6 ms·

Without going into too much detail, I think my biggest gripes are: - outdated utilities, like `make` v3, that bite you in the ass every now and then, - Docker

Without going into too much detail, I think my biggest gripes are: - outdated utilities, like `make` v3, that bite you in the ass every now and then, - Docker support is bad, it's slow and quirky, and I use it a lot for development, - hard to trust homebrew's security model, - necessity to bind a phone number and email, deanonymizing your machine, - recent security blunders like root login without a password, - ridiculous amount of telemetry that's hard or impossible to disable.

davidatbu 4y ago
Thanks for replying! > Docker support is bad, it's slow and quirky, and I use it a lot for development. That would probably be a deal breaker for me too if I used it for development. > hard to trust homebrew's security model Hmm, how is it different from, say, `apt`'s security model? > necessity to bind a phone number and email, deanonymizing your machine I'm not with you on this one. I log into Chrome/my phone anyways. > recent security blunders like root login without a password I had no impression that MacOS has root exploits at faster frequency than linux distros. Do you think that's the case? > ridiculous amount of telemetry that's hard or impossible to disable. I don't care too much about this one either.
- mstaoru 4y ago
  I do care about those things ;) > Hmm, how is it different from, say, `apt`'s security model? Core Debian packages are handled by Debian Security Team, Homebrew packages are more like npm, where anyone can upload anything at any time. Also Homebrew's PATH fiddling is very insecure (check https://infotoast.org/site/index.php/2021/05/30/homebrew-is-a-major-security-flaw-install-macports-instead/ https://infotoast.org/site/index.php/2021/05/30/homebrew-is-...). MacPorts come with their own problems. It's just an all-around hacky, insecure software supply chain that is anything but trustworthy.

davidatbu 4y ago

Thanks for replying! > Docker support is bad, it's slow and quirky, and I use it a lot for development. That would probably be a deal breaker for me too if I used it for development. > hard to trust homebrew's security model Hmm, how is it different from, say, `apt`'s security model? > necessity to bind a phone number and email, deanonymizing your machine I'm not with you on this one. I log into Chrome/my phone anyways. > recent security blunders like root login without a password I had no impression that MacOS has root exploits at faster frequency than linux distros. Do you think that's the case? > ridiculous amount of telemetry that's hard or impossible to disable. I don't care too much about this one either.

mstaoru 4y ago
I do care about those things ;) > Hmm, how is it different from, say, `apt`'s security model? Core Debian packages are handled by Debian Security Team, Homebrew packages are more like npm, where anyone can upload anything at any time. Also Homebrew's PATH fiddling is very insecure (check https://infotoast.org/site/index.php/2021/05/30/homebrew-is-a-major-security-flaw-install-macports-instead/ https://infotoast.org/site/index.php/2021/05/30/homebrew-is-...). MacPorts come with their own problems. It's just an all-around hacky, insecure software supply chain that is anything but trustworthy.