Installing FOSS/GitHub apps on macOS - any precautions?

Software
1

I’m seeing quite a few FOSS/GitHub-hosted (yes, I know those aren’t the same thing) apps that are rather interesting, but I’m a little skeptical about downloading less-trusted third-party apps in the modern environment.

Are there any precautions/monitoring software/etc. y’all employ to make the process a little less fraught?

1 Like
2

I mostly stick with apps I’ve used for years, especially tools built before the AI era. Most of my needs are already covered by apps like Alfred, BetterTouchTool, PopClip, and Hazel. I’ve in fact created more complex automations (using AI) inside these apps rather than using new apps. Like have 5-6 complex Alfred workflow that do soooo much heavy lifting including a local DB lol. it’s so good.

When I do use lesser known FOSS apps, I take a few precautions:

  • Block unnecessary internet access: I use Little Snitch to monitor network connections and create per-app or per-domain rules. For most apps, I block internet access entirely. They really need to offer a functionality that needs internet access
  • Update manually: Every two or three months, I download the latest DMG and reinstall the app myself. it’s really not a big deal.
  • Check reputation: I prefer projects with a few thousand GitHub stars, active development, and recommendations from communities such as r/macapps.
  • Build small tools myself: Since AI coding tools have improved, I’ve also started creating simple custom apps for my own use. I use the $20/month ChatGPT plan, which includes access to Codex.
3

To me dev or project reputation is the primary consideration. Bonus points if the project was created before vibe-coding was a thing. I tend to distrust apps with a 100% vibe-ish UI, or with a 100% AI-generated README.

Little Snitch (alert mode) helps by showing and blocking the telemetry connections. It is by no means a silver bullet.

r/MacApps is a useful resource with broad crowdsourced coverage of the industry, even though these days it’s filled with low-effort self-promotion posts. Search for mentions of the app you’re looking at. No mention at all? Then the app must be really niche.

Having an AI agent audit the repo is an option. I’ve never done that myself, though I’ve heard of some others doing audits regularly.

1 Like
4

I had the same question regarding VisualDiffer here. It is an old app but in 2025, the developer made it open source.
It said that it is a notorized and also a sandboxed app so that means the risk is low. Still, I am not sure about it as I am also quite wary of apps I have not heard of in this era of AI and vibe coding. Maybe I should just pay for Beyond Compare.

5

I use and test a LOT of FOSS software. I cannot go by the general rules of lots of users or fast development because the ones I actually need are small often 1 or 2 person things and slow moving. So my tactics are: I evaluate the code myself. If I can’t then I ask someone else to do it. I try to do an investigation on the person, what other things have they built? Are they still active or is it an abandoned project, and is doing something that I really need or need to understand? I also have enough machines that I can put it on a test environment (not totally air gapped but hobbled in terms of what’s on it) and test for a bit. Only then will it move to my main machine.

Anything that gets me out from under the thumb of walled gardens where I have no say in how or where my data are stored or accessed is a good thing. I also am becoming more and more totally adverse to anything that requires an ongoing mandatory subscription. That said, I also do regular donations to the open source projects that provide the FOSS tools that replace those subscriptions. It’s not the money issue as much as it’s a control issue.

I’m willing to put up with a lot to have control over my mahcines and applications.

6 Likes
6

I’m the author of VisualDiffer, and I wanted to clarify the difference between notarized and sandboxed.

Almost all apps distributed outside of MAS are notarized, which means Apple certifies that they’ve been vetted by them (I’ve greatly simplified this, sorry).

On the other hand, not all apps on Mac are sandboxed; Apple only requires it for those distributed on the MAS. Sandboxing increases the level of security, but in some cases it makes the user experience a bit more cumbersome, if not impossible, with too many restrictions and too many quirks.

For example, VisualDiffer adds entries to the Finder’s contextual menu that allow you to select two items and then open them in the app. But sandboxing forces the user to SELECT AGAIN via the file picker of the app the files they had already selected in Finder—a terrible user experience!!

VisualDiffer isn’t vibe-coded, for one simple reason: I like writing code, so I continue to do it myself. Of course, Claude is an ally, and we write some graphical parts together, but I write the core. Then, maybe, I’ll do a code review with my friend Claude Code, but I’m always the one to blame for the bugs :smiley:
The port from Objc to Swift (2024-2025) was done by hand, partly because Claude didn’t exist yet.

In my opinion, Beyond Compare is the most beautiful and complete file/folder diffing app; it’s worth every penny