Recently some non-technical managers where I work found out that GitHub has a repository with code from "Hidden Tear" which is a ransomware application. The immediate reaction was to ban GitHub, which is something that we use extensively to get open source code. The only way to access GitHub again is by proving that the site is safe. This would be easy to do if I were convincing software developers, however I am speaking with people who have never written a line of code. I have been told that if I want to use code from GitHub or view pages on the site I need to do the following:
- Show the site is safe and will not infect our computers
- Create an open source policy for use when determining the safety of code found on GitHub.
My first step was to go through a list of companies and government organizations that use GitHub. I believe that this will start to calm fears that the site is going to infect all computers with ransomware. I will expand on this by describing what GitHub is, what it does and why it is valuable.
The problem is that I don't have much experience writing policy documents. I'm hoping to find someone with some knowledge about policy that could share some of their experiences in writing open source usage policy. From what I understand our policy should be a step by step guide to determine whether or not we can use a specific library/plugin.
Show the site is safe and will not infect our computers-- You can't. How would one prove this about any website?