I’m note a programmer. I Don’t Understand Codes. How do I Know If An Open Source Application is not Stealing My Data Or Passwords? Google play store is scanning apps. It says it blocks spyware. Unfortunately, we know that it was not very successful. So, can we trust open source software? Can’t someone integrate their own virus just because the code is open?
You wouldn’t know unless it’s checked by you or someone you trust, but IMO open source should generally be better cause if you’re doing shady stuff you’re probably less likely to make it public. Also projects with lots of activity by different people are usually safer.
A question i always ask myself is, if we can see code on github for example, it still doesn’t mean their release has the same code right? They could actually compile their program with some extra stuff that sends data and just add that version on github release page, but the code itself would be clean on github right?
Yes, however there are ways of verifying that. Compiled programs are not black boxes, they’re just complicated enough that we can consider them beyond human comprehension (at least complicated programs), but they’re very much readable. Which means programs can check differences between what should be there and what is. Not to mention that you can also compile the code they said they put there and check for differences with what they’re distributing.
Is anyone doing that? Don’t know, but because it’s possible to be verified it’s unlikely that people would try to do something nasty.
Edit: I’m talking about official releases on official channels, download binaries from different sources at your own peril since those are unlikely to be checked, and even if someone found differences they could claim patches or different compilers.
It's worth pointing out that reproducible builds aren't always guaranteed if software developers aren't specifically programming with them in mind.
imagine a program that inserts randomness during compile time for seeds. Reach build would generate a different seed even from the same source code, and would fail being diffed against the actual release.
Or maybe the developer inserts information about the build environment for debugging such as the build time and exact OS version. This would cause verification builds to differ.
Rust (the programing language) has had a long history of working towards reproducible builds for software written in the language, for instance.
It's one of those things that sounds straightforward and then pesky reality comes and fucks up your year.
Yes you can tamper the executables if it’s you on your pc compiling the code and upload it to the release page…
BUT if you use ci/cd pipelines, you can almost be sure it’s not a human who is in charge of compiling. It’s a robot who automatically clones the repo, launch the build and upload the artifact to release. It’s much more transparent this way
Nobody can be 100% sure of some program’s security. However, the fact that anyone can look into the internal workings of a FOSS project means that a lot of people much smarter than you and I have their eyes on every detail of the code at all times. Plus, these projects are maintained by competent people who monitor everything that gets added to it thoroughly, so there is a very little chance of something malicious getting into a major project like that.
In comparison, nobody but the people working at Microsoft knows what Microsoft projects really do, since nobody can look inside. We just have to “trust” them. Which I do not want to do.
There are some very good comments here, here are a few to think on:
With FOSS anybody cant just modify the code that you use, say in my lemmy instance. The code I run comes from the dev’s own github account, and they manage the code that comes into the project - this doesn’t mean that the underlying code is immune to bugs any bore than closed platforms though, just that more eyes can look for bugs and exploits
With FOSS I can fork a code base and publish that, like I have done with the Alexandrite UI for lemmy. I could insert password sniffers in that cade, and someone could build from that source - but the code changes that I have made are laid out for any one to look at. Again, it doesn’t mean the base code is any better than closed, just that more eyes can look
Add comment