HN user
Old comments might not represent my views anymore.
I get what you're saying but implying someone who doesn't use the cloud is not a "normal person" and lives in a basement is needlessly condescending.
Not an average or "normal" computer user? Granted. Not a normal person? No.
Now we can place bets on personal blogs!
$50 that xeiaso.net will overtake justine.lol this year. (Kidding of course, they're two of my favorite sites.)
Of course, the software that goes onto a NixOS installation is the same as on most other Linux distros so it's not any different in that regard. What I was trying to say is the config management aspect - especially when used with an ephemeral root FS - provides an entirely different way of managing your computer that's not really possible to replicate anywhere else (except Guix as I've mentioned).
Not that that makes it objectively better or worse. The config shtick of NixOS can also be really annoying to someone who just wants to install stuff and move on. It comes down to personal preference.
Sorry to be that person but: As someone who's been using NixOS as their daily driver for about three years (after switching to it from Debian) and is currently trying out a MacBook I can tell you that NixOS provides a very different experience than everything else you've mentioned (including macOS). The only other OS I'm aware of that it's comparable to is Guix System which is distantly related to NixOS.
NixOS in its unofficial "endgame" is more like a container where you can strictly define what files to keep between reboots and everything else gets thrown away. Except unlike a container it covers your entire filesystem (not just a single application) and it's actually usable for things like a laptop since you don't have to reboot between making changes. There's a popular blog post titled "Erase your darlings" that explains it in more detail[1]. And, like with a container image (but different in how it's done), NixOS forces you to write any and all changes to your system's programs or config as code that can be introspected and delivers repeatable results.
This is definitely not to everyone's taste but for me this is now the only way to keep computers "clean" in the long term (sans specialized distros like Talos Linux). I can just look at the source code to know exactly what I'm running and I can delete stuff I no longer want without having to think about leftover files or anything like that. Backups also get a lot simpler when you only have to think about the persistent volume of your system and your config and full restores are just a matter of reinstalling with your config in place.
macOS is gorgeous and I love how everything just works pretty much (except defining global keyboard shortcuts). But I've been so spoiled by NixOS catering to my config management obsession that everything else feels kind of primitive in that regard. My dream would be the macOS userland and kernel on top of Apple hardware but built and assembled with the Nix module system. And then some APFS magic to make an ephemeral root filesystem work.
(Also yes I've tried nix-darwin. Love it and I'm infinitely grateful it exists because I'm also using a MacBook at work but it's not the same kind of "complete" experience that NixOS provides.)
If you're looking for something different in AAA shooters, try Splatoon. It's basically the antithesis to classic shooter tropes and it has a whole world of art designed around it (with fictional bands, promotional art for in-game events, etc.)
Welp, I guess HN has answered. On my front page it says:
6. Ask HN: Imagine a world with 1Tb/s internet. What would change?
7. OpenSSH Backdoors (isosceles.com)
To clarify maybe, NixOS puts all configuration and program files it handles in a world-readable object store on disk. If you want to manage secrets on NixOS securely, you have two choices:
- Manage it out of band. That negates all of the benefits of NixOS, at least for those files. (I.e. you would need additional deployment steps, rollback wouldn't work, you would have to stop and migrate system services that depend on those secrets yourself, etc.)
- Encrypt it and only decrypt it on activation (which happens when switching to a new config or on boot). agenix and nix-sops (the premier SOPS/NixOS integration) are two libraries that you can include in your config to do that. With this, the world-readable store only contains encrypted secrets.
Of course with #2 you still have to manage your private keys (age or whatever SOPS uses) out-of-band but that is significantly less work since those aren't expected to change nearly as much. You can also generally decouple that from your day-to-day deployment workflow.
Isn't screen reader support implemented using AT-SPI over D-Bus? So I would expect it to be independent of the window system.
On https://www.freedesktop.org/wiki/Accessibility/AT-SPI2/ it even says:
Wayland
Works just the same :D
Apart from that while it's true that the compositor has to do everything, some of the interfaces seem to be shared (standardized? I don't know enough about Wayland development tbh) across different compositors: https://wayland.app/protocols/
Two sides of the enterprise coin.
It can do them but maybe only once.
Hopefully no one asks where the bathroom is.
What I like about Go is not the language itself (I'm not a language designer but I dislike a lot of choices that Go makes) but the entire culture around it of doing things the idiomatic way and moving on. I'm someone who, if you give them a tool that's flexible, will spend time optimizing it. And I'm already busy optimizing other stuff so it's nice to have something constant to build upon.
Oh and you don't have to use large power-hungry IDEs that don't integrate with any sort of config management to get a decent experience! (/hj)
If I ever learn Haskell it's over for y'all though.
(Agree with OP btw, using codegen to get the enums I want is a workable remedy for Go's lack of enums.)
I think parent was pointing out that you need Linux to run Docker (since it doesn't run natively on any other OS) which is different from what Cosmopolitan provides.
Edit: Ok, apparently it natively supports Windows for Windows containers and for everything else there's a Hyper-V integration. Not sure if you can write a portable Dockerfile script like that though.
My first thought was "How does it handle untrusted input?" and they have a page dedicated to it: https://rkyv.org/validation.html
But the phrasing on that page does not exactly inspire confidence ("...good defaults that will work for most archived types...", "...it's not possible or feasible to ensure data integrity with these use cases..."). Is this actually usable for untrusted data or is it mostly used in scenarios where you already know the data is fine?
Yeah, my employer does that. We call it "infrastructure". /s
I was thinking of the case where your server has to send out bounce mail but I guess if it's configured right, it should also just relay that.
How does that work exactly? Do you set up your server as higher priority MX and the external provider as backup and then configure your server to relay outbound mail through that other service? And all your server has to have is a valid certificate while DKIM/RDNS/SPF get handled by the external service?
Is there anything to watch out for (e.g. w.r.t. bounce mail) in this setup?
Edit: Maybe you don't even have to set up an MX record for the external provider (unless you want to use it as a fallback for incoming mail).
Occasionally I've seen people fail and add the pixel as an attachment instead.
Flakes will hopefully be that soon but I wouldn't recommend starting with flakes when learning Nix in 2023. They're experimental and you still need to learn most of flake-less Nix (except channels and NIX_PATH) anyways.
When I started learning/using NixOS about two years ago I found it useful to start out with just Nixpkgs (i.e. what you get out of the box) and only add libraries when I felt they would help me. My first configs where ugly as hell and full of bad practice but the cool thing about Nix is that it gives you a lot of safety nets to enable experimentation and refactoring.
Given that the repo says "Just some little toys." in the description[1], I don't think this is made to be used in production.
Otherwise it would be an interesting idea but also more or less what Lombok is for Java.
When I write tooling for myself in Go, I usually wrap all of my errors with stacktraces since I hate having to grep for a string that may be interpolated or duplicated throughout the codebase.
Addendum: It is still a good thing to be able to add context to the error message though, so I think you've got a point.
Browsing the site on Tor Browser gave me a Google 403 page until I cycled circuits a few times. Makes perfect sense given the blog is hosted on GCP but it did make me pause initially and consider if that was some sort of joke I'm not getting.
If tri-state logic becomes viable it's game over for binary!
That's neat but doesn't `case` support fallthrough? So I expect you could just put your script in one big `case` statement and skip to the branch you need.
The big difference then vs. now is that with CAPTCHAs you can (generally) choose to complete them from a wider range of browsers and devices that have no corporate approval (unless it's that one Cloudflare CAPTCHA that gets stuck in an infinite loop). So even if it's painful, you can still access most websites. With attestation you don't have that choice.
That's neat! There really is a XEP for everything, huh.
Does XMPP do calls?
Generally agree but I don't think Secure Boot falls in this category unless the keys are locked in firmware (and in that case the firmware is the problem). Root passwords aren't evil either just because they can be withdrawn from the user.
Why would fragmentation imply you can't have a GUI? You would just pick one toolkit and depend on it being there (unless you statically link it). Setting it up correctly is then the job of the user or distributors.
Doesn't that still leave YouTube with one unique IP address that all your traffic is originating from? It would in any case close off some tracking vectors if you also use other Google products from your home IP address but I guess you would also need a proxy/VPN or share the instance to get any kind of anonymity.