82
votes
Accepted
Is GitHub "releases" section safe from malicious code? To be specific, does the binary match the code in a restrictive way?
There are no guarantees that the uploaded artefacts match the source code in the repository. That something is on GitHub does not mean that it can be trusted. You need to also trust the maintainers of ...
- 38.4k
50
votes
Security of GitHub.com
Show the site is safe and will not infect our computers
It's not "safe". GitHub allows anonymous users to upload anything they want including malware. You could get infected by downloading/...
- 2,879
32
votes
What guarantees that the published app matches the published open source code?
In addition to Mureinik's excellent point, there is a general move towards reproducible builds in FLOSS, which provides a useful halfway house between build it yourself and distributor publishes a ...
- 46.1k
31
votes
Accepted
Report a security issue to a project hosted at GitHub
There is, as far as I know, currently no way to mark an issue as a security issue. That makes reporting a security issue including full details on GitHub effectively a full disclosure strategy.
...
- 9,236
24
votes
Security of GitHub.com
There is a giant problem with the logic behind this fuss. Storing the source code of malware is not strongly correlated with being infected with malware.
Consider http://www.metasploit.com/. It's a ...
- 4,217
19
votes
Accepted
What guarantees that the published app matches the published open source code?
As a general problem, I'm not aware of a robust way to validate that a given binary matches a given source repository (see, e.g., this discussion on Security.SE).
Ultimately, it boils down to a ...
- 4,637
18
votes
Report a security issue to a project hosted at GitHub
All issues on Github are public. So, if the issue is one that is fine to disclose publicly, you could report it via the issue tracker.
However, as a general default, I would suggest trying to report ...
- 281
16
votes
What guarantees that the published app matches the published open source code?
Short answer: You can't.
There's a famous paper Reflections on Trusting Trust by Ken Thompson about how the compiler itself could be inserting the malicious code, including when compiling itself.
The ...
- 741
13
votes
Accepted
Security of GitHub.com
I'm a solo programmer, not any firm. But suppose if I were to form a small firm tomorrow and decided to write a security guideline regarding what to allow/disallow from github, it will be implemented ...
- 995
13
votes
Malicious code in open source software planted before open sourcing
Yes. The first such occurrence I know of is sufficiently old that it precedes the terms open-source and free software, dating back as it does to a time before people had realised that software could ...
- 46.1k
10
votes
Report a security issue to a project hosted at GitHub
This is an old issue, but GitHub now recommends you to open a new issue on the related repository to ask for a preferred security contact:
If there isn't a security policy in place, the most ...
- 201
9
votes
Accepted
Licence to prevent sharing a modified copy of a software?
No.
Any open source license allows anyone to share modified source code.
From the annotated open source definition clause 3:
3. Derived Works
The license must allow modifications and derived works, ...
- 9,236
8
votes
Accepted
Open Source projects with encryption keys
You should not include keys in your open source project. You should include a file location where your code expects a key, and the user (or an included utility) creates or copies their own unique key ...
- 34.8k
8
votes
Accepted
Can I hide a few lines of code because of security reasons?
You are not generally required[1] to release any secret keys necessary to make an application run. Instead, users can obtain their own key.
However, redacting your source code is not a suitable ...
- 38.4k
8
votes
How to give evidence that an open-source project is reputable?
The same way as you know any other program is not actually a virus/malware/etc.
You might trust organization x not to publish malware pretending to be something else. You might trust that it's a well ...
- 9,236
8
votes
How can I trust to Open Source programs?
It is true that the developer of the original application can be malicious: Ken Thompson's famous (and seminal, and also very readable) paper "Reflections on Trusting Trust" makes clear just ...
- 46.1k
8
votes
How to know if you can trust a third party open source plugin? (flutter)
We can't tell you what to trust. You mentioned stars for that package on a review website. Looking for social proof is a common way to decide whether something is trustworthy, but of course that is ...
- 38.4k
7
votes
How to give evidence that an open-source project is reputable?
Not right now, but in the future you'll be able to look for a badge from the just-announced Linux Foundation's Badge Program. The Best Practices Badge is a secure open source development maturity ...
- 3,901
7
votes
Is it possible to verify device identity transparently?
It seems to me that the place to start is the FSF's thoughts on Digital Restrictions Management, which note:
Then came Treacherous Computing, promoted as “Trusted Computing,” meaning that companies ...
- 46.1k
6
votes
Accepted
Are there rules on what to do with an old OpenSource software with a security issue?
What are you expected to do with the older versions...?
That is something that is decided by every project maintainer. Some projects will only provide support and updates for the latest release, ...
- 1,505
6
votes
Accepted
How do we verify if the code deployed in same as the one published?
You simply can't do this, unless they granted you login access to their production servers. In other words, you cannot verify the behavior of any server you do not control. Also, unless they built ...
- 34.8k
6
votes
How to give evidence that an open-source project is reputable?
In my experience, this is typically done with various analysis tools.
The first phase is a standard virus check on all of the files to ensure that they are clean. This is true for any software, ...
- 1,457
6
votes
What guarantees that the published app matches the published open source code?
Your guarantee is political, not technical. If a government publishes an app that collects some personal information in the background, nothing much will happen if that’s later revealed. But if a ...
- 161
5
votes
How can we verify that the open-source code is deployed and actually in use?
Not only can you not verify that the code is running unmodified, you cannot verify that there is any code running at all: perhaps the entire service is operated by a clever hacker tapping out ...
- 34.8k
4
votes
Are we obligated to scan the entire code base, or just patches?
Yes and no.
Everything under your control you can, in theory, be held responsible for. If you host code with a virus in, you are responsible for it; if it's copyright violation the same - and you can ...
- 147
4
votes
Are we obligated to scan the entire code base, or just patches?
As with anything you host publicly, you are responsible for any problem with that content. There is not much of a difference between software and other content in this case.
Depending on the country ...
- 655
4
votes
Report a security issue to a project hosted at GitHub
If the project has enabled private vulnerability reporting you can create a private repository advisory directly in GitHub.
- 141
4
votes
Can I hide a few lines of code because of security reasons?
There are two different issues here:
a legal "May I...?"
a technical "Should I...?"
For the legal side, there is one major case where this would not be allowed. If your project uses someone else's ...
- 34.8k
3
votes
Create an OAuth2.0 Application that doesn't violate Google TOS?
On my Android phone, I use a piece of free software called forecastie, which gets weather data from Open Weather Map. It ships with a default API key. This is in keeping with that provider's ...
- 46.1k
3
votes
Security of GitHub.com
Perhaps you could get access approved on a per-project basis on GitHub? For example, say you wanted to use code from https://github.com/google/zopfli you could somehow get that approved and then be ...
- 139
Only top scored, non community-wiki answers of a minimum length are eligible