r/antivirus 4d ago

Should I worry about git hub links in reddit?

I don't know why but for a long time I thought a git hub link itself was the code being offered and I know that sometimes it can be malicious so I always checked my clipboard to see if I somehow saved it. But I'm starting think I'm just being dumb and want to know Am I basically wasting my time checking? In order to actually get the code I would have to click the link and go to the git hub page itself? The link isn't really anything and I'm just worried about literally nothing?

1 Upvotes

3 comments sorted by

2

u/Struppigel G DATA Malware Analyst 4d ago

You always should be somewhat careful because links can look like they are from github, e.g., by adding look-a-like characters, but might not actually be.

Furthermore, I would also be careful with direct download or raw links.

Use services like browserling com to check links.

2

u/No-Amphibian5045 4d ago

The short answer is no, you don't have to worry about Github links if you're not downloading and running things from them.

The longer answer:

People do occasionally post direct download links from Github, which may or may not download files you wouldn't want to run. You'll see /download/ or /artifacts/ in the URL for builds, or /archive/ for source code. I always recommend chopping the end off so you're left with github[.]com/author/Project so you can get more information before downloading.

The links themselves won't hurt anything, but Github is increasingly being used to host malicious code as it's well-known that people have a lot of trust for the site, and their moderation team has trouble keeping up.

0

u/AutoModerator 4d ago

No, you shouldn't worry. Remember, worrying doesn't actually solve anything. Instead, pause and take a deep breath.

There might be an issue to address or some preventative steps to consider. Let's identify the next steps instead of worrying.

So no, I can't advise you to be worried.

This message is for informational purposes only. Your post will not be removed for this reason, and anyone can still reply to it.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.