Macpass: Reasons to trust my data isn't sent off - besides the obvious open source

[CoderJason123]

Hello. This is an amazing piece of code. Although I'm a developer for nearly 20 years, my specific Xcode experience is limited. I think the thing most people fear, even in open source software, is, a little batch of code that sends a network request to a server with your username, password, and website. This is sort of an unspoken fear even in open source, for something as critical as a password manager.

Is there a general way to express how / where MacPass uses network connections? I realize, auto update and downloading an icon, but more specifically, where is the network code? As a lay Xcode developer, I know there is a lot of NSUrl, but this is being naive and really doesn't tell me anything.

Since you are the experts, and wrote very good software, what would YOU look for, or tell someone to look for to say, "See. relax, we don't send your unencrypted stuff to another website". What type of network code should a person look for who is concerned about this?

I hope you appreciate the question and are more than willing to do the above :).

Thank you kindly for all the work every contributor has done.

[georgesnow]

Due diligence and ultimately it’s up the users. if you can’t read and evaluate the code use software like little snitch or wireshark and run a packet capture. Use some other skill set. I mean really this applies for closed source software as well.

[mstarke]

@CoderJason123 MacPass has several locations that use network access. There is no central network access entity, individual components make network requests:

1. the plugin repository JSON is loaded and cached for repetitive access at startup and when the plugin repository browser is loaded.
   https://github.com/MacPass/MacPass/blob/6b6c4fb736ee45022bb1f2e15b61d232304f7aa3/MacPass/MPPluginRepository.m#L90
   The URL is stored in the Info.plist
   https://github.com/MacPass/MacPass/blob/6b6c4fb736ee45022bb1f2e15b61d232304f7aa3/MacPass/MacPass-Info.plist#L71

2. the favicon download will load access the entries URL to load the icon. The download is only issues when the users clicks the button in the icon selection view.
   https://github.com/MacPass/MacPass/blob/6b6c4fb736ee45022bb1f2e15b61d232304f7aa3/MacPass/MPIconHelper.m#L174

3. the Sparkle framework used for updates will load the appcast url defined in the Info.plist
   https://github.com/MacPass/MacPass/blob/6b6c4fb736ee45022bb1f2e15b61d232304f7aa3/MacPass/MacPass-Info.plist#L83

[mstarke]

If you do not trust a software, you should consider installing network sniffers as @georgesnow already suggested. I recommend the tool LuLu from Patrick Wardle (@patrickwardle)

[CoderJason123]

Agreed! @mstarke thank you kindly for your response, as well as @georgesnow. Have a great rest of your weekend.