46

Show the site is safe and will not infect our computers It's not "safe". GitHub allows anonymous users to upload anything they want including malware. You could get infected by downloading/executing code or visiting anything on the "github.io" domain where arbitrary javascript (and therefore 0-day browser exploits) might be found (github.com is safer ...


22

There is a giant problem with the logic behind this fuss. Storing the source code of malware is not strongly correlated with being infected with malware. Consider http://www.metasploit.com/. It's a tool used by people protecting against intrusion -- and also by people looking to perform intrusion. Or any number of other resources used by people who study ...


21

There is, as far as I know, currently no way to mark an issue as a security issue. That makes reporting a security issue including full details on GitHub effectively a full disclosure strategy. Different people support different ways of disclosure of security issues, and full disclosure is a valid choice. However, if you don't want to go the full ...


13

Yes. The first such occurrence I know of is sufficiently old that it precedes the terms open-source and free software, dating back as it does to a time before people had realised that software could have monetary value independent of the computer on which it ran, and therefore tended to share all software. As is documented in the Wikipedia article on ...


11

All issues on Github are public. So, if the issue is one that is fine to disclose publicly, you could report it via the issue tracker. However, as a general default, I would suggest trying to report the issue privately. I can suggest two options: Look for a contact address for the maintainer. Perhaps if you are lucky it will be listed on the project web ...


10

I'm a solo programmer, not any firm. But suppose if I were to form a small firm tomorrow and decided to write a security guideline regarding what to allow/disallow from github, it will be implemented something like this: Only allow github.com domain and not github.io. Reason is that the latter is a web-hosting playground where any random developer can place ...


9

No. Any open source license allows anyone to share modified source code. From the annotated open source definition clause 3: 3. Derived Works The license must allow modifications and derived works, and must allow them to be distributed under the same terms as the license of the original software. Rationale: The mere ability to read source isn'...


8

You should not include keys in your open source project. You should include a file location where your code expects a key, and the user (or an included utility) creates or copies their own unique key into the expected location. Imagine a thousand people download your project and stand up their own versions of your open-source server -- what's the point of ...


8

You are not generally required[1] to release any secret keys necessary to make an application run. Instead, users can obtain their own key. However, redacting your source code is not a suitable approach, for the primary reason that this is inconvenient and risky for you. When you publish a new version of the code you have to make sure to always redact it. ...


8

The same way as you know any other program is not actually a virus/malware/etc. You might trust organization x not to publish malware pretending to be something else. You might trust that it's a well known product that wouldn't contain malware. You might perform static analysis. This is no different than with propriety software.


7

Not right now, but in the future you'll be able to look for a badge from the just-announced Linux Foundation's Badge Program. The Best Practices Badge is a secure open source development maturity model. Projects having a CII (Core Infrastructure Initiative) Best Practices Badge will showcase the project's commitment to security. At the moment there's a call ...


6

In my experience, this is typically done with various analysis tools. The first phase is a standard virus check on all of the files to ensure that they are clean. This is true for any software, including open-source as well as commercial packages. The next step is the use of an approved static analysis tool that includes searching for security ...


6

Is open source software more secure than proprietary software? It depends. There can be secure proprietary software and insecure Open source software and it can be the other way. It depends on knowledge and involvement of the developers. Are there reasons why Open Source Software can be more secure than proprietary software? The source code is visible to ...


6

What are you expected to do with the older versions...? That is something that is decided by every project maintainer. Some projects will only provide support and updates for the latest release, others may also provide updates for several past releases. You have provided an update and documented a known issue, even for an old version released before you ...


5

This principle is sometimes referred to as Linus' Law: Given a large enough beta-tester and co-developer base, almost every problem will be characterized quickly and the fix will be obvious to someone. Coverity published a study that "found that open source code quality is on par with proprietary code quality for codebases of similar size"; however, the ...


5

You simply can't do this, unless they granted you login access to their production servers. In other words, you cannot verify the behavior of any server you do not control. Also, unless they built their service using AGPL-licensed code, they do not have a legal obligation to expose the actual code of their service. (See the end of this answer.) In the case ...


4

Yes and no. Everything under your control you can, in theory, be held responsible for. If you host code with a virus in, you are responsible for it; if it's copyright violation the same - and you can be asked to take it down. You should always check your own code. Checking the codebase is extra work that's not strictly necessary, but if you have concerns ...


4

As with anything you host publicly, you are responsible for any problem with that content. There is not much of a difference between software and other content in this case. Depending on the country you live in, you may only be liable for violations in your hosted content once you are made aware of the issue. Also, if you host code that you received under ...


4

There are two different issues here: a legal "May I...?" a technical "Should I...?" For the legal side, there is one major case where this would not be allowed. If your project uses someone else's code that is under the GPL (or other copyleft license), then the terms of the GPL require your code to also be licensed as a whole under the GPL when you choose ...


3

On my Android phone, I use a piece of free software called forecastie, which gets weather data from Open Weather Map. It ships with a default API key. This is in keeping with that provider's policies, but it also means the app is nearly-broken as it ships: about eight or nine of each ten times when I went to get weather data, I got a "request limit ...


3

I think that your use of the term 'reputability' is important here. Open Source projects, like commercial products, have reputations. Many organizations make decisions based on reputation. Once in a while, as in Heartbleed, the results are not good. As others have said, demonstrating that a program 'does what it says it does' is a requirement for a '...


3

Having the source code available makes it easier to review it for security problems. However, this is mostly of theoretical interest in the context of a business (or a non-profit) deciding to use a piece of software. In practice, reviewing code for security is a long process requiring rare expertise, so people don't do it. When an organization wants to have ...


2

Obviously you can apply all the checks that you can also apply to proprietary software. But there are a few advantages you can use to check the software. You have access to the source code. That allows you to check the source: Make an audit. Also you can use tools for static code analysis with patterns for security related flaws. You can add logging of ...


2

Perhaps you could get access approved on a per-project basis on GitHub? For example, say you wanted to use code from https://github.com/google/zopfli you could somehow get that approved and then be able to download/use the relevant files. Annoying, but better than having to write 100% of your code from scratch. Also, if they're particularly concerned ...


2

How trustworthy a project is may be reflected in its reputation, but the existing user base simply not care beyond the first question of Does it even try to do what it says on the tin? Reviews and other evidence of an active user base such as community mailing lists will give you a hand in this area. Some critical thinking about whether you trust the ...


2

I just need to be able to demonstrate that the program is exactly what it says it is and is thus not a security risk to install. Almost all open source licenses include language along these lines: THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR ...


2

Open source projects are very diverse. The different packaging processes range from cryptographically secured reproducible builds to “there are no official builds, but this third party was kind enough to upload an .exe”. In every case, you will have to trust someone. At the very least, you have to trust your CPU vendor, compiler vendor, and the authors of ...


2

Yes. Take a look at Instructure, the provider of the Canvas online course management system (disclosure - I was the Canvas admin for the college I worked for for 6 years, and I love the product). Not only do they have a wonderful well documented REST API that actually works the way the docs say they do, the product is licensed under the AGPLv3. The ...


2

Uploading code to Github makes your code possible to read. It would not be legally possible to use unless you choose a license for your code. Github can suggest you some license options and help you with licensing your code. Make sure you choose the one that fits your needs. If you don't want to expose your DB structure, you can refactor your code in a way ...


1

I don't think the GPL is affected. To “convey” a work means any kind of propagation that enables other parties to make or receive copies. So I'd say you convey the source by placing it on a web server and allowing others to obtain it from there. Individuals downloading it do not convey the source themselves, nor is each such transfer to be seen as a ...


Only top voted, non community-wiki answers of a minimum length are eligible