4 ms·

One of the things that I really dislike about homebrew is its refusal to run via sudo plus the requirement that you own /usr/local. This means: 1) It is a sec

by gregmac 10y ago

One of the things that I really dislike about homebrew is its refusal to run via sudo plus the requirement that you own /usr/local. This means: 1) It is a security hole; any application can now modify system-wide applications at any time. 2) You can't have multiple users able to use homebrew. I was expecting homebrew to be something similar to apt/yum/etc, but this makes it pretty fundamentally different. How does Macports handle this? Does $USER still need write access to /opt?

duaneb 10y ago
It's also very difficult to roll back to a previous version of a package unless the maintainers specifically opt in to tagging them. Homebrew also updates itself when you install something now, so say if you install python, it might update readline, so your postgres client will break. It's not the worst approximation of ports, but it doesn't share the quality and care that goes into package maintenance and dependency management.
oschrenk 10y ago
Re 2) I'm running a multi user homebrew setup for years. I have my users (personal and various work accounts) live under the "Local" Group and do ``` sudo chmod -R 770 /usr/local/ sudo chmod -R +a "group:Local allow delete,readattr,writeattr,readextattr,writeextattr,list,search,add_file,add_subdirectory,delete_child,file_inherit,directory_inherit" /usr/local/ ``` I remember sometimes running into permissions issues but nothing re-running that command didn't fix.
- SkyMarshal 10y ago
  It's a bit of a smell that Homebrew doesn't do this itself.
  - 1amzave 10y ago
    Really? If you're going to do that, it seems like you might as well just merge all those users into a single account anyway, considering how trivial it would be for any one of them to execute arbitrary code as any other.
  - Watabou 10y ago
    Why is 'sudo' required? Just curious. I moved away from homebrew, to compiling my own software on macOS which I just put in ~/build. I don't use sudo make install since I own the ~/build folder. What am I doing wrong in this case?
packetslave 10y ago
There's no requirement that Homebrew be in /usr/local. Some individual (poorly-written) packages may assume that, but I've been running Homebrew in $HOME/.brew for multiple years on multiple machines with no issues at all.
- ghthor 10y ago
  That's actually fucking brilliant, and aligns much better with what homebrew is. I'm setting up my new macbook from work tomorrow and this is absolutely the way I'm going to do it, and how I'll suggest any of my colleagues do as well.
DavideNL 10y ago
< plus the requirement that you own /usr/local no, this is not required anymore... https://github.com/Homebrew/brew/commit/a2f19f0a675f7cb384b48bad773d31366c6b258d https://github.com/Homebrew/brew/commit/a2f19f0a675f7cb384b4... > You can't have multiple users able to use homebrew what i did is i run Homebrew as a user i called Admin and when logged in as another user i simply do a 'su - admin' to run the brew commands..
superchink 10y ago
This is no longer the case, as of Homebrew 1.0. See this change: https://github.com/Homebrew/brew/pull/896 https://github.com/Homebrew/brew/pull/896
- vsl 10y ago
  This is only about /usr/local itself, not the directories under it, the one with executables - that's still owned by you, not root. Some difference in ease of initial installation, zero difference in terms of (in)security.

by gregmac 10y ago

duaneb 10y ago

It's also very difficult to roll back to a previous version of a package unless the maintainers specifically opt in to tagging them. Homebrew also updates itself when you install something now, so say if you install python, it might update readline, so your postgres client will break. It's not the worst approximation of ports, but it doesn't share the quality and care that goes into package maintenance and dependency management.

oschrenk 10y ago

Re 2) I'm running a multi user homebrew setup for years. I have my users (personal and various work accounts) live under the "Local" Group and do ``` sudo chmod -R 770 /usr/local/ sudo chmod -R +a "group:Local allow delete,readattr,writeattr,readextattr,writeextattr,list,search,add_file,add_subdirectory,delete_child,file_inherit,directory_inherit" /usr/local/ ``` I remember sometimes running into permissions issues but nothing re-running that command didn't fix.

SkyMarshal 10y ago
It's a bit of a smell that Homebrew doesn't do this itself.
- 1amzave 10y ago
  Really? If you're going to do that, it seems like you might as well just merge all those users into a single account anyway, considering how trivial it would be for any one of them to execute arbitrary code as any other.
- Watabou 10y ago
  Why is 'sudo' required? Just curious. I moved away from homebrew, to compiling my own software on macOS which I just put in ~/build. I don't use sudo make install since I own the ~/build folder. What am I doing wrong in this case?

packetslave 10y ago

There's no requirement that Homebrew be in /usr/local. Some individual (poorly-written) packages may assume that, but I've been running Homebrew in $HOME/.brew for multiple years on multiple machines with no issues at all.

ghthor 10y ago
That's actually fucking brilliant, and aligns much better with what homebrew is. I'm setting up my new macbook from work tomorrow and this is absolutely the way I'm going to do it, and how I'll suggest any of my colleagues do as well.

DavideNL 10y ago

< plus the requirement that you own /usr/local no, this is not required anymore... https://github.com/Homebrew/brew/commit/a2f19f0a675f7cb384b48bad773d31366c6b258d https://github.com/Homebrew/brew/commit/a2f19f0a675f7cb384b4... > You can't have multiple users able to use homebrew what i did is i run Homebrew as a user i called Admin and when logged in as another user i simply do a 'su - admin' to run the brew commands..

superchink 10y ago

This is no longer the case, as of Homebrew 1.0. See this change: https://github.com/Homebrew/brew/pull/896 https://github.com/Homebrew/brew/pull/896

vsl 10y ago
This is only about /usr/local itself, not the directories under it, the one with executables - that's still owned by you, not root. Some difference in ease of initial installation, zero difference in terms of (in)security.