Hello everyone, and sorry for my bad english. So lets start with a usual topic about Open Source, and that is “everybody can see the code of a OpenSource programm to see if it is malware”. And my question is: how people that cannot read a single line of a programming language manage to do that? I mean, they can just trust in everybody that say which software is secure or not. If the software is a virus or malware, or poses security risks, people won’t know that unless they’re programmers, and so the same thing happens to these kinds of people as used to happen with proprietary software: they have to rely on those who “know” to find out if something. I find this quite problematic because, as I said, anyone who doesn’t understand the code wouldn’t be able to verify whether such a program is secure or not, and would have to place their trust in third parties. That aside, it’s also worth noting that most software has hundreds, if not thousands, of lines of code, which would make it take longer to parse all that code—and even more tedious than reading a typical “EULA.” Can you think of any way to fix this?
Personally when I install some software I generally look at popularity (like stars if the code is hosted on Github), whether an audit has recently happened, it is recommended by someone I trust, and whether the permissions it needs are reasonable (I’m on Silverblue so I only install Flatpaks)
When I used to use Arch I also looked at the pkgbuild beforehand since they’re generally fairly small en very human readable. I also looked at popularity there and whether the developer maintained an Arch package. But that obviously doesn’t say anything about the code itself.
I definitely don’t consider myself non-techy since I’m doing an an engineering masters with a CS track but those things shouldn’t require any programming knowledge.
But I think most of the more common users don’t really care and install the packages they need without thinking too much about it. Unless the source seems very untrustworthy.
Edit: you can never truly be certain that a project’s code is safe. You can only have soft guarantees. Albeit some like formal verification are harder than others like project popularity.