Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Homebrew 4.0.0

brew.sh

Post reply on HN
Print view View original

101–110 of 403 posts

Re: Homebrew 4.0.0

#101

Post by Chiron1991 »

tasuki wrote: post #77
lrvick wrote: post #44

Reminder that nothing in Homebrew has any signing or attempt at supply chain integrity. Now that they are moving away from clients using git, so even git commit signing is off the table now. When you install brew you are giving hundreds of people (or anyone who has access to their Github accounts) full remote code execution on your machine. Never ever use brew on a machine you use to access production.

I've been using Linux for the past 18 years or so, but damn do the M1 macs look interesting. How does one manage packages on a mac?

Excluding 3rd party tools like Homebrew, one dosn't. The native 'package manager' is the Apple App Store. You can also manually download and install .dmg files of applications (much like .deb or .rpm).

Re: Homebrew 4.0.0

#102

Post by avidphantasm »

t8sr wrote: post #67

As an old hand who was around when homebrew started, I feel obliged to let people know there are alternatives. If you find brew's take-over-your-system-and-youll-thank-me approach off putting, and/or you value stability over the coolness factor, MacPorts is still alive and well ( https://www.macports.org ), and in-fact has basically all the same packages brew does. In 18 years of using MacPorts, it's never messed up…

I recently switched back to MacPorts after 8 years on Brew. However, a few weeks ago the outdated GDAL port broke, and I lack the expertise to quickly make a new port and haven’t had the time to figure out how to (I have contributed an updated version of Catch2, but that was very easy). So I’ve had to switch back to Brew. I hope this is only temporary.

Re: Homebrew 4.0.0

#103

Post by rahen »

sirodoht wrote: post #93
throw0101c wrote: post #23

On macOS, has anyone moved from/to MacPorts to/from Homebrew? Why did you move? What are the pros and cons of each system?

Moved from homebrew to nix. Haven't looked back. If something is not on nix, I just build/compile it myself.

I use pkgsrc, which also comes with binary packages through pkgin, although I rarely need to compile things myself.

https://pkgsrc.joyent.com/install-on-macos/

Anything that nix does better than pkgsrc?

Re: Homebrew 4.0.0

#104

Post by baliex »

t8sr wrote: post #67

As an old hand who was around when homebrew started, I feel obliged to let people know there are alternatives. If you find brew's take-over-your-system-and-youll-thank-me approach off putting, and/or you value stability over the coolness factor, MacPorts is still alive and well ( https://www.macports.org ), and in-fact has basically all the same packages brew does. In 18 years of using MacPorts, it's never messed up…

I used to be a staunch macports evangelist but ended up switching to homebrew. I've found it to be much simpler.

And, as a counter to your experience of not having it mess up a machine, every time you upgrade macOS to the next major version you have to jump through some hoops to get it to play ball again. Painful.

At some point I gave up on the hoops and installed homebrew instead and haven't looked back.

Re: Homebrew 4.0.0

#105

Post by sirodoht »

rahen wrote: post #103
sirodoht wrote: post #93

Earlier quoted context omitted.

Moved from homebrew to nix. Haven't looked back. If something is not on nix, I just build/compile it myself.

I use pkgsrc, which also comes with binary packages through pkgin, although I rarely need to compile things myself. https://pkgsrc.joyent.com/install-on-macos/ Anything that nix does better than pkgsrc?

I have zero experience with pkgsrc. From a first glance (from pkgsrc.org), I can say that nix claims to have 80k packages whereas pkgsrc 26k. Also, nix'es main selling point is reproducible builds, which is pretty cool. Other than that, nix is satisfactorily fast (much faster than homebrew, not sure in comparison to pkgsrc).

Re: Homebrew 4.0.0

#106

Post by tiagod »

Mystery-Machine wrote: post #33

I despise, despise, Homebrew's "we know better than you" approach to always installing the latest versions of every dependency. How tf is this fine? They don't even offer alternative. They just say "we can't test all of the packages installed and all version combinations, so this is the best we can do". Well, no one asked you to test my exact setup. All I'm asking for is: if I have perfectly working Node 18 and I nee…

I use asdf for tooling I need to keep several versions of. People have also mentioned Nix, but I haven't tried it out yet.

Re: Homebrew 4.0.0

#107

Post by rpgbr »

anshargal wrote: post #50

While I use Homebrew on my Mac — it is a major risk. I am afraid that the project is not following strict security policies and will be compromised at some point. Evil package or evil version of brew can steal or modify my data. I think this will also hurt the Mac platform. I wish Apple would invest some effort into building an App Store for cli programs. While it may be complicated for the community(require signing,…

I'm not a very technical person, but I think MacPorts adheres better to macOS standards and security practices. (At least it asks my admin password before any major interaction.) Been using for a few years, coming from Homebrew, and it's running smoothly.

Re: Homebrew 4.0.0

#109

Post by aa-jv »

acdha wrote: post #94
aa-jv wrote: post #68

Earlier quoted context omitted.

None of this is user-friendly - all of it is obfuscated. I have to add resources to my system (env vars) in order to opt-out - and that is the issue! There are no hints/tips about this produced to educate a new user - if it weren't for your help, I wouldn't have known. The non-resource-using method I propose is that homebrew merely ask the user if its okay, after 5 or 10 runs, to send some info - and then shows me th…

> None of this is user-friendly - all of it is obfuscated This is a message which is printed with very clear instructions the first time you run any command. It’s a simple command and there’s no noticeable difference in resource usage compared to the actual package management system, which also needs environmental variables to be set. The big thing you’re missing is that the Homebrew maintainers are freely giving you…

>the kind of service developers used to pay money for

I've donated to homebrew, I support them that way.

The moral issue is, I'm using their tools and trusting them, and they are violating that trust by phoning home and sending analytic data without my involvement or approval. While it may seem trivial to you to set an environment variable, having to do that with every new homebrew install adds up, and when its forgotten about, results in a negative impact on my networking and IT resources.

> a trivial opt-out mechanism

Its not trivial, and thats the point where we disagree. No, maintaining environment variables to prevent tooling from sending unknown analytical data: this is not trivial. It is an anti-pattern designed to gain the data from un-sophisticated users, rather than treating users with respect and letting them have agency over whether their resources are used by the homebrew developers.

Tracking should always be opt-in and if it isn't, that is simply a dark pattern being used to scam resources from the users.

Re: Homebrew 4.0.0

#110

Post by atonse »

modernerd wrote: post #15

> brew update will now be run automatically less often (every 24 hours rather than every 5 minutes) and these auto-updates will be much faster as they no longer need to perform the slow git fetch of the huge homebrew/core and homebrew/cask taps’ Git repositories. Excellent! Thanks to the brew team for this — it was always frustrating to install something and have to wait for a full, slow update first.

I was just wondering, have they considered storing all that in an SQLite file? And then you could refresh the file every 6 hours, say, and post it on a CDN?
Post reply on HN