This is all very efficient to secure services, but it's also a bit opaque: since it's the daemon you sandbox, and your admin tools are outside of that sandbox it's sometimes hard to analyze how the daemon sees things.

No more. With v258 there's a new verb "unit-shell" in systemd-analyze. You specify a service name, and it opens you a shell inside that specified services' sandbox (which must be running for this). You can look around and check if everything is like you expected it to be.

@redmp meanwhile when eval-ing on the target machine, `currentSystem` would be aarch64-linux, explaining why the issue only crops up on a remote build

@redmp that's weird, it seems like it's building on the remote successfully, but then wants to build something for your admin machine's architecture (x86_64).

Do you have an `import <nixpkgs> {}` somewhere in the configuration? That would be equivalent to `import <nixpkgs> { system = builtins.currentSystem; }`, which would be x86_64-linux when you're evaluating (even if not building) on your admin machine!

@boffbowsh @gamble pi-hole itself is too, as of recently. https://search.nixos.org/options?channel=unstable&from=0&size=50&sort=relevance&type=packages&query=pi-hole

⚠️ Facebook is starting to feed its Meta AI with private, unpublished photos • The Verge

｢ Facebook users trying to post something on the Story feature have encountered pop-up messages asking if they’d like to opt into “cloud processing”, which would allow Facebook to “select media from your camera roll and upload it to our cloud on a regular basis”, to generate “ideas like collages, recaps, AI restyling or themes like birthdays or graduations.” ｣

https://www.theverge.com/meta/694685/meta-ai-camera-roll

#meta #privacy #ai

Receiving a notification about a "Go and V meetup" did make me raise an eyebrow, but the title of the talk seems to suggest it will not be an entirely uncritical look at V. Sign me up, sounds interesting.

https://www.meetup.com/vilnius-rust-go-meetup-group/events/308664111/

@LaimesKudikis suprantu, kodėl tavo atveju keista, bet man panašiai bent porą kartų skambino ir klausė ar naudoju i.APS. Kai pasakiau, kad ne, klausė kodėl (sakiau, įpratęs prie kitos sistemos, trūksta funkcijų X ir Y, t.t.). Nežinau, ar efektyviausias būdas rinkti atsiliepimus, bet faina, kad išvis renka 🙂

Man, this #vibecoding thing is starting to grow on me.

@LovesTha https://discourse.nixos.org/t/how-to-make-wg-quick-not-start-by-default/18765/2?u=justinas (the same `wantedBy` thing can be done for other VPNs or anything that is a systemd service, it's not a NixOS-specific thing).

#TIL about @fediversity;

"... a comprehensive effort to bring easy-to-use, hosted cloud services with service portability and personal freedom to everyone. We aim to provide high-quality, secure IT systems for everyday use. Without tracking, without exploitation, in a way that runs everywhere and scales effortlessly.

... based on NixOS, a disruptive Linux distribution with a unique approach to package and configuration management."

https://fediversity.eu/about-fediversity/

#Fediversity

@redmp in lieu of flakes, either: `-I nixpkgs=/path/to/nixpkgs/checkout`, or use the `--file` option, in which case instead of nixos-rebuild assuming you want to use the nixpkgs from NIX_PATH you can have explicit `pkgs = import (builtins.fetchTarball "...") {}` etc. https://github.com/NixOS/nixpkgs/pull/320462

This felt too valuable not to share. Braille-labeled maps of washrooms to help people find and use facilities in the washroom. Everyone deserves to get in, do their business, wash their hands, and get out in peace and safety.

This seems valuable for all public spaces.

#Blind #Accessibility

@katexochen interesting, I wasn't aware that pi-hole had gotten that "advanced", to the point of maintaining a fork of dnsmasq! No wonder it took some time to package it up 🙂

Riddle me this: Apple is a high-profile member of the Khronos Group. They could have influenced the design of #Vulkan in all sorts of ways. Why did #Metal become a thing then?

(I did just notice that Metal was initially released a bit before the Vulkan spec).

Here's my toot that apparently deserved this reaction, in case I'm the asshole here 🤷‍♂️ https://social.treehouse.systems/@justinas/114618741572237185

"why am I being suspended from communities I'm such a nice and rational person uwu 🥺"

@Linux the message I linked to leads with the most straightforward solution (which I'm not sure why you completely ignored), and I don't see a Discourse "edit" marker on it - although the person did make an "EDIT" (so maybe it was a "ninja edit") note with a perhaps-unfriendly comment.

I wouldn't liken a person doubting the premise of the question (with a very good reason - actually referring to the implementation which conflicts with what you're stating) to saying "your code is shit". Are you also yourself saying that your code is shit because you're asking for help with it, since it doesn't work as you expect? 🙂

I would say that "extraordinary claims require extraordinary evidence" here. If you're claiming that a program works in a wildly different way compared to:
* What the source code suggests
* What people have observed for years and years
it's on you to show it. NixOS, luckily, is a system where it should not be hard to make a self-contained, reproducible example.

I saw a similar thing in your thread about the `yes` utility, where you claimed (contrary to literally everyone else's experience) that a very well known program that has worked the same way for decades works very differently on different distros, and provided zero reproducible evidence.

It is pretty much impossible for others to prove a negative ("on no system in the world, at no point in time does this supposed bug happen"), but it should be trivially easy for you to prove a positive ("if you run this version of an OS, use this configuration, do this thing, then this happens") if you consistently encounter an issue.

@Linux https://discourse.nixos.org/t/automatic-upgrade-at-specify-time-with-independent-daily-log-and-specified-clean-up/65130/4 this is absolutely a "working tip", and ChatGPT generated you a similar solution in a longer, more roundabout way with an additional service. Which somehow "proves people wrong", I'm not sure in what way?

As people have noted, no one accused you of lying, you might have been mistaken. I know the solution suggested works, because I'm using that approach myself (as do most people who desire GC, I imagine).

@wyatt run `journalctl -u home-manager-wyatt -e` to see the full error message. It always includes the offending file AFAIK.

Yet another reason you should use Signal

If you haven’t left Telegram behind yet, time to do so.

The CEO of the company, Pavel Durov, posted the following today (archive link with full message):

This summer, Telegram users will gain access to the best AI technology on the market. Elon Musk and I have agreed to a 1-year partnership to bring xAI’s chatbot Grok to our billion+ users and integrate it across all Telegram apps

This […]

https://b.j4.lc/2025/05/28/yet-another-reason-you-should-use-signal/