heya, ive been using nixos for a few months now and im planning on doing some music stuff. on the nixos.org page for audio production theres a link to GitHub - musnix/musnix: Real-time audio in NixOS · GitHub, and its been there for a few years. are there any reasons why this is not on nixpkgs? and is there any notable code reviews in regards to safety on it? im normally not really a fan of downloading from random github repos, so i figured id ask abt it here
As far as prospective targets for open source exploits go, musnix is pretty damn unattractive. It’s a leaf-node repo that’s fairly stable and slow-moving, so anything fishy is going to stand out. And linux music creators are not a super juicy target because (a) it’s a small niche and (b) wtf are you going to make away with and sell off, unreleased indie scores and phat beats?
Seriously though, you’re right to be cautious about pulling in unfamiliar projects as system dependencies. It’s a good instinct to have.
Personally, since the project is small, I would recommend first reading over the source yourself to make sure you understand what’s going on. (Yes, I’m basically saying you should do your own code review.) Then, pin the source you depend on using your favorite method like npins or flakes so it can’t change without your knowledge. Whenever you decide to upgrade to a new version, check out the diff. They seem to have roughly one non-version-bump commit every couple of months, and the diffs are small. This is the biggest commit this year. So it’s a super easy project to keep an eye on for as long as you care to.
If security is a big concern, maybe you never really need to upgrade musnix once your system perf is in a happy place. In that case you can just read it once, freeze it, and never need to trust anyone involved.
7 Likes
I agree with @miangraham and, in addition: I’d have been surprised if it was in nixpkgs, precisely because it’s difficult to test.
1 Like
musnix is a NixOS module which mostly configures other NixOS modules (it does define a few packages, but it’s mostly a convenience thing, I think). It’s a “preset” or “profile” for your system — nix-mineral does the same thing but for hardening/security.
The main module collection doesn’t really do profiles, except for these, which are almost all just to prepare a NixOS configuration for different deployment environments. This is probably because there is no “correct” or “one-size-fits-all” way of setting up your system for music production or for security (the hardened profile was removed for this reason), so these things are best left to their own projects. By contrast, if the deployment isn’t going to have a screen attached, or if it’s going to be running in a QEMU VM, then there are certain settings that are obviously useful or required for things to work.
If you’re concerned about dependencies, just go through the configuration options set by musnix and choose which ones to set manually in your own config. Or you could use musnix but then override the options you don’t want.
2 Likes
Agree that this is a good approach as well. Read it, learn it, do it yourself is pretty common with nixos-hardware too.
1 Like
hey again, sorry for not replying for so long, thanks for ur feedback! ill be reading thru the repo sometime soon and prob cherry-pick the features for my usecase
2 Likes