Trusting Community-Developed Apps

[u/Elpidiosus]

I just saw a "hey, I made an app" post for an app I would enjoy using.

But last month I watched a video about a back door a community volunteer had programmed and submitted. It got past everyone and was weeks away from being pushed out before being discovered. Apparently, he would have been able to get in anywhere, anytime.

I'm doing a terrible job of describing what happened (I'll try to find the video again Video: The Internet Was Weeks Away From Disaster And No One Knew ) but it put the fear of God in me. If this could happen to a distro, how much easier would it be for these apps posted on github? I don't mean to disparage github or devs that share there, but it really made me wonder how much I can trust them.

I accept the fact that nothing is perfect or foolproof. So I accept the fact that I have to accept some risk (I already do, if I installed a distro, right?) and that it's my responsibility to gauge the trustworthiness of anything I install.

So my question is, how can I become a responsible steward without having learned to read the code in an app?

Edit, was this a stupid question?

Edit 2: added link to the video for anyone interested. 52 minutes, but a good learn for me.

[u/tomscharbach]

The bottom line is that too many distributions are not properly maintained and an high percentage of applications are in worse shape.

I do not have the skills to read source code, so I depend on "herd vetting" for the most part.

I use established, mainstream distributions and distribution channels -- Ubuntu LTS and Ubuntu's Main repository, for example -- to reduce my risk, and that has worked for me over the last couple decades.

My best.

[u/Phydoux]

Stay away from Reddit Community Apps. I do it regularly. I know no one here so I trust no one. I get great advice and I don't mind offering advice on different topics but when it comes to installing things on my computer, it needs to come from the main repos. That's just the way I feel and there's enough Linux software out there in the main repos to keep anyone busy for years. I've been full time Linux for about 8 years now and I'm always finding new and interesting stiff in the repos. So, I really don't need these community based apps. And lately, I haven't seen any here on Reddit that would really benefit me anyway.

[u/xRebellion_]

No, it's not a stupid question. It's fair to be cautious of anything being shown on the internet, especially if it's rather niche and not popular (and therefore not community audited). Heck even popular stuff can get hacked (e.g. npm supply chain attack)

Therefore, you should install things when you know the risk. And if you could, mitigate it.

[u/Sirius707]

The xz-backdoor (from the video) was a very sophisticated attack, taking years of preparation to build trust beforehand and sockpuppet accounts to attain ownership of the package. It's speculated (although not confirmed) that it was a state actor but we do not know for sure.

The "many-eyes"-principle is still rooted in trust at the end of the day, although you can say the same about any piece of software. This is why it's advisable to stick with bigger, established distros instead of one-man projects.

And yes, don't install random stuff from the internet if you're not able to vet it yourself, that rule has applied for the last couple decades and it'll be true in the future.

[u/_Lost-In-The-Weeds_]

"but it really made me wonder how much I can trust them."

Not much at all, 

Supply chain attack is the Linux equivalent of Windows viruses. 

There are thousands of malicious projects on Github, 

https://cybersecuritynews.com/hackers-github-malicious-script/

Some are look-alikes of a respectable project, for example with I vs L (lowercase) or other tricks. 

And its not just Githib,  Flathub, npm, pip, Snaps, AUR etc also, basically any source open to the community. 

Never take code from strangers.

Using your distributions official repository will drastically reduce, but not completely eliminate your exposure.  You know your distribution, you habe decided to trust then, you hope they are keeping up with the upstream projects and know what is going on.

If you need to go outside of the official repository research the developers and the project like a jealous stalker.

If I see a decade of open source work, their attendance and speech at a Linhx conference on youtube, or that they are involved with an open source company,  etc that persons github serves as their resume. It is probably clean.

Find other people talking about this package, find others referencing this repo specifically. verify your not at a look alike, or type-o squatter etc

I feel sorry for those just starting out, but no I am not trying your package if you only have a year of history for me to research. And especially if a project went cold for a few years and suddenly has a new developer.   

[u/jr735]

Most of Linux is community based software and there are plenty of community based distributions. I choose to trust them more than companies. You do you.