Boot with NixOS even make sense? In an ordinary Secure Boot setup, you get the kernel/initrd/etc. with signatures from a trusted vendor, but with NixOS it is going to obviously sign everything locally. That means that you are not protected against bootkits and a root compromise is still just as bad as ever.

I suppose in combination with LUKS you could at least prevent evil maid attacks, to the extent that your machine's firmware is actually secure, but it seems like a lot of work for just that...

Re: NixOS 25.11 released

#45

Post by yearolinuxdsktp »

> The old release 25.05 “Warbler” is now officially deprecated and will reach its end-of-life and stop receiving security updates after 2025-12-31.

What, one month to upgrade to keep receiving security updates? How can you force 1-month upgrade windows every 6 months and who would go for that?

Re: NixOS 25.11 released

#46

Post by foxheadman »

arianvanp wrote: post #37
johnisgood wrote: post #32

> Added nixos-init, a Rust-based bashless initialization system for systemd initrd Rust is such a heavy dependency though, is it not? Is it worth it? Additionally, what does it add as a new project / software (disregard Rust here)? What was wrong with the previous one and/or what does this fix or add that justifies adding a heavy dependency? Seems like most of these projects are written in Rust though.

Previous version was in bash. With this change you can build a nixos image not containing bash or any shell whatsoever. Not having interpreted languages on the system at all is an effective hardening technique combined with verity store containing all your executables as it makes it impossible for attackers to add new executable files to the system which stops almost all attack vectors. You can read about the project…

I'm glad to see boot security prioritisation, and to see some of the fundamentals revisited, and scripts replaced with languages that contributors want to write in (NixOS leans heavy towards Rust).

As the project doc notes:

> This radical solution is only really feasible and/or interesting for appliances (i.e. non-interactive) systems.

https://pad.lassul.us/nixos-perlless-activation

> stops almost all attack vectors

Can you explain a bit more about this? Is the idea that verity protects the integrity of the nix store, and then the boot process only runs binaries that don't expose any sort of arbitrary code functionality?

I agree with https://github.com/NixOS/nixpkgs/issues/267982#issuecomment-... that the MITRE attack vector link doesn't help understanding much. Is the right idea: removing attack vectors is useful? (I agree.)

Re: NixOS 25.11 released

#47

Post by viraptor »

dayjah wrote: post #19
viraptor wrote: post #9

Earlier quoted context omitted.

> period nix-darwin and nixpkgs would fall out of sync What do you mean? Those should be fairly independent in practice.

In practice nix-darwin relies on being a drop in, which means maintaining compatibility with api surface which in the proper nixpkgs world is a closed loop. There are several cases of this breaking since 2020 or so.

But did that happen while updating from the same stable channel? I get things could change when switching releases.

Re: NixOS 25.11 released

#49

Post by Ingon »

I am excited for having a new version of NixOS. Few days ago I realized that November is almost gone and went looking for when I can expect the new release. And right on schedule it popped out (was checking throughout the day). Big props to the release managers (and of course the maintainers)

I use nix via flakes on my own machines (via NixOS), in my projects (with direnv), on my infrastructure/servers (NixOS deploying with colmena) and at work (nix-darwin and projects). So far the upgrade have gone painlessly, the only change I needed to make is how git is configured in home manager. I continue to be amazed how well NixOS works.

Edit: The only place I still struggle in adopting nix is on my phone. Last time I tried nix-on-droid it didn't even run, but I plan to try that again. Still new to Android (and GrapheneOS)

Re: NixOS 25.11 released

#50

Post by Chris_Newton »

yearolinuxdsktp wrote: post #45

> The old release 25.05 “Warbler” is now officially deprecated and will reach its end-of-life and stop receiving security updates after 2025-12-31. What, one month to upgrade to keep receiving security updates? How can you force 1-month upgrade windows every 6 months and who would go for that?

Instability is one of the biggest but perhaps also the least understood downsides of NixOS, IMHO.

Contrary to the name, even the stable branch of NixOS can have problems while installing routine updates with `nixos-rebuild switch --upgrade`. In fairness, at least with NixOS you can normally roll back to a previous working configuration where you can try to fix or work around the problem if that does happen. It’s still painful if you have to do that, though.

Even if your routine updates all go smoothly, as you mentioned, each stable release is only supported for a very limited time window after the next one is out. NixOS doesn’t have any long-term support branch in the sense that some distros do. Again, you can overcome this to a degree by customising your configuration if you need specific versions of certain packages, but in doing so you’re moving back towards manually setting things up and resolving your own compatibility issues rather than having a distro with compatible packages you can install in whatever combination you want, which reduces the value of using a distro with a package repository in the first place.

To be clear, I’m a big fan of NixOS. I run it as my daily driver on a workstation where I do a lot of work on different projects for different clients. Its ability to have a clean, declarative description of what’s currently installed globally or for any given user or even when working in any given project directory for any given user is extremely valuable to me.

But it’s also fair to say that NixOS is not for everyone. It has been by far the least stable Linux distro I have ever used, in the sense of “If I turn my computer on and install the latest updates from the stable branch, will my computer still work afterwards?”. If you’re looking for a distro you can deploy and then maintain with little more than semi-automatic routine updates for a period of years then, at least for now, it is not the distro for you.

Post reply on HN