16

I am interested in watching an upcoming webinar that will discuss Puppet on AWS. In order to participate one needs to install a software application. Naturally, I won't do that as I can find enough information about the subject with a few simple Google services.

However, sometimes there are webinars that I am interested in participating in. What criteria might an average user use to decide if a software package seems safe enough to install. Though Firefox is open source, I'm satisfied enough to trust the Mozilla binaries and I couldn't review all the source alone even if I weren't willing to trust the binaries. So that is a lower limit of what I'll install. What would be reasonable criteria for establishing a reasonable upper limit?

Of course, I'm not looking for 100% security as nobody can provide that. I'm looking for something reasonable for average users who are not software developers. The computer is useless without installing third-party applications, even if the OS provided them via a repo.

Improve this question
3
  • Is this a question about software in general, or about your case with the webinar software (which excludes important advice about e.g. other users' experiences and reviews, company history, etc., since you've stated none is available)?
    – Jason C
    Commented May 3, 2015 at 16:28
  • 2
    You can't! That's the whole point of open source software. If the user doesn't control the software, the software controls the user.
    – Elliot Gorokhovsky
    Commented May 3, 2015 at 18:28
  • @JasonC: The question is about software in general. The webinar software is an example for presenting the ideas and expressing the concerns.
    – dotancohen
    Commented May 3, 2015 at 18:41

2 Answers 2

Reset to default
23

Trust is not a boolean variable, "trusted = true / false", you should better think about trust level.

A few example of questions which may help you to evaluate the trust level you can grant to this software:

  1. How much do you trust the editor of this software?
  2. Could the software have been modified by a malicious 3rd-party between being created and being delivered to your computer?
  3. What is the sensitivity of the data you need provide to this software?
  4. What is the sensitivity of the data residing on the computer which will run this software?
  5. How long and how often will need to use this software?

If I correctly understand your question:

  1. You do not trust the editor, otherwise you wouldn't have asked this question in the first place,
  2. This software will just need the information related to this webinar you will attend,
  3. Your computer hosts sensitive or at least personal information which makes you worry about trust issues,
  4. This will be a one spot usage for this webinar, at best for further reference only.

In such conditions, I would just create some virtual machine so I would not worry anymore with any privacy issue while being free to comply with the webinar requests. Once the webinar ends, I will be free to either archive the VM image or drop it.

Improve this answer
11
  • Thank you, the virtual machine idea is a good one. I'm surprised that there is not a simpler way to sandbox an application in Linux. Perhaps I could create a new user and install the app to that user's bin, then set my own user's folder to 0770 permissions.
    – dotancohen
    Commented May 3, 2015 at 14:24
  • 1
    If you set your homedir to 0770, then there is little to no value into using a different account since both will have access to your files. Most modern Linux distros now allow two users to have a graphical session started at the same time so you can switch from one to another without having to share any data (technically two X Servers are running in parallel, one for each user). Moreover this software may require some dependencies to be installed (libraries, etc.) on your system which may be complex to install below the user's home dir...
    – WhiteWinterWolf
    Commented May 3, 2015 at 14:33
  • 2
    @WhiteWinterWolf A lot of Linux distros ship with per-user groups (my home dir is owned by anthony:anthony, for example), so 0770 does actually keep files secret. Obviously doesn't apply if its anthony:users instead.
    – derobert
    Commented May 3, 2015 at 17:04
  • 3
    @WhiteWinterWolf The default home directory permission is often 0775 or 0755. Certainly though if that's what he/she meant, chmod o-rwx would have been clearer.
    – derobert
    Commented May 3, 2015 at 17:27
  • 1
    This is a very good answer. I would add that we need to be very careful about assumptions which suggest open source software is more secure/trustworthy than closed source. Things like the openssl failures show the flaws in such assumptions. The key metrics are really your trust in the provider, assessment of the risk versus value and what things you can do, like using a virtual machine, to control those risks to an acceptable level.
    – Tim X
    Commented May 7, 2015 at 22:28
0

You could see if there are any notable endorsements for the software, or if people you trust like or use the software, much how the Web of Trust principle works. For nontechnical users, this is the approach that I would suggest. For technical users, you can do all the homework for them and present them with the software's "pedigree" or say something like "a bunch of security professionals I trust like this software". For yourself, you'll have to do the homework to see if the software is well known enough to get recommendations or endorsements.

For example, I didn't think much about the Silent Circle services until I looked into who Phil Zimmerman is, what he has done, and read some of his politics. After looking into him, and realizing that he runs, or is heavily involved with, Silent Circle, I would consider them a trusted piece of software and/or service.

I did the same homework for OpenWhisper Systems and came to the same conclusion, partly because Steve Gibbs (GRC, Security Now) is such a fan of Moxie Marlinspike.

Another notable name that could carry weight is Bruce Schneier (his blog). If he likes or dislikes something, that's a big deal.

There is currently no neutral government agency in the US to give endorsements for secure/private/anonymous software, but the closest thing is the EFF (Electronic Frontier Foundation). They have a website that mentions security products and their features, though I don't think they offer explicit endorsements.

If the software is not very well known, and you're worried about it, then, like others have said, you should isolate it in some form. A VM is a good sandbox; spare hardware; special purpose "testing" hardware, whatever fits the level of potential damage from such a software.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .