NixOS 21.05

> how painful was it to learn and get working?

nixpkgs (which you can use on macOS or any Linux distro), quite little, you can get up to speed in 15min as a Homebrew replacement:

    nix-env -qas ruby             # 'q'uery 'a'vailable 'search'
    nix-env -I ruby.              # install by package name (not recommended)
    nix-env -iA nixpkgs.ruby_3_0  # install by "attribute", recommended
    nix-env -q                    # 'q'uery (i.e list installed)
    nix-env -e ruby               # uninstall (like deleting a git ref)
    nix-env -q
    nix-collect-garbage           # cleanup, like `git gc`
    # etc...

And as a general purpose virtualenv/rvm/whatever replacement:

    $ cat shell.nix
    {
      pkgs ? import  {}, # you can have multiple of these with different names to have e.g a mix of stable and unstable
    }:
    let
      openssl = pkgs.openssl; # just an example of how to set a var
    in pkgs.mkShell {
      buildInputs = [
        openssl
        pkgs.ruby_3_0 # or reference attires directly
      ];
    }
    $ nix-shell
    (nix) $ ruby --version
    ruby 3.0.1p64 (2021-04-05) [x86_64-darwin17]
    (nix) $ openssl version
    OpenSSL 1.1.1k  25 Mar 2021
    (nix) $ exit
    $ openssl version # back to the system one
    LibreSSL 2.8.3

That way it's immediately useful and you can dig in deeper into the concepts as you go, if you want to.

NixOS, it's barely different, only generalised to the whole OS, but it's a bit tougher, because there's this abstraction via configuration that generates e.g systems files or other configurations that you'd operate with directly otherwise on a traditional distro. But the minute you screw things up, having the generation selector to pick and boot on straight in the boot loader you can see the absolutely unparalleled value of the proposition.

What do experienced nix-ers tend to do when they need to use software that's not up to date or available in nixpkgs? Are you guys knowledgeable enough to package everything yourselves, or do you just use buildFHSUserEnv until someone else works out the kinks? I didn't get a chance to figure out how to do the latter, but I'm curious because I've struggled as a new user.

I ran Nixos for a few months from Dec 25 to Mar 12 of this year. During that time there were 2 zero-day exploits published for Chrome that went unpatched for weeks on Nixos. (Specifically the package named google-chrome went unpatched.)

This was on the "unstable" branch of Nixos, the branch that became the stable branch today, which is the occasion of this story on HN we are commenting on.

Digression: the reason I chose the unstable branch instead of the then-stable branch (named Nixos-20.09) was that I wanted to achieve an "all-Wayland" environment as quickly as practical (and in fact all of the apps running on my machine right now and for the past few weeks talk directly to Wayland without the interposition of Xwayland). And the reason I wanted to jump ahead to an all-Wayland system is that although I knew Linux pretty well, I knew very little about X11, and I reasoned that since X11 is slowly going away anyways, I would prefer to avoid spending any time learning about it and would prefer to avoid having to get used to its quirks. (End of digression.)

You cannot just install Chrome from Google's web site on Nixos: unless someone has compiled it for you, you have to compile it from source and more distressingly you have to configure the compilation extensively to have any hope of the resulting binary actually running. For example, glibc on Nixos is not in a standard location, but rather all of the files in the glibc package are under a directory with a name like /nix/store/8f9f6724fd2341d9f2bc758cf9e43830d23d37a3-glibc. Well, of course the code that compiles Chrome needs to be informed of that location and of the locations of all of the other packages it relies on, e.g., the system's libraries for drawing GUIs on the screen. This job of configuring the compilation is mostly easily done by writing something similar to a declarative build script in the Nix language, so of course that means I would've had to learn a new programming language in order to patch the zero-day exploit in Chrome before the maintainer of the google-chrome package got around to it (which I never did).

Sadly, I did not have time back then in early March to install the stable version of Nixos to determine whether these zero-day exploits had remained unpatched there, too. (I did verify that the package "chromium" was at the same vulnerable version as the package "google-chrome" was.) So I guess the purpose of this comment is that there are preliminary signs (namely, the fact that nowhere was I warned that the unstable branch might have gaping security holes) that Nixos does not get as much attention from security-knowledgeable maintainers as some of the other Linux distros do -- or at least that the security attention it gets is concentrated on server use cases with desktop use cases being relatively neglected.

I use nix-shell for dev environments. Once I've got it working it's wonderful - full replicable, across multiple development machines and CI. It's painful though. Some problems I've encountered recently on different projects:

Old version of fwup packaged. Can override to get newer version, but needed to add another dependency to make tests pass (and it gets built locally rather than being cached)

Pain getting my environment to include the right Python packages so I can run the gigalixir command line tool.

Have to workaround an oddity to do with how Erlang is packaged so that I don't get lots of warnings when anything is compiled:

    shellHook =
    ''
      export ERL_LIBS=""
    '';

Doh! You're right, I completely forgot that. Thanks for pointing it out.