cross-posted from: https://lemmy.ml/post/30846707
cross-posted from: https://lemmy.ml/post/30846701
The question is simple. I wanted to get a general consensus on if people actually audit the code that they use from FOSS or open source software or apps.
Do you blindly trust the FOSS community? I am trying to get a rough idea here. Sometimes audit the code? Only on mission critical apps? Not at all?
Let's hear it!
9 Comments
sugar_in_your_tea@sh.itjust.works · 9 pts · 1y
I don't do a full audit, but I certainly make sure the project is reasonably active before using it. I'll look at:
That only takes a few min and I think catches the most important issues.
Epimetheus@feddit.online · 7 pts · 1y
I trust the big projects: LibreOffice, Tomcat, Debian, Openmediavault.
But let's be clear: I have never done an audit myself and I'm totally not capable of doing it. I can program a bit but this is over my head. If a one guy project is overtaken by a bad actor, I wouldn't know. This has happened by the way, I don't remember which project it was, but it was pretty big - openssl or something.
brotundspiele@sh.itjust.works · 6 pts · 1y
It was xz, a software most people probably use without even knowing it as it is a library which is included in a lot of other projects. The vulnerability targeted openssh which is one of these users.
That being said: Do you also audit the dependencies of the software you're installing? I usually don't, unless a customer pays me for it. However, before I pull any dependency into one of my own projects I take a look at it's dependencies. If a library for a simple task brings tons of dependencies with it, I rather not use it.
beastlykings@sh.itjust.works · 1 pts · 1y
This is me, except even more trusting 🤷♂️
Lazycog@sopuli.xyz · 5 pts · 1y
If it's something that is not very popular/known I do actually look at the code, but never all of it.
I check:
This is of course very superficial and in general I try to avoid obscure projects that are not popular and well known.
linearchaos@lemmy.world · 3 pts · 1y
I mean, I might catch something intended and openly malicious.
If it comes down to a buffer overflow somewhere or an exploitable race condition, I'm probably not going to see it anyway.
sun_is_ra@sh.itjust.works · 3 pts · 1y
If its packaged usually I trust. If its code with few downloads I audit if I know the language else I run as different user
x00z@lemmy.world · 2 pts · 1y
I often take a small look around if it's smaller projects yes.
Reddfugee42@lemmy.world · 0 pts · 1y
This is something coding AI is getting better at