Questions tagged [security]
For questions about security practices as applied to open source software.
30 questions
4
votes
1
answer
335
views
Reimplementing security patches in older versions with different license
Companies selling products containing embedded software, tend to ban the presence of any software licensed under GPLv3, LGPLv3 or AGPLv3, to avoid the anti-tivoization clause.
The reason for this is ...
- 5,046
18
votes
2
answers
5k
views
What happens if a GitHub account for a popular open-source project is hacked?
This might be a basic question, but I’ve been wondering: what happens if the GitHub account of a well-known open-source project is compromised? Could malicious code be added, or an unauthorized update ...
1
vote
1
answer
191
views
Is open-source a right model for secure, mission critical software?
Recently, I engaged in a discussion on what would be the most befitting model for a piece of software sitting on top of an electronic voting system i.e. being in charge of collecting and summarzing ...
- 119
4
votes
1
answer
1k
views
How to know if you can trust a third party open source plugin? (flutter)
Disclaimer:
The plugin's dev has put a lot of work into it, so I don't wanna talk bad about the plugin!! I'm only working in IT since 2 years and from his Github profile he seems way more experienced, ...
- 141
6
votes
6
answers
1k
views
Is it possible to verify device identity transparently?
To what extent can we verify the identity of a particular mobile device, over NFC, in an entirely transparent manner?
Consider the following situation: A large organization currently handles access ...
39
votes
7
answers
5k
views
What guarantees that the published app matches the published open source code?
Take as an example the Italian app "Immuni" (https://github.com/immuni-app), used by the government to trace contacts exposure against COVID-19.
Since many people were afraid about how the ...
- 501
-1
votes
2
answers
229
views
Does Free Software Foundation's guidance about SaaS disallow usage of password vaults?
Password vaults, which utilize public and (likely passwordized) private keys to host and protect principally-non-human-memorized-passwords, are a kind of SaaS that remotely stores and supplies ...
8
votes
3
answers
2k
views
How can I trust to Open Source programs?
I have a question about Open Source programs. How can I sure an open source program is safe and isn't spying on me? For example, I installed Firefox on Linux and how can I sure this program is safe! ...
- 81
4
votes
1
answer
364
views
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.: CVE-2018-15494
We use an older verion of dojo in our product and our upgrade to newer version needs lot of overhauling of the product code - which is not possible at this wee hour. But we need to get rid of this ...
46
votes
2
answers
11k
views
Is GitHub "releases" section safe from malicious code? To be specific, does the binary match the code in a restrictive way?
When a developer creates a binary from the code and puts it in the releases section, does it match the code in a restrictive way so there is no chance that malicious code is compiled into it? How does ...
- 563
6
votes
2
answers
2k
views
How can we verify that the open-source code is deployed and actually in use?
Many corona apps are developed in the moment, and some of them e.g. In Germany are open source.
Many people fear to be spied by this app. Im definitely Not one of them.
Still it raised the question ...
- 161
2
votes
0
answers
63
views
ZHST_IMS_Package license issue
The ZHST_IMS_Package 1.0.0 was installed through Application insights nugget packages. As part of black duck scan found this has issue with license and reported as "License Not Found".
I found this ...
- 29
1
vote
1
answer
126
views
Open Sourcing my API - Exposing my Database?
I have an API that I created myself here: https://db.ygoprodeck.com/api-guide/
I get roughly 20,000 requests per day on it but have asked by a couple of people to open source it.
I look into this ...
- 113
1
vote
0
answers
154
views
How can I deploy an open source web app that hosts user data?
I'm thinking about developing an open-source web application where users can enter trips that they have done (touristic or commuting) and then view statistics and maps created from this data. From the ...
- 133
6
votes
2
answers
182
views
Are there rules on what to do with an old OpenSource software with a security issue?
I created Zipios version 2.x in 2015 based on an existing library and inherited the old version (0.1.5) as a result...
In June 2019, I got an email from Mike Salvatore who reported having a problem ...
- 218