back
2 comments
Depends on why you're a mac in the first place. For me it was iOS adjacent dev, and that meant upgrading the building stack every year, uncluding straight OS upgrades. And thus screwing my other dependencies every year.

After the third or fourth time, I switched to a VM that will stay stable basically whatever happens to the system.

Executing a bunch of npm modules locally, having a Mongo and Redis database running 24/7.

I don’t have a great answer. One thing I’ve noticed on Mac is that, using Activity Monitor, before installing all the dev dependencies for local dev nearly all processes seem to run under the local user’s user space, but after installing a bunch of stuff (with sudo) a ton of processes default to running as “system”

I haven’t had time to research whether this actually has a meaningful impact on security, but TLDR I trust Mac’s out of the box security, but I instantly stop trusting it the moment I start installing a bunch of stuff via Homebrew and NPM.

You generally shouldn’t ever use sudo with either Homebrew or NPM.

Homebrew is specifically designed to be used without elevated privileges. This has the downside that packages are owned by the user which first ran the install (which might lead to those packages running with elevated privileges after a sudo install as well? I don’t know, and I’m not eager to find out).

NPM packages are typically either project local (and these definitely shouldn’t be installed with sudo), or “global” (which should be global in the sense of being installed on the user’s PATH, and thus shouldn’t require sudo for any normal setup either).

You’re right to be cautious about the security implications of this.

> This has the downside that packages are owned by the user which first ran the install

This is a bit of a security problem if Homebrew's .../bin is on your sudoers secure_path, because now your normal user can overwrite something that might be invoked via a simple `sudo whatever`, which doesn't specify the full path to whatever

> which might lead to those packages running with elevated privileges after a sudo install as well? I don’t know, and I’m not eager to find out

No, definitely not by any normal mechanism. Maybe there are some exception, like packages that set up LaunchAgents or LaunchDaemons, or which run the install scripts of .pkg installers which ask for elevated privileges. But those can set up programs that run with elevated privileges anyway.

Brew will prompt for elevated privileged when necessary, or at least formulae should conform to that design
Strong rec to avoid use of sudo for brew or (p)npm, not sure why you'd want to do that.
sudo or not makes very little difference, unless you actually use multiple user accounts with different privileges on your Mac.
it makes a big difference if you don't want to practice poor security hygiene and form a bad habit of constantly entering your password for no reason.
The nice thing about the Mac is that you can run a lot of unix tools natively.

But of course, anything that runs on your Mac is a potential security hole. Obviously all 3rd party apps that you use can compromise security. But it can also be your own code: If eg. your rails app has a security vulnerability, which is common during development, and you run it with your local user, as is common during dev, then that vulnerability can potentially compromise all your data.

So if you want to be safe, run all your dev stuff in VMs or on a separate device, or in a container or something.

Of course, that is cumbersome, and whether it is necessary or not depends on what kind of threats you expect...

nvm for Node + use containers for database services?
tangent: fnm https://github.com/Schniz/fnm is faster than nvm and much cleaner in its shell integration.
nvm doesn’t stop npm modules from installing locally. many npm modules have pre/post install scripts that execute binaries and such that I’d rather not execute locally

Docker for Redis/Mongo is reasonable, but npm dependencies creeping into the system is something you can’t really easily undo other than a full wipe and reinstall of the OS. Especially when certain modules require sudo to install

Docker volumes might help with the module management too through executing npm i side a container.

YMMV as performance can sometimes be an issue.