Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Homebrew 4.0.0

brew.sh

Post reply on HN
Print view View original

311–320 of 403 posts

Re: Homebrew 4.0.0

#311

Post by jbverschoor »

anshargal wrote: post #50

While I use Homebrew on my Mac — it is a major risk. I am afraid that the project is not following strict security policies and will be compromised at some point. Evil package or evil version of brew can steal or modify my data. I think this will also hurt the Mac platform. I wish Apple would invest some effort into building an App Store for cli programs. While it may be complicated for the community(require signing,…

Same here.. I just want a default sandbox (no network + only file access to it's subdirectories)

The alternative is to run VMs/containers/etc for each project. But at that point, it will the beginning of the end for Apple's software, cause you're esentially running linux and using macOS as a terminal/thin client.. (Unit) devtools is how they got big with OS/X, and I think they sometimes forget this.

Re: Homebrew 4.0.0

#312

Post by aequitas »

jonasb wrote: post #271
aequitas wrote: post #172

Earlier quoted context omitted.

I've been trying Nix devenv[0] and nix-darwin[1] on Mac recently and having a blast. Definitely better than the stuff I had to build around Homebrew to make development environments consistent across machines. Nix-darwin even has support to install Homebrew packages. [0] https://devenv.sh [1] https://github.com/LnL7/nix-darwin

devenv is super promising, but I do find it a bit intrusive that Nix creates a separate volume for its store on Mac OS

I was bummed out by that too initially.But it's kind of inevitable with root not writable on the latest macOS releases and needing the store to be under /nix.

Re: Homebrew 4.0.0

#313

Post by melvyn2 »

latexr wrote: post #127
rpgbr wrote: post #107

Earlier quoted context omitted.

I'm not a very technical person, but I think MacPorts adheres better to macOS standards and security practices. (At least it asks my admin password before any major interaction.) Been using for a few years, coming from Homebrew, and it's running smoothly.

> At least it asks my admin password before any major interaction. Homebrew specifically stops you from doing stuff as root. It asks for your password once at install time so it never has to do it again.

It does that by making a global location (/usr/local) user-owned, which I'd say is much worse.

Re: Homebrew 4.0.0

#314

Post by bojo »

dividedbyzero wrote: post #188
bsnnkv wrote: post #158

I have a lot of love for Homebrew from many years of using it, but I don't think you'll ever find me using it in macOS or Linux again. I use Nix on both now and I'm convinced that it is the saner way of doing things.

Does Nix still have that extremely steep and high learning curve and huge time invest before you actually grok it? I'd love a Nix that is about as hard to use as homebrew, but no luck so far.

To be fair you only really need to know the commands to invoke which are similar to brew as far as what they do, and not the underlying nix expression language which is where things get difficult. Unless you intend to go full power user and add your own overrides, in which case might not be worth it.

Re: Homebrew 4.0.0

#315

Post by anshargal »

woodruffw wrote: post #191
anshargal wrote: post #50

While I use Homebrew on my Mac — it is a major risk. I am afraid that the project is not following strict security policies and will be compromised at some point. Evil package or evil version of brew can steal or modify my data. I think this will also hurt the Mac platform. I wish Apple would invest some effort into building an App Store for cli programs. While it may be complicated for the community(require signing,…

> While I use Homebrew on my Mac — it is a major risk. I am afraid that the project is not following strict security policies and will be compromised at some point. Evil package or evil version of brew can steal or modify my data. This is a genuine question: what is your threat model, and what security policies would you like to see? It's hard to imagine a threat model that assumes an "evil version of brew" that does…

It is not feasible to avoid installing any third-party software. Moreover I admitted that I use Homebrew.

However I don’t understand what makes Homebrew reliable. Homebrew is a non-profit project run entirely by unpaid volunteers.

I trust repositories controlled by corporations (RHEL, Ubuntu) or properly(?) governed non-profit organizations (Debian) more. Also I trust App Store more, because of sandboxing, static and dynamic analysis.

Re: Homebrew 4.0.0

#316

Post by bsnnkv »

dividedbyzero wrote: post #188
bsnnkv wrote: post #158

I have a lot of love for Homebrew from many years of using it, but I don't think you'll ever find me using it in macOS or Linux again. I use Nix on both now and I'm convinced that it is the saner way of doing things.

Does Nix still have that extremely steep and high learning curve and huge time invest before you actually grok it? I'd love a Nix that is about as hard to use as homebrew, but no luck so far.

Imo, no. I think the documentation is very good, unlike what I had heard. The thing that I really had to invest in was my ability to patiently read documentation closely instead of aimlessly trying to find a shortcut by jumping around the doc pages.

Re: Homebrew 4.0.0

#317

Post by woodruffw »

anshargal wrote: post #315
woodruffw wrote: post #191

Earlier quoted context omitted.

> While I use Homebrew on my Mac — it is a major risk. I am afraid that the project is not following strict security policies and will be compromised at some point. Evil package or evil version of brew can steal or modify my data. This is a genuine question: what is your threat model, and what security policies would you like to see? It's hard to imagine a threat model that assumes an "evil version of brew" that does…

It is not feasible to avoid installing any third-party software. Moreover I admitted that I use Homebrew. However I don’t understand what makes Homebrew reliable. Homebrew is a non-profit project run entirely by unpaid volunteers. I trust repositories controlled by corporations (RHEL, Ubuntu) or properly(?) governed non-profit organizations (Debian) more. Also I trust App Store more, because of sandboxing, static and…

I don't understand the distinction you're making between Homebrew and other non-profit OSS orgs: Homebrew has a documented governance structure[1] and is hosted under a non-profit foundation.

The App Store exists primarily to distribute proprietary applications. Homebrew exists primarily to distribute open source packages. Comparing the two (and Apple's justified focus on sandboxing, etc.) feels like a mismatch.

[1]: https://docs.brew.sh/Homebrew-Governance

Re: Homebrew 4.0.0

#318

Post by woodruffw »

chongli wrote: post #299
woodruffw wrote: post #287

Earlier quoted context omitted.

> Do you drop unpopular packages? Yes: Homebrew deprecates and/or disables packages if we see evidence that they're unmaintained and not actually supported on the platforms we support, or only used by a tiny fraction of users while also requiring disproportionate maintainer time (e.g. due to complex or flaky builds). The goal is to balance conflicting user interests: 99% of users want maintainer effort focused on the…

So if a package has a small community of users and is well-maintained upstream but not popular overall you'll keep it around?

Generally speaking, yes: we don't remove things that aren't disproportionately burdensome. You can see that in the yearly analytics[1]: there are packages that only get a few dozen downloads a year, and we don't remove them because they don't cause any issues.

[1]: https://formulae.brew.sh/analytics/install/365d/

Re: Homebrew 4.0.0

#319

Post by eviks »

throw0101c wrote: post #23

On macOS, has anyone moved from/to MacPorts to/from Homebrew? Why did you move? What are the pros and cons of each system?

Switched to MacPorts on an older machine which Homebrew dropped support for (and deleted all prebuilt binaries)

While neither is great as a package manager, especiall with their dependency resolution, here are a few pros&cons:

Apps: ++ Brew has a much more up-to-date collection, also more non-source binaries.

App customization: + Port, Brew dropped support for custom install flags a while ago + Brew you can setup autoupdate for your personal customizations with github actions since the main repo is using them, Ports does it manually, so you can't copy&paste their action for your use (+ Brew allows you to install Mac .app bundles in a custom folder)

Security: + Ports has a slightly better security model (folder persmissions are better though I think it only matters for multi-user machines, so mostly no relevant; it also does some sandboxing on install via a specially created user), the downside is annoying sudo, but you can remove the need for sudo for some less sensitive ops like update/uninstall to cut down on the annoyance

Space: + Brew. Both waste it with their poor package repository architecture, but with Brew you can at least delete the repo after the first install and use their API to download updates. With Ports you can't do that, moreover it duplicates its registry (one for sync, uncompressed, another for local use)

Docs: + Brew, also random Google/SO answers are less likely to be outdated

UI: + Brew. Has more info (like size), better formatted

Re: Homebrew 4.0.0

#320

Post by misnome »

melvyn2 wrote: post #313
latexr wrote: post #127

Earlier quoted context omitted.

> At least it asks my admin password before any major interaction. Homebrew specifically stops you from doing stuff as root. It asks for your password once at install time so it never has to do it again.

It does that by making a global location (/usr/local) user-owned, which I'd say is much worse.

Several years ago, when the read-only-system OS changes happened, they switched to /opt/homebrew.
Post reply on HN