Ask HN: How to deal with security implications of running/installing projects?

12 points by johng 21 hours ago | 11 comments

There are so many neat projects coming out on HN/Github, etc. But, it's so easy to inject back doors and malware into software projects now a days. I'm wondering how people deal with the secrutiy of this. Even if you install them under docker, if it's run by root it seems like there are ways they can get root access on the box.

I see so many neat projects here I'd like to try out but I'm worried that I may install some malware or backdoored software on here. There are a few AI harnesses, terminals, etc. that keep coming up that look neat... but at the very least they'd be able to get your Claude credentials, if not worse.

I'm just wondering with so much stuff coming out, most of it AI coded.

Just wondering how people deal with it? What's the best sandbox way of testing it if that's the solution?

taleodor 43 minutes ago |

Small and cheap cloud VM, preferably on a separate account used for this purpose specifically.

bitbasher 18 hours ago |

A simple qemu virtual machine is nice and quick to spin up. I mainly work inside an openbsd or linux virtual machine. I use a different vm for each project and I have a "sandbox" vm I use to run random things I download/test.

gabrielsroka 18 hours ago |

https://dl.acm.org/doi/10.1145/358198.358210

ebcode 19 hours ago |

Have you tried VirtualBox? That’s my go-to for running un-trusted code. Start with a clean VM/fresh install, and don’t put any secrets in it.

johng 19 hours ago | |

I think that might be the only way. That or maybe even this? https://github.com/89luca89/distrobox

afpx 18 hours ago |

I assume that if it's not air-gapped, it's compromised. I keep important stuff offline.

fsflover 20 hours ago |

Have you considered Qubes OS, https://qubes-os.org? It is more secure than Xen, which it relies on, https://www.qubes-os.org/security/xsa/#statistics.

johng 20 hours ago | |

I've always been interested in Qubes OS but it definitely seems like a very high pain point. I can see installing these things on VM's and then maybe trying to inspect traffic outbound to see if there is something untoward, but even that can be hidden pretty well.

Hell, I've installed some older "known good" packages and some of them have so many dependencies that are pulled in automatically, the app itself could be good but one of the obscure dependencies that it requires could be hacked and now you are still running hacked software. It just seems really scary to install nearly anything now. AI can inject an obfuscated backdoor in seemingly good software, and it can spread at a speed that humans couldn't have back in the day. I'm just hesitant with new software now and it's kind of sad. So much stuff I want to test but I'm afraid to test it.

handedness 16 hours ago | | |

Give Qubes OS a shot. It's significantly less challenging to run than it used to be, and a (small, I admit) number of us daily drive it. Hardware support these days, while far from perfect, is much better. It's not the daunting slog to get it going that it used to be.

Provided you aren't looking to run accelerated graphics or care about integrated Bluetooth, you should be fine. I'd recommend any Intel laptop (and some AMDs) with built-in Ethernet, just in case it doesn't like the Wi-Fi card. Install with kernel-latest (it's a simple option when you boot into the installer ISO), and try it out. Grab a T480/T480s if you have one handy, and you may be surprised.