Connect your Claude, Codex or OpenClaw for full transcripts on millions of podcasts. Two week free trial, cancel anytime.
Start free trial →LINUX Unplugged · Hands-On Engineering Podcasts · November 2026
A listener asked how to pull in CVE fixes on NixOS as fast as possible. After checking how Nix handled several recent vulnerabilities, Wes explains that patch speed in the source tree and patch speed on your own machine are two different things.
So they often are some of the fastest to actually. So you have to separate things when analyzing this. Lay it
down for me, Western. There's
the factor of how soon does it get into Nix packages? And then there's how soon is it actually on your machine? And this is where it sort of bifurcates because Nix is often one of the fastest to actually get it patched in the code. But because of the way Nix works, it can sometimes be one of the slower ones to actually get it on your machine because that whole reproducibility and like you can think of it, Nix packages as a giant tree that all depends on each other. And so if you're just doing a leaf of that tree, it's not a big deal, right? It's just one. You know, a package, maybe a couple of libraries related to it that you have to rebuild. But if you're doing something that's really at the root of that tree, you have to rebuild everything under it.
Yeah. And you could do that on your own machine.
But it's going to take time and power and build. Which is what
Gene's doing.