Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Homebrew 4.0.0

brew.sh

Post reply on HN
Print view View original

61–70 of 403 posts

Re: Homebrew 4.0.0

#61

Post by aa-jv »

modernerd wrote: post #16
aa-jv wrote: post #12

I wish we could get the industry to understand that when you build-in analytics and make it hard for people to opt out, you're using their resources. Sure, people don't pay for things like Homebrew (can they even?) - but this is no reason to extract resources from end users without their consent or agency. I have to work very hard to get something like Homebrew installed and in-use in my organization - the IT guys de…

> people don't pay for things like Homebrew (can they even?) They can and should! https://github.com/homebrew/brew#donations

Thanks for the link, I've now donated. :)

Re: Homebrew 4.0.0

#62

Post by acdha »

throw0101c wrote: post #23

On macOS, has anyone moved from/to MacPorts to/from Homebrew? Why did you move? What are the pros and cons of each system?

I switched from MacPorts to Homebrew very early on because it was better contained. I had to support developers who would build with MacPorts and end up with something which would crash with a linker error when they shared it with someone off the team because it was using a MacPorts binary in a non-standard location, or whose shell scripts broke expecting a GNU CLI utility version which was in their path but not their users. MacPorts also took forever to build since it dragged in so many replacements for system libraries.

Homebrew has done a much better job of staying out of the way.

Re: Homebrew 4.0.0

#63

Post by acdha »

lrvick wrote: post #48
throw0101c wrote: post #23

On macOS, has anyone moved from/to MacPorts to/from Homebrew? Why did you move? What are the pros and cons of each system?

Both are a security shit show, but at least macports bothers to sign their packages.

What security benefit do you think that provides?

Re: Homebrew 4.0.0

#64

Post by jeroenhd »

gizmo wrote: post #47
hnlmorg wrote: post #40

Earlier quoted context omitted.

You can specify specific package versions in brew if you want specific versions pinned. The default behaviour of using the latest in repo is correct and is how every package manager works. It’s the behaviour people expect and it’s the behaviour that is arguably more secure (the fact that homebrew is bleeding edge does create issues here but generally speaking my point stands). I believe you pin using the @ symbol fol…

This is not at all how every package manager works. On debian if you install a package it will just install that package and it will warn you if dependencies will require upgrading first. It won't upgrade totally unrelated packages and break everything for you. In addition, you have different branches where the debian stable branch is extremely well tested. Homebrew is way, way worse than any other package manager be…

But the shopify cli, the given example, does depend on nodejs. If you tell Debian's apt to install a package that depends on a newer version of an installed package, it'll update that package for you as well.

If Debian stable updates their nodejs package to 19 and you install any package that depends on nodejs, expect to get the nodejs 19 update.

The difference here is that Debian pins versions of software per release so you won't run into these situations. That's fine if you're willing to deal with running older software maintained by Debian rather than the original developers, but that's just a choice.

From what I can tell, Homebrew acts more like pacman and friends; it expects you to stay up to date, and if you don't it's up to you to fix the problem.

Re: Homebrew 4.0.0

#65

Post by prepend »

predmijat wrote: post #5
jray wrote: post #3

Earlier quoted context omitted.

In your .bashrc or similar: export HOMEBREW_NO_ANALYTICS=1

That’s not the point. I don’t want any software sending analytics unless I specifically allowed it.

I feel the same way.

I think it’s not cool when orgs track telemetry with opt out. But it’s not cool like when you’re at a party and you go off and fart in the corner as no one’s there and then a few seconds later someone walks by and smells it.

Continuing the analogy, telemetry with no opt out is like farting silently amongst a group of people. And tracking identified user requests while selling data is like slapping each person at the party while farting in their face.

And I guess opt in telemetry is like holding in your fart and people notice and might feel some discomfort at your discomfort.

Re: Homebrew 4.0.0

#66

Post by Upvoter33 »

Man there are a lot of complaints about this free software no one is forcing you to use. I would start with a thanks to the people who spend a lot of time on this, and probably not for much wealth. I know I greatly appreciate the existence of homebrew.

Re: Homebrew 4.0.0

#67

Post by t8sr »

As an old hand who was around when homebrew started, I feel obliged to let people know there are alternatives. If you find brew's take-over-your-system-and-youll-thank-me approach off putting, and/or you value stability over the coolness factor, MacPorts is still alive and well (https://www.macports.org), and in-fact has basically all the same packages brew does.

In 18 years of using MacPorts, it's never messed up my system, broken something that used to work or decided that I don't get to run commands right now, because it wants to run an upgrade. (It's also never spied on me.)

The price you pay for that is that more things are compiled from scratch, but hey - you only have to do that once, and it only takes like 20 minutes on a modern Mac. Upgrades are generally pretty fast.

Re: Homebrew 4.0.0

#68

Post by aa-jv »

eesmith wrote: post #37
aa-jv wrote: post #12

I wish we could get the industry to understand that when you build-in analytics and make it hard for people to opt out, you're using their resources. Sure, people don't pay for things like Homebrew (can they even?) - but this is no reason to extract resources from end users without their consent or agency. I have to work very hard to get something like Homebrew installed and in-use in my organization - the IT guys de…

How is it hidden or hard to opt-out? From https://docs.brew.sh/Analytics you can opt out using: export HOMEBREW_NO_ANALYTICS=1 -or- brew analytics off The installer gives a warning message before sending the first analytics, with a pointer to the above URL for how to disable analytics. From install.sh: ring_bell # Use an extra newline and bold to avoid this being missed. ohai "Homebrew has enabled anonymous aggregate…

None of this is user-friendly - all of it is obfuscated. I have to add resources to my system (env vars) in order to opt-out - and that is the issue!

There are no hints/tips about this produced to educate a new user - if it weren't for your help, I wouldn't have known.

The non-resource-using method I propose is that homebrew merely ask the user if its okay, after 5 or 10 runs, to send some info - and then shows me the info. No, I don't want to add resources to my environment to get this info - I want homebrew developers to be honest about it, up front, and overt.

They are being sly, using dark patterns to make it unfeasible to disable analytics, because they know this is an unpopular feature of their software.

Re: Homebrew 4.0.0

#69

Post by acdha »

lrvick wrote: post #44

Reminder that nothing in Homebrew has any signing or attempt at supply chain integrity. Now that they are moving away from clients using git, so even git commit signing is off the table now. When you install brew you are giving hundreds of people (or anyone who has access to their Github accounts) full remote code execution on your machine. Never ever use brew on a machine you use to access production.

If they were using signed binaries wouldn’t the same people who have permission to merge code have permission to sign compiled binaries (or, realistically, start a CI process which does)?

Re: Homebrew 4.0.0

#70

Post by nrvn »

anshargal wrote: post #50

While I use Homebrew on my Mac — it is a major risk. I am afraid that the project is not following strict security policies and will be compromised at some point. Evil package or evil version of brew can steal or modify my data. I think this will also hurt the Mac platform. I wish Apple would invest some effort into building an App Store for cli programs. While it may be complicated for the community(require signing,…

This, absolutely!

Apple should close this gap and I am puzzled why they have not done that yet. Because even for iOS development people need things beyond the xcode toolcahin and they resort to either of the available options. Homebrew is just one of them.

Not only cli app store but the mac app store also badly needs some love.

Post reply on HN