<story><title>One Week of NixOS</title><url>https://jae.moe/blog/2020/11/one-week-of-nixos/</url></story><parent_chain></parent_chain><comment><author>k32</author><text>Nix is a nice research project, but after playing with it for ~6 months and contributing to nix-packages, I came to conclusion that (in my case) it&amp;#x27;s not suitable for production nor development, and now I manage my personal machines with a simple Ansible playbook.&lt;p&gt;Main reason for leaving was that Nix package maintainers have to heavily patch all software. Packaging for nix is more like porting software to another operating system. Just check the amount of ad-hoc patches in nix-packages repo, and note that they have automated tools for patching the most common problems, so the problem is even worse. Now how about quality of these patches... I was able to merge some pretty large patches to nix-packages from an anonymous and sketchy-looking github account, and they weren&amp;#x27;t scrutinized much, because the original author of the derivations abandoned them.&lt;p&gt;Moreover, Nix breaks the chain of trust for the language packages. For example, Erlang and Elixir packages are signed cryptographically. Most erlang libraries come with a rebar.lock file containing hashes of the dependencies, so reproducible builds are already ensured. Unfortunately, package hashes are incompatible with Nix derivation SHA&amp;#x27;s, because they include some additional envelope data. What did Nix people do to work around this problem? They patched out the checks for rebar.lock files from the 3rd party Erlang build system. I would not dare to run a distro that contains patches like this in any kind of production environment.&lt;p&gt;Additionally, &amp;#x2F;nix directory is readable by all users, so you cannot use Nix to manage secrets, and there was no universally approved way of doing so (or at least it was the case at the time I was using it).&lt;p&gt;As for personal use... You cannot install opam packages without dealing with incompatiblities, you cannot easily install games from Gog without dealing with incompatibilities, and to be honest, do you really need such degree of reproducibility for your very own dev machine?</text></comment>
<story><title>One Week of NixOS</title><url>https://jae.moe/blog/2020/11/one-week-of-nixos/</url></story><parent_chain></parent_chain><comment><author>rgoulter</author><text>My experience with Nix and NixPkgs is that 95% of the time it&amp;#x27;s fine. That 5% is a real PITA.&lt;p&gt;I think nix isn&amp;#x27;t as useful for developers using it to setup their workstation compared to for operations setting up deployment environments. -- I like that I can just run &amp;quot;nix --install myPackages&amp;quot; and have the exact, up-to-date versions of software installed... but, it&amp;#x27;s not often that I &lt;i&gt;need&lt;/i&gt; to run this. (The up-to-date versions thing is nice). -- Maybe this will be more compelling for stuff like GitHub Codespaces, and other ephemeral machines?&lt;p&gt;(EDIT: and nix-shell is cool and very pure, but looks to me like people are just fine using images of development environments&amp;#x2F;toolschains with VMs or Docker. etc.).&lt;p&gt;NixOS itself does feel very different to other OSs. I think people discount how much trouble they run into on other OSs. Partly because other OSs have larger communities, and advice will often apply across multiple OSs. With NixOS, there&amp;#x27;s a higher requirement for understanding of what&amp;#x27;s going on; and it&amp;#x27;s not obvious that the benefit from doing this is worth it.</text></comment>