xcmw has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
xcmw has joined #nix-darwin
xcmw has quit [Quit: Textual IRC Client: www.textualapp.com]
pat_h has joined #nix-darwin
pat_h has quit [Quit: Connection closed]
cbarrett has quit [Ping timeout: 252 seconds]
cbarrett has joined #nix-darwin
__monty__ has joined #nix-darwin
mog has quit [Ping timeout: 246 seconds]
mog has joined #nix-darwin
plumm has quit [Ping timeout: 256 seconds]
philr has quit [Ping timeout: 272 seconds]
mog has quit [Ping timeout: 265 seconds]
mog has joined #nix-darwin
pat_h has joined #nix-darwin
pat_h has quit [Client Quit]
xcmw has joined #nix-darwin
<abathur> LnL: is there anything else I need to button up on the PR?
<LnL> gchristensen: ^ did you get any new information?
<gchristensen> I heard fairly consistent feedback that big companies had rules against datasets without filevault
<gchristensen> I think it is okay to make this informational and do it anyway
<gchristensen> if someone needs it that bad, they can send a PR
<LnL> yeah, the warning is there now
<gchristensen> cool
<gchristensen> I think it isn't wonderful, and maybe we'll do something different next release
<gchristensen> but let's do this for now
<LnL> only question for me is if we should keep unencrypted in the flag, it's a bit overly pessimistic but does set better expectations for the company case
<gchristensen> maybe something like without-filevault ?
<gchristensen> more specific, and it still does not install if there is no t2, right?
<LnL> yeah the conditons are good, just the name I'm not sure about
<gchristensen> yeah
<gchristensen> yeah so it isn't that it is completely unencrypted, it just doesn't have filevault
<gchristensen> (weakly held opinion)
<LnL> abathur: you got any thoughts on this?
<gchristensen> my strongly held opinion is we shouldn't scare users unnecessarily, and we shouldn't pretend like things are totally fine and let users easily poke their eye out. there is a ton of room in there :P
<abathur> nod
<abathur> not really sure, it is a bit of a lie, but my ideal case is, you know, that they have to have the implications cross through their brain as they type it out
<gchristensen> which is the lie?
<abathur> rather than being able to, justifiably or not, say they didn't know what yes/no filevault means
<abathur> that it is unencrypted when it may be encrypted-at-rest depending on setup
<gchristensen> I thought we established in the case where there is no T2 chip, but other encyrpted datasets existed, it would absolutely refuse to install
<abathur> I guess that's right; I'm also lumping in the old-hardware cases but they won't be using the flag
<gchristensen> so passing this flag is only saying, if there is a T2 chip, and some datasets are encrypted with filevault, create that dataset without filevault. and it applies in no other case, right?
<abathur> well, maybe LnL has a thought here; at first I locked the flag so it wouldn't even run pre-catalina
<abathur> but he did suggest letting pre-catalina run it if they wanted
<gchristensen> gotta run for a bit
__monty__ has quit [Quit: leaving]
<LnL> that doesn't change this however
<abathur> but it might somewhat affect what the flag "means"
<LnL> more likely to be old hardware, but the conditions stay the same
<abathur> if filevault is in use, it only creates the volume if a t2 chip is there; if filevault is *not* in use, it will just create the volume
<abathur> (and it'll end up either unencrypted on old harware, or encrypted-at-rest on new hardware)
<abathur> so saying without-filevault or non-filevault seems correct
<LnL> yeah
<abathur> but I have less of a sense of how clear it is (what fraction of potential Nix installers on a macOS system will type --create-nix-store-volume-without-filevault
<abathur> and understand how to unpack what that means)
<abathur> vs the fraction who'll run it without understanding
<abathur> it might be a non-issue, I won't object if the general perception is that the kind of person interested in Nix will understand
<LnL> somebody who doesn't know what filevault is probably won't have it enabled
<LnL> and it doesn't allow the bad case, just doesn't cover more restrictive policies
<abathur> --darwin-create-non-filevault-nix-store-volume, --darwin-create-nix-store-volume-without-filevault
<abathur> nod
<abathur> it's pretty easy to enable if you see it in the installer and say yes
<LnL> --we-added-this-but-its-not-an-ideal-solution :p
<abathur> hehe, true facts :D
<abathur> --i-hereby-release-NixOS-and-all-contributors-from-all-responsibility-and-promise-not-to-yell-at-them-on-twitter
<LnL> lol, let's go with that one
<LnL> what I'm trying to say is that it feels a bit overly verbose, but then we're back at more implicit stuff so let's go with this for now
<abathur> yeah; feel roughly the same
<abathur> I can imagine maybe breaking it into more than one flag
<abathur> but the flag parsing probably needs to be better, and I'm leery of making it harder to figure out
<abathur> or maybe as an arg to it? like --darwin-create-nix-store-volume for the core behavior, and pass a value that specifies how
philr has joined #nix-darwin
<gchristensen> LnL: pick one and go for it :)
hmpffff has joined #nix-darwin
hmpffff has quit [Quit: nchrrrr…]
mbrgm_ has joined #nix-darwin
mbrgm has quit [Ping timeout: 260 seconds]
mbrgm_ is now known as mbrgm