Mastodawn

Pierre Bourdon Sep 26, 2024

Remember when some people in the #nixos community were raising the alarm on corporate interests taking over the Nix project?

Today Nix apparently published a new security release, and at this point several hours after the release the only place where you can find information about it is on Determinate Systems' social media channels: https://x.com/DeterminateSys/status/1839145876486242659

Determinate Systems (@DeterminateSys) on X

Nix 2.24.8 is currently phasing in through all Determinate distribution channels. This release improves the security of Nix's builtin:fetchurl builder by validating TLS certificates against the system's certificate store. Note: builtin:fetchurl is not builtins.fetchUrl...

X (formerly Twitter)

Alexander Sosedkin

@delroth
https://github.com/NixOS/nix/commit/618a0cc9875628171663c9bc3829ed3755a458ed is one click away from https://github.com/NixOS/nix/releases/tag/2.24.8, which is one click away from https://github.com/NixOS/nix

What else did you want to happen between 4 AM and 8 AM CET? An episode of #FullTimeNix with @jgalowicz? Calm down the FUD.

Merge pull request #11592 from NixOS/mergify/bp/2.24-maintenance/pr-1… · NixOS/nix@618a0cc

…1585 builtin:fetchurl: Enable TLS verification (backport #11585)

GitHub

Pierre Bourdon Sep 26, 2024

@monk that's a lot of coping to justify people not doing basic release work

Alexander Sosedkin

@delroth I'll repeat my question. What other avenues of announcing this release were omitted?

piegames Sep 26, 2024

@monk @delroth https://discourse.nixos.org/c/announcements/security/56

Security

This category is here for tracking security advisories. Subscribe to it, if you want to stay in the loop about actionable announcements to keep your systems safe.

NixOS Discourse

Alexander Sosedkin

@piegames @delroth and whose responsibility it is to post there?

@monk @delroth not mine for sure 🤷

Alexander Sosedkin

@piegames @delroth OK, so

1. late in the night, a fix was backported
2. two hours later, Eelco tagged a release
3. Detsys (they're US, aren't they?) tweeted about it
4. the original poster wakes up, only finds a Detsys tweet, finds the media coverage inadequate and blames... the only party that covered the release in a way that reached them
5. people wonder, why others find the NixOS polarization ridiculous and artificially sustained

I can't even. If you don't like the release announcement process, fix it. Don't just blame a random group of people you happen to dislike for not doing the thing you wanted done. This is not USpol, there is no inherent sports team rivalry. The game is co-op.

cafkafk Sep 26, 2024

@monk @piegames @delroth

If you don’t like the release announcement process, fix it.

I don’t like it and I wanna fix it. How do I do that? I’m literally not aware of any avenue of improving that aren’t rising in governance ranks.

cafkafk Sep 26, 2024

@monk @delroth @piegames the reason people complain here is because that’s the only place someone will even listen, if leadership wasn’t deaf maybe sure, doing more than complaining would be feasible for most people.

LIke there is genuinely critical infrastructure running on Nix this is so obviously unacceptable.

Alexander Sosedkin

@cafkafk @piegames @delroth oh, absolutely cut the "ranks" stuff until you submit a change and it gets rejected. Ant if there never was a formalized process, assume that the process is monitoring github tags.

cafkafk Sep 26, 2024

@monk @piegames @delroth right so where do I submit that process change? I just open a PR against nixccp and that’s how it works? Seriously?

cafkafk Sep 26, 2024

@monk @delroth @piegames should I open an rfc?

cafkafk Sep 26, 2024

@delroth @monk @piegames if the process is monitoring github tags then that’s not a process, idk when detsys decided that Nix should be a hobbyist distro but we’re actually real people using this and this is just like, not excusable

cafkafk Sep 26, 2024

@delroth @monk @piegames there was a talk once way back where grahamc said something like “we should really get a handle on security, because I don’t wanna go back to ansible” and honestly that spirit has totally been lost, it’s a fucking shame

cafkafk Sep 26, 2024

@delroth @monk @piegames no matter how hard uncritical fans cope online NIS2 is coming Europe wide and I wanna keep working with Nix, and I could keep working with Nix with like, the same basic amount of effort as other projects put into this, if the bar is lower than that then it’s game over

Alexander Sosedkin

@cafkafk @piegames @delroth yes, just file the PR, no need to grind any imaginary ranks. The file is maintainers/release-process.md, if you were being sarcastic.

Morten Linderud Sep 26, 2024

@monk @piegames @delroth

It would just be better if the project did proper releases, changelogs and advisories.

It's not that hard when you get paid to do it.

Alexander Sosedkin

@Foxboron @piegames @delroth if that means you get paid for working on Nix, I'm genuinely happy for you. If that means you paid them for making timely changelogs and a tag is all you got, then yes, demand a refund by all means necessary.

piegames Sep 26, 2024

@monk @Foxboron @delroth I don't really understand that "getting paid" argument. Like, I have a better release process and changelogs for my own software even where I'm the only user. Like, that's not hard, that's just basic due diligence! And Nix even already has some very sophisticated release notes tooling, why not fucking use it?

Christoph Heiss Sep 26, 2024

@monk @piegames @delroth Serious question: What exactly do you gain from defending a company, which actively seeks to harm to the Nix community, so damn hard? Ended up on their payroll somehow?

Alexander Sosedkin

@c8h4 @piegames @delroth I have zero relationship with them, financial or otherwise. Ant I'm not defending one side, I'm shaming the harmful community polarizers that are phenomenally blind to what actually happens in reality if it gives them an excuse to blame the ride they don't like, even if it makes negative sense like in this example.

Like you. Go stand in a corner in shame.