frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

Open in hackernews

Ask HN: How to deal with security implications of running/installing projects?

8•johng•2h ago
There are so many neat projects coming out on HN/Github, etc. But, it's so easy to inject back doors and malware into software projects now a days. I'm wondering how people deal with the secrutiy of this. Even if you install them under docker, if it's run by root it seems like there are ways they can get root access on the box.

I see so many neat projects here I'd like to try out but I'm worried that I may install some malware or backdoored software on here. There are a few AI harnesses, terminals, etc. that keep coming up that look neat... but at the very least they'd be able to get your Claude credentials, if not worse.

I'm just wondering with so much stuff coming out, most of it AI coded.

Just wondering how people deal with it? What's the best sandbox way of testing it if that's the solution?

Comments

fsflover•2h ago
Have you considered Qubes OS, https://qubes-os.org? It is more secure than Xen, which it relies on, https://www.qubes-os.org/security/xsa/#statistics.
johng•1h ago
I've always been interested in Qubes OS but it definitely seems like a very high pain point. I can see installing these things on VM's and then maybe trying to inspect traffic outbound to see if there is something untoward, but even that can be hidden pretty well.

Hell, I've installed some older "known good" packages and some of them have so many dependencies that are pulled in automatically, the app itself could be good but one of the obscure dependencies that it requires could be hacked and now you are still running hacked software. It just seems really scary to install nearly anything now. AI can inject an obfuscated backdoor in seemingly good software, and it can spread at a speed that humans couldn't have back in the day. I'm just hesitant with new software now and it's kind of sad. So much stuff I want to test but I'm afraid to test it.

ebcode•1h ago
Have you tried VirtualBox? That’s my go-to for running un-trusted code. Start with a clean VM/fresh install, and don’t put any secrets in it.
johng•1h ago
I think that might be the only way. That or maybe even this? https://github.com/89luca89/distrobox
gabrielsroka•38m ago
https://dl.acm.org/doi/10.1145/358198.358210
afpx•6m ago
I assume that if it's not air-gapped, it's compromised. I keep important stuff offline.
bitbasher•4m ago
A simple qemu virtual machine is nice and quick to spin up. I mainly work inside an openbsd or linux virtual machine. I use a different vm for each project and I have a "sandbox" vm I use to run random things I download/test.

Ask HN: How to deal with security implications of running/installing projects?

8•johng•2h ago•7 comments

BMWs shows in-car ads for Spiderman

10•bigmattystyles•5h ago•10 comments

Goodbye POSIX, Hello Tea Room: Inside MinervaOS Architecture

9•xentnex•8h ago•6 comments

Ask HN: Why is every company encorporating AI everywhere?

23•vanessa1211•13h ago•36 comments

Claude Code getting "API Error: 529 Overloaded"

4•croemer•12h ago•2 comments

Ask HN: What are the most promising RL fields for a new master student?

34•zecice•1d ago•14 comments

Ask HN: Any New Computer Ideas?

6•robalni•17h ago•9 comments

Opus Cost = Minimum Wage in South Africa

4•bridgettegraham•15h ago•2 comments

Ask HN: Where do those LLM-generated outreach emails come from?

3•nicbou•15h ago•2 comments

Ask HN: Does the tech industry require deterministic ML training?

4•Swapnopam•16h ago•0 comments

CstWeave – On-device, privacy-first Chrome extension for tab region GIFs

2•fujidevv•16h ago•0 comments

Ask HN: How do you figure out what you're passionate about?

8•charliebwrites•1d ago•16 comments

Ask HN: What livestream do you keep open in a tab?

53•missmoss•2d ago•18 comments

Robotic Adaptation Suffers from Data Collection Bottleneck

3•aunmesh•1d ago•0 comments

Tell HN: Namecheap gave my account to an unverified third party

494•Thrashed•4d ago•176 comments

Ask HN: Protecting your Sites/Services from Unwanted Traffic?

12•prologic•1d ago•10 comments

Ask HN: Is Zig worth it over Rust in 2026?

5•soywod•23h ago•6 comments

Ask HN: Which Jabber clients support SCRAM+ and XEP-0474

12•Bender•2d ago•0 comments

Ask HN: Are you using Rust on embedded devices yet? If not, why?

9•mempirate•1d ago•4 comments

Ask HN: What's the best hands-on path to learn ML inference infrastructure?

7•censor5•1d ago•3 comments

Ask HN: HotPin – lossless 120B MoE inference on 24GB RAM (CPU, 50 loc)

13•LozzKappa•2d ago•0 comments

Ask HN: Are we having a substantial increase of "Show HN" since LLM aided coding

7•mdp2021•17h ago•4 comments

Endor Labs' AI SAST Finds Zero Day Memory-Y

2•usman_oiu•12h ago•1 comments

Timed YouTube video transcripts in .txt and .pdf

7•cristyg0101•2d ago•4 comments

Ask HN: Anyone suffering from the tyranny of the Waiting Equation?

3•akersten•1d ago•3 comments

Connection-Agnostic Presence Tracking for Stateless Distributed Back Ends

5•duckydude20•1d ago•0 comments

What happens behind the scenes when we change effort for same LLM models?

13•tbharath•2d ago•8 comments

Who's making money from using/exploiting AI?

11•jonthepirate•2d ago•6 comments

Ask HN: Do you delete your browsing history?

4•tempestn•1d ago•14 comments

Ask HN: Is an in-page speed reader useful?

2•jvbotelho•1d ago•5 comments