Questions tagged [security]

For questions about security practices as applied to open source software.

Filter by
Sorted by
Tagged with
49
votes
4answers
5k views

Security of Github.com

Recently some non-technical managers where I work found out that Github has a repository with code from "Hidden Tear" which is a ransomware application. The immediate reaction was to ban GitHub, which ...
31
votes
2answers
2k views

Report a security issue to a project hosted at GitHub

If I find a security issue in a Github project should I raise it in the project's issue tracker (where it's open to public scrutiny) or try to find private means to contact the repo's maintainer so ...
19
votes
8answers
2k views

How to give evidence that an open-source project is reputable?

Other than having someone manually reading all of the code, how can you demonstrate an open-source project's reputability? i.e. it is not a virus/malware/whatever. I'm not concerned with the ...
10
votes
1answer
1k views

Malicious code in open source software planted before open sourcing

We know it's very hard to sneak in malicious code via commits to an open source project with a public repository. However, what about closed source projects that get open sourced and start with a ...
8
votes
1answer
56 views

Does the GFDL forbid sending licensed material over a secure connection?

The infamous "DRM clause" of the GFDL reads: You may not use technical measures to obstruct or control the reading or further copying of the copies you make or distribute. From Wikipedia: A ...
6
votes
3answers
2k views

Licence to prevent sharing a modified copy of a software?

Is there any open source licence that would allow one individual to copy, modify, share the source code of the project while preventing to share a modified copy of the project? I'm asking that ...
6
votes
2answers
75 views

Are there rules on what to do with an old OpenSource software with a security issue?

I created Zipios version 2.x in 2015 based on an existing library and inherited the old version (0.1.5) as a result... In June 2019, I got an email from Mike Salvatore who reported having a problem ...
5
votes
2answers
58 views

Assessing potential security flaws in open source software

Are there established guidelines or best practices for checking open source software for security flaws prior to using it in a business environment? Is this down to the individual business to decide ...
5
votes
2answers
90 views

How do I make sure my installer doesn't set off virus scanners?

The converse of this question. How to give evidence that an open-source project is reputable? The installer for my project is being picked up as "Untrusted" by a popular anti-virus software (in ...
4
votes
1answer
710 views

Open Source projects with encryption keys

I currently have a project which I'm planning in the not too distant future to open source on GitHub. The question I have is regarding how open source projects are released if they have encryption ...
3
votes
2answers
575 views

Can I hide a few lines of code because of security reasons?

I am working on a little project, and I consider making it open source (GPLv3). But there is one little problem: There are a few lines of code I don't want to show off to the public because of a ...
3
votes
2answers
752 views

Is open source software less or more secure than proprietary software? [closed]

Free software evangelists often advertise free and open source software to be more secure than proprietary alternatives. Is this true, and why? Are there security reasons not to use free and open ...
3
votes
2answers
199 views

Are we obligated to scan the entire code base, or just patches? [closed]

Given that we should already check the patches which we distribute, does hosting the source tree of an OSS component obligate us to check it for copyright infringement, license compliance and/or ...
3
votes
1answer
103 views

How do we verify if the code deployed in same as the one published?

My question might be naive but wanted to clarify this anyway. We see software being published as open source. Take for example Signal. We can audit the software since its public. But how do we verify ...
2
votes
1answer
96 views

How to prevent integration with malware and virus of open source software in compiling section?

In every open source software community, there is a small group which pay effort on compiling and packaging open source software. As a advantage of open source software, everyone can read the source ...
1
vote
2answers
81 views

Create an OAuth2.0 Application that doesn't violate Google TOS?

I've almost completed a Blender Add-on that allows a user to upload a video to Youtube. It has just come to my attention that embedding your app's credentials from the client_secrets.json file into an ...
1
vote
1answer
48 views

Open Sourcing my API - Exposing my Database?

I have an API that I created myself here: https://db.ygoprodeck.com/api-guide/ I get roughly 20,000 requests per day on it but have asked by a couple of people to open source it. I look into this ...
1
vote
1answer
45 views

Examples of Open-Source Backends

In future I am hoping to make a non-profit organization that specialises in developing open-source libraries and tools aimed at junior developers. I've been considering making the website and backend ...
1
vote
0answers
109 views

How can I deploy an open source web app that hosts user data?

I'm thinking about developing an open-source web application where users can enter trips that they have done (touristic or commuting) and then view statistics and maps created from this data. From the ...
0
votes
0answers
18 views

ZHST_IMS_Package license issue

The ZHST_IMS_Package 1.0.0 was installed through Application insights nugget packages. As part of black duck scan found this has issue with license and reported as "License Not Found". I found this ...