Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I haven't done a clean install of OS X in a long time, but I'm pretty sure /usr/local/bin exists. But even if it doesn't I don't find this a compelling argument. Having /usr/local/bin owned by root is a universally accepted standard in the unix world, and with very good reason: having /usr/local/bin owned by a user introduces security risks.


`/usr/local` is empty on a new install. I reconfirmed with a clean install VM.


I believe /usr/local/bin is empty on a fresh install.


It should be -- after all, it's there for local software.


What are those risks?


/usr/local/bin is a global resource. It is generally full of binaries that get run by many different users including root. If a regular user can replace those binaries the result is a privilege escalation.


which programs from /usr/local/bin get run by root under current macOS?


Well, by default /usr/local/bin is empty. But people commonly install things there that eventually get run by root. The most obvious example is various programming languages, different versions of Python, alternate shells, etc.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: