3 ms·

Unfortunately, these are famous last words in a professional IT environment. I've heard the exact same argument almost verbatim from a C-level exec who got fir

by than3 4y ago

Unfortunately, these are famous last words in a professional IT environment. I've heard the exact same argument almost verbatim from a C-level exec who got fired after an outage. It was regarding backups and the infantesimal chance that we would have a power outage. It fundamentally assumes a lot of critical things that you can't control. If you follow your own advice, you will eventually be wrong, and pay more for it than you would have otherwise. As for undoing or applying changes, I've had nothing but praise for rpm, its pretty rock solid with the right setup, and better, because it is maintainable and supportable.

shakow 4y ago
You don't get it. The main issue with a hash collision in sha256 wouldn't be Nix breaking for a few hours; it would be the modern internet breaking down. I don't see why you get so fixated on Nix rather than preaching about anything else using sha256. > infantesimal chance that we would have a power outage. Power outages are experienced every day in every country; sha256 collisions are still to be found. That's not the same magnitude of ‶infinitesimal″ at all.
zdragnar 4y ago
I'll admit, I don't have a ton of experience with rpm- I've generally avoided it since I had to help a client deploy a website on I think CentOS, and the available packages for imagick, language X, and language-X-imagick bindings were all three incompatible with each other. Not a great excuse, but I since lean towards other distros and tools. In that sense, I alone have lost more time to rpm than the entire world has with nix sha256 collisions.
anon291 4y ago
Adding support for collision detection to nix, involves a one or two line change to libstore. You should implement such an assert statementt and contribute it to Nix. Nix is open-source and would likely gladly accept it. You are way overstating the importance of this. This is not a fundamental design flaw in the nix ecosystem. If there's actually no check it's because most people realize this is not a problem worth spending a lot of time on. But the time required here is a few minutes at most.

by than3 4y ago

shakow 4y ago

You don't get it. The main issue with a hash collision in sha256 wouldn't be Nix breaking for a few hours; it would be the modern internet breaking down. I don't see why you get so fixated on Nix rather than preaching about anything else using sha256. > infantesimal chance that we would have a power outage. Power outages are experienced every day in every country; sha256 collisions are still to be found. That's not the same magnitude of ‶infinitesimal″ at all.

zdragnar 4y ago

I'll admit, I don't have a ton of experience with rpm- I've generally avoided it since I had to help a client deploy a website on I think CentOS, and the available packages for imagick, language X, and language-X-imagick bindings were all three incompatible with each other. Not a great excuse, but I since lean towards other distros and tools. In that sense, I alone have lost more time to rpm than the entire world has with nix sha256 collisions.

anon291 4y ago

Adding support for collision detection to nix, involves a one or two line change to libstore. You should implement such an assert statementt and contribute it to Nix. Nix is open-source and would likely gladly accept it. You are way overstating the importance of this. This is not a fundamental design flaw in the nix ecosystem. If there's actually no check it's because most people realize this is not a problem worth spending a lot of time on. But the time required here is a few minutes at most.