I've been thinking if this could be done in Nix and toyed around with the idea just a little bit using nano-gpt. Hermeticity always seems to mean isolation, but depending on who you ask it does not always mean computing…
A consequence of universal healthcare that people don't talk about much is that it turns unhealthy citizens from an individual cost into more of a collective one. So it makes sense that countries with universal…
I think outright shortening copyright terms could be a beneficial policy along similar lines.
I would blame how Austria, a very small country, is organized into 9 provinces that actually have their own budget and can pass their own laws on some topics. Rail service is funded at the federal level, so there's less…
If you make a conventional AI agent do packaging and configuration tasks, it has to do one imperative step after the other. While it can forget, it can't really undo the effects of what it already did. If you…
Yes, the cycle times are bad and some ecosystems and tasks are a real pain still. I also agree with you when it comes to the task of auditing every line of Nix code that factors into a given system. Nix doesn't really…
I think as AI gets smarter, defenders should start assembling systems how NixOS does it. Defenders should not have to engage in an costly and error-prone search of truth about what's actually deployed. Systems should be…
I mentioned another alternative to adding flake-specific metadata to data structures that are transferred over the network, as part of the signed traces or otherwise, in a comment on that PR Eelco linked. It's keeping…
As a current PhD student (working on Nix stuff) let me take this opportunity to congratulate you on your successful PhD defense and publicly thank you for your writing. That you write and what you write are inspiring.
I work with Nix a lot, and I had never seen `__findFile`. It's kind of crazy how much there is to know about Nix. I wish there was a bit less surface area to the language. On the other hand it's really interesting how…
Human-readability was one of the aspects that I enjoyed about using CCL,the Categorical Configuration Language (https://chshersh.com/blog/2025-01-06-the-most-elegant-config...), in one of my projects recently. It saves…
I wrote a paper about how I think trust should work for software dependencies. It very much builds on the hash-based cache lookup mechanism this paper calls constructive traces (in contrast to what they call deep…
Thanks, and thank you for reading! :)
That's great. Feel free to reach out if you want to, I'm happy to answer any questions. It's basically my job, that I really love. :)
You also couldn't feasibly do that for derivations that actually build packages, instead of fixed output derivations only, because if you the update the package set to include a newer version of the compiler, which…
I think its great that Julien and his coauthors actually show some evidence of Nix working at scale, to successfully rebuild the vast majority of things, and bit-by-bit reproduce a significant portion. Lots of people…
I really wish we would take defining what it means for an artifact to be signed more seriously. Which key(s) is it signed with? What is the hash of the corresponding unsigned artifact? Signature verification tools…
Thanks, I had not heard of Tvix yet. What do you mean by day 1 reproducibility instead of repeatability? Isn't tracking and eliminating nondeterminism a gradual process anyways? I don't see how nixpkgs or NixOS is a…
Theoretically languages other than Nix can be used to generate derivations and from that point forward to the finished build result everything should work the same way. There is already some experimental setup for Nix…
If you are talking about provisioning dot files and command line applications you want to have available on all you machines then take a look at home-manager. https://github.com/nix-community/home-manager I use it on…
I guess you cannot install Nix on that Mac because you are not admin? In general you can install the Nix Package Manager and home-manager an macOS. There were some rough edges when macOS Catalina came out, but that…
I can imagine sitting down and migrating a lot of complex packages to Nix is probably quite a tall order right now. Partially because I think a switch like that is always painful, but also because of the open issues,…
This is about right but let me clarify a bit. The configuration.nix system configuration can be moved between systems, but imports a generated hardware-configuration.nix that really should not be moved between systems.…
That's an accurate description. I just want to add some info how the install process ifself works so people get a better picture of it. For the initial installation you actually have to set up the partitions and mounts…
If you are interested in Nix but don't know too much about it, let me tell you one thing: You can use the package manager to package, build and install software and to take advantage of their large package repo and…
I've been thinking if this could be done in Nix and toyed around with the idea just a little bit using nano-gpt. Hermeticity always seems to mean isolation, but depending on who you ask it does not always mean computing…
A consequence of universal healthcare that people don't talk about much is that it turns unhealthy citizens from an individual cost into more of a collective one. So it makes sense that countries with universal…
I think outright shortening copyright terms could be a beneficial policy along similar lines.
I would blame how Austria, a very small country, is organized into 9 provinces that actually have their own budget and can pass their own laws on some topics. Rail service is funded at the federal level, so there's less…
If you make a conventional AI agent do packaging and configuration tasks, it has to do one imperative step after the other. While it can forget, it can't really undo the effects of what it already did. If you…
Yes, the cycle times are bad and some ecosystems and tasks are a real pain still. I also agree with you when it comes to the task of auditing every line of Nix code that factors into a given system. Nix doesn't really…
I think as AI gets smarter, defenders should start assembling systems how NixOS does it. Defenders should not have to engage in an costly and error-prone search of truth about what's actually deployed. Systems should be…
I mentioned another alternative to adding flake-specific metadata to data structures that are transferred over the network, as part of the signed traces or otherwise, in a comment on that PR Eelco linked. It's keeping…
As a current PhD student (working on Nix stuff) let me take this opportunity to congratulate you on your successful PhD defense and publicly thank you for your writing. That you write and what you write are inspiring.
I work with Nix a lot, and I had never seen `__findFile`. It's kind of crazy how much there is to know about Nix. I wish there was a bit less surface area to the language. On the other hand it's really interesting how…
Human-readability was one of the aspects that I enjoyed about using CCL,the Categorical Configuration Language (https://chshersh.com/blog/2025-01-06-the-most-elegant-config...), in one of my projects recently. It saves…
I wrote a paper about how I think trust should work for software dependencies. It very much builds on the hash-based cache lookup mechanism this paper calls constructive traces (in contrast to what they call deep…
Thanks, and thank you for reading! :)
That's great. Feel free to reach out if you want to, I'm happy to answer any questions. It's basically my job, that I really love. :)
You also couldn't feasibly do that for derivations that actually build packages, instead of fixed output derivations only, because if you the update the package set to include a newer version of the compiler, which…
I think its great that Julien and his coauthors actually show some evidence of Nix working at scale, to successfully rebuild the vast majority of things, and bit-by-bit reproduce a significant portion. Lots of people…
I really wish we would take defining what it means for an artifact to be signed more seriously. Which key(s) is it signed with? What is the hash of the corresponding unsigned artifact? Signature verification tools…
Thanks, I had not heard of Tvix yet. What do you mean by day 1 reproducibility instead of repeatability? Isn't tracking and eliminating nondeterminism a gradual process anyways? I don't see how nixpkgs or NixOS is a…
Theoretically languages other than Nix can be used to generate derivations and from that point forward to the finished build result everything should work the same way. There is already some experimental setup for Nix…
If you are talking about provisioning dot files and command line applications you want to have available on all you machines then take a look at home-manager. https://github.com/nix-community/home-manager I use it on…
I guess you cannot install Nix on that Mac because you are not admin? In general you can install the Nix Package Manager and home-manager an macOS. There were some rough edges when macOS Catalina came out, but that…
I can imagine sitting down and migrating a lot of complex packages to Nix is probably quite a tall order right now. Partially because I think a switch like that is always painful, but also because of the open issues,…
This is about right but let me clarify a bit. The configuration.nix system configuration can be moved between systems, but imports a generated hardware-configuration.nix that really should not be moved between systems.…
That's an accurate description. I just want to add some info how the install process ifself works so people get a better picture of it. For the initial installation you actually have to set up the partitions and mounts…
If you are interested in Nix but don't know too much about it, let me tell you one thing: You can use the package manager to package, build and install software and to take advantage of their large package repo and…