Programming

Maybe all of the stars, forks, and discussions on the GitHub page are from fake accounts

All 9k stars, 10k PRs, 400 forks & professional web site are fake? Come on this is about the most obviously not fake project I've seen!

How do you know when a product like this can be trusted?

The same way you tell if anything can be trusted - you look at the signals and see if they are suss. In this case:

• Lots of stars
• Lots of real code in the repo
• Professional looking website with commercial pricing
• Lots of issues
• Good English

The amount of effort it would take to fake this for very little benefit is enormous.

Maybe I’m just being paranoid.

Yeah just a little!

Trustworthy as opposed to what, some random proprietary product? Do you think you're gonna somehow do better on that front with code that's secret?

Now, don't get me wrong: I'm not saying that every Free Software project is trustworthy. I'm just saying that as a first-pass screening criterium, rejecting everything that isn't Free Software is a pretty good one.

First off, good on you for being careful. Ultimately, use the same methods that you would use when vetting other sources, like academic or personnel for hiring.

Check reputation via stars, active contributors, see what accounts are contributing and what other projects they also contribute to. Check their LinkedIn profile and personal websites.

See if you can confirm the project is being used safely by reputable groups. See if people, especially public people you trust are using/recommending it without being sponsored.

Check in private forums with other devs and users, see what people are saying. Check the code yourself, etc.

Ultimately, there's no way to know 100%, even large companies and organizations have been duped in the past by backdoors or security bugs in OSS they use. You can be very confident however, it's all about how much investigation you are interested in doing.

And of course, don't ever put all your eggs in one basket.

And if after lots of investigation, you still have a bad feeling in your gut, listen to that. Better to be a little too careful than to compromise yourself by ignoring that gut feeling that something just doesn't pass the smell test.

You don’t, really. And even a trustworthy open source project can be infiltrated or sabotaged. Basically, you just have to rely on the reputation of the organization or developers behind it.

I think open source software has the huge advantage of being auditable. I suggest you and your team audit the entire code to see if anything is harshly wrong in there or you rely on other people doing it with you.

We actually dont know how many backdoors are in proprietary software and we never will until all code is finally forced into the open as it should be.

The only surefire way is to read it all. And understand it all. That ain't happening though. So you decide how much to do.

You should figure out how many people are landing patches and get a rough sense of why. Same for folks filing issues or talking about the project in general. Maybe you trust one of the contributors for some reason. Either way, you want to know how alive the project is.

You could land a patch.

You could spot check parts of the code.

You could run vulnerability scanners on it.

I dunno. It's hard.

I don't think it's a dumb question.

Unfortunately I'm not sure there's any guaranteed method to establish trustworthiness. It's especially difficult because if there was, it would probably be easy for the scams to utilise and thus it would stop being a good method.

Anyways, I would say try to look at the people behind the software - do they have personal websites or do they work on other stuff that also seems reliable? What about the users, do they seem legitimate? Are the issues actual issues, not fake ones? Does the code seem maintained on a regular basis with non-trivial commits? Can you find online third party mentions that seem trustworthy?

That's just what I could think of. But essentially, there is no silver bullet and you'll just need to make a thorough assessment and decide if you trust it enough.

I look at the contributors on Github and check them out. I'll check out what else they've worked on and maybe see if they have an account on mastodon or twitter. Maybe I'll ask some friends if they've used or heard of the product, or know of the devs.

There is indeed malware disguised as OSS and you do sometimes have to vet them. I'll skim the codebase and see if there's anything that looks weird or funky, but that's not perfect (like in the case of the xz) and some stuff can slip by.

Basically the same as fake news. Check web articles and so on. (Reading source code is often infeasible.)

You can also check Linux package managers. Official repositories from, eg, Red Hat and Suse are well maintained by the companies. I'd trust also the official Arch repo. I guess Debian is trustworthy, too, but don't know the process there.

Regarding OpenReplay, you could also check the companies listed as using OpenRepay. (I couldn't find any official source from those companies that mentioned OpenReplay, but that's rather expected given that they don't have to open their software stack.)

You could hire a team of security experts to audit it for you

1. look at code
2. if it looks good, build it and use it.
3. there is no #3

Personally I wouldn't trust it.

First red flag🚩: there's an "enterprise" self hosted version.

Second red flag🚩: It isn't open source, the licensing structure is confusing 🚩, but it appears to be at best some mix of source available🚩 and open core🚩 (core available?).

Read … the source code?