I Hire Engineers at Google--Here's What I Look for (And Why)
fastcompany.com
fastcompany.com
Considering this, I wouldn't dismiss the recruiter's decision that easily.
My understanding is that one then gets formulas from github over TLS (e.g. git remote -v shows https:// ...), and that both source and "bottle" (binary) downloads are identified by SHA256, SHA1 or MD5 in the formula for the package.
The formulas themselves can of course execute code, but in theory that is auditable.
On the other hand, I haven't looked at the code, so I'd be interested in hearing more about what bugs you about it.
EDIT: I do see that brew.sh site itself doesn't have a valid cert, apparently because they want to keep it on github pages, which is not ideal in terms of bootstrapping...
Anyway, you're right, that was weird. But you know, if the employees of a company got into the company largely because of their schools, and got into their schools largely because of their SATs, why wouldn't they ask. As far as they are concerned, SATs do an excellent job of predicting performance.