开发与 ITReddit 原帖
Need Tips on secure download of FOSS/.DMG files
I have always wondered about the best ways to protect oneself from malicious files when downloading free open-source software in .DMG or .zip format from GitHub or anywhere. With the proliferation of AI and CLI tools, this has become more necessary than ever before to check for any hidden files. I decided to ask here as we have a diverse group of users, including professionals and developers. So please suggest your preferred workflows, apps, software, websites or other methods you use to check something before downloading it.
已收集讨论
13 条已收集
13条已收集15条 Reddit 标称评论
for .dmg from github I usually do the boring stuff first, check the repo’s actual age, stars, last commit, whether there’s a real human behind releases. half the supply chain risk is just “is this repo what it claims to be.” after download I run it through virustotal (drop the .dmg in, not the unpacked app), and then spctl -a -vv -t install path/to/app.dmg in terminal to see who signed it and whether notarization is intact. unsigned ad-hoc stuff goes in a Parallels VM first if I actually need to use it. nothing exotic. probably 90% of the value is just sourcing github releases by the original maintainer, instead of some random mirror.
I use “What’s the sign” or I don’t remeber the exact name to check the signature . It’s also from objective see, creators of LuLu
I also heard good about Apparency
There are a few actually: https://objective-see.org/tools.html
https://www.virustotal.com/gui/home/upload
Thanks for dropping the link!
For Mac apps I’d check a few boring things first: notarization, Gatekeeper warning behavior, whether the release is signed by the same developer each time, and whether the GitHub repo actually matches the binary being shipped. AI/CLI tools add one more risk because they often ask for broad filesystem access. I would be more careful with permissions than with the download format itself.
That’s what I am most worried about too! It’s harder for normal users to find/understand the real usage of files/permissions requested by an app. Thanks for your suggestion ☺️
Hey get Intego antivirus it is so fast and also works realtime. Worth it every time and I try out 100s of apps each month …
I don’t think Mac needs an antivirus software, and more than that I don’t want a subscription. Thanks for your advice though!
For GitHub stuff, I’d be more cautious with “random release asset” binaries than with source code. Check maintainer history, release notes, issues, stars/forks aren’t everything but can help, and verify the binary is signed/notarized if it’s a Mac app. Also don’t run installer scripts unless you’ve at least skimmed what they do
Gotcha!
Just do the basics, Check the gatekeeper, the source, if the app is notarized etc.