I wonder how many more major versions until "brew update" and "brew upgrade" finally just do the same thing.
"But they're not the same!"
I don't care.
Homebrew 4.0.0
41–50 of 403 posts
Re: Homebrew 4.0.0
#42> Homebrew’s analytics are now sent both to Google Analytics and our new, self-hosted InfluxDB instance hosted in the EU. > If you had previously set HOMEBREW_NO_ANALYTICS because you didn’t like Google Analytics and/or data being sent to the USA: please consider unsetting this and setting HOMEBREW_NO_GOOGLE_ANALYTICS instead, allowing analytics data to be sent to our new InfluxDB host. My package manager was reporti…
It prints a notice when you run it:
Re: Homebrew 4.0.0
#43On macOS, has anyone moved from/to MacPorts to/from Homebrew? Why did you move? What are the pros and cons of each system?
Yah like a decade ago. I started to find what I was looking for under home brew, and not with port or fink
Re: Homebrew 4.0.0
#44Reminder that nothing in Homebrew has any signing or attempt at supply chain integrity. Now that they are moving away from clients using git, so even git commit signing is off the table now.
When you install brew you are giving hundreds of people (or anyone who has access to their Github accounts) full remote code execution on your machine.
Never ever use brew on a machine you use to access production.
Re: Homebrew 4.0.0
#45I despise, despise, Homebrew's "we know better than you" approach to always installing the latest versions of every dependency. How tf is this fine? They don't even offer alternative. They just say "we can't test all of the packages installed and all version combinations, so this is the best we can do". Well, no one asked you to test my exact setup. All I'm asking for is: if I have perfectly working Node 18 and I nee…
Homebrew’s dependency resolution was a complete joke the last time I checked it out, but they were completely happy with the laughable results so I won’t be surprised if it hasn’t changed.
Essentially it did all dependency resolution at build time (because brew used to have no prebuilt binaries and everyone’s workstation would spend 90 minutes compiling the same things over and over again). But when they added binary distribution they didn’t change the dependency resolution to work like eg deb’s or rpm’s do.
It used to be that if you told it to install from source it would thus be able to “detect” your local existing package that provides the dependency. It may just take a while depending on what you’re installing.
Re: Homebrew 4.0.0
#46Earlier quoted context omitted.
They'd be well advised to make this opt-in only for legal reasons. This is not going to go down well in a lot of places and they might get exposed to law suits.
As in the post: they're intending to drop the GA part entirely within 90 days, and it sounds like the new metrics are entirely anonymous, and so not covered by GDPR etc. IANAL but as far as I can tell that should avoid all legal concerns once GA is gone.
It's hard to send stuff over the Internet without exposing some personal information, like your ip number.
I guess they might send it over TOR to get around that.
Re: Homebrew 4.0.0
#47I despise, despise, Homebrew's "we know better than you" approach to always installing the latest versions of every dependency. How tf is this fine? They don't even offer alternative. They just say "we can't test all of the packages installed and all version combinations, so this is the best we can do". Well, no one asked you to test my exact setup. All I'm asking for is: if I have perfectly working Node 18 and I nee…
You can specify specific package versions in brew if you want specific versions pinned. The default behaviour of using the latest in repo is correct and is how every package manager works. It’s the behaviour people expect and it’s the behaviour that is arguably more secure (the fact that homebrew is bleeding edge does create issues here but generally speaking my point stands). I believe you pin using the @ symbol fol…
This is not at all how every package manager works. On debian if you install a package it will just install that package and it will warn you if dependencies will require upgrading first. It won't upgrade totally unrelated packages and break everything for you. In addition, you have different branches where the debian stable branch is extremely well tested.
Homebrew is way, way worse than any other package manager because it just breaks stuff all the time.
Re: Homebrew 4.0.0
#48On macOS, has anyone moved from/to MacPorts to/from Homebrew? Why did you move? What are the pros and cons of each system?
Both are a security shit show, but at least macports bothers to sign their packages.
Re: Homebrew 4.0.0
#49Earlier quoted context omitted.
You know, as the law requires in the EU
That is a very simplifying view of the legal situation and that's not helpful at all. First, it only applies if you collect PII - depending on what they collect, they might not be subject to the GDPR at all. Second, informed consent is only one of the options that allows collection and storage of PII. There are various other reason that allow collection and storage of PII, among them "Legitimate interest". For exampl…
The analytics page describes them tracking information across time with a unique user identifier. They claim that identifier doesn't identify you, but it's attached to an exact Brew install so it does track your personal account on your machine at the very least; I'd classify that as PII.
Had they not submitted unique user tokens I think you mag be right. However, that's not how the analytics seem to work.
The law does allow logging for a variety of things but in this case I'd say they're in the wrong. They assume that it's okay because they don't track you across websites and that's good to know, but that's not the point.
Re: Homebrew 4.0.0
#50While I use Homebrew on my Mac — it is a major risk. I am afraid that the project is not following strict security policies and will be compromised at some point. Evil package or evil version of brew can steal or modify my data.
I think this will also hurt the Mac platform. I wish Apple would invest some effort into building an App Store for cli programs. While it may be complicated for the community(require signing, sandboxing, developer effort), it is likely to have better security guarantees than Homebrew.