Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Homebrew 1.1.0

brew.sh

Post reply on HN
Print view View original

201–210 of 216 posts

Re: Homebrew 1.1.0

#201

Post by stephenr »

spatulon wrote: post #56
stephenr wrote: post #53

Earlier quoted context omitted.

> best-practices Wat? How is fundamentally broken dependency management and forcing installed global binaries to be user-owned "best practices"?

Can you rephrase your objection in a less patronising and more constructive way?

I asked a simple question, which is basically the same question I ask any time someone rushes to praise Homebrew like it's the best thing since installable software.

The person I replied to stated that Homebrew follows best practices. I asked how that's possible when it has two major failings compared to pretty much every other package management tool.

The Homebrew project has made it clear that they have no intention of fixing these two failings:

- they've doubled-down on the "install binaries writable by users", and proclaim the issue of owning /usr/local "fixed". Now you just need to own /usr/local/bin, which basically means nothing has changed from a security point of view.

- even when they finally admit the dependency management issue with binary packages, their solution is to just remove/disable some binary packages, forcing all users to compile them from source, and close the issue.

The project has massive, glaring issues. Honestly, it's like a competition these days between NPM and Homebrew to see which can be a worse tool. At least NPM doesn't insist globally installed packages be user-writable.

Re: Homebrew 1.1.0

#202

Post by mikemcquaid »

lisper wrote: post #113
mikemcquaid wrote: post #107

Earlier quoted context omitted.

We don't require you to take ownership of any directories that already exist when macOS is installed (i.e. `/usr/local` subdirectories but not `/usr/local` itself). Regardless of whether we should have picked another path, changing now would require rebuilding all our binary packages and that's a lot of effort with little return and almost certain breakages.

I haven't done a clean install of OS X in a long time, but I'm pretty sure /usr/local/bin exists. But even if it doesn't I don't find this a compelling argument. Having /usr/local/bin owned by root is a universally accepted standard in the unix world, and with very good reason: having /usr/local/bin owned by a user introduces security risks.

`/usr/local` is empty on a new install. I reconfirmed with a clean install VM.

Re: Homebrew 1.1.0

#203

Post by inDigiNeous »

groovy2shoes wrote: post #124
raimue wrote: post #99

Earlier quoted context omitted.

Very much the reason why MacPorts requires sudo, so it can drop to a less-privileged "macports" user for builds, without putting your own user account at risk.

Not to rain on anyone's parade, but I find MacPorts to be superior to Homebrew in every way, from writing the ports themselves, to installing them and managing them. I used to use Homebrew some time ago, but when I got my Mac Mini, I decided to forgo it in favor of MacPorts and Pkgsrc (which Joyent also provides binaries of for OSX). Whatever MacPorts doesn't have (a rare occurrence), Pkgsrc tends to have it. If not,…

I agree, I prefer MacPorts also. It has a more of a linux/debian package management vibe to it, which I like.

I've tried homebrew also, but it just feels more like a hack put together. Maybe version 1.1.0 is better, but I'm still going to stick with MacPorts.

Each to it's own, but I wish MacPorts would get more coverage in the news and in the OS X development world.

Re: Homebrew 1.1.0

#204

Post by _xkjn »

Recently had to reinstall my mac from scratch. I was able to install 95% of my daily software through brew, by far a new record. Big thanks to the developers / maintainers of this project.

Re: Homebrew 1.1.0

#205

Post by stephenr »

teilo wrote: post #155
matt4077 wrote: post #149

Of all package managers I use, homebrew is without a doubt the most satisfying. It tracks updates closely and has always had any package I was looking for, yet I don't remember the last time I ran into an error. (I'm sure all three happen, but if I can't find them with close to 200 packages installed, they must be doing something right)

Despite the warnings from their team, as soon as I switched to /opt/homebrew all of my homebrew problems went away. The biggest issue by far are the number of traditional packages that install in /usr/local with root privileges, thereby clobbering homebrew and making "brew doctor" freak out.

> The biggest issue by far are the number of traditional packages that install in /usr/local with root privileges

That is very much a problem with Homebrew, not those "traditional" packages.

Re: Homebrew 1.1.0

#206

Post by berntb »

stephenr wrote: post #201
spatulon wrote: post #56

Earlier quoted context omitted.

Can you rephrase your objection in a less patronising and more constructive way?

I asked a simple question, which is basically the same question I ask any time someone rushes to praise Homebrew like it's the best thing since installable software. The person I replied to stated that Homebrew follows best practices. I asked how that's possible when it has two major failings compared to pretty much every other package management tool. The Homebrew project has made it clear that they have no intentio…

Wouldn't this be mostly solved by a paragraph in the Homebrew documentation that recommend creating a specific user which do installations?

Edit: It seems to be fixed anyway? https://news.ycombinator.com/item?id=12892929

(That aside, this praise was good to read. Homebrew didn't work well enough for me a few years back, so I got a Linux computer. I'll reconsider Macs next year when it is ~ time to get a new laptop.)

Edit: Let user "homebrew" have id 0. I tried MacPorts too. Hopefully either works for me next time.

Re: Homebrew 1.1.0

#207

Post by stephenr »

berntb wrote: post #206
stephenr wrote: post #201

Earlier quoted context omitted.

I asked a simple question, which is basically the same question I ask any time someone rushes to praise Homebrew like it's the best thing since installable software. The person I replied to stated that Homebrew follows best practices. I asked how that's possible when it has two major failings compared to pretty much every other package management tool. The Homebrew project has made it clear that they have no intentio…

Wouldn't this be mostly solved by a paragraph in the Homebrew documentation that recommend creating a specific user which do installations? Edit: It seems to be fixed anyway? https://news.ycombinator.com/item?id=12892929 (That aside, this praise was good to read. Homebrew didn't work well enough for me a few years back, so I got a Linux computer. I'll reconsider Macs next year when it is ~ time to get a new laptop.)…

No. Root is the specific user which should do installations. Thus, the "solution" is for Homebrew to stop pretending that password-less binary installs is a "feature" instead of a massive security hole.

Honestly, Homebrew doesn't seem like a reason to either use or not use a Mac. For me personally, (as I mentioned elsewhere), the small amount of unix-y host (i.e. macOS) software I install is available in native Installer packages. The rest I install in Debian VMs.

For those that need/want more unix-y tools at the host level, there are a lot of positive comments about MacPorts in this thread, and it specifically doesn't have the permissions issue that Homebrew has (it requires being run as sudo, as it drops to a special account for compiling, and then later installs as root)

Reply-to-Edits:

> Edit: It seems to be fixed anyway? https://news.ycombinator.com/item?id=12892929

No. You still need to change ownership of /usr/local/bin. The problem isn't fixed, at all.

> Edit: Let user "homebrew" have id 0.

No. That would essentially be the same as running `sudo homebrew`, which they don't support.

It would also mean that packages that need to be compiled will do so as root, not a limited user account as they should be.

Re: Homebrew 1.1.0

#209

Post by berntb »

stephenr wrote: post #207
berntb wrote: post #206

Earlier quoted context omitted.

Wouldn't this be mostly solved by a paragraph in the Homebrew documentation that recommend creating a specific user which do installations? Edit: It seems to be fixed anyway? https://news.ycombinator.com/item?id=12892929 (That aside, this praise was good to read. Homebrew didn't work well enough for me a few years back, so I got a Linux computer. I'll reconsider Macs next year when it is ~ time to get a new laptop.)…

No. Root is the specific user which should do installations . Thus, the "solution" is for Homebrew to stop pretending that password-less binary installs is a "feature" instead of a massive security hole. Honestly, Homebrew doesn't seem like a reason to either use or not use a Mac. For me personally, (as I mentioned elsewhere), the small amount of unix-y host (i.e. macOS) software I install is available in native Inst…

OK, thanks. It was a few years since I touched the Mac package managers.

(I ought to ask or go read up on why it is like this, but I'll let it wait a year to when I research the next machine anyway.)

(Edit: Weird to not allow root? Oh, next year. :-) )

Post reply on HN