3 ms·

Well how will you get it installed? Brew? Well that has no signing support and no supply chain integrity. Hundreds of people have access to push whatever they

by lrvick 5y ago

Well how will you get it installed? Brew? Well that has no signing support and no supply chain integrity. Hundreds of people have access to push whatever they want to a git repo and anyone is free to forge commits and backdoor all brew users as they like. It is worse than NPM. At least on Windows you can install WSL and then get access to APT which checks RSA author signatures on everything regardless of mirror. MacOS only provides signed packages via their app store. The end. If you want software they don't offer like a modern version of bash, you have to get it from untrusted sources like Brew that risk compromising your system.

bigbizisverywyz 5y ago
>Well how will you get it installed? download source code ./configure make sudo make install seems to work for lots of software. By default it should install in /usr/local/<bin/lib> but I've done this for lots of OSS software (e.g. postgres and nginx) on Mac with few problems. Yes, sometimes you have to pursue the odd missing dependency and build that too (e.g. openssl or readline), but I've always managed to build from source in the end without brew or (what's the other one called?).
- lrvick 5y ago
  Fair enough, but I have never observed another MacOS user in the wild compile from source. No matter the risk, every engineer I know uses brew. MacPorts is the other one and it at least uses some crude bulk openssl signing, but the higher barrier to entry means fewer packages so devs don't use it.