Lingolol

0 posts0 participants0 posts today

flashfoxI though it had been a while without any <a href="https://infosec.exchange/tags/NixOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NixOS</a> drama, but of course the universe provides.Guess what, telemetry in <a href="https://infosec.exchange/tags/devenv" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#devenv</a> is coming back. Again, it's Opt-Out, not Opt-In. The difference: this time that work is sponsored by the NixOS Foundation.<a href="https://github.com/cachix/devenv/pull/1776/files" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/cachix/devenv/pull/1776/files</a><a href="https://oceansprint.org/reports/2025/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://oceansprint.org/reports/2025/</a><a href="https://infosec.exchange/tags/nix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nix</a> <a href="https://infosec.exchange/tags/nixpkgs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nixpkgs</a>Brought to you by <a href="https://fosstodon.org/@domenkozar" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@domenkozar</a> of course.

hansenerdIf I ever recommended devenv to you: I'm sorry! The new version (1.4) has <a href="https://github.com/cachix/devenv/blob/6c987a8795eedea872afe4d1c1ac518d0c7f6db1/devenv/src/devenv.rs#L226-L257" rel="nofollow noopener noreferrer" target="_blank">a function which will silently upload your entire repo you call it on to their servers</a> to do whatever with it – they call it telemetry, not exfiltration. If you're on nixos stable you didn't get 1.4 yet, so you can fix your machine before it gets impacted.My new recommendation is to uninstall devenv, delete your devenv configs, use anything else. They are saying they will roll that change back, but the tool is burned, there's no recovering from this.<a href="https://shoddy.site/tags/devenv" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#devenv</a> <a href="https://shoddy.site/tags/devenvsh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#devenvsh</a>

hexa-The <a href="https://chaos.social/tags/devenv" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#devenv</a> CLI does not do informed consent and neither `devenv.sh` nor `devenv.new` have a privacy policy or will tell you who runs the service and who it shares its data with.In <a href="https://chaos.social/tags/nixpkgs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nixpkgs</a> the package was bumped to 1.4.0 after which a contributor immediately sent a follow-up PR¹ to enable `DO_NOT_TRACK=1` when wrapping the devenv binary.This was promptly reverted² by the author of devenv.🧵2/n[1] <a href="https://github.com/NixOS/nixpkgs/pull/381817" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/NixOS/nixpkgs/pull/381817</a> [2] <a href="https://github.com/NixOS/nixpkgs/pull/381981" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/NixOS/nixpkgs/pull/381981</a>

hexa-If you're using <a href="https://chaos.social/tags/devenv" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#devenv</a> for your projects, please note that the new `generate` command in 1.4.0 uses your repository content.It tars up all files it can find through `git ls-files -z`³ and exfiltrates them to the service.It handles `DO_NOT_TRACK=`¹ by sending that intent along² as a query string, so now you need to trust the service to not keep data.🧵 1/n[1] <a href="https://github.com/cachix/devenv/blob/6c987a8795eedea872afe4d1c1ac518d0c7f6db1/devenv/src/cli.rs#L202-L204" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/cachix/devenv/blob/6c987a8795eedea872afe4d1c1ac518d0c7f6db1/devenv/src/cli.rs#L202-L204</a> [2] <a href="https://github.com/cachix/devenv/blob/6c987a8795eedea872afe4d1c1ac518d0c7f6db1/devenv/src/devenv.rs#L212-L214" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/cachix/devenv/blob/6c987a8795eedea872afe4d1c1ac518d0c7f6db1/devenv/src/devenv.rs#L212-L214</a> [3] <a href="https://github.com/cachix/devenv/blob/6c987a8795eedea872afe4d1c1ac518d0c7f6db1/devenv/src/devenv.rs#L226-L257" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/cachix/devenv/blob/6c987a8795eedea872afe4d1c1ac518d0c7f6db1/devenv/src/devenv.rs#L226-L257</a>

flashfox<a href="https://functional.cafe/@roberth" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@roberth</a> <a href="https://infosec.exchange/@oliverwiegers" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@oliverwiegers</a> <a href="https://hachyderm.io/@jfredett" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@jfredett</a> <a href="https://catgirl.farm/users/cafkafk" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@cafkafk</a> So looks like the <a href="https://infosec.exchange/tags/devenv" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#devenv</a> opt-out is not as out as you might have though...<a href="https://discourse.nixos.org/t/should-commercial-actors-ship-telemetry-in-nixpkgs/60279/42" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://discourse.nixos.org/t/should-commercial-actors-ship-telemetry-in-nixpkgs/60279/42</a>Is it to early to call <a href="https://infosec.exchange/tags/devenv" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#devenv</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> ?<a href="https://infosec.exchange/tags/nix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nix</a> <a href="https://infosec.exchange/tags/nixos" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nixos</a>

flashfox<a href="https://hachyderm.io/@jfredett" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@jfredett</a> <a href="https://infosec.exchange/@oliverwiegers" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@oliverwiegers</a> .... and reverted by the author, who apparently has commit rights and does not seem to agree with community PR workflow.So we now have commercial actors in <a href="https://infosec.exchange/tags/nixpkgs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nixpkgs</a> who can just push their own commercial agenda be decree.<a href="https://infosec.exchange/tags/nix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nix</a> <a href="https://infosec.exchange/tags/nixos" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nixos</a> <a href="https://infosec.exchange/tags/devenv" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#devenv</a>

flashfox<a href="https://hachyderm.io/@jfredett" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@jfredett</a> <a href="https://infosec.exchange/@oliverwiegers" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@oliverwiegers</a> At least in <a href="https://infosec.exchange/tags/nixpkgs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nixpkgs</a> the telemetry seems to be of by default now<a href="https://github.com/NixOS/nixpkgs/pull/381817" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/NixOS/nixpkgs/pull/381817</a><a href="https://infosec.exchange/tags/nix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nix</a> <a href="https://infosec.exchange/tags/nixos" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nixos</a> <a href="https://infosec.exchange/tags/devenv" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#devenv</a>

flashfox<a href="https://infosec.exchange/tags/devenv" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#devenv</a> now collects "anonymous" data to train their "AI" <a href="https://devenv.sh/blog/2025/02/13/devenv-14-generating-nix-developer-environments-using-ai/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://devenv.sh/blog/2025/02/13/devenv-14-generating-nix-developer-environments-using-ai/</a><a href="https://infosec.exchange/tags/nix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nix</a> <a href="https://infosec.exchange/tags/nixos" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nixos</a>

Maikel 🇪🇺 🇪🇸6. To shut down postgresql with nix-shell i just have to leave the environment, so the trap works. Less steps = Maikel happy. So here is the result (bottom link), I'm disposing of devenv.nix and devenv.yaml on my current project and sticking to nix-shell. And please don't be another reply guy and ocme up with .direnv YET for THOUSAND time again. I already know about it and I'm not interested (nor about Flakes). I'm not paid to fine-tune my Nixos setup FFS nor am I interested in going deeper into nix. <a href="https://gist.github.com/maikelthedev/08c3010a0b1e3137194c814033e697e4" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://gist.github.com/maikelthedev/08c3010a0b1e3137194c814033e697e4</a>2/2<a href="https://vmst.io/tags/elixir" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#elixir</a> <a href="https://vmst.io/tags/nixos" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nixos</a> <a href="https://vmst.io/tags/devenv" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#devenv</a> <a href="https://vmst.io/tags/nixos" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nixos</a>

Maikel 🇪🇺 🇪🇸I'm settlin nix-shell and not devenv.sh, why?1. While devenv produces somehow cleaner code it just doesn't fucking work.2. With devenv to reach fish 1. devenv up -d 2. devenv shell 3. setup 4. fish3. You cannot launch fish directly from either, it breaks either the trap in nix-shell or the launch of the service in devenv.sh4. With nix-shell I just run 1. nix-shell 2. fish. and everythuing is up and running including postgresql. 5. To shut down postgresql with devenv I have to kill the process or launch it in the foreground and manually exit. That's more steps I want less. 1/2<a href="https://vmst.io/tags/nixos" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nixos</a> <a href="https://vmst.io/tags/devenv" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#devenv</a>

HoldMyType<a href="https://mathstodon.xyz/tags/nix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nix</a> folks do you cross build/compile with <a href="https://mathstodon.xyz/tags/devenv" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#devenv</a> if yes, an example d help , I ve scanned both github issues of its repo and official documentation my alternative is to let go of both devshell / devenv and just use `builtins` `foldl'`

Joshua WoodGot my first development environment (Jekyll website) running in NixOS on my Framework laptop using devenv. That makes this my first successful dev environment in nix. :) Nice work <a href="https://fosstodon.org/@domenkozar" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@domenkozar</a>!<a href="https://devenv.sh" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://devenv.sh</a><a href="https://hachyderm.io/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> <a href="https://hachyderm.io/tags/Nix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Nix</a> <a href="https://hachyderm.io/tags/NixOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NixOS</a> <a href="https://hachyderm.io/tags/devenv" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#devenv</a> <a href="https://hachyderm.io/tags/FrameworkLaptop" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FrameworkLaptop</a> <a href="https://hachyderm.io/tags/Ruby" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Ruby</a>

Mike BellAnyone using devenv.sh know how to get the default shell to zsh?<a href="https://remotelab.uk/tags/devenv" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#devenv</a> <a href="https://remotelab.uk/tags/nix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nix</a>

maralornCurrently looking at you <a href="https://chaos.social/tags/devenv" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#devenv</a> 🧐 <a href="https://devenv.sh/community/get-involved/" rel="nofollow noopener noreferrer" target="_blank">https://devenv.sh/community/get-involved/</a> <a href="https://chaos.social/tags/nix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nix</a>

Recent searches

Search options

Administered by:

Server stats:

#devenv