This isn’t at all what people are annoyed about. I’m legitimately not sure whether you’re deliberately missing the point or just missing the point here, so to give you the benefit of the doubt, here’s a rundown:
- You work for a for-profit company which has a giant dependency on the Nix/NixOS communities. Let’s be real: without a community project like nixpkgs none of what DetSys provide has any value to anyone. That’s true of basically every other for-profit company building on top of Nix (Cachix, Flox, etc.) - without the ecosystem and the thousands of unpaid contributors you might as well close down.
- The community heavily depends on c.n.o/h.n.o. They’re existential risks to the project, it’s basically infeasible for most individual users to use nixpkgs without them (due to the cost of builds). Transitively, if c.n.o/h.n.o weren’t there, you’d lose enough of the community that it would stop operating, and see point 1 for what that means for your company.
- c.n.o and h.n.o are expensive to run, they are core to the existence of several for-profit companies (see points above), but those companies don’t give back anywhere close to what they’re receiving for it. It’s held together by (fragile) sponsorships from companies outside of the ecosystem (e.g. Amazon) and (generous but insufficient) donations made largely by individuals. That’s also true of nixpkgs and other load-bearing community pieces that y’all don’t pay for, but it’s especially painful and noticeable for c.n.o/h.n.o where there’s a clear $ amount to pay.
- Not only is DetSys in this case not contributing what it should probably be fairly contributing, you’re now explicitly telling people that distrusting the community’s work is a best practice, and serious people should instead pay you for storage and cache management. Meanwhile, the value-add of DetSys only makes sense in a world where the nixpkgs community exists and is healthy, and that’s deeply tied to c.n.o/h.n.o being healthy and usable/trustworthy. It feels completely hypocritical.
Now for technical points, because I happen to have worked on supply-chain security - both in the FAANG world and in the open source world. Your suggestion to replace c.n.o by FlakeHub is puzzling because the logic does not hold. FlakeHub can replace c.n.o’s S3 storage, yes. It does not replace h.n.o. But c.n.o is not a trusted component in the NixOS infrastructure - everything on c.n.o is signed ahead of time and verified after downloads. DetSys does not provide a viable alternative to h.n.o. FlakeHub is a glorified managed S3 bucket, not a build infrastructure. As far as I know, DetSys’s attempts at a hosted private Hydra service never went anywhere. Which means your whole argument is a non-sequitur: the alternative you’re proposing as a “best practice” isn’t “replace c.n.o with FlakeHub”, it’s “replace c.n.o with FlakeHub and make up your own replacement for h.n.o, you’re on your own lol” and hope that the replacement is in fact better and more trustworthy than h.n.o? How do you even begin to compare trust levels between h.n.o and something that doesn’t exist?
And this falls even more on its face when you consider that a chain of trust is only as fragile as its weakest link, and by far the weakest link for nixpkgs is not h.n.o, it’s the process of submitting changes to nixpkgs itself. With the limited time that NixOS security minded people have to spend on improving the chain of trust for the package set and the distro (because yes, there are people who care about this), improving the trust for h.n.o barely registers. It still gets discussed because nerds love easy theoretical problems more than realistic human problems like “how do we design a contribution review process that doesn’t let people backdoor stuff”, but I’ll reiterate - de-trusting h.n.o does barely anything for companies relying on nixpkgs (and de-trusting c.n.o by using FlakeHub does precisely nothing).
Hopefully now it’s clearer how your actions and your employer’s actions could be viewed as insulting from a community standpoint? And to be quite honest, from a technical standpoint I’m not even sure if feeling insulted would be the right response, it’s almost more puzzling how out of touch / off the mark your recommendations are. It’s a lack of understanding of supply chain security that I wouldn’t expect to show advertised on a corporate blog.
PS: running a second mirror of h.n.o operated by an independent party is also something that DetSys could completely just, like, do. It’s like a few $K/month to run a copy of h.n.o and verify all the hashes so you can guarantee that h.n.o is not compromised. It’s not even hard! Anyone with a few $K/month could do it.