From their official formula: https://github.com/mongodb/homebrew-brew/blob/master/Formula/mongodb-community%403.4.rb#L9 https://github.com/mongodb/homebrew-brew

From their official formula: https://github.com/mongodb/homebrew-brew/blob/master/Formula/mongodb-community%403.4.rb#L9 https://github.com/mongodb/homebrew-brew/blob/master/Formula... Every time I run `brew update` (or perhaps _any_ brew command), I make 6 requests to "https://downloads.mongodb.org/current.json" https://downloads.mongodb.org/current.json" (one for each version of the formula), and one request to get the SHA for mongdb-shell? This defaults the whole point of a formula - metadata describing an installable. If that .json file is compromised in any way then suddenly you are downloading anything from _anywhere_ with no checks. By embedding the hash and the download URL in the formula, like literally every other formula does, the download will fail if the release is modified. And there is a git audit trail of any formula modifications. No thanks.