ruffsl

joined 2 years ago
 

As a developer I often need to run code I cannot trust, especially dependencies from NodeJS and Python projects, on my dev machine. In order to protect my system from potentially malicious code, I built NixWrap, an adhoc sandboxing tool for NixOS.

NixWrap wraps bubblewrap (oh dear), running it with convenient defaults and offering easy to use command line flags to toggle custom options. An invocation to NixWrap is typically way shorter than the bubblewrap equivalent.

E.g. npm install can be wrapped with wrap -n npm install to gain network access and write access to the current working directory.

 

Any suggested changes since this was published a year prior?

 

Any notable advance in this regard as compared to when the original article was published in 2015?

 

cross-posted from: https://programming.dev/post/36703523

It does not require root, user namespaces support or disabling SELinux, but it relies on proot and other hacks instead. It uses a fork of Termux-the-terminal-emulator app, but has no relation to Termux-the-distro.

 

cross-posted from: https://programming.dev/post/36703523

It does not require root, user namespaces support or disabling SELinux, but it relies on proot and other hacks instead. It uses a fork of Termux-the-terminal-emulator app, but has no relation to Termux-the-distro.

 

cross-posted from: https://programming.dev/post/36703523

It does not require root, user namespaces support or disabling SELinux, but it relies on proot and other hacks instead. It uses a fork of Termux-the-terminal-emulator app, but has no relation to Termux-the-distro.

 

It does not require root, user namespaces support or disabling SELinux, but it relies on proot and other hacks instead. It uses a fork of Termux-the-terminal-emulator app, but has no relation to Termux-the-distro.

[–] ruffsl@programming.dev 4 points 1 month ago

Hey do we have a central place with everyone’s configuration file ?

As roundabout as it sounds I've had good luck using GitHub's code search with language:nix and path:flake.nix modifiers.

E.g, I was looking for complete flake examples to overlay nvidia drivers from the unstable branch/channel, I used this regex:

Most folks publishing their configs often have more advance setups, but still nice trace git blame to learn how they evolved.

some config file editor where I can just toggle kde + nvidia drivers +

There is SnowflakeOS this kind of stalled, but that could change with recent improvements to structured edits of Nix:

[–] ruffsl@programming.dev 11 points 1 month ago* (last edited 1 month ago)

I think installing NixOS is something that could really benefit from more community mentoring or nearby a local linux user group.

Now that I have a working config for my hardware, I feel like I could explain it all to my old self in under half an hour. But to get to that point of familiarity took a few days. Having someone over your shoulder to save a new user most of any trial and error could go a long way in terms of adoption or bounce rate. It's like subject that can be tricky to approach solo, but could be trivial if tutored even slightly formally.

If you also like me prefer spoken/visual instructions over written forms, I'd also recommend these resources:

[–] ruffsl@programming.dev 4 points 1 month ago (1 children)

Well let me at least leave why I think Nix is not it at the moment:

  • Software Center - browsing search.nixos.org isn't quite the same in terms low friction and discoverability
    • You already have to know what you're looking for, and it can't make system config on your behalf
    • Debian or conventional package managers usually offer a native GUI for package selection and deployment
  • System Defaults - the minimality of a basic default install can cause a lot of papercuts
    • the default boot partition is rather small given the OS's prepecity to add new kernels with new generations
    • and without any garbage collection service enabled by default, user first encounter switch failures due to this
  • External Binaries Compatibility - Linux also suffers from this in general as compared to MacOS or Windows
    • in addition to being much more niche, reuse of existing binaries from more prevalent distros becomes complicated
    • the desktop ISO could suggest a nix-ld config with default libs most binary distributes expect, easing in new users
  • The Nix language - much more complex than conventional cong markup langs, being more of a turing complete DSL
    • partial working LSP impare introspection while writing, and the runtime error messages are poorly formatted
    • most desktop users (in debian or fedora) have little need to learn their OS's packaging schemas, but NixOS users do
[–] ruffsl@programming.dev 5 points 1 month ago (3 children)

What are we doing here? This isn’t even an argument.

Correct, this isn't an argument, or at least I'm not trying to argue.
All I wanted to learn what exact properties you though makes for a better desktop OS.

I'm in agreement that NixOS isn't the best for mainstream desktop user base, but like any decent inquiry or survey, if I just preemptively bias someone's responses with my own observations on NixOS defecenties, then there wouldn't be as much of a case to before ask what they think other Linux Distro do better in the first place.

Not everyone who strikes up a convo online for a debate, and not all (but quite a few) who ask questions are trolls.

[–] ruffsl@programming.dev 12 points 1 month ago

It's a slippery slope, to be sure.

[–] ruffsl@programming.dev 7 points 1 month ago (5 children)

It doesn’t matter, because Nix isn’t built for it. That’s not it’s purpose or what it’s best at.

I was asking more about linux distros other than NixOS.

They all offer a better desktop experience because they are tuned with their packages and experience.

  • Would you say it's a front end aspect? If user driven system changes were as simple as using a Software Center UI?
  • A similar [desktop] experience sounds relative, what the comparison? Windows, MacOS, linux?
[–] ruffsl@programming.dev 3 points 1 month ago (8 children)

Not great for an uncontrolled user experience.

  • Interesting. What linux distros are optimal for that use case?
    • Specifically what properties of those distros make them ideal?
[–] ruffsl@programming.dev 4 points 1 month ago

Does anyone know of an Android app to install an additional 3rd party TTS engine that can then be configured to point to a custom Open-AI/Fast-API endpoint for self hosting higher quality voices that are not easily run/fit on mobile hardware?

[–] ruffsl@programming.dev 5 points 1 month ago

Yeah, I didn't hear much about the project over this summer.

Switched from Gnome to Plasma a little after Unity expired, as I couldn't keep up with the churn of Gnome plugins, and hoping Cosmic could balance customizability with stability. KDE has been great with adding HDR support and Wayland features, though as a Rust lang fan, I'm still curious what Cosmic will bring to the table in terms of plugin API and tooling.

[–] ruffsl@programming.dev 16 points 1 month ago

Some poignant questions for these new platform requirements:

  • How do you anticipate this being used against journalists and advocacy groups?
  • What research and statistical quantification will be done to evaluate the amount of harm these restrictions can inflict?
  • What precautions or safeguards will users have against malicious state actors or capitulating corporations?
  • How can developers protect themselves from liable damages due to service interruptions caused by third party verification?
  • Do you foresee legal restrictions in rollout due to national security concerns from differing nation states?
[–] ruffsl@programming.dev 6 points 1 month ago (2 children)

@onlinepersona@programming.dev , this could be really useful for advancing programmatic mutation of pre-existing nix config files using graphical installers and user administ ration tools, like with SnowflakeOS:

[–] ruffsl@programming.dev 3 points 1 month ago (1 children)

Wow, that sounds damning. Where can one read more on this?

view more: ‹ prev next ›