5 ms·

Homebrew is not only a weak package manager, it is a dangerous package manager. No one makes it clear anywhere in the docs or on the site that it should never b

Homebrew is not only a weak package manager, it is a dangerous package manager. No one makes it clear anywhere in the docs or on the site that it should never be used on a server or world-facing service...and people are using it for that. Because it is installed in userland (its most advertised feature), it runs everything as the same user (probably an admin level user with sudo privileges). This throws away 40 years of basic UNIX security wisdom. All so you can install it without sudo. I recently set out to make our software (and all of its dependencies) installable on Mac OS X. I tried Homebrew first, because it seems so popular and well-liked. But, it's just awful. Coming from a couple of decades using Linux package managers, it's like stepping into the stone age, and it's absurd to bring something that is vastly inferior to the existing options on Linux over. I even blogged about it, for a variety of reasons (mostly to warn people off of the thing): http://inthebox.webmin.com/homebrew-package-installation-for-servers http://inthebox.webmin.com/homebrew-package-installation-for... Frankly, this is like porting the DOS command line to Linux (which has probably happened at some point, but hopefully as a joke or to solve a specific problem). So, if you're going to use this, know that it is for home use. If you are putting this on a server for installing services (as I found many people on the web doing with the Mac version) you are doing it so wrong.

davexunit 12y ago
>it is a dangerous package manager To go along with this theme, I must ask: Does homebrew do any isolation when building from source? Chroots, separate process namespaces, etc. >All so you can install it without sudo. This is actually a really great feature. I work on a package manager called Guix, which also allows for unprivileged package management. It's one of my favorite features. You and I could have user accounts on the same machine and use different versions of the same application without conflict. Of course, I don't know what the security story is for Homebrew, but it doesn't look to be better than average. We take security very seriously with Guix, to the point that we are seeking things like bit-for-bit reproducible builds.
- SwellJoe 12y ago
  "Does homebrew do any isolation when building from source? Chroots, separate process namespaces, etc." No. This is why they install as the user. "For security", you see. I agree that non-root installs are a useful feature for some scenarios. But, the problem with that for servers is you need to be able to start all of your services as different users. That's really not optional. How you get there doesn't really matter, to me, but dpkg and RPM have long had it solved. I've looked at Guix and Nix, and find them neat. I'm kind of a package management nerd (and I judge all operating systems by their package management story...Windows and Mac OS X are unacceptable, most modern Linuxes are pretty pretty good, FreeBSD is getting better). I'm not sure I'm willing to make all of the tradeoffs and move onto such a foreign system layout, but it's on my radar.
  - Ded7xSEoPKYNsDd 12y ago
    > But, the problem with that for servers is you need to be able to start all of your services as different users. That's really not optional. Anything with an attack surface also must not be able to replace its own binaries/code. Otherwise a one-time exploit is instantly updated to a permanent infection.

davexunit 12y ago

>it is a dangerous package manager To go along with this theme, I must ask: Does homebrew do any isolation when building from source? Chroots, separate process namespaces, etc. >All so you can install it without sudo. This is actually a really great feature. I work on a package manager called Guix, which also allows for unprivileged package management. It's one of my favorite features. You and I could have user accounts on the same machine and use different versions of the same application without conflict. Of course, I don't know what the security story is for Homebrew, but it doesn't look to be better than average. We take security very seriously with Guix, to the point that we are seeking things like bit-for-bit reproducible builds.

SwellJoe 12y ago
"Does homebrew do any isolation when building from source? Chroots, separate process namespaces, etc." No. This is why they install as the user. "For security", you see. I agree that non-root installs are a useful feature for some scenarios. But, the problem with that for servers is you need to be able to start all of your services as different users. That's really not optional. How you get there doesn't really matter, to me, but dpkg and RPM have long had it solved. I've looked at Guix and Nix, and find them neat. I'm kind of a package management nerd (and I judge all operating systems by their package management story...Windows and Mac OS X are unacceptable, most modern Linuxes are pretty pretty good, FreeBSD is getting better). I'm not sure I'm willing to make all of the tradeoffs and move onto such a foreign system layout, but it's on my radar.
- Ded7xSEoPKYNsDd 12y ago
  > But, the problem with that for servers is you need to be able to start all of your services as different users. That's really not optional. Anything with an attack surface also must not be able to replace its own binaries/code. Otherwise a one-time exploit is instantly updated to a permanent infection.