3 ms·

> How do security updates work They don't. NixOS does not have a concept of a released, stable distribution and therefore does not provide security patches bac

> How do security updates work They don't. NixOS does not have a concept of a released, stable distribution and therefore does not provide security patches backported to it. You have to keep rolling forward with every new upstream release of the packages you use. Perhaps it's OK for some people's desktops but most server environments rely or stable distributions with LTS support.

tadfisher 8y ago
This is patently false. There is a stable release every six months, and a team dedicated to patching the stable release. I'm surprised you missed this, as it's right there in the first sentence of the download page: https://nixos.org/nixos/download.html https://nixos.org/nixos/download.html You have the option of following the master nixpkgs branch, or one of several "channels" which are essentially tested checkouts of the main nixpkgs repo. There are both stable release channels (i.e. nixos-18.09) and unstable channels (i.e. nixos-unstable).
- eeZah7Ux 8y ago
  I stand corrected. For how many years are security backports done?
  - joepie91_ 8y ago
    Currently, there's no real support period for non-latest releases, as there's insufficient manpower to support them. That's not for philosophical or ideological reasons, though; if somebody steps up and takes on the role of coordinating long-term support, it'd be welcomed.
- e12e 8y ago
  Looking at the security page, which generally points to the announce list - and a sample (serious configuration) issue: https://groups.google.com/forum/m/#!topic/nix-security-announce/qrDU0KH_ZRk https://groups.google.com/forum/m/#!topic/nix-security-annou... It's not immediately clear to me that there's an "lts" or "stable" that would allow easy security only updates, preferably in an automatic fashion? Or is this one issue a special case where a) the admin must see the announcement, and b) manually act to secure systems?
  - tadfisher 8y ago
    Updates are committed to the stable nixpkgs branch. These then propagate through the channel. NixOS has a configuration option to enable automatic upgrades[1], which periodically pulls the latest nixpkgs checkout from the channel you're following, rebuilds the system, and switches to that configuration. [1]: https://nixos.org/nixos/manual/#sec-upgrading-automatic https://nixos.org/nixos/manual/#sec-upgrading-automatic

tadfisher 8y ago

This is patently false. There is a stable release every six months, and a team dedicated to patching the stable release. I'm surprised you missed this, as it's right there in the first sentence of the download page: https://nixos.org/nixos/download.html https://nixos.org/nixos/download.html You have the option of following the master nixpkgs branch, or one of several "channels" which are essentially tested checkouts of the main nixpkgs repo. There are both stable release channels (i.e. nixos-18.09) and unstable channels (i.e. nixos-unstable).

eeZah7Ux 8y ago
I stand corrected. For how many years are security backports done?
- joepie91_ 8y ago
  Currently, there's no real support period for non-latest releases, as there's insufficient manpower to support them. That's not for philosophical or ideological reasons, though; if somebody steps up and takes on the role of coordinating long-term support, it'd be welcomed.
e12e 8y ago
Looking at the security page, which generally points to the announce list - and a sample (serious configuration) issue: https://groups.google.com/forum/m/#!topic/nix-security-announce/qrDU0KH_ZRk https://groups.google.com/forum/m/#!topic/nix-security-annou... It's not immediately clear to me that there's an "lts" or "stable" that would allow easy security only updates, preferably in an automatic fashion? Or is this one issue a special case where a) the admin must see the announcement, and b) manually act to secure systems?
- tadfisher 8y ago
  Updates are committed to the stable nixpkgs branch. These then propagate through the channel. NixOS has a configuration option to enable automatic upgrades[1], which periodically pulls the latest nixpkgs checkout from the channel you're following, rebuilds the system, and switches to that configuration. [1]: https://nixos.org/nixos/manual/#sec-upgrading-automatic https://nixos.org/nixos/manual/#sec-upgrading-automatic