Comment by quadrifoliate

I love wikipedia for research. It is great that anon randos can help keep a common encyclopedia maintained with high accountability. If a mistake happens it is quickly corrected.

But that trust model does not work with software.

It is negligent that MacOS users, even those with prod access, all let any anon randos that sign up to be Homebrew maintainers execute any code they want on their computers with no accountability. By the time someone figures that out and corrects it, the damage is done.

What is worse, is almost zero MacOS users I talk to are aware of this risk. Even security engineers. Many say "no worse than NPM" as if that is a defense.