Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Homebrew 6.0.0

brew.sh

Post reply on HN
Print view View original

311–320 of 380 posts

Re: Show HN: Homebrew 6.0.0

#311

Post by mikemcquaid »

cbeach wrote: post #186

Slightly tangential, but I went to set up Homebrew today on a new Mac. Stupidly clicked the top link in Google (which was sponsored but not obviously so). Took me to a spoof Homebrew page. I ran the script. Typed in my Mac password like a fool when prompted, and nothing happened. Then I realised what an idiot I’d been. Claude found evidence of an exfiltration malware on my laptop and I inmediately wiped the device an…

We’ve complained about this to Google many times to no avail. It’s very frustrating. They are literally paid money to let people install malware on your machine. Please direct all annoyance and resentment to them (we share it).

Re: Show HN: Homebrew 6.0.0

#312

Post by mikemcquaid »

Hamuko wrote: post #133

I don't understand how the tap trust improves security at all. If I'm installing something from a third-party tap, instead of running tap + install, I now run tap + trust + install? How does this protect me against compromised taps?

You can now trust individual files inside taps. It was not clear to all users before now that some commands (before —-eval-all, a mess this replaces) would evaluate all packages Ruby code from all taps). This cleans that up and some other security degrading edge cases I won’t bore you with here.

Trust is also user specific now.

It’s not a silver bullet but it does help address some potential attacks and gives us a foundation to improve on over time.

Re: Show HN: Homebrew 6.0.0

#313

Post by pjjpo »

latexr wrote: post #297
thewhitetulip wrote: post #268

Earlier quoted context omitted.

So the incident really happened lol

Ostensibly it did. But worth noting that despite many people still thinking of Max Howell when they think of Homebrew, he hasn’t been there for a long long time. Pretty sure he wasn’t there at the time of that Google interview, even. Mike and all the other contributors deserve much more credit for Homebrew. There are even contributors who since left who were there for longer and had a bigger impact than Max. And he h…

Gotten so used to brew, tap, etc never even thought how unintuitive that might be for newcomers.

Re: Show HN: Homebrew 6.0.0

#314

Post by mikemcquaid »

pdntspa wrote: post #120

Does this handle macOS installs with multiple local users? I have to su into account 1 if I want to brew install something from account 2

brew as-console-user may help here. We don’t support a multiuser setup so there may be some limitations but we try our best to address problems as they come up.

Re: Show HN: Homebrew 6.0.0

#315

Post by mikemcquaid »

ProAm wrote: post #239

Remember when this guy couldn't get hired at Apple, because Apple doesn't respect their customers or developers.....

I’ve never applied for a job at Apple.

You’re maybe thinking of the creator mxcl’s viral tweet about not getting hired at Google. He did work at Apple for a while on SwiftPM.

I also am in the “applied and didn’t get hired by Google” club which let me move back to Scotland instead :)

Re: Show HN: Homebrew 6.0.0

#316

Post by port11 »

ricardobeat wrote: post #293
port11 wrote: post #277

Earlier quoted context omitted.

Mise’s refusal to make global packages globally available is off-putting. I keep using it for specific Node versions and the integration with fnox. The big drawback: having Claude complain every couple of hours that the new worktree is untrusted; or having to prefix a bunch of commands with `mise exec …` is annoying as well. A global alias for all shells would be nice.

What do you mean by that? If you have mise activate set up correctly in your shell rc file, globally installed tools are available in every shell. There’s also shim mode [1]. I use Claude on a mise-powered project daily without any issues [1] https://mise.jdx.dev/dev-tools/shims.html

Not an expert, but Claude doesn’t seem to be running with my ZSH profile? Really, anything that isn’t a terminal and tries to use global commands, such as utilities that expect Node to be available and so on. I always have to prefix commands, unless using the terminal myself.

Re: Show HN: Homebrew 6.0.0

#317

Post by mikemcquaid »

phplovesong wrote: post #56

Does homebrew still do that insane thing when you want to upgrade a single package it tell you "hold my beer" and starts installing postgres and some obscure python version?

This behaviour came about because, before we did that we ended up upgrading just what you wanted and breaking other packages by mistake.

It’s taken a long time but we’re finally at the point where we do (pretty much) only upgrade the minimal software we need to actually avoid breakage rather than the previous “better safe than sorry” conservative approach. We also now tell you by default everything we’ll upgrade before we do it (unless you say “upgrade foo” and all we are gonna do is upgrade foo).

So: we’ve maybe solved this issue and maybe not. The perfect outcomes for everyone here is pretty much impossible given the original design of Homebrew. MacPorts or Nix or Mise are likely a better fit in that case.

Re: Show HN: Homebrew 6.0.0

#318

Post by matsemann »

pjjpo wrote: post #313
latexr wrote: post #297

Earlier quoted context omitted.

Ostensibly it did. But worth noting that despite many people still thinking of Max Howell when they think of Homebrew, he hasn’t been there for a long long time. Pretty sure he wasn’t there at the time of that Google interview, even. Mike and all the other contributors deserve much more credit for Homebrew. There are even contributors who since left who were there for longer and had a bigger impact than Max. And he h…

Gotten so used to brew, tap, etc never even thought how unintuitive that might be for newcomers.

Huh, I've never even considered that those words had anything to do with beer. I've just accepted them at face value, same as any other tech jargon.

Re: Show HN: Homebrew 6.0.0

#320

Post by latexr »

matsemann wrote: post #318
pjjpo wrote: post #313

Earlier quoted context omitted.

Gotten so used to brew, tap, etc never even thought how unintuitive that might be for newcomers.

Huh, I've never even considered that those words had anything to do with beer. I've just accepted them at face value, same as any other tech jargon.

The whole concept comes from homebrewing.

https://en.wikipedia.org/wiki/Homebrewing

Post reply on HN