homebrew-core VS youtube-dl

$ brew info eza ==> eza: stable 0.18.13 (bottled) Modern, maintained replacement for ls https://github.com/eza-community/eza Not installed From: https://github.com/Homebrew/homebrew-core/blob/HEAD/Formula/e/eza.rb License: MIT ==> Dependencies Build: pandoc ✘, pkg-config ✔, rust ✘ Required: libgit2 ✘ ==> Analytics install: 12,792 (30 days), 38,295 (90 days), 68,375 (365 days) install-on-request: 12,790 (30 days), 38,293 (90 days), 68,375 (365 days) build-error: 0 (30 days)

Is disabling the compromised repo the typical GitHub policy? My concern is there are monorepos used by package managers, like brew, that are a collection of thousands of projects [1]. These monorepos seem like a prime target for attack and if GitHub disables one because a malicious commit was merged then you've taken down an entire ecosystem.

[1] https://github.com/Homebrew/homebrew-core

> Correct. Though we do not appear to be affected, this revert was done out of an abundance of caution.

[1] https://github.com/Homebrew/homebrew-core/pull/167512

> right, but now you know even less about your setup when you some roadblock

This is the same with a binary though. And with homebrew, you can't follow patches or flags used or if they change.

- https://github.com/Homebrew/homebrew-core/blob/c964ad7fa53ad...

definitely be careful about using fortune in a corporate environment or public space if you don't know what dat files you are using or you might just get an extremely unwelcome surprise.

I was practicing a presentation and used to use "fortune" all the time. I forget exactly what it output but I remember being absolutely mortified about what could have happened if that had popped up during an internal company tech talk.

Kudos to brew for keeping unsuspecting people safe

https://github.com/Homebrew/homebrew-core/commit/3fb3c4c3e55...

I'm sorry to be asking this as I find it a bit silly, but it's blocking my PR [3], so could a few of you star the project on Github [1] to get my PR to run?

[1] https://github.com/laktak/chkbit-py

[2] https://brew.sh

[3] https://github.com/Homebrew/homebrew-core/pull/160018

I see. According to the Web Archive, this website stopped working all the way in November 2023, and http://ytdl-org.github.io/youtube-dl/ now contains all the same content as the old one and is the new "official" website.

youtube-dl is still a thing, last commit was one week ago.

https://github.com/ytdl-org/youtube-dl/commits/master

> Is there a service that actually gives MP3 downloads?

YouTube with youtube-dl [1] or NewPipe [2].

[1] https://github.com/ytdl-org/youtube-dl

[2] https://newpipe.net/

See elsewhere in the thread for details, but youtube-dl was restored by Github and is generally not considered to be in violation of the DMCA. You can see it on Github here: https://github.com/ytdl-org/youtube-dl

A copyright holder abused the DMCA process to take it down the first time.

The best way is to download the source from github, run `make`, and copy the the file to $HOME/bin . There hasn't been a release for about a year now and the files on the distro repos are even older (I think).

Also YouTube has been doing some changes lately on the the player and a lot of the tools fail to download audio or video.

For example, in the last couple of weeks there have been some issues with a redirect to a 'consent page' : https://github.com/ytdl-org/youtube-dl/issues/32499