Link to thread: Safety of software installation from source code
Why is it "too broad" ?
I thought I was very specific.. can't see what should I add..
-
3FYI - AskUbuntu is not a forum, but rather a Q&A site.– You'reAGitForNotUsingGitCommented Sep 28, 2016 at 12:11
Add a comment
|
3 Answers
The issue with your question ("How do I know if a certain source code that is located in a certain website is truly the source code of a "known" software") is that there are an infinite number of answers, and none of them are clear-cut going to answer the question. We are not a generic discussion forum site. We are geared for Q&A with a point of trying to get a precise answer for questions. Cases such as what you are asking have wide ranging, numerous, and broad approaches which do not fit with the style of this site (please read the Help Center about what kinds of questions you can ask here).
There are many cases where the package in the repositories links to a now-dead upstream website, when in reality the project name changed and now exists somewhere else. Or, it's just literally a 'dead package' that is unmaintained but upstream developers for that project continue on (this is quite frequently an issue).
Regardless, there's no way to give you an answer that'll clearly answer the question, and it's impossible to define what is 'safe' or not when you start compiling source code yourself (the idea of 'caveat emptor' and 'use at your own risk' both apply in these cases)
answered Sep 28, 2016 at 15:20
-
The user "Nonny Moose" supplied a decent answer. It seems that you prefer to avoid elaborating on the subject... My question is very important and relevant to all Ubuntu/Linux users. I'd like to know what do common experts check before installing a software from source code. Like in every problem, there are the common scenarios and the exotics ones. This is a fair question and should have been asked years ago...– johnyCommented Sep 28, 2016 at 21:39
-
4@mnoq maybe on a forum, but we're a Q&A site. And, while Nonny's answer is succinct enough to fit our format, it doesn't address your whole question, which is fine, since that's impossible for one person to do. Commented Sep 28, 2016 at 23:22
-
1If I change my Question to something like: "What do the experts check before they install from source code?" - Would it be OK ? I'm sure that expert programmers & IT professionals around the world are compiling source code by themselves. So what do they check?– johnyCommented Sep 29, 2016 at 13:51
-
@mnoq Again, there's way too many things to look out for. For example, as a network security guy, I'd set up an isolated system that I can put software on, then monitor network activity for suspicious activity matching malicious patterns. The problem is, that has tons of malicious signatures it could match. Take it from the systems engineer side, they could be looking for changes to the kernel, etc. The analysis of code for 'safety' depends on the approach taken to the analysis, and then from that any of near unlimited number of analyses/approaches.– Thomas Ward ModCommented Sep 29, 2016 at 13:53
-
1@mnoq As well, Programmers and malware analysis engineers would dissect the code to determine what that code is doing, whether it's messing with system files or downloading things or pinging to external malware C&C nodes, etc. There's way too many things to look out for regardless of the vector of analysis (whether code level or otherwise) to fit into the scope of Q&A here.– Thomas Ward ModCommented Sep 29, 2016 at 13:54
-
@ThomasWard Do you really do all that for anything that you compile/install ?– johnyCommented Sep 29, 2016 at 13:58
-
1@mnoq I take the network security approach, yes. I also don't compile anything I don't already know is safe (for example, OpenSSL binaries for certain use cases), and I don't install 'random software' without testing it. What you're asking though is "what do experts check", and depending on the expert the checks vary. Therefore, it still fits into the "too broad" category as there are numerous possible answers to the question and again, Q&A scope comes into play.– Thomas Ward ModCommented Sep 29, 2016 at 14:11
First of all there are no "threads" at AU. You posted a question that is not answerable.
It is impossible to give a rule that will help to tell if some source code at some site is "safe".
Folks here take pride in answering questions well, and that's why we close questions where we can't do that.
I think Android Dev answered your question with a comment
"You could always audit the source code yourself"
That's pretty much it I think. Before downloading anything, read the source code and whatever scripts are provided to compile and install, and make sure they aren't going to do anything you don't want them to do (I think the definition of safe is also somewhat subjective, and that's another issue with your question...) otherwise, there's just no way to know.
But that's not a helpful answer unless we tell you how to do that, and it would take too long. It would take many books. And I'm pretty sure nobody here actually does that every time they install something from source. I just cross my fingers.
We prefer questions that can be answered, not just discussed.
If you want to start a discussion thread, Ubuntu Forums is the place...
-
Obviously the advice to audit the source code myself isn't practical. I just want to know what do the expert check before they install from source code.– johnyCommented Sep 29, 2016 at 13:48
-
@mnoq The simplest thing to do is only get your source from reputable sites or even better the developers github, launchpad etc pages or download the source with
apt. Is this 100% fool proof, no but is a simple way to reduce the possibility of getting something you did not want. Commented Sep 29, 2016 at 13:59 -
@mnoq it's also not practical for one person to fully answer your question, hence the
too broadclosure. You may want to read the Help Center and maybe some Meta Stack Exchange posts as well. Commented Sep 29, 2016 at 23:36