macOS-Security-and-Privacy-Guide
macOS-Security-and-Privacy-Guide copied to clipboard
drduh
Homebrew isn't secure
Homebrew uses SSL/TLS to talk with GitHub and verifies integrity of downloaded packages, so it's fairly secure.
This sentence is misleading as using TLS doesn't mean anything about the programs (Homebrew) own security. Using TLS is the bare minimum and should be default anyway.
From https://sector7.computest.nl/post/2024-04-bringing-process-injection-into-view-exploiting-all-macos-apps-using-nib-files/
Note that Homebrew asks you to grant “App Management” (or “Full Disk Access”) permission to your terminal. This is a bad idea, as it would make you vulnerable to these attacks again: any non-sandboxed application can execute code with the TCC permissions of your terminal by adding a malicious command to (e.g.) ~/.zshrc. Granting “App Management” or “Full Disk Access” to your terminal should be considered the same as disabling TCC completely.
Your Guide uses a lot the "brew" command so just removing the Homebew part will break these too and I'm sure you want a replacement or even none change at all.
A security guide shouldn't recommend such a program which itself is a security nightmare.
That is a great point: Homebrew's security posture and risk should be better qualified and the current statement does not offer much assurance.
Running any third party software is not without its risks and Homebrew is certainly no exception. Let's find a way to objectively explain what those risks are, for example by referencing that article, especially keeping in mind some of the software is running with privileges. As always, specific examples will help demonstrate the value of spending time to secure something.
Would you like to start a PR and we can collaborate on some ideas together? Some of the brew programs' functionality is quite useful even in spite of risk, so I hesitate removing them, but let's identify the details as we go.
