homebrew-core VS mise

$ brew info eza ==> eza: stable 0.18.13 (bottled) Modern, maintained replacement for ls https://github.com/eza-community/eza Not installed From: https://github.com/Homebrew/homebrew-core/blob/HEAD/Formula/e/eza.rb License: MIT ==> Dependencies Build: pandoc ✘, pkg-config ✔, rust ✘ Required: libgit2 ✘ ==> Analytics install: 12,792 (30 days), 38,295 (90 days), 68,375 (365 days) install-on-request: 12,790 (30 days), 38,293 (90 days), 68,375 (365 days) build-error: 0 (30 days)

Is disabling the compromised repo the typical GitHub policy? My concern is there are monorepos used by package managers, like brew, that are a collection of thousands of projects [1]. These monorepos seem like a prime target for attack and if GitHub disables one because a malicious commit was merged then you've taken down an entire ecosystem.

[1] https://github.com/Homebrew/homebrew-core

> Correct. Though we do not appear to be affected, this revert was done out of an abundance of caution.

[1] https://github.com/Homebrew/homebrew-core/pull/167512

> right, but now you know even less about your setup when you some roadblock

This is the same with a binary though. And with homebrew, you can't follow patches or flags used or if they change.

- https://github.com/Homebrew/homebrew-core/blob/c964ad7fa53ad...

definitely be careful about using fortune in a corporate environment or public space if you don't know what dat files you are using or you might just get an extremely unwelcome surprise.

I was practicing a presentation and used to use "fortune" all the time. I forget exactly what it output but I remember being absolutely mortified about what could have happened if that had popped up during an internal company tech talk.

Kudos to brew for keeping unsuspecting people safe

https://github.com/Homebrew/homebrew-core/commit/3fb3c4c3e55...

I'm sorry to be asking this as I find it a bit silly, but it's blocking my PR [3], so could a few of you star the project on Github [1] to get my PR to run?

[1] https://github.com/laktak/chkbit-py

[2] https://brew.sh

[3] https://github.com/Homebrew/homebrew-core/pull/160018

Where are you getting "mise uses asdf" from? mise is simply compatible with all asdf plugins. Not the same thing.

It's even said almost at the top of the README.md in the "30 seconds demo" section:

"The following shows using mise to install different versions of node. Note that calling which node gives us a real path to node, not a shim."

https://github.com/jdx/mise?tab=readme-ov-file#30-second-dem...

So yes, mise does not use shims. It only manipulates $PATH. I did benchmarks a while ago and that definitely and consistently has shaved some milliseconds off of the startup times of my tools.

mise borrows the plugins from asdf, which also makes it non-cross platform. Interesting discussion on this topic on their GitHub: https://github.com/jdx/mise/discussions/66

Solutions considered include adopting the vfox plugin system or transpiling all asdf plugins to ShellJs.

Now I know that vfox exists.

Why not just use a tool like asdf (https://asdf-vm.com/) or mise (https://mise.jdx.dev/)?

These tools have the advantage of not being multi-taskers and can manage version for all your tools. You wouldn’t need pyenv and npm and rvm and…

We’ve even started committing the .mise.toml files for projects to our repos. That way, since we work on multiple projects that may need multiple versions of the same tool, it’s handled and documented.

direnv + mise does exactly that. When I cd to various directories I get different env vars, it's pretty neat. Setting aliases would just be a case of adding them.

https://github.com/jdx/mise/discussions/1525 for an example of how I use direnv with mise.

https://mise.jdx.dev/direnv.html

https://mise.jdx.dev/templates.html

Installed bun js runtime (I used mise, btw)

Not nix based, but I really like https://github.com/jdx/mise too to manage dev tools.

It’s a modern version of https://github.com/asdf-vm/asdf written in Rust.

The purpose of a version manager is to help you navigate or install any tools for development easily. Version Manager can be one tool for each dependency (e.g. NVM, g) or One tool for all dependencies (e.g. asdf, mise).