61–68 of 68 posts
ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/linuxbrew/go/install)"
Homebrew is not only a weak package manager, it is a dangerous package manager. No one makes it clear anywhere in the docs or on the site that it should never be used on a server or world-facing service...and people are using it for that. Because it is installed in userland (its most advertised feature), it runs everything as the same user (probably an admin level user with sudo privileges). This throws away 40 years…
>it is a dangerous package manager To go along with this theme, I must ask: Does homebrew do any isolation when building from source? Chroots, separate process namespaces, etc. >All so you can install it without sudo. This is actually a really great feature. I work on a package manager called Guix, which also allows for unprivileged package management. It's one of my favorite features. You and I could have user accou…
No. This is why they install as the user. "For security", you see.
I agree that non-root installs are a useful feature for some scenarios. But, the problem with that for servers is you need to be able to start all of your services as different users. That's really not optional. How you get there doesn't really matter, to me, but dpkg and RPM have long had it solved.
I've looked at Guix and Nix, and find them neat. I'm kind of a package management nerd (and I judge all operating systems by their package management story...Windows and Mac OS X are unacceptable, most modern Linuxes are pretty pretty good, FreeBSD is getting better). I'm not sure I'm willing to make all of the tradeoffs and move onto such a foreign system layout, but it's on my radar.
Earlier quoted context omitted.
>it is a dangerous package manager To go along with this theme, I must ask: Does homebrew do any isolation when building from source? Chroots, separate process namespaces, etc. >All so you can install it without sudo. This is actually a really great feature. I work on a package manager called Guix, which also allows for unprivileged package management. It's one of my favorite features. You and I could have user accou…
"Does homebrew do any isolation when building from source? Chroots, separate process namespaces, etc." No. This is why they install as the user. "For security", you see. I agree that non-root installs are a useful feature for some scenarios. But, the problem with that for servers is you need to be able to start all of your services as different users. That's really not optional. How you get there doesn't really matte…
Anything with an attack surface also must not be able to replace its own binaries/code. Otherwise a one-time exploit is instantly updated to a permanent infection.
Earlier quoted context omitted.
Honest question, in what way is brew faster, more flexible, or more reliable than apt-get or yum? I've had far more problems with it than I have its Linux brethren.
I have never hung my OS X boot simply by updating Homebrew packages. I have frequently hung up my Linux distro boot simply by apt-get updating. To the point that I now run all my Linux OS'es in a VM and take a snapshot prior to updating. Coming from a Mac background, this possibility is not only ridiculous , it's fucking unacceptable. And it happens BECAUSE apt-get and yum mutate the OS install instead of installing…
Earlier quoted context omitted.
Sure, but having a separate package manager (or, at least, a distinct package management "realm") for pure userland things that cannot break the OS install so that you know when you install from it you will not break the install, even with dependencies that may get pulled in, is good for piece of mind. It might be better to have a single package manager which supported bother user and OS packages, and clearly disting…
As I mentioned in a different comment, I don't think there's anything about yum/rpm that precludes doing this. Provided someone took the time to create a repository of relocatable rpm's, you could create a "yumbrew" script that does something like yum-downloader --deps --destdir=~/.myrpms foo-1.3.3.7; rpm -U --prefix=~/.yumbrew/ --dbpath=~/.yumbrewdb ~/.myrpms/* or whatever version of that would actually work. This h…
I think the biggest issue would be having it recognise packages already installed in the system when it's using a different info directory - it's possible a lot of packages would get re-installed "locally".
Other than that, I believe your concept should work on Debian.
Earlier quoted context omitted.
Can I get one of these to manage packages installed to /home in Ubuntu?
Do you mean install packages to your user's homedir or to use the package manager on a system where you do not have root access?
This is totally silly. Homebrew isn't a very good package manager. When I used it at a previous job (the only time I've used OS X), it was quite unreliable. It would try to build most things from source (which sometimes failed), but then download pre-built binaries for others. IIRC, installing the MySQL package just downloaded a binary from Oracle, it wasn't even a binary pre-built and verified with Homebrew! I have…
The whole point of Homebrew is: 1) To install things in userland 2) To make maintenance easier. Is there a Linux package manager that puts everything in userland in a place like /usr/local? If not, then it installs things into the operating system , essentially. And that is bad design, pure and simple. You're basically mutating your OS, with nondeterministic results- such as I often run into when I hit "update everyt…
No halfway-knowledgeable linux user cares about this because...
If not, then it installs things into the operating system, essentially.
...this is only true for a Mac, where a third party comes in and opaquely modifies your entire filesystem with no accountability. On a linux distro the OS is upgraded through the package manager, so a userland install is not a needed feature.
And Homebrew has a terrible track record with #2 as well. Certainly it's not going to beat any of the forementioned package managers.