What makes you trust that a piece of open source software is not malicious?

Question

We developers are in a unique position when it comes to the ability to not only be skeptical about the capabilities provided by open source software, but to actively analyze the code since it is freely available. In fact, one may even argue that open source software developers have a social responsibility to do so to contribute to the community.

But at what point do you as a developer say, "I better take a look at what this is doing before I trust using it" for any given thing? Is it a matter of trusting code with your personal information? Does it depend on the source you're getting it from?

What spurred this question on was a post on Hacker News to a javascript bookmarklet that supposedly tells you how "exposed" your information on Facebook is as well as recommending some fixes. I thought for a second "I'd rather not start blindly running this code over all my (fairly locked down) Facebook information so let me check it out".

The bookmarklet is simple enough, but it calls another javascript function which at the time (but not anymore) was highly compressed and undecipherable - though understandbly more for optimization than obfuscation. That's when I said "nope, not gonna do it". So even though I could have verified the original uncompressed javascript from the Github site and even saved a local copy to verify and then run without hitting their server, I wasn't going to. It's several thousand lines and I'm not a total javascript guru to begin with.

Yet, folks are using it anyway. Even (supposedly) bright developers. What makes them trust the script? Did they all scrutinize it line by line? Do they know the guy personally and trust him not to do anything bad? Do they just take his word?

What makes you trust that a piece of open source software is not malicious?

Note, to clarify, the reason I limit the scope of the discussion to open source software is because with open source software it can often be a matter of "do I want to expend the effort to do a proper analysis or should I just go ahead?" When the opportunity to check is there, when do you skip it and just implicitly trust the software?

Answer 1

I'd say it's a function of the community. If a piece of open source software is freely available but the source (the developer) is a relative newbie, I'm far less likely to trust it. If s/he is a member of a larger community and has an established reputation, I might give it some credibility.

I like to use news as a good metaphor here. What makes you trust CNN or the BBC over a smaller, local outlet? It's the large community supporting the publication and the long-standing reputation they've amassed for putting out quality information. The same holds true for open source developers. I'd trust just about anything Matt Mullenweg publishes. But guest_user_002943 would be a completely different story.

Answer 2

Its a matter of relativity. After all who's to say that there isn't an NSA backdoor on your Windows machine? Or that a backdoor isn't installed during a 'silent' patch. I know that my Linux kernel is safe from such attacks, because there are people more paranoid than I that keep watch. After all Backdoors are found in closed source software, and having the source code makes it A LOT easier to find.

Answer 3

The reputation of the source.

Answer 4

Simple: I don't trust any software, and you shouldn't either. From experience, I've see quite a few compromised open and closed source projects from time to time.

But at what point do you as a developer say, "I better take a look at what this is doing before I trust using it" for any given thing?

NO. This is not good enough, one can plant extremely well hidden vulnerable code in a program and without some hardcore static analysis, you'll never find it. I mean, for small apps it's okay, I do this sometimes myself, but for anything large scale, it's pretty much impossible.

I only "trust" packages from my distribution vendor, so there is a single point of failure (well, hardware vendor too, but this is another beast). It's a lot less likely for my vendor to serve compromised code to me than if I just execute random programs off the net. Even if my distribution does serve compromised code, it's more likely that someone will notice it before I even run it.

For Java apps, I just stick 'em in the sandbox. Can do the same with SELinux for C apps. However, this is not enough. Java and the Linux kernel are both written in C and are thus subject to a constant stream of critical stack smashing related vulnerabilities. So even when I'm running all my untrusted programs in secured domains, I still can't trust them.

Once C fazes out and we have a secure operating system with a decent security model based on sandboxing/mandatory access control/etc, and the kernel is written entirely in some safe language, supported at the hardware level, this should stop. We will be able to stick any program into an isolated domain, and never have to worry about weather or not it's to be trusted, because it simply can't break out.

Android and iPhone are already doing this to some extent, however, I haven't looked into them much yet, and anyways I doubt they are ideal. For one, iPhone doesn't even have Java support or .NET CLR support, big mistake. Meanwhile Android runs Java, but I'm not sure sure Java is even ideal for this anymore because of some recent code execution vulnerabilities (these are language level, and nothing to do with stacksmashing, how did they mess this up? I haven't looked into it enough to judge weather or not Java's security is taking a direction that is inheritly flawed, but now I am starting to have doubts).

Perhaps in the future, cryptographic webs of trust will be established to determine which versions of software are safe or not. Still, you should be able to run most programs and only give them a few explicitly allowed permissions, the web of trust can help determine which privileges should be given to save some time, or help people who do not know how to determine which privileges should be used on their own. Unfortunately, in the current state of Gentoo's 3rd party overlay repositories, this is simply not the case, and most people in them don't even care about security. I'm pretty sure this is the case for every other similar distribution / operating system.

Answer 5

Community, community, community. Given the fervor of most open source communities, any purposely malicious code found in an open source package would spell the end of an OSS company's distribution stream - which is the business model for most of these guys.

I feel confident that I can trust the OSS vendors I utilize in my deployments, cause I'm a member of their communities and feel comfortable that those communities are active and diligent. Two great examples are SugarCRM and MindTouch, both are products I use and both have two strong communities.

Answer 6

Community reviews and testimonials.

Answer 7

The fact that it's open source.