Re:Fedora Atomic Desktops
by hollerith on Saturday February 10, 2024 @09:55AM
(#39326550)
No it is not. That is my whole point: NixOS could have one without the other.
Consider modifying NixOS to remove the requirement that the long hex id in the name of a package in /nix/store/ is a cryptographic hash of (among other things) the hashes of every package the package depends on (thereby eliminating the need to upgrade every package on the system every time the libc packages is updated). I am pretty sure you can do that while retaining the property that it is easy to have multiple versions of something installed that don't conflict with each other. I have not actually done that (I have not actually modified NixOS in that way, then tested the result, e.g., by making it my daily driver for a while) which is why I'm using qualifiers like "I am pretty sure", but I'm confident enough it can be done that I consider it worth bringing up in online conversations about NixOS. The cryptographic hash gives you a guarantee that a binary package you got from the NixOS package servers has not been adulterated in some way on its way to you--a guarantee that you can check without your having to go through the trouble of building the package yourself, but IIUC that guarantee is not actually used anywhere to make the supply chain any more secure.
Again there are good ideas in NixOS (including ideas that seem like they could be used to meaningfully increase security) and I hope anyone creating a new distro studies NixOS, but as a distro to be actually used in anger in the present day I am not impressed.
Re:Fedora Atomic Desktops
by exe34 on Saturday February 10, 2024 @01:31PM
(#39328899)
These look like great ideas, I look forward to trying out your branch! It's pretty easy with Nix, I'd just have to NIX_PATH=<path>/to/nixpkgs-hollerith/ nix-shell -p <some package> to try it out. Good luck!
Consider modifying NixOS to remove the requirement that the long hex id in the name of a package in /nix/store/ is a cryptographic hash of (among other things) the hashes of every package the package depends on (thereby eliminating the need to upgrade every package on the system every time the libc packages is updated). I am pretty sure you can do that while retaining the property that it is easy to have multiple versions of something installed that don't conflict with each other. I have not actually done that (I have not actually modified NixOS in that way, then tested the result, e.g., by making it my daily driver for a while) which is why I'm using qualifiers like "I am pretty sure", but I'm confident enough it can be done that I consider it worth bringing up in online conversations about NixOS. The cryptographic hash gives you a guarantee that a binary package you got from the NixOS package servers has not been adulterated in some way on its way to you--a guarantee that you can check without your having to go through the trouble of building the package yourself, but IIUC that guarantee is not actually used anywhere to make the supply chain any more secure.
In general NixOS seems to be bad at security or not to care about security: for example https://news.ycombinator.com/item?id=36268776
Again there are good ideas in NixOS (including ideas that seem like they could be used to meaningfully increase security) and I hope anyone creating a new distro studies NixOS, but as a distro to be actually used in anger in the present day I am not impressed.