| 1 Sep 2022 |
 Wanja Hentze | having it in nixpkgs could even lead to the incorrect conclusion that not updating saves you from a CVE (when in fact the software was always vulnerable, but the CVE wasn't recorded in nixpkgs yet) | 13:14:29 |
| Wanja Hentze | (there are package updates that introduce new vulns, yes. but that is not what I'm talking about) | 13:15:22 |
 Sandro 🐧 | In reply to @j-k:matrix.org
well I don't mean NVD alone, I mean an actual vuln scanner like trivy or grype that aggregate many vuln lists and can update completely separate from nixpkgs, fundamentally vuln details don't play nice with declarative config.
Fundamentally an old commit is going to be affected by vulns but we're not going to go to every single branch or change history to add vuln details We only need to care about master and the current stable branch | 13:17:29 |
| Sandro 🐧 | Isn't knowVurnabilities only added if there is no known fix or patch? | 13:19:10 |
 vcunat | In reply to @sandro:supersandro.de
https://github.com/NixOS/nixpkgs/pull/189261 I can't say I like it as-is. By default people wouldn't "notice" that they're using an insecure package. | 13:38:01 |
| Sandro 🐧 | the current situation is even worse because people usually don't know that packages have vurnabilties because everyone is very hesitant to add them | 13:40:57 |
 hexa | marked as draft | 13:41:42 |
| vcunat | We'll first need to figure out some desired UX. | 13:42:52 |
| hexa | https://github.com/NixOS/rfcs/pull/127 is probably touching some parts of this | 13:42:58 |
| hexa | because as far as I understand it the issue is about knownVulnerabilities and the way the user gets presented with it | 13:44:28 |
| hexa | * because as far as I understand it the issue is about knownVulnerabilities and the way the user presentation | 13:44:49 |
| hexa | https://github.com/NixOS/nixpkgs/pull/177272 also has a system to ignore and filter warnings | 13:45:48 |
 j-k | tangentially relevant
https://discourse.nixos.org/t/packages-marked-as-broken-should-come-with-an-explanation/19187 | 13:48:57 |
| Sandro 🐧 | I don't have the time to do a shity RFC | 13:49:23 |
| vcunat | I agree it's a bit unclear whether to even have this information in-tree, but doing it differently would be probably a very large change. | 13:49:55 |
| Sandro 🐧 | In reply to @hexa:lossy.network
https://github.com/NixOS/rfcs/pull/127 is probably touching some parts of this probably goes into a similar direction | 13:51:55 |
| Sandro 🐧 | * I don't have the time to do a ~~shity~~ seemingly never ending bikeshedding RFC | 13:55:10 |
| Sandro 🐧 | * I don't have the time to do a ~shity~ seemingly never ending bikeshedding RFC | 13:55:16 |
| Sandro 🐧 | * I don't have the time to do a shity seemingly never ending bikeshedding RFC | 13:56:02 |
| Sandro 🐧 | In reply to @vcunat:matrix.org
I agree it's a bit unclear whether to even have this information in-tree, but doing it differently would be probably a very large change. we would need to replace the entire current system with some kind of stateful data source from the web | 13:56:46 |
| Sandro 🐧 | could be very similar to the current command-not-found database which has no real support in nix-index | 13:57:14 |
| Sandro 🐧 | well, you can download the old one from the channel or use nix-index which overloads the network when creating the database. | 13:57:44 |
| hexa | In reply to @sandro:supersandro.de
probably goes into a similar direction then feel free to voice your concerns on the rfc | 14:41:15 |
| hexa | there will be a shepherd meeting around the 9th | 14:41:32 |
| Sandro 🐧 | I am more concerned that the RFC did not move for ~2-3 months depending how you count and proposed and immediate solution to a problem I saw. | 14:59:10 |
| 2 Sep 2022 |
|  problems changed their display name from ash (it/its) 🏳️⚧️ to problems. | 14:08:42 |
| 3 Sep 2022 |
 @v0id:nltrix.net | https://www.thetechoutlook.com/news/current-affairs/peter-eckersley-the-founder-of-lets-encrypt-has-left-the-tech-industry-in-tears/ | 17:23:31 |
| vcunat | Uh, from the title I wondered why he's crying. | 17:31:20 |
 K900 | Yeah, probably should have said "The passing of Peter Eckersley" | 17:36:39 |
| K900 | Fuck cancer, man | 17:38:44 |
