this post was submitted on 31 Aug 2024
30 points (73.4% liked)
Programming
17010 readers
322 users here now
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
- Follow the programming.dev instance rules
- Keep content related to programming in some way
- If you're posting long videos try to add in some form of tldr for those who don't want to watch videos
Wormhole
Follow the wormhole through a path of communities !webdev@programming.dev
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
The solution to what you want is not to analyze the code projects automagically, but rather to run them in a container/virtual machine. Running them in an environment which restricts what they can access limits the harm an intentional
or accidental bug can do.
There is no way to automatically analyze code for malice, or bugs with 100% reliability.
Of course, 100% reliability is impossible even with human reviewers. I just want a tool that gives me at least something, cause I don't have the time or knowledge to review a full repo before executing it on my machine.
That is another tool you can use to reduce the risk of malicious code, but it isn't perfect, so using sandboxing doesn't mean you can forget about all other security tools.
He wasn't asking for 100% reliability. 100% and 0% are not the only possibilities.