@Mic92, you removed wifi from my MacBook Air 6.2. I prefer having an insecure wifi driver than having no internet at all. So I manually added the lines

  #insecure wifi
  boot.kernelModules = ["wl"];
  boot.extraModulePackages = [config.boot.kernelPackages.broadcom_sta];
  nixpkgs.config.allowInsecurePredicate = pkg:
    builtins.elem (lib.getName pkg) [
      "broadcom-sta" # aka “wl”
    ];

to my nix-configuration.

Is your plan to completely disable internet on these computers, or do you have a better solution?

@Mic92, you removed wifi from my MacBook Air 6.2. I prefer having an insecure wifi driver than having no internet at all. So I manually added the lines

  #insecure wifi
  boot.kernelModules = ["wl"];
  boot.extraModulePackages = [config.boot.kernelPackages.broadcom_sta];
  nixpkgs.config.allowInsecurePredicate = pkg:
    builtins.elem (lib.getName pkg) [
      "broadcom-sta" # aka “wl”
    ];

to my nix-configuration.

Is your plan to completely disable internet on these computers, or do you have a better solution?

No, but I had to remove it to fix evaluation of these modules. We can have an option that is not enabled by default to fix it though.

With these lines:

  #insecure wifi
  boot.kernelModules = ["wl"];
  boot.extraModulePackages = [config.boot.kernelPackages.broadcom_sta];
  nixpkgs.config.allowInsecurePredicate = pkg:
    builtins.elem (lib.getName pkg) [
      "broadcom-sta" # aka “wl”
    ];

I get no evaluation error. We can add that and keep the wl/Broadcom module enabled.
Exploitability requires an attacker in immediate Wi-Fi range — not a remote Internet attack — so risk is low for my trusted family/neighbors; full code execution would need much more than just being nearby.

Do you want to add this? It would be better to override the broadcom package instead of nixpkgs.config.allowInsecurePredicate since some people and CI us using nixpkgs.pkgs instances:

  boot.extraModulePackages = [
    (config.boot.kernelPackages.broadcom_sta.overrideAttrs (oldAttrs: {
      meta = oldAttrs.meta // {
        knownVulnerabilities = [];
      };
    }))
  ];

Yes, I updated my configuration. It works on my MacBook Air 6.2, thank you :-)

Okay. Please make a pull request.

Yes, I’ll do that. It will be my first NixOS pull request.
I’m planning to enable the Broadcom driver by default and add an option to disable it for people who use an external Wi-Fi stick. Does that sound okay?
Should I apply this change only to my tested MacBook Air 6, or also to all other devices where you disabled the Broadcom driver in this commit ?

✔️ All done 🙂