Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Homebrew 1.1.0

brew.sh

Post reply on HN
Print view View original

171–180 of 216 posts

Re: Homebrew 1.1.0

#171

Post by arvinsim »

lisper wrote: post #64

I have very mixed feelings about homebrew. When it works, it is awesome, but when it doesn't it can be a serious nightmare. In particular, homebrew refuses to run under sudo. Instead, to instal in /usr/local it wants me to recursively chown /usr/local to myself, which is a Really Bad Idea (tm). I have mostly stopped using it for this reason. I understand that running a program that runs third-party scripts under sudo…

I wonder how much of this could have been avoided if they defaulted to a different, user created folder.

Re: Homebrew 1.1.0

#172

Post by falsedan »

lisper wrote: post #162
lucaspiller wrote: post #118

Earlier quoted context omitted.

Other than being in a different directory, what difference is that going to make? You are going to have both in your $PATH in order to run the binaries, so if an attacker can write to either bad stuff could happen. Also you can actually install it wherever you like, this is just the default/recommended location: https://github.com/Homebrew/brew/blob/master/docs/Installati...

/usr/local/bin is a global resource populated by binaries run by many different users including root. Making it user-writable opens the door to privilege escalation attacks by replacing binaries that are then run by other users.

Why would using /opt/homebrew/bin stop these sorts of attacks?

Re: Homebrew 1.1.0

#173

Post by swrobel »

mikemcquaid wrote: post #60
AdamN wrote: post #34

I'm going to ditto the positive comments. Kudos to the maintainers - not just for the package itself but for growing it. They successfully went from a hacky page with some scripts, to a big giant repository, to multiple repos, to a fully fledged mature best-practices package manager for macOS with all the bells and whistles. The sign of a great project isn't just that it does one thing well, but that it grows with th…

Thanks for the kind words. You'd be surprised how motivating they are. <3

Thanks so much! Without homebrew I'd probably end up going back to Linux.

Re: Homebrew 1.1.0

#174

Post by spinningarrow »

krat0sprakhar wrote: post #81
dve wrote: post #65

Earlier quoted context omitted.

Ditto. I install almost everything via brew and brew cask, and store the list of packages in git. It makes setting up a new machine a breeze. Thanks for all your hard work!

This is a cool idea! How does one go about doing this though? Is there a flag to output a text file with the names of installed versioned packages?

Here's another example of a simple shell script I use to do this: https://github.com/spinningarrow/up/blob/master/up

Re: Homebrew 1.1.0

#175

Post by nindalf »

swrobel wrote: post #173
mikemcquaid wrote: post #60

Earlier quoted context omitted.

Thanks for the kind words. You'd be surprised how motivating they are. <3

Thanks so much! Without homebrew I'd probably end up going back to Linux.

Same here. It's a bother to use a computer without apt-get or homebrew.

Re: Homebrew 1.1.0

#176

Post by stiGGG »

lisper wrote: post #160
hibbelig wrote: post #154

Earlier quoted context omitted.

What are those risks?

/usr/local/bin is a global resource. It is generally full of binaries that get run by many different users including root. If a regular user can replace those binaries the result is a privilege escalation.

which programs from /usr/local/bin get run by root under current macOS?

Re: Homebrew 1.1.0

#177

Post by no_wizard »

I love homebrew! I have it all on of my macOS machines. Best, easiest way to install common software I use between computers (Where supported, anyway) and developer packages. Now if we could just get http://linuxbrew.sh/ up to the same caliber....:)

Re: Homebrew 1.1.0

#178

Post by shpx »

SkyMarshal wrote: post #123
AdamN wrote: post #37

Just a quick poll. Is anybody still using MacPorts or anything else? If so, why?

Nix package manager on my Mac [1]. Deterministic builds, plays well with POSIX/UNIX, though fewer repo's available than Brew and others. [1]: https://news.ycombinator.com/item?id=11772686

I tried switching to nix, but homebrew's command line argument "design" has spoiled me. With homebrew I'm usually able to guess command arguments, where as with every other package manager I have to google when I want to do something I haven't done before.

For example, I want to search for a package name before installing. I'm guessing it's just "brew search pkg"... yup. Now what do I do with nix? Google says it's "nix -qa pkg", that totally makes sense, and I just love how I have to memorize some arcane letters.

This is true for virtually every linux package manager I've tried (wtf is apt-cache? I can't remember pacman commands after using it for a year). Seriously, typing anything with a minus sign is slower than typing word, so what's even the point? At this point I won't (choose to) use a package manager that doesn't get this right.

Re: Homebrew 1.1.0

#179

Post by lisper »

stiGGG wrote: post #176
lisper wrote: post #160

Earlier quoted context omitted.

/usr/local/bin is a global resource. It is generally full of binaries that get run by many different users including root. If a regular user can replace those binaries the result is a privilege escalation.

which programs from /usr/local/bin get run by root under current macOS?

Well, by default /usr/local/bin is empty. But people commonly install things there that eventually get run by root. The most obvious example is various programming languages, different versions of Python, alternate shells, etc.

Re: Homebrew 1.1.0

#180

Post by lisper »

falsedan wrote: post #172
lisper wrote: post #162

Earlier quoted context omitted.

/usr/local/bin is a global resource populated by binaries run by many different users including root. Making it user-writable opens the door to privilege escalation attacks by replacing binaries that are then run by other users.

Why would using /opt/homebrew/bin stop these sorts of attacks?

It would prevent privilege escalation attacks on binaries that I have already installed in /usr/local/bin. Yes, packages installed in /opt/homebrew/bin could be attacked separately, but at least the vulnerable binaries are isolated so it's easier to keep an eye on them and make sure none of them are ever run with privileges.

But you're right: to really fix this problem requires that homebrew change its installation process entirely.

Post reply on HN