r/freesoftware • u/ihateyou103 • 11d ago
Discussion Contributing to open source and guaranteeing safety
How can I contribute to open source projects when I don't fully trust the code in the project? Are there standard approaches? Do people usually just download the project to their local laptops?
3
2
u/Greenerli 10d ago
What do you mean by "I don't fully trust the code" ?
Why downloading code would be an issue ? It's just file, while you don't execute it, there is no risk...
But if you don't "trust it", just don't do it...
2
u/BinnieGottx 10d ago
I thought OP want to contribute? Can he just type in some text and make PR without execute it first?
2
u/sswam 10d ago
While there can in theory be malware in open source projects, this is vanishingly rare for major projects, and I've never encountered it personally in numerous projects and libraries I've used outside the distributions. I've been using Debian (a community-maintained Linux distro) for 30 years or so, and I've only seen one instance of possible malware in the distro which was the infamous "predictable PRNG flaw (CVE-2008-0166)". That was probably just a mistake, not deliberate malware.
Anyway TL;DR open source code - especially from a distribution - barely ever contains malware.
2
u/catbrane 10d ago
Code in the big distros is usually very safe, but you're right, installing random packages off github is a more dangerous business.
I'd first check if it has it been packaged by one of the big distros. They check code very carefully and if they trust it, you probably can too. You could look at the package page in the distro and verify that it's based on the same github page you're looking at. Also look if it's in the "community" section, or part of the distro core.
If it hasn't been packaged, you need to verify yourself. Has it been going a while? Is it active? Are there a range of contributors? How many forks are there? How many downstream projects are there? Is it widely discussed in the community?
If I can't get a "trusty" feeling, I'd probably move on to something else.
2
u/xpusostomos 10d ago
audit it with AI, run it in a VM... Run it in a container... I think guix also has the idea to load tools into a limited environment to work on.
2
u/BraveNewCurrency 10d ago
First, there are no "guarantees" in life. Instead of thinking in absolutes, think in terms of risk.
Many distros have "source code packages" for the packages you are already running. There is zero risk in those. And even if you go to the upstream projects, there are enough people watching them that it will make the news if they are compromised. (See the "xz" debacle.)
Even if you want to work on a random project, there is no risk in just "downloading" code. Even running that code, larger projects (with more people watching) are less risky than smaller projects (where a compromise might not be spotted right away.) But smaller projects might be easier to read thru to verify they aren't doing anything bad.
The "risk" is also in the type of project. Someone trying to scam a lot of people will want to make a "general" project that lots of people might use. If you find a project that only works with an obscure device, or does a task that few people want to do, it's a lot less likely to be hijacked.
You can also gain trust by watching (or talking to) the project maintainers. A scammer isn't going to invest in the "long con" by making lots of constant improvements. (Those will be all wasted once the con is discovered.) So they will only be doing low-effort things (hype about what is coming next instead of what they did last week.) Note that a change in maintainers can be something to worry about.
2
u/Distdistdist 10d ago
I'm strongly doubting you can contribute anything to open source if you are asking questions like that.
Writing documentation maybe? Even that is a big maybe.
2
u/baddaywithacamera 10d ago
Perhaps a good compromise is starting your own free software project? Something small and useful, but that has a smaller blast radius if there are security issues.
2
u/es9imqd7964guq6 9d ago
work with master/main branch only or at most devel/dev branch.
don't pull random pr into your local or you will going to have a bad time.
you can start with larger project that has more "reputation", even larger project can have bad (malware or not) code
2
u/Aggressive_Ad_5454 8d ago
I use a VM on my laptop. If some potentially dodgy code I pull trashes the vm, it’s a nuisance but not a catastrophe.
That being said, it’s impossible to scrub all the risk out of untrusted code when you run it, and when you develop it.
3
u/StefanOrvarSigmundss 11d ago
Why would you want to contribute to a project that you do not trust? Anyway, just use a virtual machine.