Questions tagged [opensource]
Open source is a term used for software whose source code is made available. Software distributed under Open source license allow the users to study, debug and improve the software with certain rights preserved for the copyright holder.
165
questions
1
vote
1
answer
198
views
How does a non technical user/beginner vet Android apps to ensure they are safe?
Background
I moved from ios to Android so now can't rely on Apple doing some checks on the apps.
I was told that Google does some automated checks and if you buy/download apps from large organisations,...
- 129
0
votes
0
answers
580
views
Which of these filesystem encryption philosophies and methodologies are better for which purpose?
Currently on the "FLOSS market" there are multiple options for encrypting remote cloud storage following different security models and different philosophies. To name a few:
encfs (I guess ...
- 1,546
1
vote
2
answers
697
views
Do Public DNS servers log our DNS queries?
Do Public DNS servers log our DNS queries? I started running my own AdGuard Home in the cloud using Oracle Compute Instance. In AdGuard Home's dashboard, it logs my DNS queries.
I was wondering if ...
- 37
0
votes
1
answer
122
views
Should API keys, even for free services, be visible in a page's source?
I sometimes see API keys in page sources, such as the following:
<span class="nf">init</span><span class="p">(</span><span class="nv">...
12
votes
3
answers
4k
views
How to vet third-party developer packages
Looking to create a form where developers can submit requests for packages to be installed. We want to create a list of questions that can help us determine whether or not a package is safe. What are ...
- 123
0
votes
0
answers
76
views
Implementing a protection for pie register vulnerability
I'm working on implementing a protection for a WordPress pie register plugin vulnerability being called:
WordPress pie register 3.7.1.4 auth bypass / RCE
I've conducted a research on the pie register ...
- 13
0
votes
0
answers
82
views
How to protect a web app against supply chain attacks?
I'm looking for ways to further protect my web app against supply chain attacks.
Attacks focusing on supply chain have been increased a lot recently. NIST is working on a recommendation, following the ...
- 1
1
vote
1
answer
85
views
Dealing with changed hashes when building open-source packages in-house
My plan is to start building the open-source packages from their sources and use organization's security resources like SAST tools to detect security issues in them.
The good thing that I see coming ...
- 646
0
votes
0
answers
236
views
How safe is it to use a Github Action contributed by a third party?
I'm considering using a Github Action from the Github Marketplace to back up some of my source code to an AWS S3 bucket.
My question is this: I found a Github Action, written by a third-party open ...
- 101
1
vote
0
answers
80
views
Security testing best practices when opening a project to the community [closed]
I notice that although we have many tools for security tests (SAST, SCA), I couldn't find an open source project on github that implements those tests. I've searched for google, Mozilla, OWASP and ...
- 69
11
votes
7
answers
7k
views
Can you create a fake (malicious) Ubuntu iso
Recently I got into an exchange with someone on social media about the security of Linux versus OSX and Windows. I stated that it is possible (and probable) that someone could code a low level back ...
- 137
1
vote
4
answers
1k
views
Is Linux really not spying on us?
When I ask someone about Linux, people always say it's really safe and this OS doesn't collect your data and these are not spy operating systems.
When I ask them "how?" they say, "...
- 21
0
votes
1
answer
356
views
How to verify there is no malicious code in an opensource library?
I am planning to use an opensource library to my project instead of developing from scratch. How can I verify there is no malicious code in the library or someone cannot access my files?
Currently ...
- 103
7
votes
3
answers
3k
views
Open-Source Hardware Security Modules (HSM)
Are there any Open-Source Hardware Security Modules (meeting OSHWA requirements)?
I've worked with Utimaco HSMs, but I'm not a big fan of closed-source hardware -- especially when it comes to security ...
- 978
1
vote
1
answer
135
views
How are hardware wallets and other hardware-based security devices audited?
One selling point of the Trezor crypto currency wallets is that they are, supposedly, "open source".
It is not clear to me exactly what assurance this provides, since I do not know what ...
- 1,053
1
vote
2
answers
247
views
What should be a good Open Source dependency scanning frequency?
We use Snyk as our open source dependency scanner. We currently scan for vulnerable libraries on every pull request and this causes overhead to our developers. What would be a good open source ...
- 11
0
votes
1
answer
101
views
Validate that Web Service is authentic
If I have a web service (REST API, RPC, etc) that I open source, how can I prove to the user that the service they are connecting with is indeed the same one whose source I published. I am envisioning ...
user197634
39
votes
4
answers
7k
views
How do open-source projects prevent disclosing a bug while fixing it?
I understand that many open-source projects request vulnerabilities not to be disclosed on their public bug tracker but rather by privately contacting the project's security team, to prevent ...
- 3,006
3
votes
2
answers
196
views
Public registry (database or API) for known security vulnerabilities in open source software?
Is there a reliable, public registry (preferably in the form of an API) that records known security vulnerabilities in open source software?
Why would anyone want this?
I'm trying to emulate github's ...
- 1,250
0
votes
1
answer
377
views
Recommendations on minimal alternatives to openssh [closed]
Although openssh is awesome, I'm interested in exploring some more lightweight FLOSS alternatives to use for connecting to servers I'm administrating (and using alone). Since I only need a minimal ...
- 121
3
votes
3
answers
296
views
Cryptographically prove open sourced source code of server
I want to prove that the source code I am using is the same as the open-sourced version, which is publicly available. My idea was to publish a hash of the open-sourced version and compare it to the ...
- 31
0
votes
0
answers
76
views
Visual Studio Code on Linux - Privacy risk? [duplicate]
I'm a fan of Visual Studio, and recently installed VSC on my Linux Mint. However recently I did a deep-dive on Richard Stallman's site reading about just how evil and depraved all the big tech ...
- 101
1
vote
1
answer
690
views
how to anonymously contribute to Github [closed]
I have noticed how important has it become to anonymously contribute to github. I have just created a new account with protonmail and removed my actual account from my Macbook. I still have the public ...
- 121
0
votes
1
answer
135
views
Using opensource C2 dangers
I've been playing around with some of the C2's available at GitHub that I've found at https://www.thec2matrix.com/matrix
It's cool to play around with tons of Linux machines I own and send them ...
- 155
0
votes
1
answer
222
views
Are security scrutinies conducted by independent agencies on open source software like Ubuntu or Mozilla Firefox?
Any intentional malware injected into open source software by the same people who are developing them may eventually get known as the source code is open to the public. However, if the code base is ...
- 111
1
vote
0
answers
193
views
Google security warning on rclone
I am setting up some new configurations with rclone to backup stuff to google drive. I am configuring application with the steps on https://rclone.org/drive/#making-your-own-client-id
When I am going ...
- 171
4
votes
2
answers
3k
views
Is the ISO/IEC 27001 standard incompatible with free/open source software?
The ISO/IEC 27000-series of standards lay out how to create and manage an information security management system (ISMS). The ISO/IEC 27001 document provides the main body of the standard and is ...
- 179
5
votes
1
answer
384
views
How can WhatsApp be listed on the EFF secure application toolset when it's not opensource? [closed]
I see this EFF tool guide, proposing WhatsApp as one of "our pick of the best, most secure applications" source.
How can WhatsApp be trusted as a secure application when it is not open-source (...
- 191
5
votes
0
answers
2k
views
Open source KMIP Server in a production-level environment [closed]
I need to use a KMIP server for a project and searched for an open source solution. The only viable options I found are PyKMIP (https://github.com/OpenKMIP/PyKMIP) and KMIP4J (https://sourceforge.net/...
- 51
1
vote
2
answers
174
views
Mitigating security risks of using open-source software
The title sounds like a trolling question but it is not (I'm a huge fan of OSS).
I have a small company with a web app that is undergoing infosec review with a Fortune 100 company. The questions I ...
- 121
56
votes
5
answers
14k
views
Is open-sourcing the code of a webapp not recommended?
How to find out what programming language a website is built in?
How much of a Django application could be reverse-engineered if the owner forgot to turn debug mode off?
And other Qs like these ^ .
...
- 5,717
1
vote
2
answers
360
views
OpenSource API Security Testing Automation?
I had been tasked with automating application api security testing for proof of concept project which requires me to propose a tool. Now this tool has to provide data results as json/xml or otherwise ...
- 1,602
2
votes
1
answer
222
views
How can the validity and safety of a software library be checked?
So beyond looking at the source code for particular software library, is there a way to vet that it does not contain malicious code? As far as I know from my own research, services like pip, npm, and ...
- 23
5
votes
4
answers
801
views
What is the use of disabling detailed exception pages on open-sourced apps?
Frameworks for web apps typically can run in either production mode or development mode. One of the major differences between the two modes is how exceptions are handled: in development mode the ...
- 5,717
2
votes
1
answer
327
views
How safe is it to open source access to MySQL database on github, only permitting SELECT query?
The Setup: Im building an app to model visually world data. A significant part of this project will be the database since that data is what is interesting. I should only need to allow SELECT queries,...
- 123
1
vote
2
answers
387
views
How to securely transfer data from a public website, to a VPN-secured website?
I'm (currently) a VPN newby.
I have a VPS with a few websites on it, hosted by liquid web.
I have installed a medical records package (openEMR) in a sub-domain, in its own cPanel account. I intend to ...
- 11
2
votes
2
answers
630
views
How can a client verify that code sent from the server has not been tampered with?
While trying to understand the recent controversy involving ProtonMail, I started to wonder if its possible to verify that the opensource JavaScript being sent from the server to the client hasn't ...
- 125
3
votes
2
answers
505
views
Should things like project IDs, cloud region IDs etc be kept secret on an open source project?
All my side project are open source - just using the free Github account.
I'm wondering about how security conscious I need to be about keep things like:
Google Cloud Platform Project IDs
Log ...
- 707
1
vote
1
answer
970
views
How to Check Open Source Code for Vulnerabilities? [closed]
I am a member in bug bounty platform. There are some programs that make their source code available to the hackers to find vulnerabilities. For example, their PHP, JS, C++, or ruby code.
I want to ...
- 23
-1
votes
1
answer
283
views
Secure Admin Password in Open Source Software
I am writing a server using nodejs. It is on a public GitHub repository, so its complete code is visible to anyone. The client can send strings to the server. I need to determine if the given string ...
- 113
2
votes
2
answers
156
views
How to cryptographically guarantee that data came from a trusted application on a mobile device?
I'd like to have an open source application generate data and sign it in such a way that anyone with access to the data alone can know for sure it was generated by that open source code.
More ...
- 21
7
votes
3
answers
1k
views
How can Linux be secure if it allows for open source contributions from the public?
From my brief understanding of Linux, developers from around the globe submit code to be included into a Linux update. It's then reviewed by security administrators. When approved, it's passed onto ...
- 487
13
votes
1
answer
16k
views
Does karabiner elements on Mac OSX contain, or potentially contain, malware?
I'm using Karabiner elements, an open-source program to remap the keys on my MacBook Air (running the latest Mac OSX High Sierra) and my apple wireless keyboard. It works very nicely.
However, I am ...
- 233
1
vote
0
answers
66
views
Aptitude & Yum: Studies on Actual Security
The theory has long been that package managers (and potentially other sources of FOSS) were potentially "more secure" and/or "more trustworthy" than commercial software because more people's eyes have ...
- 1,700
2
votes
1
answer
10k
views
How secure is Keepass when using mobile apps
Keepass appears to be very secure, because it is open-source and the code is examined by a lot of independent people. Furthermore the database which holds all passwords is stored wherever the user ...
- 441
1
vote
1
answer
201
views
Making an API repository private vs public
So I am currently working on the API of an application that will be serving many users. Currently the only "sensitive" information being stored using the API is user emails and names. The application ...
- 13
2
votes
1
answer
362
views
How is the create-react-app package tree properly sanitized?
React, and it's application creation script, create-react-app, are popular packages nowadays... and with good reason: React is a rock-star framework.
From a security perspective, sanitizing all the ...
- 129
1
vote
2
answers
143
views
Possible setup for a direct democracy voting system to prevent fraud
My Government is designing a direct democratic voting system and would like the system to be open sourced and unable to be corrupted by individuals and other stakeholders.
Some requirements as of now:...
- 175
3
votes
1
answer
4k
views
What are easy checks to identify malware in Python code?
It is well known that PyPI does not prevent the upload of malicious code.
Unfortunately, automated tools often cannot distinguish between features of a program and malicious code.
In the case of ...
- 131
1
vote
1
answer
612
views
Public guest user for PostgreSQL?
I manage an open-source software project that relies on data that I am happy to share with the public. The software is hosted on github.com, but the dataset is too large to host there. It is easiest ...
- 113