Gotta say, I’m half keen to try DutchOS.
What’s so special with nixos?
Nixos is quite a bit different than other Linux distributions. It is a declarative system, as far as I understand (I am by no means an expert, I have never used it), there is basically one config file where you put in what you want to have installed on the system and how it is configured. The system then will figure out how to reach that declared state.
I imagine this is quite fitting for centrally orchestrated systems in an Organisation.
I am somewhat doubtful that this is a good approach security wise. Such a system also means that you have a huge monoculture fleet that can be compromised in the exact same way.
I think declarative systems make a lot of sense when you run a farm of virtual servers that you often spin up and decomission again, or when you are doing research and want your setup to be replicable by other research groups.
But a fleet of government PCs benefit very little from NixOS (or guix), while increasing the risk of catastrophic failure due to monoculture.
More generalized recovery features like A/B booting of immutable system images, and/or automatic snapshot for easy rollback to a functional state seem like the better idea technology wise.
Centralized configuration is not the same thing as monolithic configuration. The entire field of configuration management and deployment is quite mature at this point.
Also, what do you think the current Windows infrastructure looks like?
And what do you think gets owned by ransomware gangs all the time?
Badly designed configuration servers that are overly centralized without any regional firewalling or rate limiting?
Also way to ignore my question about the current infrastructure situation.
Not sure about the Netherlands but from what I’ve observed in other European countries, it seems that governments like to just give everyone (of course with some exceptions for military and a couple other divisions) the same hp laptop with the same corporate windows 11 installation. In such a setup I’m not sure that the nixOS approach is that much worse.
I am somewhat doubtful that this is a good approach security wise. Such a system also means that you have a huge monoculture fleet that can be compromised in the exact same way.
You could still decide to provision your systems with different browsers, webserveres, whatever even within nixos.
It has reproducible declarative configuration management out of the box, atomic upgrades, and immutability. This makes it easy to deploy and operate a large fleet with similar but potentially specialised configurations, and it makes it much easier to both prevent and recover from several classes of cyber attacks.
reproducible declarative configuration management
Makes me curious to try out. Is it hard to learn?
it takes a bit to “get it” but once you do…man you’ll never use another distro again. The thing with NixOS is that it “makes the hard things easy, and the easy things hard”. System configuration, kernel configs, hardware configs, etc are an absolute breeze on NixOS but something more simple can be a bit of a struggle.
You can configure your system however you want. just want to use the one configuration.nix file? go for it. want to cut up your system into individual easy to manage modules that are turned off and on via a nix flake? have at it. there’s really no wrong or right way to configure your NixOS build so you can really get your entire system to be specific to you personally.
Add to the fact you can git repo your entire configuration. So say you want to take your current build and slap it on another machine then it’s a cakewalk. in 15min or so you can replicate, entirely, your system configuration from one computer to another. that includes terminal, window manager, whatever configs. just git clone your nixos configuration, rebuild on the new machine, and you’re off to the races.
If you do any kind of development work then NixOS makes that a breeze also. you can flake your project directories so packages, libraries, etc are specific to that project. Therefore the whole “well it works on my machine” never applies ever again because your project will now work on ALL machines that have Nix. you can also use things without needing to install them via nix-shells. So say you do web development and want to test something on various browsers without having to install said browsers. that’s easy.
nix-shell -p firefoxwill download a firefox build to your system and open it. you can then use it just like you would if it was actually installed. Once you exit the terminal it goes away and off your system. So you can try out programs, packages, whatever without having to commit to them. to make it easier I use a tool called “comma” where all I have to do in the terminal is something like " , fastfetch" and it will launch fastfetch. it’s not actually installed on my system though. I do the same for btop or anything I might use every once in awhile but not often.another thing I love about NixOS is because it’s declarative you know EXACTLY what is on your system because YOU put it there. so it’s not like other distros where you can install a bunch of stuff and then lose track of it thus cluttering up your system. you don’t get that in NixOS because you see everything that’s installed within your nix config.
Finally Nix Generations are a life saver. Everytime you rebuild it saves a previous version of your build. So say you configure something or install a package or whatever and it breaks your system it’s no big deal at all. just go back to a previous generation and you’re back to a working system where you can just remove whatever it is that broke it. You can also pin applications to whatever version you want. So say you have something that worked but an update broke it it’s not a big deal, you can just pin that app to a working version. For example I use QBZ which is a gui player for Quboz. recently the maintainer decided to stop updating it. no big deal I’ve pinned it to the last working version so I can still use it and it will persist after updates.
It REALLY is a great distro. takes a bit to wrap your head around it but once you do you honestly won’t use anything else again.
Yes, it is hard
Not sure, but the leadership had some issues. I’d recommend Lix instead, but that might be personal taste.
Harder to mess up the system unintentionally
They seem to be using a special package manager, where software seems to be distributed in a similar way to that of Flatpaks.
