!NBBFPbiuttRgTqbrcY:nixos.org

NixOS Security Discussions

365 Members
Discussions around Security | Triaging happens in #security:nixos.org127 Servers

Load older messages


SenderMessageTime
21 Oct 2024
@fabianhjr:matrix.orgFabiรกn Heredia
In reply to @emilazy:matrix.org
(do we even have a policy for how old aliases have to be to be removed?)
* If I remember correctly 1 release for throws then auto-removal.
05:55:50
@hexa:lossy.networkhexabut fabian11:16:05
@hexa:lossy.networkhexaremoving aliases without a warning is not ok!11:16:12
@hexa:lossy.networkhexahttps://github.com/nixos/nixpkgs/commit/0b6a7a953d7bc7aa453683919c7bbcadad739aa311:16:13
@hexa:lossy.networkhexahttps://github.com/nixos/nixpkgs/commit/e72450d032e3e6b28124e73400959cef4f064fd411:16:30
@hexa:lossy.networkhexa * removing aliases without a warning is not ok! \s 11:16:39
@hexa:lossy.networkhexaI'd say there is no consensus on removing them11:17:06
@hexa:lossy.networkhexaand if you tell the wrong person they'll try to revert ๐Ÿ™‚ 11:17:15
@hexa:lossy.networkhexathink of all the downstream consumers that are affected by this11:17:31
@hexa:lossy.networkhexa * think of all the downstream consumers that are affected by this ๐Ÿคท11:18:14
@sigmasquadron:matrix.orgSigmaSquadronthe determinate systems community will never recover from this11:22:09
@emilazy:matrix.orgemilyso the idea is that we have to go alias โ†’ alias with warning โ†’ throw โ†’ removal?11:22:30
@emilazy:matrix.orgemily seems like that would make aliases.nix the most stable interface in the repository 11:22:42
@emilazy:matrix.orgemilyI can't imagine any reason to attach dates other than to remove later though11:23:10
@emilazy:matrix.orgemily seems to me like allowAliases is the warning 11:23:36
@hexa:lossy.networkhexaaliases should warn immediately imo ๐Ÿ˜›11:23:38
@hexa:lossy.networkhexayeah, kinda11:23:42
@hexa:lossy.networkhexabut I think people want eval traces11:23:51
@emilazy:matrix.orgemily til remove-old-aliases.py 11:24:14
@emilazy:matrix.orgemilyI feel like the fact that that script exists and that it was in the release process notes indicates a consensus that extends beyond one person's objections.11:24:47
@emilazy:matrix.orgemily
In reply to @hexa:lossy.network
aliases should warn immediately imo ๐Ÿ˜›
(is there any reason we don't do that other than nobody made the infrastructure for it? seems like it would be a "simple" mapAttrs)
11:27:38
@hexa:lossy.networkhexafeel free to give it a shot11:27:59
@sandro:supersandro.deSandro ๐Ÿง * Debians poor depreciation processes hitting again 12:10:48
@sandro:supersandro.deSandro ๐Ÿง
In reply to @hexa:lossy.network
says distro who has an ever growing aliases file, no proper deprecation cycle and other failings
Those things are minor compared to Debian and you don't notice mid upgrade in an unstable state that some package is now missing.
12:12:12
@sandro:supersandro.deSandro ๐Ÿง
In reply to @emilazy:matrix.org
so the idea is that we have to go alias โ†’ alias with warning โ†’ throw โ†’ removal?
alias and alias with warning are the same thing, aren't they?
12:14:13
@sandro:supersandro.deSandro ๐Ÿงand between the other steps I think we had something like one release cycle12:14:24
@qyliss:fairydust.spaceAlyssa Rossno warning means nobody gets a chance to notice12:15:16
@emilazy:matrix.orgemily
In reply to @sandro:supersandro.de
alias and alias with warning are the same thing, aren't they?
howso?
12:15:18
@emilazy:matrix.orgemily
In reply to @qyliss:fairydust.space
no warning means nobody gets a chance to notice
I think allowAliases = false is meant to serve the purpose of giving notice to those it matters for
12:16:18
@emilazy:matrix.orgemily(though whether it is effective at that, idk)12:16:23

Show newer messages


Back to Room ListRoom Version: 9