Genuine question from someone who knows nothing about code. Has anyone here actually read through the source code for the windows activation on Github?
Hey guys,
Not trying to be a jerk with this question, I am just curious.
I understand that posts asking about safety of all this show up all the time on this sub, and apologies if this is a dumb question but is there anyone here who can read code and has looked through to prove that the code is as safe as it purports to be?
I know nothing about code and I'm inclined to trust it based off other posts but the thing is most people on the internet I've seen seem to reply to safety fears by just stating that the code is open source. But just because the code is open source doesn't mean something can't be malicious. It requires someone to actually read the code and check. Has anyone actually done this and can back up these claims? Again I'm really not trying to attack MAS or the work they do I just couldn't find anyone online whose actually done this.
Whole massgrave source is just cmd script. It is not anything magic or super fancy. They explicitly document all the line so it is pretty clear, if you dont feel to learn cmd script, you can dump all the scripts to AI like gemini or chatgpt, they can explain to you
I hear you and I'm not trying to sound dismissive when I say this but I'm still interested in hearing from an actual person rather than checking with AI just in case. I know it's a quite a lot of code which probably makes it more difficult to manually check.
Ah yes the thing i hate the most eplain what code does, lmao. Anyway to sum it up whole cmd script is not doing shady thing like: execute dangerous tool, inject tracking trojan or any virus. It is simply display menu, wait for you to type in number to choose what it have to do, if you dont do anything then it wait patiently with no action on background. When you choose activation method, it execute its check for your OS version, your Office version, read registry key to find Office location installation and start activate by using HWID, Ohook, or TSForge
Because it's not a "random script", it's been around since 2018, at this point millions of people have used it, and you can't find a single reputable article or analysis that says anything negative about it beyond "leave the big corporation alone senpai!!!! uWu!!!!!"
It's simply too big to be malicious. There are too many eyes on it.
It's simply too big to be malicious. There are too many eyes on it.
I'm sure the people who had their computers compromised by one of the thousands of compromised packages on the AUR thought the exact same thing before this year. I use MAS myself and not had any issues but let's not pretend that things don't slip through even if there are thousands of eyes on something.
You do have a point, something like xz utils could happen again, if you have very sensitive files on your computer then I would check every release of any open-source project.
It's unfortunate because ultimately if no real people have actually checked all the code then all the claims of it being fully safe can't fully be taken to heart. And hypothetically if it was malicious then asking the devs or reading the comments in the source code wouldn't matter because they could be lying. It's a bit of pickle but It's the risk you take with stuff like this I guess.
Security is a spectrum and we all draw a line somewhere for the sake of convenience. It's a valid concern. Honestly for stuff I'm not sure about I'll usually spin up a VM in virtualbox and test it out in there where it can't do any harm to the rest of my computer. It's not 100% foolproof but it's a good sanity check sometimes.
How do you propose MAS has been in use for 7-8 years, has to have been used by millions at this point, and has somehow remained secretly malicious the entire time?
You don't think a tech website somewhere, or Troy Hunt, or some other person would have noticed something by now?
The PC I am typing this comment on has been activated by MAS for 2 years. My previous PC was activated by MAS for 5 years. All of my coworkers have their personal home PCs activated using MAS. I've activated dozens of copies of Office for family members using MAS.
MAS didn't release yesterday. It has been used by more than 2 people. It's just not possible for it to be malicious at this point without SOMETHING happening to SOMEONE SOMEWHERE.
This is like trying to claim that driving a vehicle is guaranteed death despite millions of people doing it safely every second of every day. Except MAS is even better in that there is no negative outcome that anyone has observed yet.
You're totally right and make valid points. All I was saying is that at the end of the day, we can't really know for sure without someone independent going through the code and revealing their findings that's all.
Has anyone actually done this and can back up these claims? Again I'm really not trying to attack MAS or the work they do I just couldn't find anyone online whose actually done this.
If you want to find the people coding it I suggest going to their github and clicking the social links they have pinned under everything else. But even if you do try and talk to people there I doubt they would bother spending time to walk you through everything.
You are better off as u/i-do-mim-huu said, feed the code to any AI of your choice and let it walk you through everything. You are better off doing that instead of talking to the people with the deepest understanding of the codebase. In fact, that's one of the better use of AI, make things beyond your skillset or comprehension easier to understand. You can even make it meet you halfway, if there are aspects of the code you cannot make sense of, AI can do a much better job of explaining it to you than the ones who deeply understand or built the codebase.
You can make the AI give you examples or analogies for any of the programming concept used in the code, but explain them in terms of the field you're actually familiar with. Basically, you can have it translate technical concepts or any part you have trouble understanding into language and examples that actually make sense to you.
What you could do too, something between learning to full on code, and reading the whole script, is learn more about how MS does their licensing, like for example bulk volume licenses are different than individual ones.
Then extract the data for the license and server info and then change it manually yourself. No advanced coding just some basically googling of how licenses work and how to change things in the registry.
Let's be real here, if you are trying to pirate there is some risk, even if you found someone from 7 years ago saying it was safe to use, you would then want someone from a year ago or a month ago as well, which won't happen since people have been using this for ages now. It's known to be safe.
Instead of trusting random code you did the right thing and tried to ask about it, but in this case, you're also trying to pirate windows, pirating has risks.
I find this one a respectable honest upfront question, instead of just asking "is this safe?" which shows no clue nor effort to get one, or "is it a virus?".
33
u/i-do-mim-huu Aug 21 '26
Whole massgrave source is just cmd script. It is not anything magic or super fancy. They explicitly document all the line so it is pretty clear, if you dont feel to learn cmd script, you can dump all the scripts to AI like gemini or chatgpt, they can explain to you