5 ms·

I wonder what this Google recruiter would say about this: https://twitter.com/mxcl/status/608682016205344768 https://twitter.com/mxcl/status/608682016205344768.

• dozzie 10y ago
  It's not like Homebrew is a solid piece of software. Every now and then I see somebody complaining about how it resolves dependencies. And the team didn't provide any package verification whatsoever, no package signatures and even no SSL/TLS, and they don't see any problem with that. Considering this, I wouldn't dismiss the recruiter's decision that easily.
  • xyzzy123 10y ago
    The brew script itself is bootstrapped over an HTTPS gist. My understanding is that one then gets formulas from github over TLS (e.g. git remote -v shows https:// https:// ...), and that both source and "bottle" (binary) downloads are identified by SHA256, SHA1 or MD5 in the formula for the package. The formulas themselves can of course execute code, but in theory that is auditable. On the other hand, I haven't looked at the code, so I'd be interested in hearing more about what bugs you about it. EDIT: I do see that brew.sh site itself doesn't have a valid cert, apparently because they want to keep it on github pages, which is not ideal in terms of bootstrapping...
  • joe563323 10y ago
    Even though if it is a solid piece of software, what is wrong with not hiring a guy who does not know the fundamentals(google standard)? Sounds very much google and i would not expect anything less of a googles employees.