Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Our audit of Homebrew

blog.trailofbits.com

Post reply on HN
Print view View original

101–110 of 205 posts

Re: Our audit of Homebrew

#101

Post by saagarjha »

CaliforniaKarl wrote: post #64
sizeofchar wrote: post #59

Earlier quoted context omitted.

When I started using a Mac in 2009, MacPorts, Fink (and I think there was another I can't recall the name) simply wouldn't work for me. They would take very long to build what I wanted, there weren't nearly as many packages as was in Debian/Ubuntu, and many were old versions. Worse, many build attempts would just fail. In that scenario, brew worked like a charm. It was quick, had most or even more packages than Debia…

I don't know when they introduced it, but I believe MacPorts will build the common variants of the more-used packages. So, if you install a package with the default variants, you'll get a binary download instead of building from source. But indeed; fast SSDs, parallel compilation, and modern CPUs really help!

I think MacPorts builds basically everything and offers it as a binary if they think they can distribute it legally

Re: Our audit of Homebrew

#102

Post by saagarjha »

I peeked at the sandbox escape bug and its associated fix: https://github.com/Homebrew/brew/pull/17700/commits/f4e5e0c7.... Is this…correct? Like, this is to prevent it from being interpolated into a sandbox profile and messing things up. How confident are we about this list of characters?

Re: Our audit of Homebrew

#103

Post by Brian_K_White »

luckman212 wrote: post #79
woodruffw wrote: post #53

Earlier quoted context omitted.

Given that I did the audit, I don’t think it’s appropriate for me to offer an endorsement (or a negative endorsement) in this context. What I’ll say is this: the findings on Homebrew were not inconsistent with what I’d expect to find on any similarly sized userspace package manager that serves its own binary builds.

My dumb brain had to read it 3 times before realizing that by saying "the findings were not inconsistent with what I'd expect" you meant "the findings _were_ consistent with what I'd expect"

"not inconsistent" is a common phrase and is used for a reason. It's a subtle difference but "not inconsistent" is not exactly the same as "is consistent".

Re: Our audit of Homebrew

#104

Post by simonklitj »

luckman212 wrote: post #79
woodruffw wrote: post #53

Earlier quoted context omitted.

Given that I did the audit, I don’t think it’s appropriate for me to offer an endorsement (or a negative endorsement) in this context. What I’ll say is this: the findings on Homebrew were not inconsistent with what I’d expect to find on any similarly sized userspace package manager that serves its own binary builds.

My dumb brain had to read it 3 times before realizing that by saying "the findings were not inconsistent with what I'd expect" you meant "the findings _were_ consistent with what I'd expect"

That’s not necessarily what was meant though.

“Not inconsistent” is more cautious and less assertive. It allows for some ambiguity rather than claiming perfect consistency.

Re: Our audit of Homebrew

#105

Post by koito17 »

ninetyninenine wrote: post #85
koito17 wrote: post #71

Before moving to Nix, I was using MacPorts since Homebrew had some...eccentric behavior at the time (didn't work with multi-user setups, owned your /usr/local, lots of "works on my machine" problems from auto-updating and lack of version control, ...). One thing that has always felt insecure about Homebrew to me was the ability to use GitHub (not Git) URLs as ad-hoc packages. I wonder if that is how TOB-BREW-13 worke…

Nix also allows github.

Sure, Nix is extremely flexible in input definition, but it's different in the sense that Homebrew exposes a single command to e.g. install a cask from a user-inputted GitHub repository. So all an attacker needs to do is typo squat or take control of the GitHub repository that people are using to install a certain cask.

In Nix, flakes are pure functions and run in pure evaluation mode. One needs to consciously add a Git repository (URL + commit hash, branch, or tag) and then make use of something malicious exported by the input. But to find out what the flake exposes at all, reading the flake (or its documentation) is pretty much necessary.

Re: Our audit of Homebrew

#106

Post by dewey »

rurban wrote: post #84
CydeWeys wrote: post #78

Earlier quoted context omitted.

Apple should have written it themselves. It's embarrassing that they didn't. Nonprofit Linux distros with one-millionth the resources manage to write package managers and run repos, and then with MacOS, Apple gives you diddly-squat.

Apple would certainly favor macports over that rubbish ruby thing. Ports are from FreeBSD, MacOS is from FreeBSD.

No need to call someone’s free open source project “rubbish”.

Re: Our audit of Homebrew

#107

Post by Lio »

arvinsim wrote: post #88
CydeWeys wrote: post #78

Earlier quoted context omitted.

Apple should have written it themselves. It's embarrassing that they didn't. Nonprofit Linux distros with one-millionth the resources manage to write package managers and run repos, and then with MacOS, Apple gives you diddly-squat.

IMO, it's just counter to what Apple aspires MacOS to be. If they would do it all over again, I would bet that they would have wanted to make MacOS be like iOS.

I’m not sure.

Back in the day Apple marketed macOS as a serious Unix system for scientists and engineers boasting about NASA’s use of it.

I think if Apple aspired to lockdown general purpose computing they would push the ipad pro range with more models and slowly kill off the Mac but they’re not doing that.

Re: Our audit of Homebrew

#108

Post by Brian_K_White »

bokchoi wrote: post #96
pmarreck wrote: post #52

I ditched `brew` for `nix` a while back and while the TUI could be more end-user-friendly (to the point that I wrote a wrapper called "ixnay" just so I could do "ixnay install " as easily as with brew, https://github.com/pmarreck/ixnay ), the overall guarantees make it worth it.

I also find the nix command line annoying. I'll give this a try. I like the embedded `#help` documentation!

So do I ;)

I've had some form of `grep '^#h ' $0` in most of my scripts forever.

This one is a purity stunt and doesn't use grep, or anything else: https://github.com/bkw777/pdd.sh

(the script itself is of no use to you since it only talks to a piece of hardware)

The command dispatcher case statement and all the embedded help is in do_cmd() at 2857, and the help reader is help() at 425

I like their explicit #args vs #help

One jank in mine is I have a verbosity level setting which affects most messages, and help() uses it to filter some of the help. Normal verbosity shows only the normal help for the normal commands. If verbosity is set higher, then help() shows more commands.

The way that's implimented in help() is extra comments that change the behavior of help() as it's scanning the file from top to bottom.

When it hits a '#v 2' it starts only displaying the help if the user has currently set verbosity>=2 until further notice. Later down the file it hits a '#v 1' and starts displaying help again...

It works but it feels kind of 70's or assembly.

  #v 1
  #h normal help for mortals
  #h ...
  #v 2
  #h don't confuse the simple folk with this dangerous powerful stuff...
  #h ...
  #v 1
  #h a few more normal commands
  #h ...
  #v 0
  #h display this even the user has set verbosity to 0 to request silence
  #h ...

Re: Our audit of Homebrew

#109

Post by lifty »

Cloudef wrote: post #62
jonahx wrote: post #38

Earlier quoted context omitted.

I cannot reply to your top comment for some reason, so asking here: What is your personal recommendation for Mac users? Would you suggest a different package manager and, if so, which?

I use nix on both mac and linux, also on CI where homebrew is especially brittle

Don’t you have to disable SIP to use nix on macOS?

Re: Our audit of Homebrew

#110

Post by Cloudef »

lifty wrote: post #109
Cloudef wrote: post #62

Earlier quoted context omitted.

I use nix on both mac and linux, also on CI where homebrew is especially brittle

Don’t you have to disable SIP to use nix on macOS?

No. Even though SIP is slightly annoying because you can't have strace equivalent with it.
Post reply on HN