4 ms·
Being open source isn't going to stop someone replacing a download on a hacked server. Also, the package manager you're after is brew, specifically 'brew cask'
by Benjamin_Dobell 9y ago
Being open source isn't going to stop someone replacing a download on a hacked server.
Also, the package manager you're after is brew, specifically 'brew cask', which installs GUI apps.
EDIT: By the way, building from source doesn't stop someone replacing the source package the package manager uses. Sure you can look at the code in the package, but are you going to? It's more likely you'd check the code on Github, if at all.
- soraminazuki 9y agoI'm mostly worried about the security of the build/distribution platform, which is why I would would prefer a reputable package manager to provide binaries built and distributed using their own infrastructure. If this isn't feasible, better support for building from source would at least ensure that the binaries are correct, provided that your own computer isn't compromised. Homebrew Cask currently can't address this kind of situation, since the binary is still built and distributed from non-reputable sources. The correctness of the source code itself is surely a problem, but it's better than having to trust random binaries built and distributed from non-reputable sources.
- simooooo 9y agoThe leakyness here was the Dev, would likely be the Dev again, just pre-github
- rovr138 9y agoThe cask description is misleading though. Cask deals with applications which are too complex to compile (/shrug) but provide an .app or .pkg, or with things that only provide a compiled .app or .pkg (not open source) brew has GUI applications. Easiest one I can think of (because I use it) is Pidgin.