The Homebrew team has released version 6.0 of this popular open-source package manager for macOS and Linux, with a new mechanism for trusting packages and support for sandboxing on Linux, to align with existing sandboxing on macOS. Homebrew 6.0 introduces tap trust, a "tap" being a collection of formulae, casks (a package of pre-compiled binaries) and commands which usually reside in a Git repository. The tool trusts official Homebrew taps by default, but requires an explicit agreement before it will trust third-party taps (which can include arbitrary Ruby code) before they install or run any code. Tap trust is part of Homebrew’s approach to supply chain security, which has a number of distinctive features. Package maintainers are Homebrew maintainers, not the authors of the package. Names are maintainer-curated, so typosquats (giving a package a misleading name designed to be similar to one that is popular) can be rejected. Each download is pinned to a sha256 checksum. Package binaries are built from source, which protected Homebrew from incidents like the Trivy compromise earlier this year when official Trivy binaries were replaced with malicious versions. These and other features of Homebrew security are described in the documentation. Project leader Mike McQuaid told us that "Homebrew was less vulnerable 10-15 years ago than npm is today. The trust model is radically different and, even today, we are much quicker to break backwards compatibility in the interest of security." A new security feature is sandboxing on Linux when Homebrew compiles software. This was already implemented on macOS (and has been for a decade). Version 6.0 adds a Linux implementation based on the Bubblewrap project, and this will be on by default for developers. A new Homebrew sub-command, brew vulns, will check installed packages for known vulnerabilities, by checking against the OSV (vulnerability database for open source). The commands brew install and brew upgrade will now show a dependency summary and require a conformation prompt before running, called ask mode, following a developer survey earlier this year where this was highly requested. Another new command, brew exec, will run a Homebrew-provided executable, similar to the way npx works for npm packages. Homebrew startup performance in 6.0 is said to be faster, thanks to parallelised bottle fetching (a bottle is a pre-built package) and other optimizations. Apple is phasing out support for Intel macOS both for future versions of macOS and for Rosetta, the Intel compatibility layer. Homebrew is following: in September this year no new bottles will be built for macOS Intel and from September 2027 macOS Intel will be "unsupported entirely and all related code deleted," according to the post introducing Homebrew 6.0. Homebrew is well-liked by developers, and becoming more popular on Linux as well as macOS. There is some frustration though regarding the dropping of Intel support. "The deprecation of Intel support is agressive! Every Mac enthusiast I know who uses a Mac as a server uses their old machines, which are pretty much all Intel. We'll lose support from you guys a year before Apple!," said one. McQuaid replied noting that Homebrew will still work for a year after support is dropped to "Tier 3”, meaning almost unsupported, and added that "there’s nothing stopping you for doing the work to setup ‘Intelbrew’ and support it for the community." Another issue he mentioned is that GitHub is dropping macOS Intel runners for continuous integration towards the end of 2027. It is notable that Homebrew 6.0 made extensive use of AI coding. A document on responsible AI usage takes the line that AI contributions must be disclosed and human-reviewed, and that AI is not responsible for any code, rather the human contributor is responsible. "AI is great if used responsibly which means a human reviewing all changes both before PRs submitted and a maintainer reviewing before PRs are merged. I have found despite using it responsibly it has been a huge personal accelerator," McQuaid told us. ®

Cars have been one of the recurring themes throughout my illustration career. Whether I'm creating artwork for a luxury car show on the shores of Lake Como or visualising emerging technologies such as hydrogen-powered vehicles and clean energy infrastructure, it's a subject I never tire of exploring. Here is a selection of automotive illustrations from recent years.

Bij de VPRO vielen deze week tientallen ontslagen als gevolg van bezuinigingen. Het gevolg: minder vrijheid, minder creativiteit. De absurde programma's van Wim T. Schippers waren vroeger ongehoord, en zijn nu letterlijk ongehoord.

Sudden shifts from wet to dry weather, or vice versa, may foil typical drought- and flood-prevention measures

Rising temperatures may trigger a dangerous increase in “hydroclimatic whiplash” in rivers that would make traditional approaches to flood and drought planning insufficient, a study has found.

As temperatures rise owing to the worsening climate crisis, rivers will experience increasingly rapid transitions between heavy downpours and long dry spells – called hydroclimatic whiplash events – because a warmer atmosphere holds more moisture, intensifying rainfall extremes.

Continue reading...

We start this week with Joseph’s story about the FCC’s wild proposal to require peoples’ government ID numbers to even get a phone plan. The FCC is doing it to curb robocalls, but also said it would be useful for a bunch of other stuff. After the break, Jason tells us all about cops abusing Flock to stalk girlfriends and other people. In the subscribers’ only section, Emanuel explains how a software update is impacting Amazon drivers.

Listen to the weekly podcast on Apple Podcasts, Spotify, or YouTube. Become a paid subscriber for access to this episode's bonus content and to power our journalism. If you become a paid subscriber, check your inbox for an email from our podcast host Transistor for a link to the subscribers-only version! You can also add that subscribers feed to your podcast app of choice and never miss an episode that way. The email should also contain the subscribers-only unlisted YouTube link for the extended video version too. It will also be in the show notes in your podcast player.

• ⁠FCC Wants to Kill Burner Phones By Forcing Telecoms to Get All Customers’ IDs⁠
• ⁠Cops Keep Getting Arrested for Using Flock to Stalk People⁠
• ⁠Software Update Automatically Turns off Amazon Delivery Drivers’ AC During Dangerous Summer Heat⁠

Proposed UI rule of thumb: “If I take a screenshot of your app at any moment, it must make sense.”

Jennifer 真泥佛 * Taiwan (Busy) has added a photo to the pool:

Sources told Russian media that Traber, who has reported ties to Vladimir Putin, is suspected of being involved in the murder of a businessman and politician in 2022.