Hacker News Reader

Comment by yjftsjthsd-h | Hacker News Reader

There's a bunch of TOB-BREW-n listed - are those like CVE numbers just for this project?

Edit: Oh, it's "Trail Of Bits - homeBREW". But probably still yes.

Yep. We use the TOB-$PRODUCT-$XXXX convention for our audit findings, where $PRODUCT is the target under audit and $XXXX is a unique incrementing counter for each finding.

(As far as I know, a lot of audit firms do similar things.)

First time seeing TOB being used honestly, it would’ve helped saying something along the lines of ”Trait of Bits (TOB from now on)”

Other companies do similar things. Red Hat creates RHSA-YYYY:XXXX for example, like this one for Log4Shell: https://access.redhat.com/errata/RHSA-2022:0442

I cannot reply to your top comment for some reason, so asking here:

What is your personal recommendation for Mac users? Would you suggest a different package manager and, if so, which?

Given that I did the audit, I don’t think it’s appropriate for me to offer an endorsement (or a negative endorsement) in this context. What I’ll say is this: the findings on Homebrew were not inconsistent with what I’d expect to find on any similarly sized userspace package manager that serves its own binary builds.

My dumb brain had to read it 3 times before realizing that by saying "the findings were not inconsistent with what I'd expect" you meant "the findings _were_ consistent with what I'd expect"

One should try to avoid using double negatives in both speech and programming to make intent more obvious ;-)

Except the ambiguity was the intent.

Human language is not math.

It needs to convey concepts that are infinitely variable rather than binary.

When a poet or novelist says something in an unusual way, they are being more accurate not less accurate. If there is ambiguity, it is because the concept or observation they mean to express has some ambiguous element.

Trying to avoid that is just downsampling analog color reality to a 200ppi 1bpp fax.

A related concept that even the most aspbergers STEM head should be able to understand, is how a scientist almost never asserts anything unequivocally. Almost every statement is qualified with whatever is appropriate to the context. Even the most fundamental constants of the universe like the speed of light are famously relative. Are those scientists being more or less ambiguous when they decline to say something simple and direct?

Everything they don't say is deliberate and carefully crafted to be as correct as possible, not some sloppy ommission.

The speed of light _is_ constant, how could it otherwise be a fundamental constant? I think you might have meant time/distance is relative?

Perhaps they're thinking of how it's dependent on the transmission material?

What is the definition of speed?

"not inconsistent" is a common phrase and is used for a reason. It's a subtle difference but "not inconsistent" is not exactly the same as "is consistent".

That’s not necessarily what was meant though.

“Not inconsistent” is more cautious and less assertive. It allows for some ambiguity rather than claiming perfect consistency.

I use nix on both mac and linux, also on CI where homebrew is especially brittle

Don’t you have to disable SIP to use nix on macOS?

No. Even though SIP is slightly annoying because you can't have strace equivalent with it.

No, see https://nix.dev/manual/nix/2.18/installation/installing-bina...

If there's any hope of Nix seeing widespread adoption as a Mac package manager, uh... this link kinda shoots it down a lot.

From that:

- create a new APFS volume for your Nix store

- update /etc/synthetic.conf to direct macOS to create a "synthetic" empty root directory to mount your volume - specify mount options for the volume in /etc/fstab: rw: read-write, noauto: prevent the system from auto-mounting the volume (so the LaunchDaemon mentioned below can control mounting it, and to avoid masking problems with that mounting service), nobrowse: prevent the Nix Store volume from showing up on your desktop; also keeps Spotlight from spending resources to index this volume

- if you have FileVault enabled: generate an encryption password, put it in your system Keychain, use it to encrypt the volume

- create a system LaunchDaemon to mount this volume early enough in the boot process to avoid problems loading or restoring any programs that need access to your Nix store

Even as someone who knows how to do all that... no thanks.

The installer does it all for you. Theres even graphical installer https://determinate.systems/posts/graphical-nix-installer/

Reply on news.ycombinator.com