4 ms·
What to search for in open source code to be sure there isn't malicious code?
- hedora 4y agoThey've discovered step one in the arms race that is anti-virus software. A reasobable definition of malicious code is anything that misbehaves and gets past your scanner. It might be better to just run static analysis tools and fuzzers to see how exploitable the software is. Here's an old, but good one: https://security.web.cern.ch/recommendations/en/codetools/rats.shtml https://security.web.cern.ch/recommendations/en/codetools/ra... Hopefully better things exist these days.
- hulitu 4y ago> What to search for in open source code to be sure there isn't malicious code? Search for "open", "close", "fork" and "exec". If your code has one of those, is malicious. /s