Homebrew SECURITY FLAW! You could EASILY be ATTACKED!

Homebrew has a SERIOUS SECURITY FLAW, thus enabling attacks to happen easily. Let me show you how the vulnerability works and what you can do to protect yourself and continue to use this AWESOME Package Manager.

Homebrew Links:

Special Thanks To: Photo by Markus Spiske from Pexels

🔥 Ninja Mac Videos:🔥
Control Mac With iPhone  Remote Mac Desktop and Screen Share Mac To iPhone - Remote Mac Access!

🔥Remotely Control Any  Mac With Screen Sharing!🔥Remote Mac Desktop with Remote Mac Access!

Dual Boot Mac OS Catalina  Mojave!

How to Test Mac Hardware using Apple Hardware Diagnostics Tool - How well is your Mac Working?

Unlock Mac  Apple Watch!

How To Download MacOS Catalina & MacOS Mojave without the App Store! NEW FEATURE IN MAC OS CATALINA!

How to Zip Files in Mac  How to Unzip On Mac  Password Protected Zip File Mac  Unzip Command Mac!

Mac Terminal  10 Awesome Commands!

Mac OS Catalina  Mojave - Storage Management Tool!

Lost Mac? Find My Mac! Find My Mac iCloud & Find My Mac Alert! How does Find My Mac work? Dive in!

🔥How to Encrypt External Drives on your Mac!🔥

iMovie Tutorial 2019  iMovie For Mac Tutorial will give you the Skills to Make your Movie Awesome!

[robertburrowes]

Another approach is to create a new 'brew' user on the mac, and use it to install everything. You change to that user to add new binaries, but never use the 'brew' user account for anything else.

Not requiring a password to add software, or to alter the files is /usr/local, is a huge security hole.

[AtacamaHumanoid]

I didn't quite catch what you did there to secure it.

[jesuscervantes]

How about creating a script that goes back to a secure bin folder after downloading and installing any formulas and or casks?

[Knightjp]

This is why I prefer macports over Homebrew.

[jesuscervantes]

Also, what about MacPorts, does it also have security flaws?

[avashurov]

What about the original location where the alias is pointing to? You can still overwrite that? How about the brew executable itself or it’s libraries?

[piperskenny]

Hi Apple Ninja, great video! -- thank you.

Q: I’m a bit confused though could you please clarify.
As I understand your solution to this brew flaw is to chown the permissions back and forth.
In other words you maintain permissions as:
sudo chown root:wheel /usr/local/bin
and then
sudo chown macguy:admin /usr/local/bin
when you want to install a formula? Is that correct?

And what about:
/usr/local/opt
Q: Would your permissions toggling be advisable there, too?
And if not why not?

[jimmyconway]

what if nothing pops up on brew list does that mean theres nothing to worry about as far as security ?

[piperskenny]

thank you in advance for your time! : )