Hacker News Reader

Comment by toastal | Hacker News Reader

Makes you wonder why the whole protocol isn't Bittorrent with users seeding their builds to others.

Because the cloud movement in all of its hype stifled any investment in this area.

I believe it. I foresee a lot of holes being dug for projects buying into “the cloud” and “the edge”.

With NixOS the main problem is that a lot of local "packages" are configuration files with a lot of secrets. It is very easy to end up seeding your VPN and email passwords this way.

It's not required but it’s a best practices to not get your secrets into the nix store. There are solutions like env vars or Agenix.

People do it anyway, and none of those solutions are as convenient.

Guess you should just check all your secrets into source control. That would be easier too.

The Nix store is world-readable. Storing plaintext secrets in the Nix store is absolutely insane and foolish. Who does this?

Either don't store your secrets this way or don't use Nix. Please.

I use agenix when I can, but I'm internally wincing at the thought of trying to explain it to friends I'm getting into nixos. It's not exactly usable.

/nix/store isn't world-readable. It's machine-readable, and most machines are single-user. I'll explain the caveats, but I can't tell them never to put secrets there; the predictable outcome then is they won't try nixos.

There are unfortunately lots of software packages that don't offer a convenient passwordFile option in nix and the easiest way to get running is to specify a password in a way that ends up in the nix store.

I knew of a few options like that, but didn't realize it was so widespread. I wish Nixpkgs had a policy against writing modules that way. This creates a policy nightmare for companies that might use Nix. Alternatively, we need ACLs for the Nix store, or at least some store paths, at a minimum. :-\

The reason usually cited for why not BitTorrent for software packages is because it makes public what package versions you have and haven’t downloaded.

This information could be useful to an attacker.

Hardly. Plus I'd rather have a random bunch of people get a small fraction of such information rather than a single company see everything.

Only if you're only seeding what you're using. It would be easy to add an obfuscation layer that seeds more.

At one point there were BitTorrent transports for Debian's apt.

<https://wiki.debian.org/DebTorrent>

Reply on news.ycombinator.com