undefined | Better HN

0 pointsgregmac9y ago0 comments

One of the things that I really dislike about homebrew is its refusal to run via sudo plus the requirement that you own /usr/local.

This means:

1) It is a security hole; any application can now modify system-wide applications at any time.

2) You can't have multiple users able to use homebrew.

I was expecting homebrew to be something similar to apt/yum/etc, but this makes it pretty fundamentally different.

How does Macports handle this? Does $USER still need write access to /opt?

0 comments

DavideNL9y ago

< plus the requirement that you own /usr/local

no, this is not required anymore... https://github.com/Homebrew/brew/commit/a2f19f0a675f7cb384b4...

> You can't have multiple users able to use homebrew

what i did is i run Homebrew as a user i called Admin and when logged in as another user i simply do a 'su - admin' to run the brew commands..

packetslave9y ago

There's no requirement that Homebrew be in /usr/local. Some individual (poorly-written) packages may assume that, but I've been running Homebrew in $HOME/.brew for multiple years on multiple machines with no issues at all.

ghthor9y ago

That's actually fucking brilliant, and aligns much better with what homebrew is. I'm setting up my new macbook from work tomorrow and this is absolutely the way I'm going to do it, and how I'll suggest any of my colleagues do as well.

duaneb9y ago

It's also very difficult to roll back to a previous version of a package unless the maintainers specifically opt in to tagging them. Homebrew also updates itself when you install something now, so say if you install python, it might update readline, so your postgres client will break.

It's not the worst approximation of ports, but it doesn't share the quality and care that goes into package maintenance and dependency management.

oschrenk9y ago

Re 2) I'm running a multi user homebrew setup for years. I have my users (personal and various work accounts) live under the "Local" Group and do

``` sudo chmod -R 770 /usr/local/ sudo chmod -R +a "group:Local allow delete,readattr,writeattr,readextattr,writeextattr,list,search,add_file,add_subdirectory,delete_child,file_inherit,directory_inherit" /usr/local/ ```

I remember sometimes running into permissions issues but nothing re-running that command didn't fix.

SkyMarshal9y ago

It's a bit of a smell that Homebrew doesn't do this itself.

1amzave9y ago

Really? If you're going to do that, it seems like you might as well just merge all those users into a single account anyway, considering how trivial it would be for any one of them to execute arbitrary code as any other.

Watabou9y ago

Why is 'sudo' required? Just curious.

I moved away from homebrew, to compiling my own software on macOS which I just put in ~/build. I don't use sudo make install since I own the ~/build folder.

What am I doing wrong in this case?

superchink9y ago

This is no longer the case, as of Homebrew 1.0.

See this change: https://github.com/Homebrew/brew/pull/896

vsl9y ago

This is only about /usr/local itself, not the directories under it, the one with executables - that's still owned by you, not root. Some difference in ease of initial installation, zero difference in terms of (in)security.

j / k navigate · click thread line to collapse