For a toy project this is not a problem of course. But before I'd use nixos in production, it needs a better story for security patches. If you try to look up the word 'security' you get viagra spam on their wiki. and there is no security mailinglist whatsoever iirc.
I'm sure this will improve over time though. And for development, nix is still a saviour.
Rather than rebuild everything that depends on the fixed glibc, we build the fixed glibc, then rewrite all references to the old glibc to refer to the new one. That rewriting happens in new copies of the referring packages, of course, since the "store" is immutable.
https://www.gnu.org/software/guix/manual/html_node/Security-... https://savannah.gnu.org/forum/forum.php?forum_id=8470
Luckily guix is a better UX for nix. =)
I see that there's a bunch of `nix-whatever` tools around, but even their names aren't much sensible.
I'm not in doubt that nix is technically superior to homebrew, but UX-wise it's at least been a disappointing experience for me.