3 ms·
Packages are often downloaded from third party sites, blindly running those with Sufi sounds like a terrible idea. Most developer Mac's are single user anyway.
by orf 10y ago
Packages are often downloaded from third party sites, blindly running those with Sufi sounds like a terrible idea. Most developer Mac's are single user anyway.
It's not like apt, yum or WU where the updates come from a trusted source.
- stephenr 10y agoThe "trusted" source in this case is Homebrew. The rest of your argument makes no sense, because homebrew is designed to be a trusted source - the recipes aren't just downloaded from any random URL. Being single user doesn't make installing software user owned any less of a bad idea.
- orf 10y ago... the recepies then download code from random sources. Obviously vetted sources, but it's not a central repository with all of the packages that is controlled by Homebrew like the other package managers you list. It's just a big git repository of recepies, which are exactly that. Instructions on how to combine things (source code, binaries, flags etc) from external sources.
- stephenr 10y agoNot random, specific source archives, listed in the recipe, along with a known hash of the file being downloaded. Given that, it effectively is a central repo that is controlled by Homebrew.
- Myrmornis 10y ago> Being single user doesn't make installing software user owned any less of a bad idea. Can you explain why you believe that?