Hacker News Reader

Comment by pbadenski | Hacker News Reader

I wonder what this Google recruiter would say about this: https://twitter.com/mxcl/status/608682016205344768.

It's not like Homebrew is a solid piece of software. Every now and then I see somebody complaining about how it resolves dependencies. And the team didn't provide any package verification whatsoever, no package signatures and even no SSL/TLS, and they don't see any problem with that.

Considering this, I wouldn't dismiss the recruiter's decision that easily.

The brew script itself is bootstrapped over an HTTPS gist.

My understanding is that one then gets formulas from github over TLS (e.g. git remote -v shows https:// ...), and that both source and "bottle" (binary) downloads are identified by SHA256, SHA1 or MD5 in the formula for the package.

The formulas themselves can of course execute code, but in theory that is auditable.

On the other hand, I haven't looked at the code, so I'd be interested in hearing more about what bugs you about it.

EDIT: I do see that brew.sh site itself doesn't have a valid cert, apparently because they want to keep it on github pages, which is not ideal in terms of bootstrapping...

Even though if it is a solid piece of software, what is wrong with not hiring a guy who does not know the fundamentals(google standard)? Sounds very much google and i would not expect anything less of a googles employees.

Reply on news.ycombinator.com