Hacker News Reader

Comment by user6723 | Hacker News Reader

One of my colocated servers has 60TB of space to spare and has a 10gbe unmetered uplink on the provider's IP-transit blend.

It is easy to configure traffic shaping on the box so that any unused upload bandwidth can be used without any impact to existing applications.

I would be happy to seed NixOS torrents. There is an extension to torrents where files can be added to a torrent after a torrent is released that might make sense to look at.

View on HN

Makes you wonder why the whole protocol isn't Bittorrent with users seeding their builds to others.

Because the cloud movement in all of its hype stifled any investment in this area.

I believe it. I foresee a lot of holes being dug for projects buying into “the cloud” and “the edge”.

The reason usually cited for why not BitTorrent for software packages is because it makes public what package versions you have and haven’t downloaded.

This information could be useful to an attacker.

Hardly. Plus I'd rather have a random bunch of people get a small fraction of such information rather than a single company see everything.

Only if you're only seeding what you're using. It would be easy to add an obfuscation layer that seeds more.

At one point there were BitTorrent transports for Debian's apt.

<https://wiki.debian.org/DebTorrent>

With NixOS the main problem is that a lot of local "packages" are configuration files with a lot of secrets. It is very easy to end up seeding your VPN and email passwords this way.

It's not required but it’s a best practices to not get your secrets into the nix store. There are solutions like env vars or Agenix.

People do it anyway, and none of those solutions are as convenient.

Guess you should just check all your secrets into source control. That would be easier too.

The Nix store is world-readable. Storing plaintext secrets in the Nix store is absolutely insane and foolish. Who does this?

Either don't store your secrets this way or don't use Nix. Please.

There are unfortunately lots of software packages that don't offer a convenient passwordFile option in nix and the easiest way to get running is to specify a password in a way that ends up in the nix store.

I knew of a few options like that, but didn't realize it was so widespread. I wish Nixpkgs had a policy against writing modules that way. This creates a policy nightmare for companies that might use Nix. Alternatively, we need ACLs for the Nix store, or at least some store paths, at a minimum. :-\

I use agenix when I can, but I'm internally wincing at the thought of trying to explain it to friends I'm getting into nixos. It's not exactly usable.

/nix/store isn't world-readable. It's machine-readable, and most machines are single-user. I'll explain the caveats, but I can't tell them never to put secrets there; the predictable outcome then is they won't try nixos.

I wonder if it’s possible to easily seed portions/parts of giant files. A little bit like another project mentioned here but just mediated with torrents and volunteers.

Reply on news.ycombinator.com