4 ms·
Yea not to mention the entire homebrew ecosystem is built around trusting random people's shell scripts. MacOS devs blindly trust it like it's the app store.
by elif 2y ago
Yea not to mention the entire homebrew ecosystem is built around trusting random people's shell scripts.
MacOS devs blindly trust it like it's the app store.
- pmarreck 2y agoA simple `brew cat <packagename>` (possibly piping to bat if you want syntax highlighting) should spit out the ruby install formula for that package, for inspection.
- nozzlegear 2y agoThe assumption is that maintainers at Homebrew are reviewing each pull request before being merged, though it's obviously not a full security audit. Homebrew will also use macOS's sandboxing if a formula needs to be built during installation, which will limit file access to specific Homebrew directories and restrict network access. But I agree that everyone should review the Homebrew install script for any package they're installing if they're concerned about security.