Timeline for My thread is too broad, why? - "Safety of software installation from source code"
Current License: CC BY-SA 3.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 5, 2016 at 11:03 | vote | accept | johny | ||
| Sep 29, 2016 at 14:11 | comment | added | Thomas Ward Mod | @mnoq I take the network security approach, yes. I also don't compile anything I don't already know is safe (for example, OpenSSL binaries for certain use cases), and I don't install 'random software' without testing it. What you're asking though is "what do experts check", and depending on the expert the checks vary. Therefore, it still fits into the "too broad" category as there are numerous possible answers to the question and again, Q&A scope comes into play. | |
| Sep 29, 2016 at 13:58 | comment | added | johny | @ThomasWard Do you really do all that for anything that you compile/install ? | |
| Sep 29, 2016 at 13:54 | comment | added | Thomas Ward Mod | @mnoq As well, Programmers and malware analysis engineers would dissect the code to determine what that code is doing, whether it's messing with system files or downloading things or pinging to external malware C&C nodes, etc. There's way too many things to look out for regardless of the vector of analysis (whether code level or otherwise) to fit into the scope of Q&A here. | |
| Sep 29, 2016 at 13:53 | comment | added | Thomas Ward Mod | @mnoq Again, there's way too many things to look out for. For example, as a network security guy, I'd set up an isolated system that I can put software on, then monitor network activity for suspicious activity matching malicious patterns. The problem is, that has tons of malicious signatures it could match. Take it from the systems engineer side, they could be looking for changes to the kernel, etc. The analysis of code for 'safety' depends on the approach taken to the analysis, and then from that any of near unlimited number of analyses/approaches. | |
| Sep 29, 2016 at 13:51 | comment | added | johny | If I change my Question to something like: "What do the experts check before they install from source code?" - Would it be OK ? I'm sure that expert programmers & IT professionals around the world are compiling source code by themselves. So what do they check? | |
| Sep 28, 2016 at 23:51 | history | edited | Thomas WardMod | CC BY-SA 3.0 |
added 336 characters in body
|
| Sep 28, 2016 at 23:22 | comment | added | TheWanderer | @mnoq maybe on a forum, but we're a Q&A site. And, while Nonny's answer is succinct enough to fit our format, it doesn't address your whole question, which is fine, since that's impossible for one person to do. | |
| Sep 28, 2016 at 21:39 | comment | added | johny | The user "Nonny Moose" supplied a decent answer. It seems that you prefer to avoid elaborating on the subject... My question is very important and relevant to all Ubuntu/Linux users. I'd like to know what do common experts check before installing a software from source code. Like in every problem, there are the common scenarios and the exotics ones. This is a fair question and should have been asked years ago... | |
| Sep 28, 2016 at 15:20 | history | answered | Thomas WardMod | CC BY-SA 3.0 |