4 ms·

Meanwhile, you can have the best of both worlds using Nix. Tons of things are packaged already, and for the most part dependences are shared across many differe

Meanwhile, you can have the best of both worlds using Nix. Tons of things are packaged already, and for the most part dependences are shared across many different packages. But if a package needs a special version of a dependency, thats no big deal.

Gigachad 3y ago
Does nix have any version of XDG portals for allowing programs to open file pickers without seeing the contents? This seems like the killer feature of flatpak.
- mixedCase 3y ago
  XDG portals are just APIs that applications can implement and use. Regardless, do you not trust the applications that you run natively?
  - kaba0 3y ago
    A “good” pdf reader only needs a bug and a bad pdf file.
  - carbotaniuman 3y ago
    I mean I trust Firefox to not steal my data, or maybe $APP_NAME, but do I trust the C++ code? Or maybe it's an app that's been pwned a lot. Sandboxing has uses other than running actively hostile apps (for which I'd argue this kind of sandboxing isn't enough).
  - ben0x539 3y ago
    I generally trust the applications that I run natively to not be malicious, but I don't always trust them to not step on each other's toes, or make a well-intentioned mess of things.
  - mjg59 3y ago
    I don't assume that applications are inherently hostile, but I do not trust that the developer of every application I use to open untrusted input is sufficiently security conscious to prevent those applications from being subverted.
  - Gigachad 3y ago
    No, I absolutely do not trust the applications I run natively. I trust the hardware, the OS, and the sandboxing layer. Mostly because I have to. I absolutely do not trust Spotify or Steam with my personal documents
- prussian 3y ago
  https://github.com/nixpak/nixpak https://github.com/nixpak/nixpak
  - Gigachad 3y ago
    The readme isn’t super clear how you use this. Is there some way I can for example use this to install Spotify with no file system, microphone, and camera access?
- kaba0 3y ago
  Why should sandboxing be part of package management? We should absolutely need sandboxes as non-android linux’s security is criminal, but that’s a separate issue in my opinion.
  - Gigachad 3y ago
    That’s how every other OS does it so it doesn’t seem like such a wild idea to me. Where else should it go?
    - kaba0 3y ago
      No, the actual sandboxing is not part of the package managers
johnny22 3y ago
nix doesn't help you with containing each program last I heard. I've been waiting to hear about any work on one. It'd be really cool if nix package definitions also let you define defaults for containment per program.
- hamandcheese 3y ago
  No, it doesn't. I meant the best of both worlds w.r.t. packaging and distribution (which seemed to be the focus of the article), not sandboxing.
whateveracct 3y ago
Flatpaks also run fine on NixOS! So you don't even miss out.
ben0x539 3y ago
Yeah, until you're trying to install something that uses OpenGL. :)

Gigachad 3y ago

Does nix have any version of XDG portals for allowing programs to open file pickers without seeing the contents? This seems like the killer feature of flatpak.

mixedCase 3y ago
XDG portals are just APIs that applications can implement and use. Regardless, do you not trust the applications that you run natively?
- kaba0 3y ago
  A “good” pdf reader only needs a bug and a bad pdf file.
- carbotaniuman 3y ago
  I mean I trust Firefox to not steal my data, or maybe $APP_NAME, but do I trust the C++ code? Or maybe it's an app that's been pwned a lot. Sandboxing has uses other than running actively hostile apps (for which I'd argue this kind of sandboxing isn't enough).
- ben0x539 3y ago
  I generally trust the applications that I run natively to not be malicious, but I don't always trust them to not step on each other's toes, or make a well-intentioned mess of things.
- mjg59 3y ago
  I don't assume that applications are inherently hostile, but I do not trust that the developer of every application I use to open untrusted input is sufficiently security conscious to prevent those applications from being subverted.
- Gigachad 3y ago
  No, I absolutely do not trust the applications I run natively. I trust the hardware, the OS, and the sandboxing layer. Mostly because I have to. I absolutely do not trust Spotify or Steam with my personal documents
prussian 3y ago
https://github.com/nixpak/nixpak https://github.com/nixpak/nixpak
- Gigachad 3y ago
  The readme isn’t super clear how you use this. Is there some way I can for example use this to install Spotify with no file system, microphone, and camera access?
kaba0 3y ago
Why should sandboxing be part of package management? We should absolutely need sandboxes as non-android linux’s security is criminal, but that’s a separate issue in my opinion.
- Gigachad 3y ago
  That’s how every other OS does it so it doesn’t seem like such a wild idea to me. Where else should it go?
  - kaba0 3y ago
    No, the actual sandboxing is not part of the package managers

johnny22 3y ago

nix doesn't help you with containing each program last I heard. I've been waiting to hear about any work on one. It'd be really cool if nix package definitions also let you define defaults for containment per program.

hamandcheese 3y ago
No, it doesn't. I meant the best of both worlds w.r.t. packaging and distribution (which seemed to be the focus of the article), not sandboxing.

whateveracct 3y ago

Flatpaks also run fine on NixOS! So you don't even miss out.

ben0x539 3y ago

Yeah, until you're trying to install something that uses OpenGL. :)