30

I wonder if Homebrew is safe for Mac users...

Do you have any bad experience with this software (like malware for example)?

Improve this question
1

1 Answer 1

Reset to default
25

Homebrew on its own acts like a command-line App Store.

  • It's safe, if you know what you're downloading.
  • It uses SHA256 to fingerprint the downloaded instructions as a validity / tamper detection verification check.
  • It’s open, so you could validate what it’s downloading and how it works.
  • It refuses to use sudo to intentionally be safer.

If you are concerned about downloading hijacked binaries, verify the SHA/SHA1 sum of the binary you've downloaded against the SHA/SHA1 sum published by the developer, usually on their webpage.

Despite a long track record of people not pushing malware or bad code to the system, it would be good hygiene to start validating downloads.

Improve this answer
8
  • 2
    I think one thing that people might dislike (security-wise) with homebrew is that it alters permissions for usr/local, /usr/local/bin for example.
    – Jim Aho
    Commented Nov 4, 2018 at 18:24
  • 2
    See this article for security concerns: applehelpwriter.com/2018/03/21/…
    – Jim Aho
    Commented Nov 4, 2018 at 19:12
  • 1
    @JimAho That article at applehelpwriter is outdated and incorrect. Brew no longer leaves /usr/local/ owned by the user.
    – TJ Luoma
    Commented Nov 5, 2018 at 1:43
  • 1
    PLEASE verify the SHA/SHA1 as outlined. In this day we're getting increasing issues with security and everyone should be doing their part. If the SHA does not match notify the developer immediately. Welcome to the new "safe".
    – akahunahi
    Commented Jun 26, 2019 at 20:52
  • 1
    As of Nov 2016, Homebrew is using SHA256. SHA1 was deprecated. docs.brew.sh/Checksum_Deprecation
    – Marcy
    Commented Nov 29, 2019 at 21:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .