If you’re trying to avoid a lot of those traps, shellcheck is pretty cool. I have written my fair share of bash and yet still get caught off-guard by its warnings - and it’s right most of the time!

Honestly this made me really sad that we’re stuck with this archaic, awful language as a primary way of programmatically interacting with our computers. And I don’t mean to say anybody has done anything wrong here - sh and bash were revolutionary and amazing for their respective times, and maintainers who are keeping bash alive now are heroes who deserve praise. However, many decisions made when sh was originally developed turned out to be footguns, still creating bugs today (despite shellcheck et al).

nushell is somewhat promising but flawed (because it has to be built on the same system interfaces as sh, after all). The most annoying is that there’s no facilities for setting any metadata on data streams (in particular there’s no way to set the format of the data) so everything has to be marshalled manually, which would be OK for a proper programming language but really annoying for a shell. At least it fixes most of the quoting, escaping, interpolation, substition etc awfulness, and allows for manipulating data in a more structured way.

I really don’t know if it’s even possible to make a language that would be a good convenient shell and at the same time not prone to bugs which are easily noticeable in other languages. I hope that something like this becomes a reality at some point.

Passing them as arguments can be even worse - depending on the configuration, process arguments of running processes can be seen by everything running on the machine.

Careful there. You are only a half dozen abstraction layers away from reinventing NixOS.

As for your question, the best way is to put it in a file that is then read by the chroot script and delete later.

There should be no updating unless enabled <…> and never nag the user.

I disagree, at that point you might as well continue using Win10. Security updates are the #1 reason to do this. Most computer use nowadays is networked (actually in a browser), and it’s super important we keep that updated.

If updating is turned on, it should be very conservative, updates hand curated by grandmasnixos, basically never uses software that hasn’t been proven rock solid for at least 6 months

Eh, this sounds like a lot of work. Probably just use the stable channels, and only manually test when switching to a new stable channel.

Rolling back any update should be one-click-trivial

Agreed, should also be very obvious (like a label on the desktop that says “Issues after update?” and gives you a button to roll back and reboot)

The desktop environment should be something occasional win10 using grandma will not get lost in

This is the main question IMHO. I’ve not used any DEs for a while, so don’t really know which one would fit this best while also being simple and robust.

I think we can be even simpler than that. Don’t ask any questions. Simply generate the hardware-configuration.nix and have a single configuration.nix that is unchanged:

• Some easy-to-use and simple DE. I’m thinking something like lxqt or xfce, maybe Pantheon - but that would be more familiar to Mac users than Windows. KDE seems way too complicated to just have it in configuration.nix without touching it, and it can sometimes break on updates.
• Chromium (with pre-installed ublock origin)
• Libreoffice
• Some flatpak store (so that people can install apps without touching configuration.nix)
• Make a simple “update” app that just pops up once in a couple weeks or so, prompts you to click a button and then runs npins update and nixos-rebuild boot, and finally annoys you until you reboot (it should also update to the next stable channel when that becomes available, and make that a big deal so that a user understands it might change some of their workflows)
• Set up the bootloader so that if a generation “fails” (some script in the autostart of the DE doesn’t set a flag somewhere) on the next boot it boots a previous generation, kinda like Android’s A/B slot system but better. I don’t think systemd-boot allows this sort of thing, but I think it’s possible with a GRUB script
• Maybe add a shortcut to open tmate and copy the URL to clipboard, so that you can send it someone in the know and they can help you troubleshoot
• Finally, use impermanence to make sure everything outside /home, /nix, and wherever flatpak are stored, is wiped on every reboot and recreated from the generation, so that “reboot it” is a viable troubleshooting strategy.

Hmm, I’ll pitch this idea to a couple of Nixy lfriends, maybe we can hack something together. Also throw a Linux install party!

I’ve not used Guix but I don’t think any distro has anything close to number of desirable available packages as arch— so be prepared for that

nixpkgs would like a word

Most consumer hardware on earth does already (Android phones). The problem is those drivers are usually proprietary bullshit that’s very difficult to integrate with anything but OEMs kernel fork & Android version. Unfortunately I don’t really foresee that changing in the near future, hopefully if Linux becomes more mainstream, Linux phones become too and then we get some progress.

And for laptops/desktops, I think the situation is pretty good already as well. Many mainstream OEMs have an option with Linux pre-installed now, and the drivers there are mostly FOSS. I’m hoping that the problematic part vendors e.g. NVidia and Broadcom step up and provide sources for their drivers - otherwise they will continue to be a buggy mess that most people hate.

Expect a steep learning curve even if you know Linux inside out. Don’t assume things work the way they did on Arch (or most other distros). If your hardware doesn’t work well, or you otherwise need some proprietary stuff, check out https://gitlab.com/nonguix/nonguix. Good luck!

The numbers suggest that 2025 could be a turning point for Linux on desktop computers

Ah yes, the year of the Linux desktop

(in all seriousness, this is looking really good, my main hope from all this is that hardware manufacturers step up their FOSS drivers game)

The ssh key to access the private git repo is on the same yubikey as the decryption key (they are technically different GPG slots but I don’t need to care about that, just plug the key in, type in the pin, and it all works automagically)

The process then still is: check out that Git repository, except there’s another step: copy over your private key so that you can decrypt your secrets.

I store my secrets in a separate private git repo and automatically decrypt them with my hardware key (https://github.com/balsoft/nixos-config/blob/master/modules/secrets.nix) so for me it’s literally just plug in my yubikey and nixos-install github:balsoft/nixos-config#hostname

I think NVK is only for newer cards though, right?

And with no real reason

The real reason is planned obsolescence. Your old GPU working is bad for NVidia because it means you’re not buying a new one from them.

How is nouveau doing for those older cards these days? Are they at least still usable as a display adapter?

The really offensive part is having >2 liters of milk, per person, in a work fridge. What the fuck do you need so much for? I bet that fridge smells like a mix of spoiled milk and utter distrust for other human beings.

It should work. The only practical issues are:

• Usually, you will have to manually install the proprietary drivers (I think Fedora makes this relatively easy)
• Wayland (the protocol most desktop environmentss use nowadays) support may be hit-and-miss at times (it will mostly work but it’s not as polished as with Intel/AMD), and Proton (the thing that lets you play Windows games) may not play well either.

The ideological issue (which you probably don’t care about) is that it pretty much requires proprietary (non-FOSS) drivers which run in kernel space and so in theory have complete access to all data on your computer (but then so does Intel ME). This is the main reason I personally will never use NVidia cards.

I’m doing Nix consulting-type jobs - it can mean anything from simply packaging some stuff for Nix and making a devShell to refactoring existing Nix-based infra (which can be hundreds of thousands of SLOC) to building entirely new developer UX, CI/CD and even production deployments on Nix/NixOS. I’ve also been paid to implement some cool features into Nix itself, fix bugs, etc. I’m really quite happy with the job, even though it could probably pay more :)

Eh, probably if Guix becomes significantly better I’ll switch to it (from NixOS). I really like how seriously they take user freedom, bootstrapping (only 357 bytes of binary to bootstrap everything else from source!) and consistent user interfaces (scheme everywhere). But unfortunately the package repo is just not big and mature enough yet, and declarative configuration options are not as good as they are with NixOS. My job is also Nix-related, and that’s another major reason I’m staying for now.