I don't agree with everything that Homebrew does, but the primary maintainers are visible, vocal and very opinionated. They have shown credibility and earnt my trust over the years given it is a crucial entry point to potential malware to my system.
Homebrew has continued to improve performance each major version. It's certainly a lot quicker nowadays than 5 years ago. I want reliability and safety in a package manager, speed is nice to have.
I applaud competition, but something like this starts with trust zero as far as I'm concerned. If there is one place that I want human input over LLM it's here. It needs to scream: smart humans are in control and overseeing the project. I don't see that here.
100% agree on your comment. For a package manager, speed is aspiration but security and reliability are basic requirements. And the credibility is a big plus. Today anyone can build a package manager in a week with AI, but once the system grows, how is the team going to manage? This is where credibility matters.
> If there is one place that I want human input over LLM it's here. It needs to scream: smart humans are in control and overseeing the project. I don't see that here.
How is Homebrew fundamentally different (as of today) - they vibe code. For example, the new app BrewUI is vibe coded, Claude is #2 contributor.
That wasn't the point, and it's also a fundamental mistake to think that the app store app for anapp store is of low importance, but also it doesn't resolve anything - if it's "a crucial entry point to potential malware to my system." how does it help that it's an entry point to a smaller part of your user base? And if that's just fine, what principle would stop the vibes from permeating "the core"??? The core also has llm contributions
The point you are ignoring or missing is that the homebrew maintainers have earned the trust to use AI contributions and have not simply whacked out a 100% vibe coded app in a week.
That's another made up point not coming from the source. But also, that's almost literally what they did. Ok, it wasn't in a week but a few months and the % is not 100%, but still more than 50%
But then this project's first release was in Feb, so it's actually been longer in development than the brew UI app! It's not a 1-week app! Stop making hypothetical stuff up, look at real apps
This isn't just a replacement for the homebrew UI, it's for the CLI too, so comparison invalid. I see the dev behind it has a whole 4 years of github experience - only the most recent 2 of which with anything significant (presumably model written), how reassuring.
The comment you originally replied addresses the "invalid" comparison, so circle back there. And you have the same issue here - how does "years of github experience" connects to concerts about LLM output in security-critical package managers?
Yes, using tooling is literally what differentiates humans from the apes. Claude and the like are just the next evolution of tooling. BrewUI looks fine to me and I certainly prefer it (as it's native) over all the "hand-crafted" node/electron dumpster fires. If you want to continue to rub sticks together to make fire, nobody is stopping you (except perhaps the market).
No, you have a primitive understanding of evolution. Apes literally use tools. And if you want to play with AI fire in the "crucial entry point to potential malware to my system", nobody is stopping you either (even if you trust your own ringing security endorsement of "looks fine to me"), but that would still not address the core point of this discussion
Maybe Homebrew is reliable, but do not assume it is safe. It has always operated on the honor system for contributions and code review. Every maintainer is able to merge anything they want without review or signatures. No matter how good their intentions, Homebrew is a massive supply chain attack waiting to happen.
Is it smart to deprecate everything the minute Apple sunsets their OS version?
This is not a smart package manager, its a manager for the “dumb” masses, that need to be saved and protected from themselves by forcing them into the next walled garden, so to speak…
Another recommendation for mise, in my case it has already fully replaced brew, stow and direnv since I started using it this January, and it has many more features I'm not using yet (secret management, tasks, automation, ...), all from a single rust binary.
Also, unlike homebrew/linuxbrew, the install path for apps can be set to anywhere and is fully portable (it's all relative symlinks).
So far I never had any issue with it or any backward incompatibilities when upgrading, despite the very frequent releases and constant new features. The developer also seems very security minded (he immediately added a "minimum release age" feature for all apps when the trivy github action debacle was made public)
Oh! I thought it was a wrapper around brew so you could list all your tools in one place, but you’re right, it bypasses homebrew altogether. Nice.
I’ve recently started using mise to manage dotfiles, including its own config, and sync them on all my systems. Now I can easily have all the same packages installed everywhere. I am loving mise a lot these days.
i benchmarked it locally a few weeks ago and it's much faster than homebrew 7
how much faster is kind of a useless metric: it's so highly variable on which command and things like network speed, expect 2x-1000x faster depending on what we're talking about
"Alternative to homebrew (the CLI utility)" -> "Frontend to Homebrew (the package system)".
Along these lines, I wonder when somebody will come up with a "universal package manager" that factors out the dependency resolution, content-addressable store, packing / unpacking, file manipulation, signatures, etc. Small plugins, maybe just declarative descriptions, would suffice to connect it to stores like npm, homebrew, pypi, maybe even cargo and nixpkgs.
I can see how apt may be an "universal package manager" because Debian has everything, in several variations. But it only works a the Debian-style package database.
What I mean saying "universal" is an ability to adapt to any sane package database, among other things.
Bazel (which I had a chance to know also as Blaze) is a might build tool. But can it install a local package for you, the way brew, nix, npm, or apt can? Blaze is famously hermetic.
- homebrew maintainers wouldn't be interested in accepting this as a PR unless it's actually maintainable, as they're the ones who would have to take responsibility for maintaining it going forward. And it needs to integrate well with the existing architecture, be well-designed and well-documented, have a migration plan and fallbacks for edge cases that are currently supported but won't work with this, etc. OPs implementation works, but is some combination of hacked together / slopcoded and it would take a lot of work to get it into a shape that could be accepted upstream. OP isn't interested in (or isn't capable of) putting in that work.
- "I made zerobrew, with 7.6K GitHub stars and thousands of users" sounds more impressive than "I made a contribution to homebrew that sped up package installation by up to 100x" despite the latter being both harder and more useful.
Good! I want to be able to trust and rely on homebrew, authorization, authentication, infra, os and other _crucial_ software. The bar should be really high and I appreciate the efforts of open source maintainers now more than ever.
That's exactly the problem with loaded words. People often use it to mean different things.
For example, in open source software, "open" has a different meaning than it does in "open door". It never meant that anyone could upstream their desired changes. It meant, and still means, that you can take the code and do whatever you want with it without legal consequences. You can still do this.
What's changed is the large volume of slop and garbage thrown at open source maintainers. When these are understandably rejected, people (or AI companies) get upset and complain about gatekeeping.
What's the significance of warm speedup in the benchmarks? For most new installs, cache would mostly be empty, shouldn't the cold numbers be more significant for day to day use?
Why would one care for 100x faster homebrew? it's a tool you use every now and then, you rarely install or upgrade 1000 things, and when you do it doesn't really matter if it takes 10s or 0.1s
I wonder how the industry has not yet learned to use ASD-STE100 Simple Technical English for documentation. It makes it so much more polished and so much less AI-sloppy.
I don't think MacPorts users have those kind of problems.
Personally I was burnt by Homebrew many years ago already. I lost trust in any such package managers. Since then I went back to just compile everything myself (I manage about 300 packages like that in my installation.) It's not that a big of problem. Only initially when you need to bootstrap everything to replace Homebrew it was quite the time investment, of course. But now you compile like a package here or there… just follow the script. It's very quickly done.
The best thing… no clutter. Every package has its strict directory. I only symlink from that what I need into /usr/local/bin.
When Homebrew first came out, I found its antagonistic marketing off-putting. The website used to read "MacPorts driving you to drink?" I always found its takeover of /usr/local and the lack of authentication for software installation to be strange decisions. Amusingly, its approach these days is closer to the way MacPorts has always done things.
> Every package has its strict directory. I only symlink
Isn't that exactly the benefit of homebrew? It installs in one folder and symlinks.
And my guess, it would've been much easier to remove extra symlinks you don't need from its package manifest rather than rewrite the whole system
Homebrew links everything by default (at least that's how it was), so you ended up with all kind of extra junk files all over the place you never needed that comes with some packages... all cluttering up things in the /usr/local main directories and the PATH.
Homebrew additionally also had bunch of other directories, a huge git checkout, etc. then add the weird permission restrictions/ limitations on top of it… many packages then stopped supporting the customisation options at some point, so you were forced to rebuild half of them yourself anyway, if you needed the respective options. Now you had even more mess in /usr/local. :-)
It may work for some, but it wasn't for me anymore (and I used Homebrew for many years before that.)
Same. When they explained why they assumed and required /usr and/or /usr/local was owned by steve or bill or whatever, with a straight face, I was gobsmacked and never touched it again.
Like, how did people so ignorant come to manage such a project? I excuse most of the users but not the authors who have the balls to call themselves "engineers" on top.
I wouldn't be suprised if they weren't the very reason shortly after that Apple took over ownership and brute force OS control over those dirs.
It's just the same on Linux though. Don't touch anything under /usr but /usr/local or you will run into issues, third-party software uses /usr/local, and that is why Macports ended up in /opt/local - guaranteed free of collisions.
Homebrew is rushing to drop support for Intel Macs despite the fact Intel Macs received a major version of macOS from Apple only 12 months ago. Check out MacPorts. It was the original popular package manager for macOS, and it supports Macs going all the way back to Leopard. It has a ton of packages, and the maintainers are very responsive to requests and bug reports in my experience.
I tried zerobrew before the original author archived it. It really was faster. There's even a mise plugin for it, but the plugin for it wasn't great to be honest. Caused some wild slowdowns on my prompt. I think it's cos zb or maybe the plugin loads some huge Homebrew version file every time it's invoked. Didn't look too much into it, but it was killed my prompt on slower connections
I use nix-darwin as a replacement for homebrew, and it’s served me well for circa 8 years.
Nix isn’t for everyone, but I find it to be far more stable.
Most of the slowness in brew comes from download times, so I don't really need this I think? I never thought "brew is too slow" except when it's downloading.
But I always thought I don't need pnpm untill I started using it, so. I don't know.
(I always knew I needed actually good python package manager before uv came, though.)
With coding agents available for the config files, I don’t see any reason not to use nix. Easy rollbacks, temp envs with different versions, what not to like.
Homebrew has continued to improve performance each major version. It's certainly a lot quicker nowadays than 5 years ago. I want reliability and safety in a package manager, speed is nice to have.
I applaud competition, but something like this starts with trust zero as far as I'm concerned. If there is one place that I want human input over LLM it's here. It needs to scream: smart humans are in control and overseeing the project. I don't see that here.
How is Homebrew fundamentally different (as of today) - they vibe code. For example, the new app BrewUI is vibe coded, Claude is #2 contributor.
Does this scream "smart humans"?
AI may make it easy to clone or port something to a new language but it will later need a dedicated human to put in a shift and fine tune it.
So unless you are ready to keep jumping to the newest, it's better to stay with the trusted for now.
Is it smart to deprecate everything the minute Apple sunsets their OS version?
This is not a smart package manager, its a manager for the “dumb” masses, that need to be saved and protected from themselves by forcing them into the next walled garden, so to speak…
So far I never had any issue with it or any backward incompatibilities when upgrading, despite the very frequent releases and constant new features. The developer also seems very security minded (he immediately added a "minimum release age" feature for all apps when the trivy github action debacle was made public)
I’ve recently started using mise to manage dotfiles, including its own config, and sync them on all my systems. Now I can easily have all the same packages installed everywhere. I am loving mise a lot these days.
I use Brewfile too. Still prefer some stuff to be managed by brew. For example the browsers, App Store apps (managed via mas[1])
[1] https://github.com/mas-cli/mas
how much faster is kind of a useless metric: it's so highly variable on which command and things like network speed, expect 2x-1000x faster depending on what we're talking about
Along these lines, I wonder when somebody will come up with a "universal package manager" that factors out the dependency resolution, content-addressable store, packing / unpacking, file manipulation, signatures, etc. Small plugins, maybe just declarative descriptions, would suffice to connect it to stores like npm, homebrew, pypi, maybe even cargo and nixpkgs.
What I mean saying "universal" is an ability to adapt to any sane package database, among other things.
Ok, but why a new app for that instead of a PR for brew?
- homebrew maintainers wouldn't be interested in accepting this as a PR unless it's actually maintainable, as they're the ones who would have to take responsibility for maintaining it going forward. And it needs to integrate well with the existing architecture, be well-designed and well-documented, have a migration plan and fallbacks for edge cases that are currently supported but won't work with this, etc. OPs implementation works, but is some combination of hacked together / slopcoded and it would take a lot of work to get it into a shape that could be accepted upstream. OP isn't interested in (or isn't capable of) putting in that work.
- "I made zerobrew, with 7.6K GitHub stars and thousands of users" sounds more impressive than "I made a contribution to homebrew that sped up package installation by up to 100x" despite the latter being both harder and more useful.
It’s sad, but also makes some sense.
Nobody wants to maintain someone else’s AI slop when they could do their own version of the slop.
Good! I want to be able to trust and rely on homebrew, authorization, authentication, infra, os and other _crucial_ software. The bar should be really high and I appreciate the efforts of open source maintainers now more than ever.
Everyone doing any kind of gatekeeping is convinced that it’s for a great reason.
That's exactly the problem with loaded words. People often use it to mean different things.
For example, in open source software, "open" has a different meaning than it does in "open door". It never meant that anyone could upstream their desired changes. It meant, and still means, that you can take the code and do whatever you want with it without legal consequences. You can still do this.
What's changed is the large volume of slop and garbage thrown at open source maintainers. When these are understandably rejected, people (or AI companies) get upset and complain about gatekeeping.
Personally I was burnt by Homebrew many years ago already. I lost trust in any such package managers. Since then I went back to just compile everything myself (I manage about 300 packages like that in my installation.) It's not that a big of problem. Only initially when you need to bootstrap everything to replace Homebrew it was quite the time investment, of course. But now you compile like a package here or there… just follow the script. It's very quickly done.
The best thing… no clutter. Every package has its strict directory. I only symlink from that what I need into /usr/local/bin.
Isn't that exactly the benefit of homebrew? It installs in one folder and symlinks. And my guess, it would've been much easier to remove extra symlinks you don't need from its package manifest rather than rewrite the whole system
Homebrew additionally also had bunch of other directories, a huge git checkout, etc. then add the weird permission restrictions/ limitations on top of it… many packages then stopped supporting the customisation options at some point, so you were forced to rebuild half of them yourself anyway, if you needed the respective options. Now you had even more mess in /usr/local. :-)
It may work for some, but it wasn't for me anymore (and I used Homebrew for many years before that.)
Like, how did people so ignorant come to manage such a project? I excuse most of the users but not the authors who have the balls to call themselves "engineers" on top.
I wouldn't be suprised if they weren't the very reason shortly after that Apple took over ownership and brute force OS control over those dirs.
https://docs.brew.sh/Support-Tiers
Thanks to LLMs I just vibe my own package management system based on debian packages and have my own registry now with stuff that I care about
From https://nixos.org/manual/nixpkgs/unstable/release-notes#x86_...
> [...] We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs. [...]
But I always thought I don't need pnpm untill I started using it, so. I don't know.
(I always knew I needed actually good python package manager before uv came, though.)
https://github.com/Homebrew/brew-rs
curl && tar -x && ./configure && make install ? Guess what, it's the same with more steps.
Bruh…