How do Open Source projects audit code to ensure it comes from ethical sources. For example, if a hacker hacks into IBM, steals some code and contributes it to the kernel, how does the kernel team ensure that it doesn't get into the kernel?

  • 1
    Why hello there! You're question is a tad broad, and it would be easier to give an answer if you could state the project, and if there are any policies and practices surrounding the project. Thanks :D – Zizouz212 Sep 17 '15 at 0:09

The short answer is they don't OK, most of them don't.

The longer answer is this:

When accepting contributions, many projects have contributor agreements. These often contain a clause that says "if you submit code, you certify that you have the right to license such code to the project". If someone's committing stolen code, they don't have the right to license it, so their contribution is legally void. If IBM comes after the project maintainers for including that code, they can simply point to the agreement contract and say "blame him".

Even for projects without a contributor agreement, there is the principle of good faith. A project accepts contributions in good faith; that is, they assume you have the right to license them the code you contribute. If you don't, the project can't be held liable because of this - they would have to replace the offending code, but they wouldn't be legally responsible for damages, etc.

  • 1
    -1 Because some projects do have security audits. This question is clearly too broad. – curiousdannii Sep 16 '15 at 22:41
  • @curiousdannii Not that questions are a reason to downvote answers, of course...technicalities. Fixed. – ArtOfCode Sep 16 '15 at 22:53

Not the answer you're looking for? Browse other questions tagged or ask your own question.