• casual_turtle_stew_enjoyer@sh.itjust.works
    0·
    7 months ago

    Nix is already beyond fucked because they actively dismiss the need for appropriate security measures to prevent supply chain attacks. There were multiple discussions about this over the years that appear to have succumbed to neglect.

    I wouldn’t trust nix, just like I don’t trust pip, brew, or a whole plethora of other package managers and repositories. They are just too neglectful

      • casual_turtle_stew_enjoyer@sh.itjust.works
        1·
        6 months ago

        If I were to fully elaborate, I’d be typing for hours, so I’ll sum up:

        • pip - default behavior is to install to system-wide site packages. In a venv, it will try to upgrade/uninstall system packages without notice/consent unless you specify --require-virtualenv. Multiple things can fuck up your ENV to make the python binaries point to system-wide, while your terminal will still show you as in a venv. Also why TF would package metadata files need to be executable? Bad practice, -1/10
        • nix - they acknowledged years ago that they should probably have some kind of package signing and perhaps an SBOM or similar mechanism, but then did nothing to implement it and just said “oh well, guess we’re vulnerable to supply chain attacks, best not to think about it”
        • brew - installing packages parallel to your system packages manager, without containers. My chief complaint here is that brew is a secondary package manager that people might treat as a “set and forget” for some packages, rarely updating them. So what happens when a standard library used by a brew package is vuln? A naive Linux user might update their system packages but totally forget to update brew. And when updating brew, you can easily hit max_open_file_descriptors because kitchen sink

        From there, it’s all extremely nit-picky and paranoid-fueled-- basically, none of the package managers I mentioned are conducive, in my eyes at least, to a secure and intuitive compute environment.

        Unfortunately, there’s not much I can do about it except bang pots and pans and throw maintainers under buses when the issue that has been present for years rears it’s ugly head. Because they are the only ones who can change this, and pressure is the only thing that might motivate them to.

  • onlinepersona@programming.devEnglish
    0·
    7 months ago

    We have heard from multiple people in multiple unrelated contexts that they are hoping for a hard fork of the entire community over the continued inaction on the toxic culture in the Nix project.

    Oh yes, please. My experiences on the nix community forums and matrix have been soured by the actions of high-level contributors. They are simply unable to view things from another perspective and harshly defend their perceived territory. I accept that they make mistakes as we are all human, but they are aware of their positions of power and happily take advantage of it.

    My major problem has been the documentation of the project and how top contributors are unable to accept how bad it is. Discussions about improvements and attempts at improving it at regularly shut down or impeded. Coming back to the “harsh defense of perceived territory”, it distinctly feels like existing teams are supposed to be the only ones making changes to the things they own. Contributions from “outsiders” never exit nix review hell and are nitpicked to death.

    A hard fork doesn’t guarantee existing problems won’t be copy-pasted into a new community (humans be humans), but at least if a new one started there’d be an attempt at resolving existing problems.

    (no, I’m not xz’ist - this is a real person with a real opinion)

    Edit: I realise I don’t have the same issues as described in this open letter which seems to be focused on Eelco. There have been no interactions with the dude, so I can’t judge, but interactions with some high-level nix members haven’t been pleasant.

    Anti Commercial-AI license