I’m a fan of FOSS and reasonable privacy with data. I also often look for and install software on my computers for random tasks as they come up. Today, when I was looking to install an extension to Firefox called Wikipedia-EN that helps me search Wikipedia by highlighting a word, the Mozilla page for the extension states:
This add-on is not actively monitored for security by Mozilla. Make sure you trust it before installing.
As someone that is not educated in programming or perpetually current on tech news, what can I do to assess the safety of this and other software? Is there a site that transparently evaluates software and publishes its findings?
A lot of it comes down to trust. Scan downloads with antivirus. Decide how much you trust everything else. Err on the side of caution if you’re unsure.
In your example, the software you’re using seems fine to me. A simple addon with limited scope that hasn’t been updated in years, but has some good reviews.
That said, you don’t need this addon; go to your favourite Wikipedia front page, right click the search bar, and click “add keyword for this search”. If you enter keyword “wen”, you can search English Wikipedia by typing “wen <something>” in the search bar. Works for other websites too
Github releases can contain completely different code than the source code on there. Don’t trust them blindly like others might suggest. It’d be trivial for someone with bad intent to release FOSS software and include a virus. It happened to an important Linux tool not that long ago. Most code on Github is fine and most software is just out there to help you, but it’s good to he careful.
My personal process involves checking for things like “how many downloads does this have” and in the case of addons and apps “how many permissions does this ask”. Addon with a dozen downloads to change your Facebook theme that wants access to your entire browsing history? No thanks!
The biggest differentiator between virus and safe in my experience is “how legal is the thing I’m downloading”. Viruses, cracks, keygens, pay wall bypasses, that sort of stuff is full of bad shit, because whether or not there’s a virus in there, your antivirus will go off anyway and you’d assume it to be a false positive.
There are steps you can take to protect your computer, but generally “keep antivirus on”, “don’t pirate stuff”, and “when in doubt, click no” are generally good enough.
There’s a cool trick recent pro/education versions of Windows have where you can create an entirely temporary copy of Windows by simply right clicking an executable and clicking “run in sandbox” or something like that. This is great for trying out small programs that you don’t 100% trust but seem fine at a glance. Doesn’t work well for games, isn’t 100% bullet proof, but it’s an easy way to prevent unexpected infections. The only downside is that you need to get a Windows pro/education key somewhere (though those are not hard to come by). Really wish Microsoft would roll that out to home users.