Hacker News Reader

Comment by JonnieCache | Hacker News Reader

I recently set up a new server for a toy project with nixos and it was a pleasurable experience, even if I did have to pull together several sources of somewhat thin documentation. Recommended. Next time I set up a new dev machine I'm going to give nix a try for dev environment management.

Using nixops to push a closure from your local system up to ec2 is very pleasing. It feels like the future.

View on HN

I did this too until there was a glibc vulnerability. and it took ages for a 'patch' to come out that had to be installed in an obscure way.

For a toy project this is not a problem of course. But before I'd use nixos in production, it needs a better story for security patches. If you try to look up the word 'security' you get viagra spam on their wiki. and there is no security mailinglist whatsoever iirc.

I'm sure this will improve over time though. And for development, nix is still a saviour.

In Guix, we address this problem with grafting.

Rather than rebuild everything that depends on the fixed glibc, we build the fixed glibc, then rewrite all references to the old glibc to refer to the new one. That rewriting happens in new copies of the referring packages, of course, since the "store" is immutable.

https://www.gnu.org/software/guix/manual/html_node/Security-... https://savannah.gnu.org/forum/forum.php?forum_id=8470

Nix has a way of doing this as well, just needs a better UX (like most of nix).

> just needs a better UX

Luckily guix is a better UX for nix. =)

I was quite surprised that `nix install vim` didn't work out of the box. More so after realising that there's not even a `nix` command.

I see that there's a bunch of `nix-whatever` tools around, but even their names aren't much sensible.

I'm not in doubt that nix is technically superior to homebrew, but UX-wise it's at least been a disappointing experience for me.

What Nix for Mac needs more than anything is a great, simple overview of how to use it in practice, for casual users. I use it as my main package manager, but I install software with it rarely enough that I need to dig around in the manpages every time.

Doesn't this affect the promised reproducibility of builds?

No, there's no compromise there.

You end up with a new, grafted dependency graph, which can be reproduced just like the un-grafted graph. Is there some other reproducibility issue you see?

NixOS is pretty awesome :) For anyone trying to start with NixOS, I suggest trying it out on a small DigitalOcean server. Check out this[0] blog post on some hints how to install NixOS there.

A big help is IMO to get a solid understanding about how nix itself works[1]. Also check out some existing `configuration.nix` files on GitHub. Just google for "github configuration.nix". This might give you some inspiration what you can do with the `configuration.nix`.

If you have some trouble with customizing vim on NixOS/via nix, checkout this[2] blog post I wrote a month ago. Hope it helps :)

[0] http://blog.tinco.nl/2016/02/05/nixos-on-digital-ocean.html [1] https://nixos.org/nix/about.html [2] https://www.mpscholten.de/nixos/2016/04/11/setting-up-vim-on...

I found this blogpost helpful:

http://zef.me/blog/5981/deploying-a-simple-node-js-applicati...

Is there a reason you suggest trying it on DO instead of a local VM?

Reply on news.ycombinator.com