I'm glad someone made this site! Another good registry is https://github.com/aquaproj/aqua-registry

Yeah I am not a fan of curl bash either, but installing via most package managers (brew, npm etc) isn’t much better, since most of these skip sandboxing rn.

Maybe I am missing something, but the second you run the code, it has the same powers and risk profile as a bash curled from the internet. Maybe something about having explicit versioning?

(as an aside, I think this will change very soon…)

Homebrew is heavily sandboxed and has been using the macOS sandbox for the best part of a decade, long before many other package managers did.

We also offer a .pkg installer and other installation options so curl | bash not needed for install that either.

TIL! Thank you :)

I’ll take a look then, as I am unsure how sandboxing will interact with this system since it does a few unusual things

ok I read up on the sandbox. IIUC, this applies to the installer/formula part. The app itself is still unsandboxed.

I can see that it closes one vector of attack (attacking the install script serving), but beyond that the user still runs the binary outside a sandbox.

I feel that the binaries themselves, both directly and indirectly (supply chain attack) are the elephant in the room.

Any thoughts on that? I always wished the cli stuff I install from Homebrew was locked down by default, but it's not practical with today's computer systems since it kills usability.

Anyway, big fan of Homebrew. Looks like I can't submit a formula to core until I get more traction on GitHub (stars/forks/watchers). Otherwise I have to go to taps which takes away a lot of the benefits of being on homebrew-core iiuc.

Run everything you don’t trust, particularly agents, in a non-admin user account under a sandbox. Check out sandvault for some great CLI for this.

OTOH I'd encourage anyone who thinks that curl bash is a good idea to keep distributing their stuff via curl bash.