Some background: I’m a software developer, and I’ve never really participated in the open source software community before. (i.e. I don’t contribute to open source projects, I don’t know anyone who does, and I don’t really know anything about the companies who start these projects to begin with, or what their motivations are for being open source.)
I’m currently trying to find software that my team at work can use to solve a particular problem we have. After doing some googling, it looks like this open source product called OpenReplay is a good fit for what we need: https://openreplay.com/
But when I first visited that website, I noticed that the background artwork looks AI generated. This made me feel skeptical of the project, and it makes me wonder: what if it’s actually a huge scam and it’s actually malware? For example, maybe OpenReplay is actually a copy of a different legitimate product that I’m not aware of. Maybe all of the stars, forks, and discussions on the GitHub page are from fake accounts. When I Google OpenReplay, there aren’t a whole lot of results. How do I know if it’s trustworthy if I can’t find an authoritative source telling me it is?
Maybe I’m just being paranoid. But this is basically the first time in my career where I’ve tried to vet a new piece of software for my team to use, and I want to make sure I’m doing it right. How do you know when a product like this can be trusted?
EDIT: I don’t mean to cast doubt on OpenReplay specifically, I’m just using that as an example because it’s the product I’m currently looking into. My question applies to any piece of software that isn’t widely known about.
As a software developer you should have a bit of a head start - you can read the code - one of the big pluses of open source projects is it’s all there in the open. Even if not familiar with the specific language used you can see the source and get a rough idea of scope and complexity.
And look at the Github details like the age, the frequency between releases, commits, forks. Malicious projects don’t stick around for long on a host site like that, and they don’t get 1000s of stars or lots of engagement from legitimate users. It’s very difficult to fake that.
Look at the project website. Real projects have active forums, detailed wikis, and evidence of user engagement. You’ll see people recommending the project elsewhere on the net if you search, or writing independent tutorials on how to deploy or use it, or reviews on YouTube etc. Look for testimonials and user experiences.
Also look at where the software is deployed and recommended. If it’s included in big name Linux distros repos thats a good sign.
Look at all the things you’d be looking at for paid software to see it’s actually in use and not a scam.
And try it out - it’s easy to set up a VM and deploy something in a sandbox safe environment and get a feeling if it does what it claims to do. Whether that be a cut down system with docker or an entire OS in the sandbox to stress test the software and out it through its paces.
There are so many possible elements to doing “due diligence” to ensure it’s legitimate but also the right solution for your needs.