4 ms·

This is totally silly. Homebrew isn't a very good package manager. When I used it at a previous job (the only time I've used OS X), it was quite unreliable.

This is totally silly. Homebrew isn't a very good package manager. When I used it at a previous job (the only time I've used OS X), it was quite unreliable. It would try to build most things from source (which sometimes failed), but then download pre-built binaries for others. IIRC, installing the MySQL package just downloaded a binary from Oracle, it wasn't even a binary pre-built and verified with Homebrew! I have zero confidence in Homebrew to provide any security. Now, I see that people are saying that it fills a niche of having the latest and greatest builds of things. Other GNU/Linux distros already have similar things. Arch Linux's core repo is quite fresh and there's also the AUR for bleeding edge stuff. Debian testing isn't as fresh, but it has most new software fairly quickly. I don't know much about Gentoo, but it's overlay system gives users easy access to custom repos with bleeding edge software. Hell, even Ubuntu seems to have PPA for everything if the software in the release isn't new enough. Then there's some less known options like Nix and GNU Guix that provide very up-to-date packages and have far more features than Homebrew. In short, we need better system package managers for our distros, not additional package managers to slap on top of the distro we use.

lectrick 12y ago
The whole point of Homebrew is: 1) To install things in userland 2) To make maintenance easier. Is there a Linux package manager that puts everything in userland in a place like /usr/local? If not, then it installs things into the operating system, essentially. And that is bad design, pure and simple. You're basically mutating your OS, with nondeterministic results- such as I often run into when I hit "update everything" and my Linux distro then refuses to boot.
- stephenr 12y ago
  The whole point of Homebrew is to be a package manager for OS X, and it's only popular because its the best of several shit options. That it installs things as a non-admin user is not specific or inherent to its goal.
  - lectrick 12y ago
    > That it installs things as a non-admin user is not specific or inherent to its goal. Yes, yes it is. I was there when it was originally released, and its most radical feature at the time (when root-installing package managers were prevalent) was the change of philosophy of putting things in userland. And 99% of installable code should live in userland. Without admin privs.
  - tlrobinson 12y ago
    It's one of the key differences between Homebrew and existing OS X package managers (Macports, Fink) and they talk about it quite a lot on the homepage and installation instructions. IMHO one of the reasons it's more popular. "The standard script installs Homebrew to /usr/local so that you don’t need sudo when you brew install" https://github.com/Homebrew/homebrew/blob/master/share/doc/homebrew/Installation.md#installation https://github.com/Homebrew/homebrew/blob/master/share/doc/h... "Homebrew installs packages to their own directory and then symlinks their files into /usr/local." "Homebrew won’t install files outside its prefix, and you can place a Homebrew installation wherever you like." http://brew.sh/ http://brew.sh/
- tbirdz 12y ago
  Nix
- davexunit 12y ago
  >Is there a Linux package manager that puts everything in userland in a place like /usr/local? GNU Guix and Nix. I am a core developer for GNU Guix.
- jessedhillon 12y ago
  > 1) To install things in userland No halfway-knowledgeable linux user cares about this because... If not, then it installs things into the operating system, essentially. ...this is only true for a Mac, where a third party comes in and opaquely modifies your entire filesystem with no accountability. On a linux distro the OS is upgraded through the package manager, so a userland install is not a needed feature. And Homebrew has a terrible track record with #2 as well. Certainly it's not going to beat any of the forementioned package managers.
diminoten 12y ago
Here's what Homebrew runs for the MySQL installation. Can you point out the part of this that's giving you security concerns? https://github.com/Homebrew/homebrew/blob/master/Library/Formula/mysql.rb https://github.com/Homebrew/homebrew/blob/master/Library/For...
- davexunit 12y ago
  The current state of this package looks pretty good! As long as no Homebrew package downloads a pre-built binary from a third-party, I'm content, and I redact that particular criticism.
tlrobinson 12y ago
"it wasn't even a binary pre-built and verified with Homebrew" Most (all?) "formulas" include cryptographic hash checks for any downloaded files: https://github.com/Homebrew/homebrew/blob/master/Library/Formula/mysql.rb https://github.com/Homebrew/homebrew/blob/master/Library/For...
- davexunit 12y ago
  This package recipe actually builds from source, which is great! I swear that at one point the mysql package downloaded a pre-built binary from a third party site. Even with a cryptographic hash, I don't trust it, because it could have been built with a tainted compiler. This brings me to an issue that I have not only with homebrew, but with most other package managers: reproducibility. Can I have any confidence that the binaries built on your machine and my machine are the same?
  - tlrobinson 12y ago
    It actually includes methods for both prebuilt binaries ("bottles" in homebrew terminology) and source. It will use a bottle if one exists for your OS version, but you can force installation from source with "--build-from-source". The problem of bitwise-identical / deterministic builds is difficult when using most legacy tooling, in particular tools that insert timestamps or other non-determinism. Bitcoin and Tor use Gitian https://gitian.org/ https://gitian.org/ and Google just open sourced their tool, Bazel http://bazel.io/ http://bazel.io/

lectrick 12y ago

The whole point of Homebrew is: 1) To install things in userland 2) To make maintenance easier. Is there a Linux package manager that puts everything in userland in a place like /usr/local? If not, then it installs things into the operating system, essentially. And that is bad design, pure and simple. You're basically mutating your OS, with nondeterministic results- such as I often run into when I hit "update everything" and my Linux distro then refuses to boot.

stephenr 12y ago
The whole point of Homebrew is to be a package manager for OS X, and it's only popular because its the best of several shit options. That it installs things as a non-admin user is not specific or inherent to its goal.
- lectrick 12y ago
  > That it installs things as a non-admin user is not specific or inherent to its goal. Yes, yes it is. I was there when it was originally released, and its most radical feature at the time (when root-installing package managers were prevalent) was the change of philosophy of putting things in userland. And 99% of installable code should live in userland. Without admin privs.
- tlrobinson 12y ago
  It's one of the key differences between Homebrew and existing OS X package managers (Macports, Fink) and they talk about it quite a lot on the homepage and installation instructions. IMHO one of the reasons it's more popular. "The standard script installs Homebrew to /usr/local so that you don’t need sudo when you brew install" https://github.com/Homebrew/homebrew/blob/master/share/doc/homebrew/Installation.md#installation https://github.com/Homebrew/homebrew/blob/master/share/doc/h... "Homebrew installs packages to their own directory and then symlinks their files into /usr/local." "Homebrew won’t install files outside its prefix, and you can place a Homebrew installation wherever you like." http://brew.sh/ http://brew.sh/
tbirdz 12y ago
Nix
davexunit 12y ago
>Is there a Linux package manager that puts everything in userland in a place like /usr/local? GNU Guix and Nix. I am a core developer for GNU Guix.
jessedhillon 12y ago
> 1) To install things in userland No halfway-knowledgeable linux user cares about this because... If not, then it installs things into the operating system, essentially. ...this is only true for a Mac, where a third party comes in and opaquely modifies your entire filesystem with no accountability. On a linux distro the OS is upgraded through the package manager, so a userland install is not a needed feature. And Homebrew has a terrible track record with #2 as well. Certainly it's not going to beat any of the forementioned package managers.

diminoten 12y ago

Here's what Homebrew runs for the MySQL installation. Can you point out the part of this that's giving you security concerns? https://github.com/Homebrew/homebrew/blob/master/Library/Formula/mysql.rb https://github.com/Homebrew/homebrew/blob/master/Library/For...

davexunit 12y ago
The current state of this package looks pretty good! As long as no Homebrew package downloads a pre-built binary from a third-party, I'm content, and I redact that particular criticism.

tlrobinson 12y ago

"it wasn't even a binary pre-built and verified with Homebrew" Most (all?) "formulas" include cryptographic hash checks for any downloaded files: https://github.com/Homebrew/homebrew/blob/master/Library/Formula/mysql.rb https://github.com/Homebrew/homebrew/blob/master/Library/For...

davexunit 12y ago
This package recipe actually builds from source, which is great! I swear that at one point the mysql package downloaded a pre-built binary from a third party site. Even with a cryptographic hash, I don't trust it, because it could have been built with a tainted compiler. This brings me to an issue that I have not only with homebrew, but with most other package managers: reproducibility. Can I have any confidence that the binaries built on your machine and my machine are the same?
- tlrobinson 12y ago
  It actually includes methods for both prebuilt binaries ("bottles" in homebrew terminology) and source. It will use a bottle if one exists for your OS version, but you can force installation from source with "--build-from-source". The problem of bitwise-identical / deterministic builds is difficult when using most legacy tooling, in particular tools that insert timestamps or other non-determinism. Bitcoin and Tor use Gitian https://gitian.org/ https://gitian.org/ and Google just open sourced their tool, Bazel http://bazel.io/ http://bazel.io/