10

I've been trying to harden my OSX 10.11 computer and one of the guides suggested installing Homebrew to get updates to things such as OpenSSL. While updates are great, it seems like Apple should be relatively on top of issues (a recent web test showed TLS 1.2 installed...), along with having a comprehensively tested system OS.

Would Homebrew +package updates have an additive effect with Apple security updates? Does Homebrew have known security issues in and of itself? Or would installing a package manager and associated updates change the system configuration such that, in the hands of a relatively inexperienced admin, it will ultimately be in a more vulnerable state?

  • I must say that after spending a bit of time trying to figure this out, I still don't understand the basics of the Homebrew security policy. To what extend is security guaranteed? Do you install the more obscure packages at your own risk? Do you use brew-cask(github.com/caskroom/homebrew-cask) at your own risk? Is it recommended to use Homebrew if you are not an "expert"? I feel these questions should have simple, official answers, but I could not find any... – Jacob Akkerboom Dec 24 '15 at 11:14
  • ... in particular the word "security" is not present in the FAQ – Jacob Akkerboom Dec 24 '15 at 11:14
  • @JacobAkkerboom Homebrew is a package manager, not a security solution. It may have fringe benefits related to security. See my answer to the question for a bit more. – user84662 Dec 28 '15 at 4:12
8

Would Homebrew +package updates have an additive effect with Apple security updates?

It should improve security if you leverage it to regularly update packages that Apple is either shipping out of date, or not maintaining and patching. Example

Does Homebrew have known security issues in and of itself?

Without a full security review this answer is unknown. Worth digging around reported issues for other security related issues.

... Would installing a package manager and associated updates change the system configuration such that, in the hands of a relatively inexperienced admin, it will ultimately be in a more vulnerable state?

This question leaves a lot to speculation. I believe the homebrew documentation and its community is large enough that this should not be an issue. Deeper dive into considering ways to secure OSX.

  • Thanks, the reported issues and homebrew discussions are particularly helpful in making an informed decision with this package manager. – Dave Dec 22 '15 at 0:00
  • Very welcome, in my personal opinion homebrew is a win in any case. Worst case is you update everything only once. You will be at a better state than never having done so without disrupting normal operating procedures. – user84662 Dec 22 '15 at 0:29
2

The first thing the OSX HomeBrew installer want to do is change owner of /usr/local/bin to your local user. Thus making any random executable a major security threat. I'd say it would be hard to expect any security after installing HomeBrew.

  • 1
    I'd really like to know why I got a down-vote on this one. Any one who have tried to secure a unix-like system would be upset by having /usr/local/bin writeable by any one besides root. You would never get it past a security audit. It's actually so basic a security breach that it might not be mentioned in a security instruction. – Samuel Åslund Oct 23 '18 at 8:43
  • 2
    A blog emphasising this is applehelpwriter.com/2018/03/21/… – user151019 Nov 6 '18 at 9:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.