4 ms·
And every time your libc needs to be updated, almost every other package you have installed must be updated at the same time.
by hollerith 3y ago
And every time your libc needs to be updated, almost every other package you have installed must be updated at the same time.
- exe34 3y agoAnd if there's the slightest issue with the update, you can just reboot into the previous generation and continue working until you have time to figure it out later, or just wait until it's fixed!
- hollerith 3y agoFedora atomic desktops have that property, too, without the wasteful property I just described.
- exe34 3y agoYes, there is a garbage collector to get rid of the old stuff you don't need anymore!
- hollerith 3y agoThe existence of the garbage collector does not negate the wastefulness of updating every package on the system just because the hash of the C library has changed: even if all the old versions of the packages get garbage collected soon enough, it still wastes network and storage bandwidth to download all the new packages into /nix/store/. NixOS has some good ideas, but also some seemingly boneheaded or impractical ones.
- exe34 3y agoThis is what allows you to have multiple versions of something and all its dependencies installed and not conflict with each other!
- hollerith 3y agoNo it is not. That is my whole point: NixOS could have one without the other. Consider modifying NixOS to remove the requirement that the long hex id in the name of a package in /nix/store/ is a cryptographic hash of (among other things) the hashes of every package the package depends on (thereby eliminating the need to upgrade every package on the system every time the libc packages is updated). I am pretty sure you can do that while retaining the property that it is easy to have multiple versions of something installed that don't conflict with each other. I have not actually done that (I have not actually modified NixOS in that way, then tested the result, e.g., by making it my daily driver for a while) which is why I'm using qualifiers like "I am pretty sure", but I'm confident enough it can be done that I consider it worth bringing up in online conversations about NixOS. The cryptographic hash gives you a guarantee that a binary package you got from the NixOS package servers has not been adulterated in some way on its way to you--a guarantee that you can check without your having to go through the trouble of building the package yourself, but IIUC that guarantee is not actually used anywhere to make the supply chain any more secure. In general NixOS seems to be bad at security or not to care about security: for example https://news.ycombinator.com/item?id=36268776 https://news.ycombinator.com/item?id=36268776 Again there are good ideas in NixOS (including ideas that seem like they could be used to meaningfully increase security) and I hope anyone creating a new distro studies NixOS, but as a distro to be actually used in anger in the present day I am not impressed.
- exe34 3y agoThese look like great ideas, I look forward to trying out your branch! It's pretty easy with Nix, I'd just have to NIX_PATH=<path>/to/nixpkgs-hollerith/ nix-shell -p <some package> to try it out. Good luck!
- Cu3PO42 3y agoYou probably don't even need to reboot. Only once have I broken a generation badly enough I actually needed to reboot. And that was entirely my fault: I mis-configured PAM and couldn't sudo anymore to switch back.
- exe34 3y agoI don't think it does hot patching the kernel?