6 ms·

lix [1] might be less affected. Pierre Bourdon noticed that lix refactored surrounding code 4 months ago [2], and a comment claims that this Lix commit at least

lix [1] might be less affected. Pierre Bourdon noticed that lix refactored surrounding code 4 months ago [2], and a comment claims that this Lix commit at least patched a different vulnerability GHSA-wf4c-57rh-9pjg [3]. To use lix instead of nix, set `nix.package = pkgs.lix` in your NixOS/home-manager configurations. [1]: https://lix.systems/ https://lix.systems/ [2]: https://mastodon.delroth.net/@delroth/113110218127456491 https://mastodon.delroth.net/@delroth/113110218127456491 [3]: https://lobste.rs/s/ixb3v7/nix_2_24_is_vulnerable_remote_privilege#c_v6ogj5 https://lobste.rs/s/ixb3v7/nix_2_24_is_vulnerable_remote_pri...

takeda 2y ago
What's the difference between Nix and Lix? The website is still not entirely clear. I mean as an user, why would I want to use it (besides avoiding this vulnerability)
- clhodapp 2y ago
  Lix is a (nixpkgs-compatible) fork of Nix, led by Nix community members that don't get along with the core Nix team. At this point, the primary reason to switch to Lix would be if you trusted the Lix folks more than the core Nix team
  - myst1c 2y ago
    There are plenty of fantastic reasons not to, despite the prior issues with Eelco's leadership style. The NixOS Starknet situation[1] was very suspicious and involved many of the wrong incentives for an open source project. One of the primary people involved was trying to get the drops transferred to other people's accounts (getting around geofencing prohibiting US withdrawals too). So it is virtually guaranteed that is being transferred toward something other than the NixOS binary cache despite it being emphasised it would go there. I guess it will be going to "save Nix together" for the fork. All €20 000 or what-not of it. At least Lix is doing some interesting things with the language and fixing some long-standing regressions, but some of the people involved seem to enjoy standing next to others doing the work whilst they loudly take credit, and participating in cryptocurrency ponzi schemes using open source as the vessel. [1] https://discourse.nixos.org/t/starknet-cryptocurrency-contributions/40268 https://discourse.nixos.org/t/starknet-cryptocurrency-contri...
  - soraminazuki 2y ago
    Lix claims to have a more welcoming community, but I too often see prominent members gloating about every Nix bugs and implementation details on Mastodon and elsewhere so YMMV.
    - bfrog 2y ago
      More welcoming how, by stabbing the heart of Eelco with shitty demands? Very welcoming.
      - myst1c 2y ago
        If you look elsewhere in this thread, many of the bullies are doing PR for Lix and trying to use this situation to their advantage. What no one is disclosing to people is that their fork of nixpkgs (ForkOS) is nearly done, so pointing people to it is going to be almost entirely in their benefit. But, why would sociopaths tell people that when they can just publicly embarrass people instead? The amount of gaslighting here is frankly astounding. There were some good developers who went over to Lix but also a few pathological liars and primary school bullies. People don't know half of the abuse going on.
  - bfrog 2y ago
    Didn't get along is an understatement. They gaslit and destroyed the little bit of leadership structure of NixOS had through harassment and bullying.
    - myst1c 2y ago
      Watch out, they may call you the problem when they're accidentally talking about themselves... It's very bad and one can simply look through the Discourse and GitHub issues from earlier this year to discover the full extent of the problem. Watch how they turn a security issue into PR now, this is just a microcosm of the dishonesty.
    - srid 2y ago
      I think you are referring to 4 out of 5 NixOS board members quitting https://old.reddit.com/r/NixOS/comments/1dqn9os/4_out_of_5_nixos_board_members_have_quit/ https://old.reddit.com/r/NixOS/comments/1dqn9os/4_out_of_5_n...
anonfordays 2y ago
[flagged]
- one-punch 2y ago
  I have not been following closely this back story, so I am not aware of such ban, or that (allegedly) Lix is Pierre Bourdon’s software. I am not affiliated with Nix (Cppnix) or Lix.
  - max-privatevoid 2y ago
    Why call it "Cppnix"?
    - eviks 2y ago
      Because it's written in C++ and the fork plans to rewrite in Rust?
      - Macha 2y ago
        Also there's too many things called Nix. There's the overall project, the language, and the primary interpretation. It's also why you'll sometimes see nixlang to refer to the language.
        forgotpwd16 2y ago
        Thought was the norm using capitalized for language and lower case for the tooling. So Nix/nix, like AWK/awk and Go/go.
        Macha 2y ago
        Full caps AWK feels like a relic from the screaming UNIX days, and golang for Go is incredibly common (and as far as I can tell, the proximate cause of the nixlang term)
        2y ago

takeda 2y ago

What's the difference between Nix and Lix? The website is still not entirely clear. I mean as an user, why would I want to use it (besides avoiding this vulnerability)

clhodapp 2y ago
Lix is a (nixpkgs-compatible) fork of Nix, led by Nix community members that don't get along with the core Nix team. At this point, the primary reason to switch to Lix would be if you trusted the Lix folks more than the core Nix team
- myst1c 2y ago
  There are plenty of fantastic reasons not to, despite the prior issues with Eelco's leadership style. The NixOS Starknet situation[1] was very suspicious and involved many of the wrong incentives for an open source project. One of the primary people involved was trying to get the drops transferred to other people's accounts (getting around geofencing prohibiting US withdrawals too). So it is virtually guaranteed that is being transferred toward something other than the NixOS binary cache despite it being emphasised it would go there. I guess it will be going to "save Nix together" for the fork. All €20 000 or what-not of it. At least Lix is doing some interesting things with the language and fixing some long-standing regressions, but some of the people involved seem to enjoy standing next to others doing the work whilst they loudly take credit, and participating in cryptocurrency ponzi schemes using open source as the vessel. [1] https://discourse.nixos.org/t/starknet-cryptocurrency-contributions/40268 https://discourse.nixos.org/t/starknet-cryptocurrency-contri...
- soraminazuki 2y ago
  Lix claims to have a more welcoming community, but I too often see prominent members gloating about every Nix bugs and implementation details on Mastodon and elsewhere so YMMV.
  - bfrog 2y ago
    More welcoming how, by stabbing the heart of Eelco with shitty demands? Very welcoming.
    - myst1c 2y ago
      If you look elsewhere in this thread, many of the bullies are doing PR for Lix and trying to use this situation to their advantage. What no one is disclosing to people is that their fork of nixpkgs (ForkOS) is nearly done, so pointing people to it is going to be almost entirely in their benefit. But, why would sociopaths tell people that when they can just publicly embarrass people instead? The amount of gaslighting here is frankly astounding. There were some good developers who went over to Lix but also a few pathological liars and primary school bullies. People don't know half of the abuse going on.
- bfrog 2y ago
  Didn't get along is an understatement. They gaslit and destroyed the little bit of leadership structure of NixOS had through harassment and bullying.
  - myst1c 2y ago
    Watch out, they may call you the problem when they're accidentally talking about themselves... It's very bad and one can simply look through the Discourse and GitHub issues from earlier this year to discover the full extent of the problem. Watch how they turn a security issue into PR now, this is just a microcosm of the dishonesty.
  - srid 2y ago
    I think you are referring to 4 out of 5 NixOS board members quitting https://old.reddit.com/r/NixOS/comments/1dqn9os/4_out_of_5_nixos_board_members_have_quit/ https://old.reddit.com/r/NixOS/comments/1dqn9os/4_out_of_5_n...

anonfordays 2y ago

[flagged]

one-punch 2y ago
I have not been following closely this back story, so I am not aware of such ban, or that (allegedly) Lix is Pierre Bourdon’s software. I am not affiliated with Nix (Cppnix) or Lix.
- max-privatevoid 2y ago
  Why call it "Cppnix"?
  - eviks 2y ago
    Because it's written in C++ and the fork plans to rewrite in Rust?
    - Macha 2y ago
      Also there's too many things called Nix. There's the overall project, the language, and the primary interpretation. It's also why you'll sometimes see nixlang to refer to the language.
      - forgotpwd16 2y ago
        Thought was the norm using capitalized for language and lower case for the tooling. So Nix/nix, like AWK/awk and Go/go.
        Macha 2y ago
        Full caps AWK feels like a relic from the screaming UNIX days, and golang for Go is incredibly common (and as far as I can tell, the proximate cause of the nixlang term)
        2y ago