A couple of weeks ago I decided to backup my hard drive, reformat it and reinstall OS X Mavericks to get rid of the cruft that seems to have built up in 4 years, updating from every OS since Mac OS X 10.5 Leopard.
I made halfhearted attempts to organize my dotfiles and configuration in the past, like the cool kids do on Github. That’s when I learned about Homebrew Cask (http://caskroom.io) which makes it super easy to install the GUI apps I install on whatever Mac I’m using—iTerm, Transmission, Vagrant, Virtual Box, etc.
I'm hoping someone could answer this for me. How do you trust the applications that `brew cask` installs?
What is preventing `brew cask install firefox` from installing something malicious? When I download an application manually, I trust the site I'm on by virtue of being there and being savvy enough to know it's a legitimate site. But when you script it, you lose the ability to gauge see for yourself what you're downloading.
I realize I could probably do: `brew cask info firefox`, find the ruby file it points to (https://github.com/caskroom/homebrew-cask/commits/master/Cas...), open that up, verify the link is trustworthy.. but I don't want to do that for every installation. And if it's valid now, what's to prevent it from changing in the future?
Hey there! This is a valid concern, but I don't think it's all that different from using Homebrew. The community maintains the cask definitions, and all pull requests are reviewed via the project team. There's a checksum verification feature built in, though we're still figuring out how to reconcile that with un-versioned download URLs [1].
At the end of the day, when you use any package management software, you are implicitly trusting the team that maintains said software. Perhaps it would be better for us to do our best to force users to make that trust more explicit? It's an interesting question - any suggestions you have would be more than welcome - feel free to open an issue to discuss! :)
Cask could be awesome, but it's not at this stage. There are no upgrades, in many cases it doesn't work. Most apps complain that they are not in /Applications, but are in ~/Applications instead and so on. At the end of the day, it duplicates some of the Homebrew functionality - some non-GUI packages are getting into Cask, because possibly Homebrew doesn't want them - it's a bit confusing as well. I think efforts should be put into merging into Homebrew instead of keeping it separate.
Hiya - author here. Thanks for the feedback on this stuff! It's always good to hear where it's best to focus improvements.
I'm going to address a few of your points specifically.
There are no upgrades, in many cases it doesn't work.
It's true that `brew cask upgrade` is not yet a thing. I would very much like it to be. I've been sort of avoiding work on the feature for fear of messing it up. But that's no reason to not try to make something work! :) Maybe I'll use this as an occasion to start digging in and getting my hands dirty.
At the end of the day, it duplicates some of the Homebrew functionality - some non-GUI packages are getting into Cask, because possibly Homebrew doesn't want them - it's a bit confusing as well.
If the purpose of the project is not clear, that's definitely a problem. I'm not aware of many (any?) purely non-gui apps making it in to Cask. The `Homebrew/homebrew-binary` tap is the place for those. I'll go review our included Casks to make sure things are clear.
I think efforts should be put into merging into Homebrew instead of keeping it separate.
I can understand this opinion, but I think we may actually end up going in the other direction. The places we share code with Homebrew have been the biggest problem areas for us. We are already 90% code independent from Homebrew, and I think moving Cask to its own world may benefit both the project and the users. But of course that's a conversation to have with the (amazing!) project team.
Huh… I’ve installed 17 Casks; no apps have complained about being in ~/Applications. In fact, for properly written apps, it should not matter, so there may be something else going on.
I’ve been using ~/Applications forever for beta testing and accessing two different versions of the same app.
That's true. I hope more apps improve as well as OS X itself. The issue with ~/Application seems to be OS X-related as reported by HyperSwitch (http://bahoom.com/hyperswitch/), which cannot run in background without being under /Applications.
So that’s a HyperSwitch issue that doesn’t have anything to do the operating system itself. Properly written apps (and that probably means not using undocumented APIs or doing otherwise unsupported things) don’t care about being in ~/Applications.
I know about this, but I would want only the problematic apps to auto select /Application - some work fine in ~/Applications, i.e. the Cask formula can override the appdir default value.
Comments
For some reason I'd never seen Homebrew Cask before, which looks very interesting! Does anyone have experiences with Cask to share?
Homebrew Cask is awesome!
A couple of weeks ago I decided to backup my hard drive, reformat it and reinstall OS X Mavericks to get rid of the cruft that seems to have built up in 4 years, updating from every OS since Mac OS X 10.5 Leopard.
I made halfhearted attempts to organize my dotfiles and configuration in the past, like the cool kids do on Github. That’s when I learned about Homebrew Cask (http://caskroom.io) which makes it super easy to install the GUI apps I install on whatever Mac I’m using—iTerm, Transmission, Vagrant, Virtual Box, etc.
And now I have them in a Brewfile (http://robots.thoughtbot.com/brewfile-a-gemfile-but-for-home...) under version control in case I need to install the whole shebang on another Mac.
And now brew update && brew upgrade updates everything.
I'm hoping someone could answer this for me. How do you trust the applications that `brew cask` installs?
What is preventing `brew cask install firefox` from installing something malicious? When I download an application manually, I trust the site I'm on by virtue of being there and being savvy enough to know it's a legitimate site. But when you script it, you lose the ability to gauge see for yourself what you're downloading.
I realize I could probably do: `brew cask info firefox`, find the ruby file it points to (https://github.com/caskroom/homebrew-cask/commits/master/Cas...), open that up, verify the link is trustworthy.. but I don't want to do that for every installation. And if it's valid now, what's to prevent it from changing in the future?
How do you guys justify using cask?
Hey there! This is a valid concern, but I don't think it's all that different from using Homebrew. The community maintains the cask definitions, and all pull requests are reviewed via the project team. There's a checksum verification feature built in, though we're still figuring out how to reconcile that with un-versioned download URLs [1].
At the end of the day, when you use any package management software, you are implicitly trusting the team that maintains said software. Perhaps it would be better for us to do our best to force users to make that trust more explicit? It's an interesting question - any suggestions you have would be more than welcome - feel free to open an issue to discuss! :)
[1] https://github.com/caskroom/homebrew-cask/issues/1021
Cask could be awesome, but it's not at this stage. There are no upgrades, in many cases it doesn't work. Most apps complain that they are not in /Applications, but are in ~/Applications instead and so on. At the end of the day, it duplicates some of the Homebrew functionality - some non-GUI packages are getting into Cask, because possibly Homebrew doesn't want them - it's a bit confusing as well. I think efforts should be put into merging into Homebrew instead of keeping it separate.
Hiya - author here. Thanks for the feedback on this stuff! It's always good to hear where it's best to focus improvements.
I'm going to address a few of your points specifically.
It's true that `brew cask upgrade` is not yet a thing. I would very much like it to be. I've been sort of avoiding work on the feature for fear of messing it up. But that's no reason to not try to make something work! :) Maybe I'll use this as an occasion to start digging in and getting my hands dirty.
If the purpose of the project is not clear, that's definitely a problem. I'm not aware of many (any?) purely non-gui apps making it in to Cask. The `Homebrew/homebrew-binary` tap is the place for those. I'll go review our included Casks to make sure things are clear.
I can understand this opinion, but I think we may actually end up going in the other direction. The places we share code with Homebrew have been the biggest problem areas for us. We are already 90% code independent from Homebrew, and I think moving Cask to its own world may benefit both the project and the users. But of course that's a conversation to have with the (amazing!) project team.
Is there anything Homebrew can do differently to make things easier for your project?
Just saw at least one duplicate - OSXFUSE.
Huh… I’ve installed 17 Casks; no apps have complained about being in ~/Applications. In fact, for properly written apps, it should not matter, so there may be something else going on.
I’ve been using ~/Applications forever for beta testing and accessing two different versions of the same app.
That's true. I hope more apps improve as well as OS X itself. The issue with ~/Application seems to be OS X-related as reported by HyperSwitch (http://bahoom.com/hyperswitch/), which cannot run in background without being under /Applications.
So that’s a HyperSwitch issue that doesn’t have anything to do the operating system itself. Properly written apps (and that probably means not using undocumented APIs or doing otherwise unsupported things) don’t care about being in ~/Applications.
You can override the application directory for Cask:
I know about this, but I would want only the problematic apps to auto select /Application - some work fine in ~/Applications, i.e. the Cask formula can override the appdir default value.