11

I wonder if Homebrew is safe for Mac users...

Do you have any bad experience with this software (like malware for example)?

9

Homebrew on its own acts like a command-line App Store. It's safe, if you know what you're downloading.

If you are concerned about downloading hijacked binaries, verify the SHA/SHA1 sum of the binary you've downloaded against the SHA/SHA1 sum published by the developer, usually on their webpage.

Despite a long track record of people not pushing malware or bad code to the system, it would be good hygiene to start validating downloads.

  • 2
    I think one thing that people might dislike (security-wise) with homebrew is that it alters permissions for usr/local, /usr/local/bin for example. – Jim Aho Nov 4 '18 at 18:24
  • 2
    See this article for security concerns: applehelpwriter.com/2018/03/21/… – Jim Aho Nov 4 '18 at 19:12
  • @JimAho That article at applehelpwriter is outdated and incorrect. Brew no longer leaves /usr/local/ owned by the user. – TJ Luoma Nov 5 '18 at 1:43
  • 1
    PLEASE verify the SHA/SHA1 as outlined. In this day we're getting increasing issues with security and everyone should be doing their part. If the SHA does not match notify the developer immediately. Welcome to the new "safe". – Ligemer Jun 26 at 20:52
  • 1
    As of Nov 2016, Homebrew is using SHA256. SHA1 was deprecated. docs.brew.sh/Checksum_Deprecation – Marcy Nov 29 at 21:12

Not the answer you're looking for? Browse other questions tagged .