Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

For questions about security practices as applied to open source software.

3
votes
1answer
84 views

How do we verify if the code deployed in same as the one published?

My question might be naive but wanted to clarify this anyway. We see software being published as open source. Take for example Signal. We can audit the software since its public. But how do we verify ...
2
votes
1answer
60 views

How to prevent integration with malware and virus of open source software in compiling section?

In every open source software community, there is a small group which pay effort on compiling and packaging open source software. As a advantage of open source software, everyone can read the source ...
3
votes
2answers
248 views

Can I hide a few lines of code because of security reasons?

I am working on a little project, and I consider making it open source (GPLv3). But there is one little problem: There are a few lines of code I don't want to show off to the public because of a ...
1
vote
2answers
75 views

Create an OAuth2.0 Application that doesn't violate Google TOS?

I've almost completed a Blender Add-on that allows a user to upload a video to Youtube. It has just come to my attention that embedding your app's credentials from the client_secrets.json file into an ...
4
votes
1answer
460 views

Open Source projects with encryption keys

I currently have a project which I'm planning in the not too distant future to open source on GitHub. The question I have is regarding how open source projects are released if they have encryption ...
11
votes
1answer
813 views

Malicious code in open source software planted before open sourcing

We know it's very hard to sneak in malicious code via commits to an open source project with a public repository. However, what about closed source projects that get open sourced and start with a ...
8
votes
1answer
52 views

Does the GFDL forbid sending licensed material over a secure connection?

The infamous "DRM clause" of the GFDL reads: You may not use technical measures to obstruct or control the reading or further copying of the copies you make or distribute. From Wikipedia: A ...
6
votes
3answers
1k views

Licence to prevent sharing a modified copy of a software?

Is there any open source licence that would allow one individual to copy, modify, share the source code of the project while preventing to share a modified copy of the project? I'm asking that ...
28
votes
2answers
2k views

Report a security issue to a project hosted at GitHub

If I find a security issue in a Github project should I raise it in the project's issue tracker (where it's open to public scrutiny) or try to find private means to contact the repo's maintainer so ...
47
votes
4answers
5k views

Security of Github.com

Recently some non-technical managers where I work found out that Github has a repository with code from "Hidden Tear" which is a ransomware application. The immediate reaction was to ban GitHub, which ...
5
votes
2answers
89 views

How do I make sure my installer doesn't set off virus scanners?

The converse of this question. How to give evidence that an open-source project is reputable? The installer for my project is being picked up as "Untrusted" by a popular anti-virus software (in ...
19
votes
8answers
2k views

How to give evidence that an open-source project is reputable?

Other than having someone manually reading all of the code, how can you demonstrate an open-source project's reputability? i.e. it is not a virus/malware/whatever. I'm not concerned with the ...
3
votes
2answers
197 views

Are we obligated to scan the entire code base, or just patches? [closed]

Given that we should already check the patches which we distribute, does hosting the source tree of an OSS component obligate us to check it for copyright infringement, license compliance and/or ...
5
votes
2answers
57 views

Assessing potential security flaws in open source software

Are there established guidelines or best practices for checking open source software for security flaws prior to using it in a business environment? Is this down to the individual business to decide ...
3
votes
2answers
628 views

Is open source software less or more secure than proprietary software? [closed]

Free software evangelists often advertise free and open source software to be more secure than proprietary alternatives. Is this true, and why? Are there security reasons not to use free and open ...