Security of Github.com

1. Show the site is safe and will not infect our computers

It's not "safe". GitHub allows anonymous users to upload anything they want including malware. You could get infected by downloading/executing code or visiting anything on the "github.io" domain where arbitrary javascript (and therefore 0-day browser exploits) might be found (github.com is safer than github.io).

2. Create an open source policy for use when determining the safety of code found on GitHub.

The only way to determine the safety of source code is to go through one line at a time and carefully read every single line.

With major projects, you might assume somebody else has already done this, but that's not a safe assumption. For example OpenSSL's security was completely compromised in 2011 but code reviewers failed to notice the problem until 3 years later. Criminal organisations were aware of the problem long before it was fixed and companies were compromised.

Small businesses using open source Word Press plugins are continuously being hacked, we see it almost every day where I work. Smart companies avoid the problem by refusing to use random word press plugins and your company policy should be the same.

What you need to do is make a risk/reward analysis. Outline the risks of allowing access to GitHub in detail, and then outline the rewards, and conclude with your case that the rewards outweigh the risks.

The largest and most successful corporations in the world have all decided that the rewards outweigh the risks. But those risks are still real and your company still needs to be aware of them - don't go downloading code and executing it without thinking first about who might have written the code.

There is a giant problem with the logic behind this fuss. Storing the source code of malware is not strongly correlated with being infected with malware.

Consider http://www.metasploit.com/. It's a tool used by people protecting against intrusion -- and also by people looking to perform intrusion. Or any number of other resources used by people who study malware.

Yes, github.com could turn out to contain active malware -- but so could anything else where arbitrary websites are hosted. Does your management prohibit access to all of AWS? Google apps? Heroku? Sourceforge? Bitbucket? There's a list of about a million places that allow people, including bad people, to set up web sites. Does your employer really maintain a white list of only sites that they like? And what do they do when one gets broken into, and turned into a malware distribution apparatus?

So, this has nothing much to do with open source, except insofar as github.com is a hard place to avoid if you want to use it. You could have this debate about every wordpress blog site in creation; those get compromised approximately once every five minutes.

Perhaps you could get access approved on a per-project basis on GitHub? For example, say you wanted to use code from https://github.com/google/zopfli you could somehow get that approved and then be able to download/use the relevant files. Annoying, but better than having to write 100% of your code from scratch.

Also, if they're particularly concerned about ransomware, something like first testing code in a VM that can be trashed at a moment's notice might help them to feel like it's safer?