6 ms·

Given that they're using a HSM (actually several), there's really not much that needs protection via FDE. The certs are obviously public and the domains are in

Given that they're using a HSM (actually several), there's really not much that needs protection via FDE. The certs are obviously public and the domains are in the transparency log. On the ZFS note: it's been rock solid for me with Ubuntu but a living nightmare with Arch. My Arch update would upgrade the kernel but then OpenZFS would semi-routinely incompatible resulting in an unbootable system.

pmarreck 3y ago
I had the same issue. I went from Ubuntu -> Arch -> NixOS looking for a distro with well-supported ZFS. Finally found one (the last one). This is the magic line from my declarative configuration that ensures I never get a kernel update that is incompatible with my ZFS-on-root config: kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages; Been running it for 2 years now; quite happy with it, and this is probably my "final distro hop". Once you go declarative (and climb the learning curve), you are done with everything else I guess. Put it this way, I can switch to an entirely different window manager by changing 1 configuration line. And it works every time. I've tried that on other Linux distros, and it always borks something or other. I can also change my GRUB theme and boot animation via Plymouth, something I would have NEVER risked on ANY other Linux distro due to the risk of modifying boot configuration... but since it's declarative (and validated) on NixOS, I've had no issues (just tweaking). If I manage to bork something, which is rare, I just reboot into a previous update of my OS and fix it and then try again.
- pdntspa 3y ago
  Consider giving FreeBSD a shot, ZFS support is excellent
  - thaumaturgy 3y ago
    Yeah, FWIW my first production ZFS deploy was on FreeBSD over 10 years ago. It was rock solid (though low-demand).
    - ComputerGuru 3y ago
      I started with Solaris, moved to OpenIndiana, then to FreeBSD (the last over ten years ago). FreeBSD is hands-down the best. (I have a few Debian servers for other purposes but contemplate moving them to FreeBSD as well.)
  - sofixa 3y ago
    But everything else is not. There are so few packages released for *BSDs it's a constant game of searching, compiling dependencies, etc.
    - pdntspa 3y ago
      Not sure what apps you are running but everything I have wanted to install on it either compiled from source, compiled from ports, or has a package, without too much hassle. (Worst thing was having to type 'cmake' instead of 'make' for building llama.cpp) BSD has its issues, for sure, but on the question of ZFS support it is stellar.
  - pmarreck 3y ago
    Underrated fact: The Nix repo has the largest number of supported packages of any Linux distro (my guess is that since everything is deterministically built "from the metal" more or less, that this results in far fewer needs for support and troubleshooting)
  - pmarreck 3y ago
    I have experienced too many other benefits to NixOS (and learned enough Nix to get by along the way) to turn back now. It now seems like the only way to do Linux sanely to me. It’s perfect for tinkerers like me due to having more supported packages than any other distro, plus instant rollbacks. It would be like asking a functional programmer to go back to C. “But… I’d lose all my guarantees, and spend too much time troubleshooting crap that just would never happen in [functional language/NixOS] again… No thanks” To some things, there’s simply no turning back… and Nix is (slowly but steadily) gaining marketshare and mindshare for this reason. If the BSD’s want future relevance, they better steal some ideas from Nix quick, and get cracking with declarative immutability and deterministic builds
    - pdntspa 3y ago
      Those things are cool... but I don't need them. I suspect many of us don't. I like BSD's simplicity, consistency, and its native integration with ZFS. I don't know about deterministic builds but I suspect it does that without making a big deal, since everything can arrive via ports. Linux, as much as I love it, is a rat's nest of different ideas and the inconsistency between distributions makes me want to pull my hair out. I care less about how it does things, and more that I only have to learn one system to understand each component -- as opposed to the mess that is init.d vs systemd vs upstart or whatever. man pages are good but the FreeBSD Handbook is better.
      - pmarreck 3y ago
        > I suspect many of us don’t One thing I’ve learned after crossing the 50 year mark is that time is actually the most valuable thing we have (and, most egalitarianly, everyone starts out with more or less the same amount of it left). So while troubleshooting can be enjoyable to many, time spent troubleshooting any issue that would simply be impossible to encounter in an alternative system is expensive indeed. Consider reading this very understandable paper, which I consider at least as important as the Bitcoin paper: https://edolstra.github.io/pubs/nspfssd-lisa2004-final.pdf https://edolstra.github.io/pubs/nspfssd-lisa2004-final.pdf
- hamandcheese 3y ago
  +1 to this, ZFS with NixOS is quite manageable. One thing I'm not a fan of though is the guide on the NixOS wiki was removed and instead points to this guide in the OpenZFS docs: https://openzfs.github.io/openzfs-docs/Getting%20Started/NixOS/ https://openzfs.github.io/openzfs-docs/Getting%20Started/Nix... It does not have much in the way of rationale - I.e. they say you need minimum 1GB reserve space but don't say what reserve space is and why you need it. I recall the NixOS wiki used to explain options and trade offs in a lot more detail. Nice tip re: latestCompatibleLinuxPackage! Had not seen that anywhere yet (probably because I haven't had any issues yet).

pmarreck 3y ago

I had the same issue. I went from Ubuntu -> Arch -> NixOS looking for a distro with well-supported ZFS. Finally found one (the last one). This is the magic line from my declarative configuration that ensures I never get a kernel update that is incompatible with my ZFS-on-root config: kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages; Been running it for 2 years now; quite happy with it, and this is probably my "final distro hop". Once you go declarative (and climb the learning curve), you are done with everything else I guess. Put it this way, I can switch to an entirely different window manager by changing 1 configuration line. And it works every time. I've tried that on other Linux distros, and it always borks something or other. I can also change my GRUB theme and boot animation via Plymouth, something I would have NEVER risked on ANY other Linux distro due to the risk of modifying boot configuration... but since it's declarative (and validated) on NixOS, I've had no issues (just tweaking). If I manage to bork something, which is rare, I just reboot into a previous update of my OS and fix it and then try again.

pdntspa 3y ago
Consider giving FreeBSD a shot, ZFS support is excellent
- thaumaturgy 3y ago
  Yeah, FWIW my first production ZFS deploy was on FreeBSD over 10 years ago. It was rock solid (though low-demand).
  - ComputerGuru 3y ago
    I started with Solaris, moved to OpenIndiana, then to FreeBSD (the last over ten years ago). FreeBSD is hands-down the best. (I have a few Debian servers for other purposes but contemplate moving them to FreeBSD as well.)
- sofixa 3y ago
  But everything else is not. There are so few packages released for *BSDs it's a constant game of searching, compiling dependencies, etc.
  - pdntspa 3y ago
    Not sure what apps you are running but everything I have wanted to install on it either compiled from source, compiled from ports, or has a package, without too much hassle. (Worst thing was having to type 'cmake' instead of 'make' for building llama.cpp) BSD has its issues, for sure, but on the question of ZFS support it is stellar.
- pmarreck 3y ago
  Underrated fact: The Nix repo has the largest number of supported packages of any Linux distro (my guess is that since everything is deterministically built "from the metal" more or less, that this results in far fewer needs for support and troubleshooting)
- pmarreck 3y ago
  I have experienced too many other benefits to NixOS (and learned enough Nix to get by along the way) to turn back now. It now seems like the only way to do Linux sanely to me. It’s perfect for tinkerers like me due to having more supported packages than any other distro, plus instant rollbacks. It would be like asking a functional programmer to go back to C. “But… I’d lose all my guarantees, and spend too much time troubleshooting crap that just would never happen in [functional language/NixOS] again… No thanks” To some things, there’s simply no turning back… and Nix is (slowly but steadily) gaining marketshare and mindshare for this reason. If the BSD’s want future relevance, they better steal some ideas from Nix quick, and get cracking with declarative immutability and deterministic builds
  - pdntspa 3y ago
    Those things are cool... but I don't need them. I suspect many of us don't. I like BSD's simplicity, consistency, and its native integration with ZFS. I don't know about deterministic builds but I suspect it does that without making a big deal, since everything can arrive via ports. Linux, as much as I love it, is a rat's nest of different ideas and the inconsistency between distributions makes me want to pull my hair out. I care less about how it does things, and more that I only have to learn one system to understand each component -- as opposed to the mess that is init.d vs systemd vs upstart or whatever. man pages are good but the FreeBSD Handbook is better.
    - pmarreck 3y ago
      > I suspect many of us don’t One thing I’ve learned after crossing the 50 year mark is that time is actually the most valuable thing we have (and, most egalitarianly, everyone starts out with more or less the same amount of it left). So while troubleshooting can be enjoyable to many, time spent troubleshooting any issue that would simply be impossible to encounter in an alternative system is expensive indeed. Consider reading this very understandable paper, which I consider at least as important as the Bitcoin paper: https://edolstra.github.io/pubs/nspfssd-lisa2004-final.pdf https://edolstra.github.io/pubs/nspfssd-lisa2004-final.pdf
hamandcheese 3y ago
+1 to this, ZFS with NixOS is quite manageable. One thing I'm not a fan of though is the guide on the NixOS wiki was removed and instead points to this guide in the OpenZFS docs: https://openzfs.github.io/openzfs-docs/Getting%20Started/NixOS/ https://openzfs.github.io/openzfs-docs/Getting%20Started/Nix... It does not have much in the way of rationale - I.e. they say you need minimum 1GB reserve space but don't say what reserve space is and why you need it. I recall the NixOS wiki used to explain options and trade offs in a lot more detail. Nice tip re: latestCompatibleLinuxPackage! Had not seen that anywhere yet (probably because I haven't had any issues yet).