5 ms·

I'm going to ditto the positive comments. Kudos to the maintainers - not just for the package itself but for growing it. They successfully went from a hacky p

by AdamN 10y ago

I'm going to ditto the positive comments. Kudos to the maintainers - not just for the package itself but for growing it. They successfully went from a hacky page with some scripts, to a big giant repository, to multiple repos, to a fully fledged mature best-practices package manager for macOS with all the bells and whistles. The sign of a great project isn't just that it does one thing well, but that it grows with the needs of the users and engages with them to constantly make something better without falling prey to bloat. And by that measure, Homebrew gets a gold star.

stephenr 10y ago
> best-practices Wat? How is fundamentally broken dependency management and forcing installed global binaries to be user-owned "best practices"?
- spatulon 10y ago
  Can you rephrase your objection in a less patronising and more constructive way?
  - deleted 10y ago
    [deleted]
    - deleted 10y ago
      [deleted]
  - mikemcquaid 10y ago
    There was a similar comment by the same author on the top-voted comment on the last Homebrew release issue too: https://news.ycombinator.com/item?id=12548454 https://news.ycombinator.com/item?id=12548454
  - stephenr 10y ago
    I asked a simple question, which is basically the same question I ask any time someone rushes to praise Homebrew like it's the best thing since installable software. The person I replied to stated that Homebrew follows best practices. I asked how that's possible when it has two major failings compared to pretty much every other package management tool. The Homebrew project has made it clear that they have no intention of fixing these two failings: - they've doubled-down on the "install binaries writable by users", and proclaim the issue of owning /usr/local "fixed". Now you just need to own /usr/local/bin, which basically means nothing has changed from a security point of view. - even when they finally admit the dependency management issue with binary packages, their solution is to just remove/disable some binary packages, forcing all users to compile them from source, and close the issue. The project has massive, glaring issues. Honestly, it's like a competition these days between NPM and Homebrew to see which can be a worse tool. At least NPM doesn't insist globally installed packages be user-writable.
    - berntb 10y ago
      Wouldn't this be mostly solved by a paragraph in the Homebrew documentation that recommend creating a specific user which do installations? Edit: It seems to be fixed anyway? https://news.ycombinator.com/item?id=12892929 https://news.ycombinator.com/item?id=12892929 (That aside, this praise was good to read. Homebrew didn't work well enough for me a few years back, so I got a Linux computer. I'll reconsider Macs next year when it is ~ time to get a new laptop.) Edit: Let user "homebrew" have id 0. I tried MacPorts too. Hopefully either works for me next time.
      - stephenr 10y ago
        No. Root is the specific user which should do installations. Thus, the "solution" is for Homebrew to stop pretending that password-less binary installs is a "feature" instead of a massive security hole. Honestly, Homebrew doesn't seem like a reason to either use or not use a Mac. For me personally, (as I mentioned elsewhere), the small amount of unix-y host (i.e. macOS) software I install is available in native Installer packages. The rest I install in Debian VMs. For those that need/want more unix-y tools at the host level, there are a lot of positive comments about MacPorts in this thread, and it specifically doesn't have the permissions issue that Homebrew has (it requires being run as sudo, as it drops to a special account for compiling, and then later installs as root) Reply-to-Edits: > Edit: It seems to be fixed anyway? https://news.ycombinator.com/item?id=12892929 https://news.ycombinator.com/item?id=12892929 No. You still need to change ownership of /usr/local/bin. The problem isn't fixed, at all. > Edit: Let user "homebrew" have id 0. No. That would essentially be the same as running `sudo homebrew`, which they don't support. It would also mean that packages that need to be compiled will do so as root, not a limited user account as they should be.
        berntb 10y ago
        OK, thanks. It was a few years since I touched the Mac package managers. (I ought to ask or go read up on why it is like this, but I'll let it wait a year to when I research the next machine anyway.) (Edit: Weird to not allow root? Oh, next year. :-) )
        10y ago
mikemcquaid 10y ago
Thanks for the kind words. You'd be surprised how motivating they are. <3
- amorphid 10y ago
  I started writing a package manager example app, and I quickly learned how much work goes into creating a good one. Ever since I have been grateful for any work others put into working on package management!
- swrobel 10y ago
  Thanks so much! Without homebrew I'd probably end up going back to Linux.
  - nindalf 10y ago
    Same here. It's a bother to use a computer without apt-get or homebrew.
  - avelosa 10y ago
    Same!

by AdamN 10y ago

stephenr 10y ago

> best-practices Wat? How is fundamentally broken dependency management and forcing installed global binaries to be user-owned "best practices"?

spatulon 10y ago
Can you rephrase your objection in a less patronising and more constructive way?
- deleted 10y ago
  [deleted]
  - deleted 10y ago
    [deleted]
- mikemcquaid 10y ago
  There was a similar comment by the same author on the top-voted comment on the last Homebrew release issue too: https://news.ycombinator.com/item?id=12548454 https://news.ycombinator.com/item?id=12548454
- stephenr 10y ago
  I asked a simple question, which is basically the same question I ask any time someone rushes to praise Homebrew like it's the best thing since installable software. The person I replied to stated that Homebrew follows best practices. I asked how that's possible when it has two major failings compared to pretty much every other package management tool. The Homebrew project has made it clear that they have no intention of fixing these two failings: - they've doubled-down on the "install binaries writable by users", and proclaim the issue of owning /usr/local "fixed". Now you just need to own /usr/local/bin, which basically means nothing has changed from a security point of view. - even when they finally admit the dependency management issue with binary packages, their solution is to just remove/disable some binary packages, forcing all users to compile them from source, and close the issue. The project has massive, glaring issues. Honestly, it's like a competition these days between NPM and Homebrew to see which can be a worse tool. At least NPM doesn't insist globally installed packages be user-writable.
  - berntb 10y ago
    Wouldn't this be mostly solved by a paragraph in the Homebrew documentation that recommend creating a specific user which do installations? Edit: It seems to be fixed anyway? https://news.ycombinator.com/item?id=12892929 https://news.ycombinator.com/item?id=12892929 (That aside, this praise was good to read. Homebrew didn't work well enough for me a few years back, so I got a Linux computer. I'll reconsider Macs next year when it is ~ time to get a new laptop.) Edit: Let user "homebrew" have id 0. I tried MacPorts too. Hopefully either works for me next time.
    - stephenr 10y ago
      No. Root is the specific user which should do installations. Thus, the "solution" is for Homebrew to stop pretending that password-less binary installs is a "feature" instead of a massive security hole. Honestly, Homebrew doesn't seem like a reason to either use or not use a Mac. For me personally, (as I mentioned elsewhere), the small amount of unix-y host (i.e. macOS) software I install is available in native Installer packages. The rest I install in Debian VMs. For those that need/want more unix-y tools at the host level, there are a lot of positive comments about MacPorts in this thread, and it specifically doesn't have the permissions issue that Homebrew has (it requires being run as sudo, as it drops to a special account for compiling, and then later installs as root) Reply-to-Edits: > Edit: It seems to be fixed anyway? https://news.ycombinator.com/item?id=12892929 https://news.ycombinator.com/item?id=12892929 No. You still need to change ownership of /usr/local/bin. The problem isn't fixed, at all. > Edit: Let user "homebrew" have id 0. No. That would essentially be the same as running `sudo homebrew`, which they don't support. It would also mean that packages that need to be compiled will do so as root, not a limited user account as they should be.
      - berntb 10y ago
        OK, thanks. It was a few years since I touched the Mac package managers. (I ought to ask or go read up on why it is like this, but I'll let it wait a year to when I research the next machine anyway.) (Edit: Weird to not allow root? Oh, next year. :-) )
      - 10y ago

mikemcquaid 10y ago

Thanks for the kind words. You'd be surprised how motivating they are. <3

amorphid 10y ago
I started writing a package manager example app, and I quickly learned how much work goes into creating a good one. Ever since I have been grateful for any work others put into working on package management!
swrobel 10y ago
Thanks so much! Without homebrew I'd probably end up going back to Linux.
- nindalf 10y ago
  Same here. It's a bother to use a computer without apt-get or homebrew.
- avelosa 10y ago
  Same!