> This is now how smart people install software.

On the contrary, I think what Homebrew does with regards to permissions is fundamentally incorrect. /usr/local, being shared, should be owned by root, and it should require administrator permissions to install software there.

If I shared my Mac with anyone I’d agree, but as it is, my Mac is a single-user machine and I’d rather run brew as myuser:mygroup to avoid running the install scripts as root.

With Brew it's a moot point - you can't choose to do otherwise, it will refuse to run as root, and has no capability to do the "normal" `make && sudo make install` pair, where you build as user and install as root.

I'd rather not run a random `make install` (or, in Brew's case, as random ruby script) as root, though.

And that's what a user ~/bin directory is for then - you don't want to run as root, install in your home.

Installing user-own software, in a user-specific location is fine.

/usr/local is not user specific, and setting the permissions so it is treated that way doesn't stop other software referring to it as a system-wide $PATH.

There is no ~/bin directory on macOS though. Homebrew could create one, but iirc Apple's guidelines discourage creating new directories in the user's home folder. (Which I generally agree is a bad practice, btw, although this might be an exception.)

I guess you could put something in the ~/Library folder, although that's not ideal either...

There's no `/usr/local/Brew` (or whatever directory it uses) either, but it creates it, and it changes the ownership of `/usr/local/bin` to make it writable without a sudo prompt - which is more egregious than creating a `~/bin` directory, any day of the week.

If they didn't insist on using `/usr/local/bin` (which is in the default $PATH) the permissions issue would be much less of an issue IMO (not a non-issue, but less of an issue than it is currently)

Gah, sorry typo in my comment, it should say "not", but it says "now.

Anyway, I agree, it should be root owned and use sudo/similar to install.

Sorry for the confusion!

I should have been clearer about this^

On most systems with 1 user it's irrelevant as by default they are in the admin group. Rather, usr/local exists and you may read and write into it even if you don't have explicit ownership (e.g, root). Whether that's brew, or your own script doesn't really matter.

On Mojave at least, `/usr/local` is owned by root:wheel, the first user account (which has admin rights) is not in the wheel group but can use sudo to write to `/usr/local`.

I happily make /usr/local owned by myuser:mygroup—on a single-user machine that’s no more dangerous than putting ~/bin into $PATH

If you edit your own $PATH, it literally only affects your user account.

`/usr/local/bin` is in the default $PATH, so making it world writable means anything malicious installed there may end up being called by a system utility that runs as another user than your own.

For your (and Brew's stated goal), installing into ~/bin would be a better result, because it's literally that single users account.

But the Brew developers never want to hear any criticism of their ridiculous bullshit, whether it's security issues or their half-assed dependency resolution.