126
open letter to the NixOS foundation
(save-nix-together.org)
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
Nix is already beyond fucked because they actively dismiss the need for appropriate security measures to prevent supply chain attacks. There were multiple discussions about this over the years that appear to have succumbed to neglect.
I wouldn't trust nix, just like I don't trust pip, brew, or a whole plethora of other package managers and repositories. They are just too neglectful
Can you elaborate?
If I were to fully elaborate, I'd be typing for hours, so I'll sum up:
--require-virtualenv
. Multiple things can fuck up your ENV to make the python binaries point to system-wide, while your terminal will still show you as in a venv. Also why TF would package metadata files need to be executable? Bad practice, -1/10From there, it's all extremely nit-picky and paranoid-fueled-- basically, none of the package managers I mentioned are conducive, in my eyes at least, to a secure and intuitive compute environment.
Unfortunately, there's not much I can do about it except bang pots and pans and throw maintainers under buses when the issue that has been present for years rears it's ugly head. Because they are the only ones who can change this, and pressure is the only thing that might motivate them to.
Those criticisms seem reasonable. Regarding package signing, are you referring to https://github.com/NixOS/nix/issues/613#issuecomment-134361033? Additionally, that default for pip seems veritably insane. I understand using system packages, but modifying packages outside the virtual environment is definitely weird.