How to deal with security implications of running/installing projects?

Question

There are so many neat projects coming out on HN/Github, etc. But, it's so easy to inject back doors and malware into software projects now a days. I'm wondering how people deal with the secrutiy of this. Even if you install them under docker, if it's run by root it seems like there are ways they can get root access on the box.I see so many neat projects here I'd like to try out but I'm worried that I may install some malware or backdoored software on here. There are a few AI harnesses, terminals, etc. that keep coming up that look neat... but at the very least they'd be able to get your Claude credentials, if not worse.I'm just wondering with so much stuff coming out, most of it AI coded.Just wondering how people deal with it? What's the best sandbox way of testing it if that's the solution?

fsflover · Accepted Answer

Have you considered Qubes OS, https://qubes-os.org? It is more secure than Xen, which it relies on, https://www.qubes-os.org/security/xsa/#statistics.

ebcode · Answer

Have you tried VirtualBox? That&rsquo;s my go-to for running un-trusted code. Start with a clean VM/fresh install, and don&rsquo;t put any secrets in it.

bitbasher · Answer

A simple qemu virtual machine is nice and quick to spin up. I mainly work inside an openbsd or linux virtual machine. I use a different vm for each project and I have a "sandbox" vm I use to run random things I download/test.

afpx · Answer

I assume that if it's not air-gapped, it's compromised. I keep important stuff offline.

gabrielsroka · Answer

https://dl.acm.org/doi/10.1145/358198.358210