Programming

17534 readers

246 users here now

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Follow the programming.dev instance rules
Keep content related to programming in some way
If you're posting long videos try to add in some form of tldr for those who don't want to watch videos

Wormhole

Follow the wormhole through a path of communities [email protected]

founded 2 years ago

MODERATORS

snowe

Ategon

[email protected]

Dumb question: how do I know if an open source project is trustworthy? (lemmy.one)

submitted 6 months ago* (last edited 6 months ago) by [email protected] to c/programming

38 comments fedilink hide all child comments

Some background: I'm a software developer, and I've never really participated in the open source software community before. (i.e. I don't contribute to open source projects, I don't know anyone who does, and I don't really know anything about the companies who start these projects to begin with, or what their motivations are for being open source.)

I'm currently trying to find software that my team at work can use to solve a particular problem we have. After doing some googling, it looks like this open source product called OpenReplay is a good fit for what we need: https://openreplay.com/

But when I first visited that website, I noticed that the background artwork looks AI generated. This made me feel skeptical of the project, and it makes me wonder: what if it's actually a huge scam and it's actually malware? For example, maybe OpenReplay is actually a copy of a different legitimate product that I'm not aware of. Maybe all of the stars, forks, and discussions on the GitHub page are from fake accounts. When I Google OpenReplay, there aren't a whole lot of results. How do I know if it's trustworthy if I can't find an authoritative source telling me it is?

Maybe I'm just being paranoid. But this is basically the first time in my career where I've tried to vet a new piece of software for my team to use, and I want to make sure I'm doing it right. How do you know when a product like this can be trusted?

EDIT: I don't mean to cast doubt on OpenReplay specifically, I'm just using that as an example because it's the product I'm currently looking into. My question applies to any piece of software that isn't widely known about.

you are viewing a single comment's thread
view the rest of the comments

[–] FizzyOrange 57 points 6 months ago (8 children)

Maybe all of the stars, forks, and discussions on the GitHub page are from fake accounts

All 9k stars, 10k PRs, 400 forks & professional web site are fake? Come on this is about the most obviously not fake project I've seen!

How do you know when a product like this can be trusted?

The same way you tell if anything can be trusted - you look at the signals and see if they are suss. In this case:

Lots of stars
Lots of real code in the repo
Professional looking website with commercial pricing
Lots of issues
Good English

The amount of effort it would take to fake this for very little benefit is enormous.

Maybe I’m just being paranoid.

Yeah just a little!

[–] [email protected] 15 points 6 months ago (3 children)

I agree it does look legitimate, I was just wondering what signs I should look out for in general. Like I'm sure fake GitHub engagement must be a thing, but I don't know how widespread it is and I don't know what the threshold is before a project can be considered definitely real. It sounds like you're saying the level of engagement on this project is well beyond what can be considered sketchy, which is helpful information. Thanks

[–] sus 23 points 6 months ago (1 children)

for a large project, you can probably look at the history of issues, if there are lots of issues that are 5 years old, it's almost certainly legit

[–] [email protected] 20 points 6 months ago

Don’t forget the 300-comment-long “+1” feature request chains

load more comments (1 replies)

load more comments (5 replies)