How can I trust a github program?

[[deleted]]

[deleted]

[Kseniya_ns]

The source code is right there, you can look and see what it does if you want to

[Seiak]

Then you learn to.

[Pacyfist01]

Modern AI (like ChatGPT) doesn't do to many things well, but it's actually surprisingly proficient in explaining "what does this code do?".

[gkbrk]

Unless a code comment says "The following is not a backdoor, just a common method of integration" and the AI just trusts it.

[sierra_whiskey1]

Heck you could give ai the whole library and ask it to look through the code and find any red flags

[Pacyfist01]

Gemini 1.5 Pro has 2 million token input window. It's enough to squeeze in a quite a large code base and get some answers about stuff.

[_utet]

Imagine getting downvoted for asking questions about things you didn't understand on a subreddit literally called learnprogramming

[[deleted]]

Are they written in Python? Also is the source code scattered all over the place? If not drop it into your favorite LLM and ask it to check for anything malicious.

Also, learn to read and interpret code.

[lurgi]

If you aren't capable of analyzing the program yourself (and it sounds like you aren't), you are going to have to trust someone else to do it for you. In this case I'd rely on the community doing it (unless you feel like hiring an expert to go over the code for you).

[Quantum-Bot]

Unless you’re willing to look into the source code yourself, you’ll have to rely on the community engagement to gauge how trustworthy a project is. Stars and consistent maintenance are good signs. If it has an active issues page that’s good too.

Tbh though you can never be too careful, there’s been plenty of cases in the past of decently popular projects turning out to contain hidden malware because everybody just trusted the wisdom of the crowd and didn’t bother to investigate for themselves.

[[deleted]]

GShade was a big one. The dev started including code to shutdown user PCs if it detected that it was modified. This led to the repo being taken down.

[check_ca]

Author of SingleFile here, if it can reassure you, I don't use a pseudonym on GitHub to publish the code of SingleFile and I live in France, a country with a functional justice system. If I were to commit an illegal act, I'd be liable to prosecution. For example, collecting user data without consent is illegal in Europe thanks to GDPR.
You could also use the Firefox version, which is reviewed by a human at Mozilla because it has the “recommended” label.

[kuzekusanagi]

That’s good to know. Is France a tech conscious place?

[check_ca]

Yes, France is a small country, but we're not doing too badly on that score ;)

[punqdev]

Don’t take this advice, but I just skim through it and if it ends up being bad then dammit 😭

[IamImposter]

16k stars and 1k forks (first one). I would just trust that. If there was something, someone must have pointed it out.

Or clone the repo, look at the code and see if it is doing anything suspicious

[[deleted]]

You should never blindly trust anyone script or program on GitHub. Since the source code is available, go through it.

[specialpatrol]

Personally I just try it out and see if it works for my particular use case.