Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Homebrew 4.0.0

brew.sh

Post reply on HN
Print view View original

191–200 of 403 posts

Re: Homebrew 4.0.0

#191

Post by woodruffw »

anshargal wrote: post #50

While I use Homebrew on my Mac — it is a major risk. I am afraid that the project is not following strict security policies and will be compromised at some point. Evil package or evil version of brew can steal or modify my data. I think this will also hurt the Mac platform. I wish Apple would invest some effort into building an App Store for cli programs. While it may be complicated for the community(require signing,…

> While I use Homebrew on my Mac — it is a major risk. I am afraid that the project is not following strict security policies and will be compromised at some point. Evil package or evil version of brew can steal or modify my data.

This is a genuine question: what is your threat model, and what security policies would you like to see? It's hard to imagine a threat model that assumes an "evil version of brew" that doesn't also prevent you from installing any third-party software on your machine. Malicious packages are always possible, but Homebrew's integrity checks do an adequate (but improvable!) job of making such attacks auditable; I'm not aware of any successful supply-chain attacks mounted against Homebrew users.

I have a lot of experience with various package managers, and Homebrew is not particularly out of band with its peers (which should be read, partially, as a general indictment of packaging practices).

Re: Homebrew 4.0.0

#193

Post by woodruffw »

jillesvangurp wrote: post #8
stjo wrote: post #2

> Homebrew’s analytics are now sent both to Google Analytics and our new, self-hosted InfluxDB instance hosted in the EU. > If you had previously set HOMEBREW_NO_ANALYTICS because you didn’t like Google Analytics and/or data being sent to the USA: please consider unsetting this and setting HOMEBREW_NO_GOOGLE_ANALYTICS instead, allowing analytics data to be sent to our new InfluxDB host. My package manager was reporti…

They'd be well advised to make this opt-in only for legal reasons. This is not going to go down well in a lot of places and they might get exposed to law suits.

Homebrew is not a custodian of any personally identifiable data.

Re: Homebrew 4.0.0

#194

Post by nicky0 »

pdimitar wrote: post #170
lamontcg wrote: post #161

Earlier quoted context omitted.

> Why does a package manager need to track their users at all? Do any of you actually work in this industry shipping software products to end users? Without telemetry the problem there is literally one of trying to read the mind of your end users to figure out what they're doing, hoping that your internal CI manages to reflect the configuration in their environment.

Any actual arguments? I don't see why something that's little more than a file server needs telemetry.

[flagged]

Re: Homebrew 4.0.0

#196

Post by mo_42 »

ianai wrote: post #75
pimterry wrote: post #13

Earlier quoted context omitted.

As in the post: they're intending to drop the GA part entirely within 90 days, and it sounds like the new metrics are entirely anonymous, and so not covered by GDPR etc. IANAL but as far as I can tell that should avoid all legal concerns once GA is gone.

Why does a package manager need to track their users at all? If you want usage statistics for packages just track how often individual packages are downloaded on the server side. A maintainer has no need to know who's installing what.

This discussion on GitHub reveals the mindset of the Homebrew people: https://github.com/Homebrew/brew/pull/6745

Re: Homebrew 4.0.0

#197

Post by dlyons »

aequitas wrote: post #172
t8sr wrote: post #67

As an old hand who was around when homebrew started, I feel obliged to let people know there are alternatives. If you find brew's take-over-your-system-and-youll-thank-me approach off putting, and/or you value stability over the coolness factor, MacPorts is still alive and well ( https://www.macports.org ), and in-fact has basically all the same packages brew does. In 18 years of using MacPorts, it's never messed up…

I've been trying Nix devenv[0] and nix-darwin[1] on Mac recently and having a blast. Definitely better than the stuff I had to build around Homebrew to make development environments consistent across machines. Nix-darwin even has support to install Homebrew packages. [0] https://devenv.sh [1] https://github.com/LnL7/nix-darwin

Yes, it is really great! I haven't had to run homebrew in forever; Nix + home-manager does it as part of my overall config. I've configured home-manager to both install and update homebrew packages.

Did you know you can even install Mac App Store apps?

Here are the relevant bits where my config does it: https://github.com/dustinlyons/nixos-config/blob/main/macos/...

Re: Homebrew 4.0.0

#198

Post by kimi »

justinclift wrote: post #123
FnuGk wrote: post #60

Earlier quoted context omitted.

> It’s only happened twice in more than a decade, but I still have the feeling that I was better off compiling stuff manually and cultivating a tidy /usr/local/bin like I did in early 2000s. But it’s probably rose-colored glasses and I’d definitively never take the time these days. thats exactly what homebrew does.

A lot of Homebrew packages are pre-compiled binaries ("bottles" produced by Homebrew) that are pretty much just downloaded and untarred onto your system. The Homebrew formulas' are what's used to produce those binaries, or - if there's no pre-compiled one available - that's when it's compiled live on your system. Seems like a decent tradeoff, as otherwise installing (say) Qt could take an hour+, since that's a bit of…

The problem is that every time you install something it will update a gazillion dependencies because there is a minor version difference in a library I don't even use. And of course I did not ask for those binaries to be upgraded.

When I do a yum install, 99% of the cases it just add the package I need. And won't mess with my dev tools.

Re: Homebrew 4.0.0

#199

Post by rch »

dividedbyzero wrote: post #188
bsnnkv wrote: post #158

I have a lot of love for Homebrew from many years of using it, but I don't think you'll ever find me using it in macOS or Linux again. I use Nix on both now and I'm convinced that it is the saner way of doing things.

Does Nix still have that extremely steep and high learning curve and huge time invest before you actually grok it? I'd love a Nix that is about as hard to use as homebrew, but no luck so far.

This might be helpful:

-- https://zero-to-nix.com/

Someone also did a video walkthrough of this material recently. I don't have the link, but it might be worth searching for.

Re: Homebrew 4.0.0

#200

Post by woodruffw »

lrvick wrote: post #44

Reminder that nothing in Homebrew has any signing or attempt at supply chain integrity. Now that they are moving away from clients using git, so even git commit signing is off the table now. When you install brew you are giving hundreds of people (or anyone who has access to their Github accounts) full remote code execution on your machine. Never ever use brew on a machine you use to access production.

> Reminder that nothing in Homebrew has any signing or attempt at supply chain integrity. Now that they are moving away from clients using git, so even git commit signing is off the table now.

This is incorrect: Homebrew pins bottle and source installs to digests, meaning that you do have a strong integrity check each time you install a package.

Homebrew does not currently do code signing, which is not particularly abnormal for non-Linux-distribution package managers (ask yourself when you last verified a PGP signature from PyPI). There are some plans in progress to remedy that but, in its absence, HTTPS and package digests are both reasonable and no worse than standard practice in packaging.

Post reply on HN