On Dec 8, 2016, at 12:27 PM, Spencer Graves <spencer.graves at effectivedefense.org> wrote:
On 12/8/2016 12:24 PM, Marc Schwartz wrote:
Dimitri,
Even if you narrowly define "safe" as being virus/malware free and even if the CRAN maintainers have extensive screening in place, the burden will still be on the end users to test/scan the downloaded packages (whether in source or binary form), according to some a priori defined standard operating procedures, to achieve a level of confidence, that the packages pass those tests/scans.
As you know, virus and malware are moving targets and there are so-called "zero day" exploits, which means that even actively updated virus and malware scanning software can be defeated.
With respect to the security issue you raised, to the best of my knowledge, no CRAN packages are tested for such exploits (it would be an impossible task to extensively check for overt, much less covert channels of communications) and that again, would be a local issue. CRAN packages are, of course, not the only potential source of such exploits, as we know.
As Bert noted in his reply, even the official R distribution comes with no warranty, and that will be the case with most OSS.
Will an organization like RStudio provide some sort of testing service -- for a fee of course?
Spencer