Live data from Hacker News

Homebrew 4.0.0

brew.sh

141–150 of 403 posts

Re: Homebrew 4.0.0

#141
post #58

Thanks for the hard work everyone. I've used brew and brew installed software almost everyday since it was first launched way back when. Mike, Max and the gang have materially improved my life at least, cheers! :D

Despite mentioning he started Homebrew every chance he gets, Max hasn’t been part of Homebrew for longer than he was a part of it.

Re: Homebrew 4.0.0

#142
post #52

Earlier quoted context omitted.

I think you’re right about the rose-colored nostalgia: it’s easy to forget how far behind people got on updates. I remember so many support emails where someone had hit a bug which had been patched a year earlier but never thought to install it. A couple of times where people reinvented something which had been added to PHP in the meantime because they didn’t know it was there.

But do I need the latest openSSL for local development? Seems more trouble than it should.

That’s why they keep it private by default, but the answer is often yes. There have been multiple times where a package like Python 3.10 required a newer version (1.1.1) than the OS release included (I suspect that’s also why the AWS Lambda runtime is stuck on 3.9 since it’s based on Amazon Linux 2 and that uses 1 .0).

This has settled down a bit but the big HTTPS-everywhere push last decade flushed out a ton of things which had been quietly aging in place, unnoticed until someone started depending on SNI, newer crypto suites, actually disabling deprecated versions of SSL/TLS, etc.

Re: Homebrew 4.0.0

#143

Earlier quoted context omitted.

I haven't looked at what they're actually collecting, but here's a few things that come to mind: - Time to install packages - Versions of things - Has the compilation (when required) failed? What dependency versions are installed? - CPU architecture - OS version ... There's a lot more that can be sent from the client that's not available on the server side. > I fundamentally don't 'get' what richness they actually ne…

Im okay with sending data to the server if things break and be asked each time to okay it. Is it safe to assume that if no errors or exceptions are encountered nothing should be sent back home?

How can they monitor failure rate if they only track failures though?

Re: Homebrew 4.0.0

#144
post #106

I despise, despise, Homebrew's "we know better than you" approach to always installing the latest versions of every dependency. How tf is this fine? They don't even offer alternative. They just say "we can't test all of the packages installed and all version combinations, so this is the best we can do". Well, no one asked you to test my exact setup. All I'm asking for is: if I have perfectly working Node 18 and I nee…

I use asdf for tooling I need to keep several versions of. People have also mentioned Nix, but I haven't tried it out yet.

I wanted to love Nix, and still use it sometimes, but it is unfortunately not very friendly to arbitrary package version selection. Asdf for the worse-is-better win!

Re: Homebrew 4.0.0

#145
post #133

Earlier quoted context omitted.

[flagged]

Don’t do this! not only is it wrong for Apple Silicon Macs, you may be screwing up software not installed by Homebrew. Several GUI apps with CLI components install to /usr/local/bin.

Yes, I know, but most Unix things on my Mac are either installed by homebrew or myself, so I think it’s safe. But it’s a desperation act for sure.

Why do you say it’s wrong on Apple Silicon? If you mean system integrity protection stuff, I don’t think it applies to /usr/local

Re: Homebrew 4.0.0

#146
post #75

Earlier quoted context omitted.

Why does a package manager need to track their users at all? If you want usage statistics for packages just track how often individual packages are downloaded on the server side. A maintainer has no need to know who's installing what.

> Why does a package manager need to track their users at all? According to https://docs.brew.sh/Analytics they use it to measure how often formulas fail to install, to get overall metrics on which OS versions are used, and to correlate those (i.e. to tell on which OS versions specific packages fail to install correctly). > A maintainer has no need to know who's installing what Aside from the IP, they don't know who'…

I agree that they don't need to know the "who", but it is perfectly understandable that they want to know "what" is being installed. And as part of the "what", they would want to know on which platform, and whether the install succeeded or failed, and probably a few other metrics about the install to ensure that things are working correctly and identify gaps that should be filled.

Based on what I read on the site, that looks like exactly what they are doing, and they are explicitly NOT storing information that would identify "who".

Re: Homebrew 4.0.0

#148
post #133

Earlier quoted context omitted.

Don’t do this! not only is it wrong for Apple Silicon Macs, you may be screwing up software not installed by Homebrew. Several GUI apps with CLI components install to /usr/local/bin.

Yes, I know, but most Unix things on my Mac are either installed by homebrew or myself, so I think it’s safe. But it’s a desperation act for sure. Why do you say it’s wrong on Apple Silicon? If you mean system integrity protection stuff, I don’t think it applies to /usr/local

> Yes, I know

But other users might not, and you wrote that as a reply to someone asking how to do it. My comment was meant to warn others they should not go that route, especially when there’s an official uninstallation script (linked in my other comment).

> Why do you say it’s wrong on Apple Silicon?

Because in that case Homebrew installs to /opt/homebrew, not /usr/local.

Re: Homebrew 4.0.0

#149

I despise, despise, Homebrew's "we know better than you" approach to always installing the latest versions of every dependency. How tf is this fine? They don't even offer alternative. They just say "we can't test all of the packages installed and all version combinations, so this is the best we can do". Well, no one asked you to test my exact setup. All I'm asking for is: if I have perfectly working Node 18 and I nee…

> I despise, despise, Homebrew's "we know better than you" approach to always installing the latest versions of every dependency

I love it. I'm using a desktop, not a server. I specifically want my dependencies to be always up to date

> All I'm asking for is: if I have perfectly working Node 18 and I need to install fcking Shopify CLI, don't fcking install Node 19 and break my whole setup! Tf?!

Then install nvm. Nvm will always be latest, the Homebrew packages will always depend on the latest node version, and locally you'll depend on your own node version that you installed with nvm.

Re: Homebrew 4.0.0

#150
post #110

Earlier quoted context omitted.

I was just wondering, have they considered storing all that in an SQLite file? And then you could refresh the file every 6 hours, say, and post it on a CDN?

Using SQLite instead of JSON could have worked too and would likely make the manifests smaller: > curl -sI https://formulae.brew.sh/api/formula.json | grep content-length => 19898457 (~19.9MB) > curl -sI https://formulae.brew.sh/api/cask.json | grep content-length => 4023930 (~4MB) But the JSON API has been around for a while so brew 4.0 just makes use of it by default. Brew 3.3 added an off-by-default HOMEBREW_INSTA…

Homebrew actually passes `--compressed` here so it's smaller:

> curl -sI --compressed https://formulae.brew.sh/api/formula.json | grep content-length => 3482583 (~3.3MB)

> curl -sI --compressed https://formulae.brew.sh/api/cask.json | grep content-length => 722915 (~0.6MB)

Post reply on HN