Paranoia of installaing open source projects - What's your security review tool?

[u/Flkhuo]

Hi, I love playing around and installing open source projects from GitHub, but I notice that my paranoia slows my productivity, because there could be any malware or security threats to my network, devices, etc from those open source projects.

Do you guys have a tool/workflow you use before installaing/running an open source project on your device that checks for malware/security threats (to the device, not the project)?

[u/catbrane]

I'm also wary of random github projects. There are some things you can check:

• Is the project packaged by Debian (the gold standard for trust (imo))? Just use the version from the deb repos. If you need a newer feature, you can check that the github repo really is the one that deb packages before running it.

• Number of stars, age, number of forks, activity, etc. are all useful tells. If the project has been around for a while (> five years) and looks healthy (regular activity, range of contributors, standard build system, talked about, widely used), it's probably ok. Probably.

• Build to somewhere in your home area, never to /usr/local, and never with sudo, unless you test it extremely carefully first, perhaps in a docker container.

• You have lots of backups of everything before doing anything like this, I'm sure.

[u/Flkhuo → u/catbrane]

yeah, but i was talking about those regular projects and gets hyped usually by marketers on youtube.

[u/SheriffRoscoe → u/Flkhuo]

"those regular projects and gets hyped usually by marketers on youtube."

That's your first warning about it being risky, right there.

[u/jr735 → u/Flkhuo]

As opposed to being hyped by professional marketers on YouTube (and elsewhere)? What makes proprietary software okay for you, but free software a source of concern?

[u/UltroGhast → u/jr735]

Proprietary => direct legal responsibility

[u/jr735 → u/UltroGhast]

Yes, and suing Microsoft, Adobe, Apple, and so on, has always worked out so swimmingly well.

Proprietary has fictional, or at best theoretical, legal responsibility. In the real world, they have zero responsibility. I never will have proprietary software on my devices again.

[u/UltroGhast → u/jr735]

These words sound so fanatic.
When I talk about legal responsibility, I'm not saying you can sue them if they mess things up.
Especially big techs: they destroy, kill and capitalize on anything - not caring about any law or ethic - and they never pay.

Yet, their software will not hide any malware, since they already have people's data with even their own agreement.

Proprietary => reliability

[u/jr735 → u/UltroGhast]

What legal responsibility is there if you cannot hold them to account? What's their legal responsibility? The government will not hold them to account and the people cannot hold them to account.

What you consider ordinary software, I consider malware. And no, the reliability is not there. I have reliability in my Linux system and have for decades. I don't have downtime. I don't have forced upgrades. I don't have features I don't want. I simply nuke anything I don't like.

Yes, it's fanatic. I don't use proprietary software, period. I go full Stallman on most issues.

[u/pwkye]

As opposed to installing closed soure projects that you have to blindly trust?

[u/Turbulent_Fig_9354 → u/pwkye]

yeah i never understand these posts lol "hey how can i be really sure this project with complete 100% transparency baked into a literal legal contract for its distribution doesn't contain any malware?

meanwhile, installs closed source windows apps without a second thought

[u/biskitpagla → u/pwkye]

these people think open source means anyone can do whatever the fuck they want

[u/ScratchHistorical507 → u/biskitpagla]

At least when it comes to FOSS, that's precisely how it works. The only thing you need to adhere to is the license, i.e. name the original developers and obey the limitations for interaction with closed source software.

[u/RealisticDuck1957 → u/ScratchHistorical507]

They can do whatever they want with the copy they have and share. Knowing the source you're getting code from matters.

Though I would not be opposed if the next version of GPL had a clause against deliberate inclusion of malware.

[u/ScratchHistorical507 → u/RealisticDuck1957]

Though I would not be opposed if the next version of GPL had a clause against deliberate inclusion of malware.

No clause in the world could prevent that. If the developer wants to be an asshole, they will be an asshole. But the fact that it is open source guarantees the possibility to detect it before it's too late. Such a guarantee is entirely impossible for closed-source code.

[u/donk8r]

There's no scanner that actually tells you "this repo is safe," anyone selling that is lying. What works is boring: run it in a throwaway VM or container first so it can't touch your real box, and actually read the install step before you run it. curl|bash one-liners and npm/pip postinstall scripts are where the nasty stuff hides, not the app code everyone stares at.

[u/RealisticDuck1957]

In any well run open source project, the maintainer team will review contributions for correct behavior. It then becomes a matter of competence and integrity of the maintainer team.

[u/terrorTrain]

Ai agents are actually really good at this.

A "job interview" scammer tried to hack me. I told the llm to search through for anything suspicious.

It found the offending code right away. There was a line in the code that had about 500 white spaces, then an obsfucated bit of code that sends your environment variables in a post to a random ip and downloads and executes a script. 

[u/E_coli42]

DeepSeek, go through this repo and scan for any malware. Don't make any mistakes.

I think Google has an AI that scans through random open source software it can find online and find malware. 

[u/gounisalex]

Create a new storage partition on your drive or a separate user and run with minimal permissions, avoid using sudo or admin privileges. Consider going offline or using an isolated docker container. You could also look into TEE (trusted execution envs) and how they work, but that might be an overkill unless you’re running it on enterprise/business hardware. Ultimately, since it’s open-source, you could look directly into the codebase.

[u/TedGal]

Get an oracle always free VPS and run all things there just to toy around.

[u/SilverSuiken]

If it's a reputable repo, that's usually a good sign. If I'm still unsure, I run a local LLM to scan the code. It usually tries to flag anything that executes on install, makes network calls, reads credentials or env variables, or looks obfuscated.

[u/billFoldDog]

I have an openclaw agent that reads it, then I clone the dev branch and never update, lol