Re: No Bison 3 in untainted macOS installs

[Hans Åberg]

> On 15 Dec 2018, at 17:58, Uxio Prego <address@hidden> wrote:
> 
> 
>> On 15 Dec 2018, at 17:02, Uxio Prego <address@hidden> wrote:
>> 
>>> Also, MacPorts [3] packages tend to be more up-to-date. It is installed in 
>>> /opt/, so /usr/local doesn't get cluttered. So it is possible to choose 
>>> what one wants, say GCC from MacPorts, and the original Clang from their 
>>> site in different builds, especially easy if you use Automake, which admits 
>>> out of source tree compilation.
>> 
>> Actually Homebrew clutters a specific `Cellar/` dir under
>> `/usr/local/`, so I see no effective benefit. And Homebrew
>> already seems really up to date.
> 
> You are right, it clutters /usr/local/ all over the place.
> I stand corrected. Thanks.

I think that the may make links into the directory you mentioned. They also 
used to have the requirement to change the permissions of the /usr/local to a 
single user.

> In my opinion that leaves the discriminant to be which one
> of these is less vulnerable to package hijacking a la NPM.
> Ouch. No idea which one.

On MacPorts, one has to sudo. But normally, for security reasons, one should 
compile the package as user, and as root, only install it.