3 ms·

I switched from brew to macports recently, so here are my thoughts: - before, I had generally heard of homebrew a lot, and macports very little. Brew's marketi

I switched from brew to macports recently, so here are my thoughts: - before, I had generally heard of homebrew a lot, and macports very little. Brew's marketing is better. I think this is intentional (as in Macports doesn't really do any) - The docs for macports are very poor. They are comprehensive, but barely navigable. Keyword search doesn't work well. They're obtuse. Further context: I also find brew docs poor, but they're much more user-focused (how to install packages), whereas macports' seem more packager-focused. - Requiring sudo is a security feature, but Macports doesn't advertise this well, so brew "seems" more secure on first impression - Most software with cli install instructions recommend brew up top (even when there's a macports option). i.e. there's no evangelization of macports by maintainers who package for it. I don't really know why this is, but it's something macports maintainers could/should look into.

SkyMarshal 6y ago
Interesting observations. Why does Brew seem more secure on first impression?
- eyelidlessness 6y ago
  Because not using sudo implies you’re not giving anything escalated privileges. I’m aware there’s a contrary view (which I can’t recall, but will dutifully refresh my memory after I post this answer) but this reasoning still feels more intuitive to me.
- lucideer 6y ago
  As the sibling mentioned, using sudo gives the process root, with the implication being it has full access to your system and can potentially do a lot more damage. Extend this to any arbitrary installer you're running and it becomes scary. So brew's sudo-less model seems more secure in this context. In reality however, macports uses "privilege separation" which drops privileges for each individual install to a separate "macports" user. This is more secure than brews sudoless approach because not only does the installer not have root access, it doesn't have full access to your own user either (e.g. your HOME). Privilege separation isn't possible without initially having root privileges.

SkyMarshal 6y ago

Interesting observations. Why does Brew seem more secure on first impression?

eyelidlessness 6y ago
Because not using sudo implies you’re not giving anything escalated privileges. I’m aware there’s a contrary view (which I can’t recall, but will dutifully refresh my memory after I post this answer) but this reasoning still feels more intuitive to me.
lucideer 6y ago
As the sibling mentioned, using sudo gives the process root, with the implication being it has full access to your system and can potentially do a lot more damage. Extend this to any arbitrary installer you're running and it becomes scary. So brew's sudo-less model seems more secure in this context. In reality however, macports uses "privilege separation" which drops privileges for each individual install to a separate "macports" user. This is more secure than brews sudoless approach because not only does the installer not have root access, it doesn't have full access to your own user either (e.g. your HOME). Privilege separation isn't possible without initially having root privileges.