logoalt Hacker News

lrvick • today at 11:11 AM • 0 replies • view on HN

Maybe Homebrew is reliable, but do not assume it is safe. It has always operated on the honor system for contributions and code review. Every maintainer is able to merge anything they want without review or signatures. No matter how good their intentions, Homebrew is a massive supply chain attack waiting to happen.