6 ms·

Actually I think VMs for dev are evil. I hope it's a stop gap measure until tooling like nix catches up enough. Running an entire seperate OS just for developme

Actually I think VMs for dev are evil. I hope it's a stop gap measure until tooling like nix catches up enough. Running an entire seperate OS just for development is completely bonkers to me.

mpweiher 6y ago
I'd phrase it this way: it is completely bonkers that this isn't bonkers.
mcny 6y ago
If you think that's bonkers, I'll give you an even worse idea: a dedicated desktop machine. I have a dell optiplex running Intel i3-2100 with 8GB RAM and 1TB Samsung 860 Evo SSD. No display. Fedora runs like a dream with dnf automatic. Use cockpit if you'd like. You can use your windows or Mac laptop with visual studio code to do web development. ng serve works as if you ran it from your laptop. The biggest drawback I can think of is if you ever needed to leave the house. Thankfully, I have no life so I don't have this problem.
- cassianoleal 6y ago
  > The biggest drawback I can think of is if you ever needed to leave the house. Add ZeroTier to the equation and as long as you have Internet connection when you're outside the house you'll probably not even notice it.
- Tsiklon 6y ago
  Having both your laptop and desktop on a WireGuard vpn with the gateway on your choice of cloud host would solve that problem, also it would solve having to deal with wandering IP addresses as you may find with a home internet connection
- rovr138 6y ago
  I see WireGuard and ZeroTier mentioned. I just use ssh. SSH to a VPS and map 22 to a port on the VPS. I have a really small VPS for this.
  - mcny 6y ago
    I think the reason they mentioned more complicated setups is because I'm using an actual old machine at home and unless you know what you're doing you don't want to expose it to the world. I think poking a hole on port 22 is mostly ok if you only allow key authentication and no password authentication but I don't know enough to give advice on security.
    - rovr138 6y ago
      Just posting alternatives. I use a VPS with SSH. I have to ssh in, then I can ssh into the machine at home. For safety, key authentication and fail2ban would cover a lot. I mainly have the 1 port. If I need to expose another SSH port to the internet, I can do it, but yes, it would need extra protection since logs are coming from the machine ssh'ing in.
      - hiq 6y ago
        > For safety, key authentication and fail2ban would cover a lot. I mainly have the 1 port. Changing the port from the default 22 to something else is also recommended, if only because it makes fail2ban logs way less verbose.
ccouzens 6y ago
I don't know much about nix. Does it solve the security problem by preventing access to the majority of your home directory? Or solve it by only allowing you to install vetted libraries?
- rowanG077 6y ago
  You cannot access the home directory at all during a nix build.
  - mixmastamyk 6y ago
    Interesting, what about when your software runs? Is it still in a chroot or similar?
    - rowanG077 6y ago
      It's not running in a sandbox. That's not the goal of nix. It's only a package manager/build system.
      - mixmastamyk 6y ago
        Oh, then why can it not access the home folder?
        rowanG077 6y ago
        The build process is sandboxed. Not the environment you run the application in afterwards.
linspace 6y ago
Running desktop applications inside a web browser is bonkers too. And the cloud. It's better to embrace the madness. I recommend watching Dr Strangelove.
FpUser 6y ago
I have it an easy way I think. My development for Linux except some RPi projects is strictly limited to some high performance business servers. I use C++ with a couple of multiplatform libraries for such development. So I simply develop and do main testing on Windows using Microsoft Visual Studio C++. The big one, not VS code. When the time comes for release I just check out project on Linux, run build and tests and that is it. I do have Linux VM on my development computer (VMware, full Linux OS with the GUI and dev environments) in case Linux tests fail due to some compiler differences / whatever. During last 3 years I had to use like it twice for that purpose. I mostly use Vm's to test my server setup from scratch scripts.
bpye 6y ago
Nix has been something I’ve played with for a while, but increasingly I’ve been using it. I would love to see Nix working on Windows - there was a project to make that happen but I don’t know what the current status is.

Actually I think VMs for dev are evil. I hope it's a stop gap measure until tooling like nix catches up enough. Running an entire seperate OS just for development is completely bonkers to me.

mpweiher 6y ago

I'd phrase it this way: it is completely bonkers that this isn't bonkers.

mcny 6y ago

If you think that's bonkers, I'll give you an even worse idea: a dedicated desktop machine. I have a dell optiplex running Intel i3-2100 with 8GB RAM and 1TB Samsung 860 Evo SSD. No display. Fedora runs like a dream with dnf automatic. Use cockpit if you'd like. You can use your windows or Mac laptop with visual studio code to do web development. ng serve works as if you ran it from your laptop. The biggest drawback I can think of is if you ever needed to leave the house. Thankfully, I have no life so I don't have this problem.

cassianoleal 6y ago
> The biggest drawback I can think of is if you ever needed to leave the house. Add ZeroTier to the equation and as long as you have Internet connection when you're outside the house you'll probably not even notice it.
Tsiklon 6y ago
Having both your laptop and desktop on a WireGuard vpn with the gateway on your choice of cloud host would solve that problem, also it would solve having to deal with wandering IP addresses as you may find with a home internet connection
rovr138 6y ago
I see WireGuard and ZeroTier mentioned. I just use ssh. SSH to a VPS and map 22 to a port on the VPS. I have a really small VPS for this.
- mcny 6y ago
  I think the reason they mentioned more complicated setups is because I'm using an actual old machine at home and unless you know what you're doing you don't want to expose it to the world. I think poking a hole on port 22 is mostly ok if you only allow key authentication and no password authentication but I don't know enough to give advice on security.
  - rovr138 6y ago
    Just posting alternatives. I use a VPS with SSH. I have to ssh in, then I can ssh into the machine at home. For safety, key authentication and fail2ban would cover a lot. I mainly have the 1 port. If I need to expose another SSH port to the internet, I can do it, but yes, it would need extra protection since logs are coming from the machine ssh'ing in.
    - hiq 6y ago
      > For safety, key authentication and fail2ban would cover a lot. I mainly have the 1 port. Changing the port from the default 22 to something else is also recommended, if only because it makes fail2ban logs way less verbose.

ccouzens 6y ago

I don't know much about nix. Does it solve the security problem by preventing access to the majority of your home directory? Or solve it by only allowing you to install vetted libraries?

rowanG077 6y ago
You cannot access the home directory at all during a nix build.
- mixmastamyk 6y ago
  Interesting, what about when your software runs? Is it still in a chroot or similar?
  - rowanG077 6y ago
    It's not running in a sandbox. That's not the goal of nix. It's only a package manager/build system.
    - mixmastamyk 6y ago
      Oh, then why can it not access the home folder?
      - rowanG077 6y ago
        The build process is sandboxed. Not the environment you run the application in afterwards.

linspace 6y ago

Running desktop applications inside a web browser is bonkers too. And the cloud. It's better to embrace the madness. I recommend watching Dr Strangelove.

FpUser 6y ago

I have it an easy way I think. My development for Linux except some RPi projects is strictly limited to some high performance business servers. I use C++ with a couple of multiplatform libraries for such development. So I simply develop and do main testing on Windows using Microsoft Visual Studio C++. The big one, not VS code. When the time comes for release I just check out project on Linux, run build and tests and that is it. I do have Linux VM on my development computer (VMware, full Linux OS with the GUI and dev environments) in case Linux tests fail due to some compiler differences / whatever. During last 3 years I had to use like it twice for that purpose. I mostly use Vm's to test my server setup from scratch scripts.

bpye 6y ago

Nix has been something I’ve played with for a while, but increasingly I’ve been using it. I would love to see Nix working on Windows - there was a project to make that happen but I don’t know what the current status is.