3

This question already has an answer here:

I downloaded a piece of software which says it is open source, but I didn't manage to build the project from source (it's written in go).

The other option I have is to download the binary file and run it.

Can it do any harm to my computer if I run this file without giving it root privileges? Maybe it can work well, but it may have a keylogger or other kind of malware... should I be concerned?

marked as duplicate by Ravexina, karel, Eric Carvalho, Zanna, user364819 Aug 13 '17 at 8:42

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 2
    If you expect it to have some malicious software why do you wanna risk anything? Also if you know the source code is open source available for anyone to see, why do you expect it to be harmful aswell? Just mention the software that you are about to use, people might have experience with that already. Any script you run with your own priviliges can do things to your own settings/your homefolder. But nothing globally, so the most you risk is a corrupted homefolder. – Ziazis Aug 9 '17 at 14:23
7

In Theory, every file you execute on your computer can cause harm, and can hold a key-logger.

This article reflection on trusting trust by Ken Thompson Actually says that you can't trust any software.

To what extent should one trust a statement that a program is free of Trojan horses? Perhaps it is more important to trust the people who wrote the software.

Kenneth Lane "Ken" Thompson (born February 4, 1943), commonly referred to as ken in hacker circles, is an American pioneer of computer science. Having worked at Bell Labs for most of his career, Thompson designed and implemented the original Unix operating system. He also invented the B programming language, the direct predecessor to the C programming language, and was one of the creators and early developers of the Plan 9 operating systems. Since 2006, Thompson has worked at Google, where he co-invented the Go programming language.

1

If the software is malicious, the harm is probably already done. Many popular build systems such as make are pretty much full-featured scripting languages which can anything a binary could do. There could be other risks as well, such as exploits in compilers / interpreters. Just because the software is open source doesn't mean it's safe to build it, or run the resulting binary.

You should build / run untrusted software in a VM which has no access to sensitive files.

0

It depends on what you are executing. It probably wouldn't be able to access your /etc/shadow files for example, but it could do something else depending on the permissions in your files and folders or use a security issue that your system has to gain privileges. So, to be honest, just make sure that whatever you are trying to run is legit (by checking the checksum maybe or knowing exactly what you are doing) and you won't have any problems. Many applications asks you not to run them as Root anyway.

Not the answer you're looking for? Browse other questions tagged or ask your own question.