3 ms·

Can you rephrase your objection in a less patronising and more constructive way?

by spatulon 10y ago

deleted 10y ago
[deleted]
- deleted 10y ago
  [deleted]
mikemcquaid 10y ago
There was a similar comment by the same author on the top-voted comment on the last Homebrew release issue too: https://news.ycombinator.com/item?id=12548454 https://news.ycombinator.com/item?id=12548454
stephenr 10y ago
I asked a simple question, which is basically the same question I ask any time someone rushes to praise Homebrew like it's the best thing since installable software. The person I replied to stated that Homebrew follows best practices. I asked how that's possible when it has two major failings compared to pretty much every other package management tool. The Homebrew project has made it clear that they have no intention of fixing these two failings: - they've doubled-down on the "install binaries writable by users", and proclaim the issue of owning /usr/local "fixed". Now you just need to own /usr/local/bin, which basically means nothing has changed from a security point of view. - even when they finally admit the dependency management issue with binary packages, their solution is to just remove/disable some binary packages, forcing all users to compile them from source, and close the issue. The project has massive, glaring issues. Honestly, it's like a competition these days between NPM and Homebrew to see which can be a worse tool. At least NPM doesn't insist globally installed packages be user-writable.
- berntb 10y ago
  Wouldn't this be mostly solved by a paragraph in the Homebrew documentation that recommend creating a specific user which do installations? Edit: It seems to be fixed anyway? https://news.ycombinator.com/item?id=12892929 https://news.ycombinator.com/item?id=12892929 (That aside, this praise was good to read. Homebrew didn't work well enough for me a few years back, so I got a Linux computer. I'll reconsider Macs next year when it is ~ time to get a new laptop.) Edit: Let user "homebrew" have id 0. I tried MacPorts too. Hopefully either works for me next time.
  - stephenr 10y ago
    No. Root is the specific user which should do installations. Thus, the "solution" is for Homebrew to stop pretending that password-less binary installs is a "feature" instead of a massive security hole. Honestly, Homebrew doesn't seem like a reason to either use or not use a Mac. For me personally, (as I mentioned elsewhere), the small amount of unix-y host (i.e. macOS) software I install is available in native Installer packages. The rest I install in Debian VMs. For those that need/want more unix-y tools at the host level, there are a lot of positive comments about MacPorts in this thread, and it specifically doesn't have the permissions issue that Homebrew has (it requires being run as sudo, as it drops to a special account for compiling, and then later installs as root) Reply-to-Edits: > Edit: It seems to be fixed anyway? https://news.ycombinator.com/item?id=12892929 https://news.ycombinator.com/item?id=12892929 No. You still need to change ownership of /usr/local/bin. The problem isn't fixed, at all. > Edit: Let user "homebrew" have id 0. No. That would essentially be the same as running `sudo homebrew`, which they don't support. It would also mean that packages that need to be compiled will do so as root, not a limited user account as they should be.
    - berntb 10y ago
      OK, thanks. It was a few years since I touched the Mac package managers. (I ought to ask or go read up on why it is like this, but I'll let it wait a year to when I research the next machine anyway.) (Edit: Weird to not allow root? Oh, next year. :-) )
    - theCodeStig 10y ago
      You seem to have strong views about the matter. Homebrew is open source after all; why not submit a pull request with the changes that you propose?
      - stephenr 10y ago
        > why not submit a pull request with the changes that you propose I wasn't aware you could submit a pull-request to change the mentality of project leaders.

Can you rephrase your objection in a less patronising and more constructive way?

deleted 10y ago

[deleted]

deleted 10y ago
[deleted]

mikemcquaid 10y ago

There was a similar comment by the same author on the top-voted comment on the last Homebrew release issue too: https://news.ycombinator.com/item?id=12548454 https://news.ycombinator.com/item?id=12548454

stephenr 10y ago

I asked a simple question, which is basically the same question I ask any time someone rushes to praise Homebrew like it's the best thing since installable software. The person I replied to stated that Homebrew follows best practices. I asked how that's possible when it has two major failings compared to pretty much every other package management tool. The Homebrew project has made it clear that they have no intention of fixing these two failings: - they've doubled-down on the "install binaries writable by users", and proclaim the issue of owning /usr/local "fixed". Now you just need to own /usr/local/bin, which basically means nothing has changed from a security point of view. - even when they finally admit the dependency management issue with binary packages, their solution is to just remove/disable some binary packages, forcing all users to compile them from source, and close the issue. The project has massive, glaring issues. Honestly, it's like a competition these days between NPM and Homebrew to see which can be a worse tool. At least NPM doesn't insist globally installed packages be user-writable.

berntb 10y ago
Wouldn't this be mostly solved by a paragraph in the Homebrew documentation that recommend creating a specific user which do installations? Edit: It seems to be fixed anyway? https://news.ycombinator.com/item?id=12892929 https://news.ycombinator.com/item?id=12892929 (That aside, this praise was good to read. Homebrew didn't work well enough for me a few years back, so I got a Linux computer. I'll reconsider Macs next year when it is ~ time to get a new laptop.) Edit: Let user "homebrew" have id 0. I tried MacPorts too. Hopefully either works for me next time.
- stephenr 10y ago
  No. Root is the specific user which should do installations. Thus, the "solution" is for Homebrew to stop pretending that password-less binary installs is a "feature" instead of a massive security hole. Honestly, Homebrew doesn't seem like a reason to either use or not use a Mac. For me personally, (as I mentioned elsewhere), the small amount of unix-y host (i.e. macOS) software I install is available in native Installer packages. The rest I install in Debian VMs. For those that need/want more unix-y tools at the host level, there are a lot of positive comments about MacPorts in this thread, and it specifically doesn't have the permissions issue that Homebrew has (it requires being run as sudo, as it drops to a special account for compiling, and then later installs as root) Reply-to-Edits: > Edit: It seems to be fixed anyway? https://news.ycombinator.com/item?id=12892929 https://news.ycombinator.com/item?id=12892929 No. You still need to change ownership of /usr/local/bin. The problem isn't fixed, at all. > Edit: Let user "homebrew" have id 0. No. That would essentially be the same as running `sudo homebrew`, which they don't support. It would also mean that packages that need to be compiled will do so as root, not a limited user account as they should be.
  - berntb 10y ago
    OK, thanks. It was a few years since I touched the Mac package managers. (I ought to ask or go read up on why it is like this, but I'll let it wait a year to when I research the next machine anyway.) (Edit: Weird to not allow root? Oh, next year. :-) )
  - theCodeStig 10y ago
    You seem to have strong views about the matter. Homebrew is open source after all; why not submit a pull request with the changes that you propose?
    - stephenr 10y ago
      > why not submit a pull request with the changes that you propose I wasn't aware you could submit a pull-request to change the mentality of project leaders.