Some background: I’m a software developer, and I’ve never really participated in the open source software community before. (i.e. I don’t contribute to open source projects, I don’t know anyone who does, and I don’t really know anything about the companies who start these projects to begin with, or what their motivations are for being open source.)
I’m currently trying to find software that my team at work can use to solve a particular problem we have. After doing some googling, it looks like this open source product called OpenReplay is a good fit for what we need: https://openreplay.com/
But when I first visited that website, I noticed that the background artwork looks AI generated. This made me feel skeptical of the project, and it makes me wonder: what if it’s actually a huge scam and it’s actually malware? For example, maybe OpenReplay is actually a copy of a different legitimate product that I’m not aware of. Maybe all of the stars, forks, and discussions on the GitHub page are from fake accounts. When I Google OpenReplay, there aren’t a whole lot of results. How do I know if it’s trustworthy if I can’t find an authoritative source telling me it is?
Maybe I’m just being paranoid. But this is basically the first time in my career where I’ve tried to vet a new piece of software for my team to use, and I want to make sure I’m doing it right. How do you know when a product like this can be trusted?
EDIT: I don’t mean to cast doubt on OpenReplay specifically, I’m just using that as an example because it’s the product I’m currently looking into. My question applies to any piece of software that isn’t widely known about.
I don’t think it’s a dumb question.
Unfortunately I’m not sure there’s any guaranteed method to establish trustworthiness. It’s especially difficult because if there was, it would probably be easy for the scams to utilise and thus it would stop being a good method.
Anyways, I would say try to look at the people behind the software - do they have personal websites or do they work on other stuff that also seems reliable? What about the users, do they seem legitimate? Are the issues actual issues, not fake ones? Does the code seem maintained on a regular basis with non-trivial commits? Can you find online third party mentions that seem trustworthy?
That’s just what I could think of. But essentially, there is no silver bullet and you’ll just need to make a thorough assessment and decide if you trust it enough.