6 ms·

Why is it a travesty?

by cjlm 9y ago

stephenr 9y ago
It has fundamental flaws in how it handles dependencies, particularly when dealing with binary packages. installing user-owned global software is a terrible idea. The maintainers of homebrew are aware of both issues and simply don't care: they are not going to fix either, because they won't even acknowledge that they're actual problems.
- lgas 9y ago
  Possibly because many people use their software and are very happy with it without running into those issues and addressing them would be a tremendous amount of work.
  - stephenr 9y ago
    They have put in work to actively prevent use as root, even with binary packages. This isn't just "its going to take too long", this is "fuck you, we know better than every OS vendor on the planet"
    - orf 9y ago
      Packages are often downloaded from third party sites, blindly running those with Sufi sounds like a terrible idea. Most developer Mac's are single user anyway. It's not like apt, yum or WU where the updates come from a trusted source.
      - stephenr 9y ago
        The "trusted" source in this case is Homebrew. The rest of your argument makes no sense, because homebrew is designed to be a trusted source - the recipes aren't just downloaded from any random URL. Being single user doesn't make installing software user owned any less of a bad idea.
        orf 9y ago
        ... the recepies then download code from random sources. Obviously vetted sources, but it's not a central repository with all of the packages that is controlled by Homebrew like the other package managers you list. It's just a big git repository of recepies, which are exactly that. Instructions on how to combine things (source code, binaries, flags etc) from external sources.
        stephenr 9y ago
        Not random, specific source archives, listed in the recipe, along with a known hash of the file being downloaded. Given that, it effectively is a central repo that is controlled by Homebrew.
        Myrmornis 9y ago
        > Being single user doesn't make installing software user owned any less of a bad idea. Can you explain why you believe that?
- Myrmornis 9y ago
  Running `sudo make install` in order to install software on your own laptop is a terrible idea. I've used homebrew on a mac daily for 6 years and it has worked perfectly. If it has fundamental flaws why have they not affected me?
  - stephenr 9y ago
    > Running `sudo make install` in order to install software on your own laptop is a terrible idea. Why do you believe that requiring administrator rights to install global software is "a terrible idea" ? Every single OS-vendor provided software install mechanism on computing devices in use today uses this concept. Keep in mind that I'm talking about installing, not building. No one sane suggests `sudo make && sudo make install`. It's always `make && sudo make install`. Homebrew not just doesnt do this by default, it prevents this model of building & installing, and won't even allow pre-build binaries to be installed as root.
    - Myrmornis 9y ago
      1. Because installing (frivolous) user utilities should not have the ability to write to critical system files, by default at least. 2. Because there's no make uninstall. I've had this argument with others who get similarly worked up about homebrew as you seem to. I think the problem may be that you're thinking about installing core system utilities, whereas we're talking about installing all our frivolous user-domain software. So whatever package we happen to have read about and thought "oh I'll try that out". Prior to using OS X for the last 6 years my personal laptop ran Linux for the 10 years prior to that. Not everything was available via apt-get, and I know from far too much first-hand experience the dangers of installing software with root permissions, and not being able to reverse the process, so there's really no question in my mind that you're wrong; I suspect we must be answering subtly different questions as I said above. Can you explain why you're emphasizing global software? You sound like you're talking about being a sys admin for a shared computing resource. We are just talking about our laptops. Very occasionally we put on the hat of "administrator" of our laptop, but mostly we have on the hat of "the single user". Now, how about my question: if it's as bad as people like you say, then why does it work so well for so many people?
- wruza 9y ago
  What exactly goes wrong with dependencies? Are macports any better in that regard?
  - stephenr 9y ago
    Dependencies become hardcoded at build time, so any binary 'bottle' whose source package has dependencies that are satisfied by 1+ packages will become hardcoded to just one of those dependencies. https://github.com/Homebrew/legacy-homebrew/pull/41595#issuecomment-135551114 https://github.com/Homebrew/legacy-homebrew/pull/41595#issue... Note that the maintainers response was: fuck it, the users can just re-complile this package every time they install it.

Why is it a travesty?

by cjlm 9y ago

Why is it a travesty?

It has fundamental flaws in how it handles dependencies, particularly when dealing with binary packages. installing user-owned global software is a terrible idea. The maintainers of homebrew are aware of both issues and simply don't care: they are not going to fix either, because they won't even acknowledge that they're actual problems.

lgas 9y ago
Possibly because many people use their software and are very happy with it without running into those issues and addressing them would be a tremendous amount of work.
- stephenr 9y ago
  They have put in work to actively prevent use as root, even with binary packages. This isn't just "its going to take too long", this is "fuck you, we know better than every OS vendor on the planet"
  - orf 9y ago
    Packages are often downloaded from third party sites, blindly running those with Sufi sounds like a terrible idea. Most developer Mac's are single user anyway. It's not like apt, yum or WU where the updates come from a trusted source.
    - stephenr 9y ago
      The "trusted" source in this case is Homebrew. The rest of your argument makes no sense, because homebrew is designed to be a trusted source - the recipes aren't just downloaded from any random URL. Being single user doesn't make installing software user owned any less of a bad idea.
      - orf 9y ago
        ... the recepies then download code from random sources. Obviously vetted sources, but it's not a central repository with all of the packages that is controlled by Homebrew like the other package managers you list. It's just a big git repository of recepies, which are exactly that. Instructions on how to combine things (source code, binaries, flags etc) from external sources.
        stephenr 9y ago
        Not random, specific source archives, listed in the recipe, along with a known hash of the file being downloaded. Given that, it effectively is a central repo that is controlled by Homebrew.
      - Myrmornis 9y ago
        > Being single user doesn't make installing software user owned any less of a bad idea. Can you explain why you believe that?
Myrmornis 9y ago
Running `sudo make install` in order to install software on your own laptop is a terrible idea. I've used homebrew on a mac daily for 6 years and it has worked perfectly. If it has fundamental flaws why have they not affected me?
- stephenr 9y ago
  > Running `sudo make install` in order to install software on your own laptop is a terrible idea. Why do you believe that requiring administrator rights to install global software is "a terrible idea" ? Every single OS-vendor provided software install mechanism on computing devices in use today uses this concept. Keep in mind that I'm talking about installing, not building. No one sane suggests `sudo make && sudo make install`. It's always `make && sudo make install`. Homebrew not just doesnt do this by default, it prevents this model of building & installing, and won't even allow pre-build binaries to be installed as root.
  - Myrmornis 9y ago
    1. Because installing (frivolous) user utilities should not have the ability to write to critical system files, by default at least. 2. Because there's no make uninstall. I've had this argument with others who get similarly worked up about homebrew as you seem to. I think the problem may be that you're thinking about installing core system utilities, whereas we're talking about installing all our frivolous user-domain software. So whatever package we happen to have read about and thought "oh I'll try that out". Prior to using OS X for the last 6 years my personal laptop ran Linux for the 10 years prior to that. Not everything was available via apt-get, and I know from far too much first-hand experience the dangers of installing software with root permissions, and not being able to reverse the process, so there's really no question in my mind that you're wrong; I suspect we must be answering subtly different questions as I said above. Can you explain why you're emphasizing global software? You sound like you're talking about being a sys admin for a shared computing resource. We are just talking about our laptops. Very occasionally we put on the hat of "administrator" of our laptop, but mostly we have on the hat of "the single user". Now, how about my question: if it's as bad as people like you say, then why does it work so well for so many people?
wruza 9y ago
What exactly goes wrong with dependencies? Are macports any better in that regard?
- stephenr 9y ago
  Dependencies become hardcoded at build time, so any binary 'bottle' whose source package has dependencies that are satisfied by 1+ packages will become hardcoded to just one of those dependencies. https://github.com/Homebrew/legacy-homebrew/pull/41595#issuecomment-135551114 https://github.com/Homebrew/legacy-homebrew/pull/41595#issue... Note that the maintainers response was: fuck it, the users can just re-complile this package every time they install it.