2.10 Importing nixpkgs, properly

How to bring in nixpkgs the right way: import <nixpkgs> { } versus pinning a specific commit for true reproducibility, plus config.allowUnfree and permittedInsecurePackages for the real-world cases the quick tutorials quietly skip.