It is a bit hard to know what the issue is here.

But on average brew is much more safer than downloading a binary from the ether where we don't know what it does.

I see more tools use the curl | bash install pattern as well, which is completely insecure and very vulnerable to machines.

Looks like the best way to install these tools is to build it yourself, i.e. make install, etc.

▲

garblegarble 3 days ago | parent [-]

>the best way to install these tools is to build it yourself, i.e. make install, etc.

And you're fully auditing the source code before you run make, right? I don't know anyone who does, but you're handing over just as much control as with curl|bash from the developer's site, or brew install, you're just adding more steps...

▲

colesantiago 3 days ago | parent [-]

> And you're fully auditing the source code before you run make.

I mean you can?

But that is the whole point when the source is available, it is easier to audit, rather than binaries.

Even with brew, the brew maintainers have already audited the code, and it the source to install and even install using --HEAD is hosted on brew's CDN.

	▲	garblegarble a day ago \| parent [-]
		>Even with brew, the brew maintainers have already audited the code Realistically, how much are they auditing? I absolutely agree with your sentiment that it's better than a binary, but I think the whole security model we have is far too trusting because of the historically overwhelming number of good-faith actors in our area both in industry and hobbyists