“I like your funny words magic man” -me when I look at code

Yes. I have various ways I check, including reading the source code, looking for open known vulnerabilities, and reviewing recent commit history to see if it’s still actively maintained.

And…Looking at the other replies here - you’re all welcome, I guess. Yes. I am that part of the community. We exist. There may be dozens of us…

Anyway. Thank you all for all you do in the community, too. High fives all around.

Occasionally. Not big projects like Krita. I regularly check apps with Wireshark, most apps should be entirely offline. I also turn off internet access with flatseal.

I’ve worked on FOSS stuff with very large user bases and seen very obvious flaws go unnoticed for several years, so I guess most people don’t.

No

I wouldn’t say blindly, rather my heuristic is, the most long term and popular a project is, the less I’ll bother.

If I do though get a random script from a random repository, rather than from say Debian official package manager from main contrib sources, then I will check.

If it’s another repository, say Firefox from Mozilla or Blender then I won’t check but I’ll make sure it genuinely comes from there, maybe not a mirror or that the mirror does have a checksum that gets validated.

So… investment on verifying trust us is roughly proportional to how little I expect others to check.

So the whole thing about FOSS is that at its core, someone could add malicious features or whatever to a codebase, but it can be discovered if people notice adverse effects and dig into it.

Like that one supply chain attack by “Jia Tan” on xz tools, that was quite nefarious, well planned and executed, yet some nerd noticed a slightly longer than normal response time and looked into it (a gross simplification, some luck might have been involved but you get the point). If it were a closed-source proprietary tool, the owners would shrug their shoulders and gaslight people into believing it’s nothing.

That’s why people make a fuss about binary blobs in FOSS code, if anything unwanted was happening, it could always be from there.

My personal level of checking is ensuring that I have gone to the correct official source, but I will generally have to trust the builder that was linked from that source did not modify or inject anything.

Depends. I read the PKGBUILDs of all AUR packages I install at least, which is not the same as reading source code but it’s something. If it’s a very widely used piece of software I don’t bother—if all these people haven’t spotted some secret backdoor, I as a lay person am not going to be the one to spot it. I will read small things like bash scripts or in general the more “obscure” software I run will be some kind of script. But also if you’re going to publish malware in a script you’re probably obscuring the malicious function so that someone doing a preliminary read won’t spot it.

I don’t. I just hope for the best and try to install as few things as possible.

I’m focussing on disaster recovery now, more than prevention. Prevention seems like it’s almost impossible in this age.

EDIT: I mistakenly answered based on security, not privacy.

Lmao. I commented about this exact shit a few days ago and people in that thread were agast that people used software without vetting. So many were so confident in the security and superiority to paid solutions.

Not really. Or only when it doesn’t do exactly what I expect.

I don’t have the fluency to detect vulnerabilities or memory leaks. I wish I did, and I’m trying to learn. Being self-taught is hard work.

But I can read bug reports and get the hint. And I check upstream sources to make sure projects are still under active development. Even occasional maintenance is better than nothing.

If it’s a package I’m not familiar with and is relatively small/unknown then I’ll give it a brief once over to see if there’s anything that sticks out (obfuscated code, making http requests when the package should never do that, etc.). Most of the time though it is just trusting the FOSS community.

No, because I don’t know enough coding to do so. I am learning, though, and I do tend to research software before I install it, even from trusted repos.

Not a dev here so I have to trust what I’m hosting on my server…

I do check the issue section and base my opinion on how healthy a repo is and how long it hasn’t been update.

Based on popularity also helps a bit? Check how sane their docker-compose is and how complicated and what closed source thing they integrate in the image, but that’s it !

However, on android I do some app analysis with PCAPdroid to check what strange communications is happening behind the scenes.

Not at all unfortunately. I’m not a programmer though.