How to vet an untrusted open-source project? | Hacker News Reader

How to vet an untrusted open-source project?

Sometimes you may want to use some software in your project, but the maintainer(s) may have some functional affiliation(s) that makes it difficult to use without significant security assessment effort.

Example here: GlobalProtect is VPN software from Palo Alto Networks, but the maintainer of this open source client is based in China. He may be a fine, upstanding person, the code may be pristine, but there's systemic risk that needs to be bought down.

What are your tools of choice to assess something like this?

https://github.com/yuezk/GlobalProtect-openconnect

View on HN

Official openconnect client source is on gitlab btw: https://gitlab.com/openconnect/openconnect

To avoid this problem, once I know the name of the project, I research it to find the official site / project page and then follow their links to source.

To answer your original question, security is very complex and it's not hard to hide backdoors or malicious functionality from the uninitiated. If you're not an appsec person by trade, it's probably safer to pay to have it professionally audited.

That's usually cost prohibitive. You can try free SAST and DAST scanners for code (run in a VM or on a VPS for DAST scanning - VPS has the added benefit that if it's serious malware that includes VM escape, your system is still safe) as well as multiscanners like virustotal for compiled binaries, but do not assume that a lack of findings in those means a tool, project, or binary is safe.

How much would you expect an audit of something like this to be? Like, 4, 5, 6, or 7 figures?

Mid 4 figures on the low end for a small scope on an ordinary app by a single auditor up to mid 5 figures / very low 6 figures for a large scope test from a team at a boutique / specialist firm (e.g. auditing a new cryptocurrency ecosystem).

You can certainly find people advertising services in the low 4 figures and even high 3 figures, but at that price point, you are probably (but not definitely, there are certainly exceptions) going to be getting auditors of questionable skill level / experience OR a questionably thorough audit.

Reply on news.ycombinator.com