It’s a convenience so that no matter what directory you’re in in the shell, you can execute commands without having to specify the full path to them. This is basically a list of directories that the shell environment uses to find programs. To understand the crucial error being foisted upon Homebrew users here you need to understand a little about the program search path on macOS and other unix variant operating systems. We’re not worried about other users, but processes running as our user that can now attempt to elevate their own privileges by stealing the admin user’s password. If you need to run Homebrew in a multi-user environment, consider creating a separate user account especially for use of Homebrew.īut that just isn’t going to cut it. The brew docs seem to be unaware of the danger, however, only noting that: Why does brew do this? According to the docs, they want to avoid using sudo because of the security flaws it contains (it’s true, sudo does have security issues) unfortunately, the proposed solution is far worse and creates a far bigger security hole. Other 3rd party software plays correctly with usr/local and doesn’t change its ownership permissions.

Also, what the brew docs fail to mention is that although Apple may have “left this directory for us”, they didn’t intend for you to change its ownership and make it writable by just anything in userland. Here, we’re not concerned with ‘messing up’ existing tools, but spoofing system tools that live further down the path search hierarchy behind the user’s back. Which means there is no /usr/local directory by default, so there is no need to worry about messing up existing tools.Īh, wrong kind of safe. But wait, the brew docs say installing into /usr/local is safe, look at the screenshot at the top of this post from their FAQ, which saysĪpple has left this directory for us. Homebrew’s installer is kind enough to tell you what is happening, but it seems neither the installer nor the developers have any idea just what this means: Danger! Danger!Īs soon as I saw that, the words ‘ sudo piggyback!’ sprang to mind.

Peril indeed, for those that follow that advice. One of the reasons Homebrew just works relative to the competition is because we recommend installing to /usr/local. Some things may not build when installed elsewhere. Homebrew’s webpage encouragingly says “you can place a Homebrew installation wherever you like”, but almost everywhere 1 else 2, the docs are more insistent:ĭo yourself a favor and install to /usr/local. An oddness, it turns out, that is a gaping security flaw. However, installing it recently on a new setup brought something odd to my attention. As their own tag line goes, “Homebrew installs the stuff you need that Apple didn’t.” # Allow `]`, `func '$(command)'`, pipes, etc.Popular macOS package manager Homebrew is a great way to easily install and manage 3rd party software. The script detail is as follows: #!/bin/bash # We don't need return codes for '$(command)', only stdout is needed. To view more uninstall options, just download the uninstall script and run /bin/bash uninstall.sh -help To Uninstall Homebrew, run this command in the OSX terminal: /bin/bash -c ' $( curl -fsSL )' In this tutorial, we will show you how to uninstall Homebrew on macOS. If you have problems with Homebrew, you can uninstall it.

Need sudo access on macos homebrew