12

I've been trying to harden my OSX 10.11 computer and one of the guides suggested installing Homebrew to get updates to things such as OpenSSL. While updates are great, it seems like Apple should be relatively on top of issues (a recent web test showed TLS 1.2 installed...), along with having a comprehensively tested system OS.

Would Homebrew +package updates have an additive effect with Apple security updates? Does Homebrew have known security issues in and of itself? Or would installing a package manager and associated updates change the system configuration such that, in the hands of a relatively inexperienced admin, it will ultimately be in a more vulnerable state?

Improve this question
3
  • I must say that after spending a bit of time trying to figure this out, I still don't understand the basics of the Homebrew security policy. To what extend is security guaranteed? Do you install the more obscure packages at your own risk? Do you use brew-cask(github.com/caskroom/homebrew-cask) at your own risk? Is it recommended to use Homebrew if you are not an "expert"? I feel these questions should have simple, official answers, but I could not find any...
    – Jacob Akkerboom
    Dec 24, 2015 at 11:14
  • ... in particular the word "security" is not present in the FAQ
    – Jacob Akkerboom
    Dec 24, 2015 at 11:14
  • @JacobAkkerboom Homebrew is a package manager, not a security solution. It may have fringe benefits related to security. See my answer to the question for a bit more.
    – user84662
    Dec 28, 2015 at 4:12

2 Answers 2

Reset to default
9

Would Homebrew +package updates have an additive effect with Apple security updates?

It should improve security if you leverage it to regularly update packages that Apple is either shipping out of date, or not maintaining and patching. Example

Does Homebrew have known security issues in and of itself?

Without a full security review this answer is unknown. Worth digging around reported issues for other security related issues.

... Would installing a package manager and associated updates change the system configuration such that, in the hands of a relatively inexperienced admin, it will ultimately be in a more vulnerable state?

This question leaves a lot to speculation. I believe the homebrew documentation and its community is large enough that this should not be an issue. Deeper dive into considering ways to secure OSX.

Improve this answer
2
  • Thanks, the reported issues and homebrew discussions are particularly helpful in making an informed decision with this package manager.
    – Dave
    Dec 22, 2015 at 0:00
  • Very welcome, in my personal opinion homebrew is a win in any case. Worst case is you update everything only once. You will be at a better state than never having done so without disrupting normal operating procedures.
    – user84662
    Dec 22, 2015 at 0:29
4

The first thing the OSX HomeBrew installer want to do is change owner of /usr/local/bin to your local user. Thus making any random executable a major security threat. I'd say it would be hard to expect any security after installing HomeBrew.

Improve this answer
2
  • 2
    I'd really like to know why I got a down-vote on this one. Any one who have tried to secure a unix-like system would be upset by having /usr/local/bin writeable by any one besides root. You would never get it past a security audit. It's actually so basic a security breach that it might not be mentioned in a security instruction.
    – Samuel Åslund
    Oct 23, 2018 at 8:43
  • 3
    A blog emphasising this is applehelpwriter.com/2018/03/21/…
    – mmmmmm
    Nov 6, 2018 at 9:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .