3 ms·
I don't think Nix solves security concerns as well as other distributions do. It excels in most ways but this is the weakest point.
by mongol 3y ago
I don't think Nix solves security concerns as well as other distributions do. It excels in most ways but this is the weakest point.
- k8svet 3y agoNix isn't an OS and NixOS does "security concerns" just as well as any other distro. I'm really struggling to understand what you mean. Nix itself doesn't have any runtime sandboxing, but that's no different than using distro packages on any other distro. Meanwhile you can still use Flatpaks, docker, podman, kvm/libvirt, etc, just like on any distro.
- endgame 3y agoAs great as Nix is, a security update to something like glibc will necessitate a rebuild of the entire universe as a necessary consequence of its "immutable, hashed inputs" model. Guix has a feature called "grafts" that avoids some of this pain, but compromises the purity of the functional packaging model to do so.
- SkyMarshal 3y agoBut Nix rebuilds are cheap and fast, what’s the problem?
- ochoseis 3y agoPlus they can be easily cached so you only ever have to do it once, and the result is available to your whole fleet.
- nbpname 3y agoGrafting is indeed a good solution for fast security updates, except that the way this is implemented in Guix depends on the maintainer of each package. This is indeed better than Nix which relies on asking every user to replace the dependencies. A few years ago, I made a proposal to have some automatic grafting mechanism: https://github.com/NixOS/nixpkgs/pull/10851 https://github.com/NixOS/nixpkgs/pull/10851 This would automagically work by simply maintaining 2 trees of Nixpkgs, one with the cherry-picked security updates, and one which matches the latest set of cached packages. This way one can fully benefit from the cached packages while having the ability to replaces with the latest security patches they want to import without building the world. Unfortunately, rewritting Nixpkgs to fit the requirements needed to have the automagic mechanism is a huge project, especially given the activity of Nixpkgs. Maintaining a fork of Nixpkgs which stays up-to-date while changing its inner working cannot be held by a single person. My hopes would be to push this to the Nixpkgs Architecture Team, while preventing them from doing mistakes by inserting extra complexity while making this work more challenging.
- mongol 3y agoNo it doesn't. It has nothing like SELinux or AppArmor
- fiddlerwoaroof 3y agoSo, first of all, nix isn't a distribution, it's a build/packaging tool. Secondly, docker/containers are not a security mechanism
- pxc 3y agoNixpkgs is a distribution, as is NixOS. Neither of those things is Nix, but it's an easy mistake to mentally correct when interpreting someone charitably. That said, GP didn't give you much to go off of. As for security, it's worth noting here that there are Nix-native tools for generating MicroVMs as well, if that's what folks are after with Kata and Firecracker.
- fiddlerwoaroof 3y agoNixpkgs isn’t really a distribution, but something relatively new (although a bit like FreeBSD ports and Gentoo’s portage): it’s a collection of build scripts designed to make it possible to build software cross-platform in a reproducible way.
- pxc 3y agoPortage and *BSD ports systems are certainly software distributions. They're just source-based distributions. Nixpkgs includes the same kind of reuse and integration and patching that you see in other kinds of software distributions, like Linux distros or Conda.
- fiddlerwoaroof 3y agoIn this context I assumed “distribution” meant “operating system distribution”
- pxc 3y agoAh! Got you.