CrabGopher vedhavyas

brew is a bad neighbor

This isn't a guide about locking down homebrew so that it can't touch the rest of your system security-wise.

This guide doesn't fix the inherent security issues of a package management system that will literally yell at you if you try to do something about "huh, maybe it's not great my executables are writeable by my account without requiring authorization first".

But it absolutely is a guide about shoving it into its own little corner so that you can take it or leave it as you see fit, instead of just letting the project do what it likes like completely taking over permissions and ownership of a directory that might be in use by other software on your Mac and stomping all over their contents.

By following this guide you will:

Never have to run sudo to forcefully change permissions of some directory to be owned by your account

This is a plain-text version of Bret Victor’s reading list. It was requested by hf on Hacker News.

Highly recommended things!

This is my five-star list. These are my favorite things in all the world.

A few of these works have had an extraordinary effect on my life or way of thinking. They get a sixth star. ★

Locate the section for your github remote in the .git/config file. It looks like this:

[remote "origin"]
	fetch = +refs/heads/*:refs/remotes/origin/*
	url = [email protected]:joyent/node.git

Now add the line fetch = +refs/pull/*/head:refs/remotes/origin/pr/* to this section. Obviously, change the github url to match your project's URL. It ends up looking like this:

	#include <time.h> // Robert Nystrom
	#include <stdio.h> // @munificentbob
	#include <stdlib.h> // for Ginny
	#define r return // 2008-2019
	#define l(a, b, c, d) for (i y=a;y\
	<b; y++) for (int x = c; x < d; x++)
	typedef int i;const i H=40;const i W
	=80;i m[40][80];i g(i x){r rand()%x;
	}void cave(i s){i w=g(10)+5;i h=g(6)
	+3;i t=g(W-w-2)+1;i u=g(H-h-2)+1;l(u

	package main

	import (
	"io"
	"net/http"
	"os/exec"
	)

	var (
	BUF_LEN = 1024

	# In order for gpg to find gpg-agent, gpg-agent must be running, and there must be an env
	# variable pointing GPG to the gpg-agent socket. This little script, which must be sourced
	# in your shell's init script (ie, .bash_profile, .zshrc, whatever), will either start
	# gpg-agent or set up the GPG_AGENT_INFO variable if it's already running.

	# Add the following to your shell init to set up gpg-agent automatically for every shell
	if [ -f ~/.gnupg/.gpg-agent-info ] && [ -n "$(pgrep gpg-agent)" ]; then
	source ~/.gnupg/.gpg-agent-info
	export GPG_AGENT_INFO
	else

	default['sshd']['sshd_config']['AuthenticationMethods'] = 'publickey,keyboard-interactive:pam'
	default['sshd']['sshd_config']['ChallengeResponseAuthentication'] = 'yes'
	default['sshd']['sshd_config']['PasswordAuthentication'] = 'no'