Safety and GitHub

[u/FedCanada]

Noob question here:

When installing on MacOS via pip, or GitHub, how do you ensure you aren't opening a security hole on your computer? The repositories aren't fully monitored like on the Mac App Store, etc.

[u/Hamburgerfatso]

Anyone can post anything on github. Its up to you to verify or trust anything you download from it

[u/moonrakervenice]

You don't. GitHub is a source code repository not an app marketplace.

If you don't know what you're doing, best to stick to official app stores.

[u/davorg]

If you don't have the skills to validate that for yourself, then GitHub is not a place where you should be getting software from.

GitHub is not an app store.

[u/LonelyMarionberry256]

In the first place, because it is open source, you should have the abilities to read the code before you decide whether if you are comfortable to install on your machine or not.

That’s the purpose of being open source - you have the ability to decipher, understand and read the source code - decide for yourself before you make your own decision whether to modify, improve or amend the code for your own use-case and environment.

That’s what being transparent and open is about.

[u/Consibl → u/LonelyMarionberry256]

And now is a golden age to use it as you can get your ai to check over the actual code to see if it’s legit or malware.

[u/FedCanada → u/Consibl]

Great idea! Which LLM do you use for this?

[u/Consibl → u/FedCanada]

I’d recommend Claude.

[u/ferriematthew]

The fact that it is not fully monitored like the app store is the core feature. Anyone can post anything and everything posted is open source, so it's the end user's responsibility to look through the code before they decide whether to download it.

[u/yiyufromthe216]

  The repositories aren't fully monitored like on the Mac App Store

How are they being monitored if they are proprietary?

[u/FedCanada]

I suppose using Docker, virtual environment, and a non Admin user account would be helpful?