Conversation

Notices

1. hexa- (hexa@chaos.social)'s status on Sunday, 16-Feb-2025 06:15:42 JST hexa-

   If you're using #devenv for your projects, please note that the new `generate` command in 1.4.0 uses your repository content.

   It tars up all files it can find through `git ls-files -z`³ and exfiltrates them to the service.

   It handles `DO_NOT_TRACK=`¹ by sending that intent along² as a query string, so now you need to trust the service to not keep data.

   🧵 1/n

   [1] https://github.com/cachix/devenv/blob/6c987a8795eedea872afe4d1c1ac518d0c7f6db1/devenv/src/cli.rs#L202-L204
   [2] https://github.com/cachix/devenv/blob/6c987a8795eedea872afe4d1c1ac518d0c7f6db1/devenv/src/devenv.rs#L212-L214
   [3] https://github.com/cachix/devenv/blob/6c987a8795eedea872afe4d1c1ac518d0c7f6db1/devenv/src/devenv.rs#L226-L257

   • Alexander Sosedkin (monk@social.unboiled.info)'s status on Sunday, 16-Feb-2025 06:15:34 JST Alexander Sosedkin

     in reply to
     @hexa "warning" doesn't do it justice. the only adequate next steps are commit privilege revocation and marking the package insecure
   • hexa- (hexa@chaos.social)'s status on Sunday, 16-Feb-2025 06:15:41 JST hexa-

     in reply to

     • ck

     The #devenv CLI does rely on informed consent and neither `devenv.sh` nor `devenv.new` have a privacy policy or will tell you who runs the service and who it shares its data with.

     In #nixpkgs the package was bumped to 1.4.0 after which @ck immediately sent a follow-up PR¹ to enable `DO_NOT_TRACK=1` when wrapping the devenv binary.

     This was promptly reverted² by the author of devenv.

     🧵2/n

     [1] https://github.com/NixOS/nixpkgs/pull/381817
     [2] https://github.com/NixOS/nixpkgs/pull/381981

     NH4ClO4 φ :nixos: :linux: repeated this.