c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.
THE RULES
Instance Rules
Community Rules
If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.
Learn about hacking
Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !securitynews@infosec.pub !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub
Notable mention to !cybersecuritymemes@lemmy.world
I don't do a full audit, but I certainly make sure the project is reasonably active before using it. I'll look at:
That only takes a few min and I think catches the most important issues.
I trust the big projects: LibreOffice, Tomcat, Debian, Openmediavault.
But let's be clear: I have never done an audit myself and I'm totally not capable of doing it. I can program a bit but this is over my head. If a one guy project is overtaken by a bad actor, I wouldn't know. This has happened by the way, I don't remember which project it was, but it was pretty big - openssl or something.
This is me, except even more trusting 🤷♂️
It was xz, a software most people probably use without even knowing it as it is a library which is included in a lot of other projects. The vulnerability targeted openssh which is one of these users.
That being said: Do you also audit the dependencies of the software you're installing? I usually don't, unless a customer pays me for it. However, before I pull any dependency into one of my own projects I take a look at it's dependencies. If a library for a simple task brings tons of dependencies with it, I rather not use it.
If it's something that is not very popular/known I do actually look at the code, but never all of it.
I check:
This is of course very superficial and in general I try to avoid obscure projects that are not popular and well known.
I mean, I might catch something intended and openly malicious.
If it comes down to a buffer overflow somewhere or an exploitable race condition, I'm probably not going to see it anyway.
If its packaged usually I trust. If its code with few downloads I audit if I know the language else I run as different user
I often take a small look around if it's smaller projects yes.
This is something coding AI is getting better at