← Back to context

Comment by politelemon

3 days ago

Please don't use or suggest using homebrew as a Linux installation solution. It's better to simply point at the binaries directly.

Why?

Is it the best out there? No. But it does work, and it provides me with updates for my tools.

Random curl scripts don't auto-update.

Me downloading executables and dropping them in /bin, /sbin, /usr/bin or wherever I'm supposed to drop them [0] also isn't secure.

[0] https://news.ycombinator.com/item?id=46487921

Also, I find it is usually better to follow up with something like:

'It's better to use Y instead of X BECAUSE of reasons O, P, Q, R & S' vs making a blanket statement like 'Don't use X, use this other insecure solution instead', as that way I get to learn something too.

  • I use mise to update binaries. Especially TUIs that are not on the arch repos. It supports several backends, from cargo crates to GitHub releases, to uv for python and so on.

    So one doesn't really need homebrew that has Linux as third class citizen (with the 2nd class empty)

What's the problem with Homebrew?

> It's better to simply point at the binaries directly.

Binaries aren't at all signed and can be malicious and do dangerous things.

Especially if it's using curl | bash to install binaries.

  • Are you using Homebrew on Linux? Genuinely curious - I never met a Linux user doing that.

  • I had some issues with brew breaking up my system and pkg-config.

    • It is a bit hard to know what the issue is here.

      But on average brew is much more safer than downloading a binary from the ether where we don't know what it does.

      I see more tools use the curl | bash install pattern as well, which is completely insecure and very vulnerable to machines.

      Looks like the best way to install these tools is to build it yourself, i.e. make install, etc.

      3 replies →

Also don't use Homebrew on MacOS because it screws around in /usr/local and still hasn't worked out how root is supposed to work.

Use Macports, it's tidy, installs into /opt/macports, works with Apple's frameworks and language configuration (for python, java etc), builds from upstream sources + patches, has variants to add/remove features, supports "port select" to have multiple versions installed in parallel.

Just a better solution all around.

Nice, download a random binary off the internet and give it your AWS credentials.

Please people, inspect the source to your tools, or don't use them on production accounts.

What’s the issue with homebrew?

  • It’s specifically a Mac workaround package manager. There’s better/cleaner ways to do it on Linux.

    • I love Debian's stability, but I rely on Homebrew (instead of apt) to get more recent releases of software. Overall it works swimmingly!

    • Don't let the beer emoji in the program's output fool you: unlike most Linux package managers, Homebrew has undergone a professional security audit, and is used (along with Flatpak and Ostree) by Secureblue.