Is it safe to download code from GitHub? [closed]

Question

I'm fairly new when it comes to using GitHub, so I'm a bit skeptical when it comes to downloading repos and running them on my machine. I am looking at a key logger right now, for personal use (fun) and not to do anything malicious.

Answer 1

Nothing that you download from the internet is 100% safe. However, you can generally gauge the safety of code on Github by the following factors:

• # of Contributors/Commits: This tells you that there are a lot of people working on it, not just a single bad actor. While it is possible that it is a group conspiracy to infect users' computers, a larger # of people working to improve the code is generally a good sign.
• # of Stars: Basically shows how many people are interested in the project. You can take this as a crowd-verified reputation system of sorts. If a lot of people are interested, it is likely not malicious.
• Activity: Are people updating it, fixing bugs, etc? Ensure that there aren't open unaddressed bugs.

In terms of quality, you should also look for good documentation and the existence of unit tests to check that the code is clean.

Answer 2

As with anything you download over the internet, there could be malicious stuff when you download anything, some antivirus quickscan keep novices happy, most do automatically nowadays as people use the files.

When you do compile it and run it, well, it is assumed you KNOW what the program is when you compile you will have all the source code for it to compile. If the program is communicating with the internet through a backdoor, the backdoor should be pretty elaborate and is often not some simple 1 line of code (If the program is using any 3rd party linked libraries, checkout the libraries themselves).....security concern can go on and on.

but in the end, if you trust the dev who are working on the tree, download and run it. GitHub has pretty secure end-to-end transmission, and you can check the integrity of the repo with checksums to virtually eliminate the man-in-the-middle stuff.