3 ms·
For most people, depending on historic versions of nixpkgs is an anti-pattern. The main reason I say this is security. You may want an old version of, say, ruby
by hamandcheese 3y ago
For most people, depending on historic versions of nixpkgs is an anti-pattern. The main reason I say this is security. You may want an old version of, say, ruby, but you probably don't want the old, insecure libraries it was built against (i.e. glibc, openssl).
It is often just as easy to use overrides to build a different version of a piece of software, and in the rare case that doesn't work you can fall back to a custom derivation (drawing inspiration from the old version of nixpkgs, perhaps).
I worry about tools like this which make doing the wrong thing too easy.
- wredue 3y agoYeah. People like to push that there are “legitimate reasons” to want old versions, but it usually comes down to businesses. I would suggest instead that there are no legitimate reasons, and that businesses who are requiring old software are at best being negligent. I’ve worked with people that refuse to modernize and update and it’s always the same stupid thing: “cost”. We really do need strong regulations on businesses that negligently refuse keep reasonably up to date.
- haolez 3y agoYou are assuming that software always improves as its development moves forward. It might not. It might even get more insecure as time passes.
- lallysingh 3y agoOr is always backwards compatible. Upgrades aren't free.
- wredue 3y ago1) In general, older code tends to have security patches 2) it costs money to run a business, and saving money through gross negligence, leading to real people having real impacts through massive data leaks while suffering zero repercussions for that needs to end. “It costs money to keep software up to date” is a shit argument for why businesses should not be managing their software.
- hamandcheese 3y agoI'm not arguing against using old versions of software, per se, rather I'm arguing against old versions of transitive dependencies.
- OhSoHumble 3y ago> I would suggest instead that there are no legitimate reasons, and that businesses who are requiring old software are at best being negligent. 1. Backwards incompatible schema changes for data that the software works with which requires a migration path. The version for that software needs to be locked until that migration is complete. 2. A functionality regression in the software. The version needs to be locked until that patch lands. 3. A security vulnerability can be introduced with new features. The version needs to be locked until that security issue is patched out. You can't just yolo to the latest version of software every time it drops.