Post #1973989

I've used #homebrew on my mac since its early days—days in which, generally, one could feel comfortable that open source software was written by actual humans who cared about freedom. Whatever the timeline or vectors of colonization have been, I now _feel_ far less confident in the software that I have been up to now arguably too comfortable just typing "brew update && brew upgrade" to update. Including transient dependencies, I count 328 packages managed by homebrew on my system right now. Given how long Homebrew has been around, its dual role as package manager and indirection point for code it doesn't own, and the convenience of the happy path and therefore muscle memory and inertial trust many of us have acquired, has there been any critical analysis of its trustworthiness from a user's perspective? What about the relative risks of not updating working software that might have bus versus updating to new versions that introduce exploitation? #macos #oss #infosec