Questions tagged [opensource]

Open source is a term used for software whose source code is made available. Software distributed under Open source license allow the users to study, debug and improve the software with certain rights preserved for the copyright holder.

Filter by
Sorted by
Tagged with
1 vote
2 answers
76 views

Do Public DNS servers log our DNS queries?

Do Public DNS servers log our DNS queries? I started running my own AdGuard Home in the cloud using Oracle Compute Instance. In AdGuard Home's dashboard, it logs my DNS queries. I was wondering if ...
user avatar
0 votes
1 answer
38 views

Should API keys, even for free services, be visible in a page's source?

I sometimes see API keys in page sources, such as the following: <span class="nf">init</span><span class="p">(</span><span class="nv">...
user avatar
12 votes
3 answers
4k views

How to vet third-party developer packages

Looking to create a form where developers can submit requests for packages to be installed. We want to create a list of questions that can help us determine whether or not a package is safe. What are ...
user avatar
0 votes
0 answers
55 views

Implementing a protection for pie register vulnerability

I'm working on implementing a protection for a WordPress pie register plugin vulnerability being called: WordPress pie register 3.7.1.4 auth bypass / RCE I've conducted a research on the pie register ...
user avatar
0 votes
0 answers
70 views

How to protect a web app against supply chain attacks?

I'm looking for ways to further protect my web app against supply chain attacks. Attacks focusing on supply chain have been increased a lot recently. NIST is working on a recommendation, following the ...
user avatar
  • 1
0 votes
0 answers
64 views

Dealing with changed hashes when building open-source packages in-house

My plan is to start building the open-source packages from their sources and use organization's security resources like SAST tools to detect security issues in them. The good thing that I see coming ...
user avatar
  • 606
0 votes
0 answers
75 views

How safe is it to use a Github Action contributed by a third party?

I'm considering using a Github Action from the Github Marketplace to back up some of my source code to an AWS S3 bucket. My question is this: I found a Github Action, written by a third-party open ...
user avatar
  • 101
1 vote
0 answers
75 views

Security testing best practices when opening a project to the community [closed]

I notice that although we have many tools for security tests (SAST, SCA), I couldn't find an open source project on github that implements those tests. I've searched for google, Mozilla, OWASP and ...
user avatar
  • 69
10 votes
7 answers
6k views

Can you create a fake (malicious) Ubuntu iso

Recently I got into an exchange with someone on social media about the security of Linux versus OSX and Windows. I stated that it is possible (and probable) that someone could code a low level back ...
user avatar
1 vote
4 answers
600 views

Is Linux really not spying on us?

When I ask someone about Linux, people always say it's really safe and this OS doesn't collect your data and these are not spy operating systems. When I ask them "how?" they say, "...
user avatar
0 votes
1 answer
216 views

How to verify there is no malicious code in an opensource library?

I am planning to use an opensource library to my project instead of developing from scratch. How can I verify there is no malicious code in the library or someone cannot access my files? Currently ...
user avatar
3 votes
3 answers
874 views

Open-Source Hardware Security Modules (HSM)

Are there any Open-Source Hardware Security Modules (meeting OSHWA requirements)? I've worked with Utimaco HSMs, but I'm not a big fan of closed-source hardware -- especially when it comes to security ...
user avatar
1 vote
1 answer
122 views

How are hardware wallets and other hardware-based security devices audited?

One selling point of the Trezor crypto currency wallets is that they are, supposedly, "open source". It is not clear to me exactly what assurance this provides, since I do not know what ...
user avatar
  • 1,043
0 votes
2 answers
172 views

What should be a good Open Source dependency scanning frequency?

We use Snyk as our open source dependency scanner. We currently scan for vulnerable libraries on every pull request and this causes overhead to our developers. What would be a good open source ...
user avatar
  • 1
0 votes
1 answer
96 views

Validate that Web Service is authentic

If I have a web service (REST API, RPC, etc) that I open source, how can I prove to the user that the service they are connecting with is indeed the same one whose source I published. I am envisioning ...
user avatar
  • 123
38 votes
4 answers
7k views

How do open-source projects prevent disclosing a bug while fixing it?

I understand that many open-source projects request vulnerabilities not to be disclosed on their public bug tracker but rather by privately contacting the project's security team, to prevent ...
user avatar
  • 2,914
3 votes
2 answers
175 views

Public registry (database or API) for known security vulnerabilities in open source software?

Is there a reliable, public registry (preferably in the form of an API) that records known security vulnerabilities in open source software? Why would anyone want this? I'm trying to emulate github's ...
user avatar
  • 1,214
0 votes
1 answer
289 views

Recommendations on minimal alternatives to openssh [closed]

Although openssh is awesome, I'm interested in exploring some more lightweight FLOSS alternatives to use for connecting to servers I'm administrating (and using alone). Since I only need a minimal ...
user avatar
  • 121
2 votes
3 answers
223 views

Cryptographically prove open sourced source code of server

I want to prove that the source code I am using is the same as the open-sourced version, which is publicly available. My idea was to publish a hash of the open-sourced version and compare it to the ...
user avatar
0 votes
0 answers
76 views

Visual Studio Code on Linux - Privacy risk? [duplicate]

I'm a fan of Visual Studio, and recently installed VSC on my Linux Mint. However recently I did a deep-dive on Richard Stallman's site reading about just how evil and depraved all the big tech ...
user avatar
1 vote
1 answer
440 views

how to anonymously contribute to Github [closed]

I have noticed how important has it become to anonymously contribute to github. I have just created a new account with protonmail and removed my actual account from my Macbook. I still have the public ...
user avatar
0 votes
1 answer
120 views

Using opensource C2 dangers

I've been playing around with some of the C2's available at GitHub that I've found at https://www.thec2matrix.com/matrix It's cool to play around with tons of Linux machines I own and send them ...
user avatar
  • 155
0 votes
1 answer
213 views

Are security scrutinies conducted by independent agencies on open source software like Ubuntu or Mozilla Firefox?

Any intentional malware injected into open source software by the same people who are developing them may eventually get known as the source code is open to the public. However, if the code base is ...
user avatar
  • 111
0 votes
0 answers
130 views

Are the pre-compiled binaries in open source projects safe to use? [duplicate]

It seems that the author of a project can upload arbitrary binary files on the release page, and I don't see a way to verify that the binary is actually built from the source code without malicious ...
user avatar
  • 1
1 vote
0 answers
175 views

Google security warning on rclone

I am setting up some new configurations with rclone to backup stuff to google drive. I am configuring application with the steps on https://rclone.org/drive/#making-your-own-client-id When I am going ...
user avatar
  • 171
4 votes
2 answers
2k views

Is the ISO/IEC 27001 standard incompatible with free/open source software?

The ISO/IEC 27000-series of standards lay out how to create and manage an information security management system (ISMS). The ISO/IEC 27001 document provides the main body of the standard and is ...
user avatar
5 votes
1 answer
365 views

How can WhatsApp be listed on the EFF secure application toolset when it's not opensource? [closed]

I see this EFF tool guide, proposing WhatsApp as one of "our pick of the best, most secure applications" source. How can WhatsApp be trusted as a secure application when it is not open-source (...
user avatar
5 votes
0 answers
2k views

Open source KMIP Server in a production-level environment [closed]

I need to use a KMIP server for a project and searched for an open source solution. The only viable options I found are PyKMIP (https://github.com/OpenKMIP/PyKMIP) and KMIP4J (https://sourceforge.net/...
user avatar
  • 51
1 vote
2 answers
161 views

Mitigating security risks of using open-source software

The title sounds like a trolling question but it is not (I'm a huge fan of OSS). I have a small company with a web app that is undergoing infosec review with a Fortune 100 company. The questions I ...
user avatar
56 votes
5 answers
14k views

Is open-sourcing the code of a webapp not recommended?

How to find out what programming language a website is built in? How much of a Django application could be reverse-engineered if the owner forgot to turn debug mode off? And other Qs like these ^ . ...
user avatar
  • 5,587
1 vote
2 answers
342 views

OpenSource API Security Testing Automation?

I had been tasked with automating application api security testing for proof of concept project which requires me to propose a tool. Now this tool has to provide data results as json/xml or otherwise ...
user avatar
2 votes
1 answer
146 views

How can the validity and safety of a software library be checked?

So beyond looking at the source code for particular software library, is there a way to vet that it does not contain malicious code? As far as I know from my own research, services like pip, npm, and ...
user avatar
  • 23
5 votes
4 answers
445 views

What is the use of disabling detailed exception pages on open-sourced apps?

Frameworks for web apps typically can run in either production mode or development mode. One of the major differences between the two modes is how exceptions are handled: in development mode the ...
user avatar
  • 5,587
2 votes
1 answer
269 views

How safe is it to open source access to MySQL database on github, only permitting SELECT query?

The Setup: Im building an app to model visually world data. A significant part of this project will be the database since that data is what is interesting. I should only need to allow SELECT queries,...
user avatar
  • 123
1 vote
2 answers
341 views

How to securely transfer data from a public website, to a VPN-secured website?

I'm (currently) a VPN newby. I have a VPS with a few websites on it, hosted by liquid web. I have installed a medical records package (openEMR) in a sub-domain, in its own cPanel account. I intend to ...
user avatar
  • 11
2 votes
2 answers
521 views

How can a client verify that code sent from the server has not been tampered with?

While trying to understand the recent controversy involving ProtonMail, I started to wonder if its possible to verify that the opensource JavaScript being sent from the server to the client hasn't ...
user avatar
  • 125
4 votes
2 answers
347 views

Should things like project IDs, cloud region IDs etc be kept secret on an open source project?

All my side project are open source - just using the free Github account. I'm wondering about how security conscious I need to be about keep things like: Google Cloud Platform Project IDs Log ...
user avatar
1 vote
1 answer
946 views

How to Check Open Source Code for Vulnerabilities? [closed]

I am a member in bug bounty platform. There are some programs that make their source code available to the hackers to find vulnerabilities. For example, their PHP, JS, C++, or ruby code. I want to ...
user avatar
-1 votes
1 answer
260 views

Secure Admin Password in Open Source Software

I am writing a server using nodejs. It is on a public GitHub repository, so its complete code is visible to anyone. The client can send strings to the server. I need to determine if the given string ...
user avatar
2 votes
1 answer
122 views

How to cryptographically guarantee that data came from a trusted application on a mobile device?

I'd like to have an open source application generate data and sign it in such a way that anyone with access to the data alone can know for sure it was generated by that open source code. More ...
user avatar
7 votes
3 answers
935 views

How can Linux be secure if it allows for open source contributions from the public?

From my brief understanding of Linux, developers from around the globe submit code to be included into a Linux update. It's then reviewed by security administrators. When approved, it's passed onto ...
user avatar
  • 487
10 votes
1 answer
12k views

Does karabiner elements on Mac OSX contain, or potentially contain, malware?

I'm using Karabiner elements, an open-source program to remap the keys on my MacBook Air (running the latest Mac OSX High Sierra) and my apple wireless keyboard. It works very nicely. However, I am ...
user avatar
  • 203
1 vote
0 answers
63 views

Aptitude & Yum: Studies on Actual Security

The theory has long been that package managers (and potentially other sources of FOSS) were potentially "more secure" and/or "more trustworthy" than commercial software because more people's eyes have ...
user avatar
  • 1,710
2 votes
1 answer
10k views

How secure is Keepass when using mobile apps

Keepass appears to be very secure, because it is open-source and the code is examined by a lot of independent people. Furthermore the database which holds all passwords is stored wherever the user ...
user avatar
  • 431
1 vote
1 answer
155 views

Making an API repository private vs public

So I am currently working on the API of an application that will be serving many users. Currently the only "sensitive" information being stored using the API is user emails and names. The application ...
user avatar
2 votes
1 answer
355 views

How is the create-react-app package tree properly sanitized?

React, and it's application creation script, create-react-app, are popular packages nowadays... and with good reason: React is a rock-star framework. From a security perspective, sanitizing all the ...
user avatar
  • 129
1 vote
2 answers
135 views

Possible setup for a direct democracy voting system to prevent fraud

My Government is designing a direct democratic voting system and would like the system to be open sourced and unable to be corrupted by individuals and other stakeholders. Some requirements as of now:...
user avatar
  • 165
3 votes
1 answer
2k views

What are easy checks to identify malware in Python code?

It is well known that PyPI does not prevent the upload of malicious code. Unfortunately, automated tools often cannot distinguish between features of a program and malicious code. In the case of ...
user avatar
1 vote
1 answer
484 views

Public guest user for PostgreSQL?

I manage an open-source software project that relies on data that I am happy to share with the public. The software is hosted on github.com, but the dataset is too large to host there. It is easiest ...
user avatar
3 votes
2 answers
277 views

How do I escalate a security concern of a library when the author doesn't seem to care

There's an open source library that is horribly insecure. The author acknowledges it's insecure. The library's headline says "This is an implementation for platform X of Library Y". Library Y is ...
user avatar
  • 458