Ask HN: How would you implement a verifiable open-source web application?

#1

Post by gvido » Thu, Mar 19, 2015, 12:28 PM UTC

Wasn't really sure how to make the title descriptive enough without putting the full question there.

Anyway, I have been toying with the idea of creating an open-source web application. Open-source in the way that I would host the product on my own servers but the full source code, except, of course, authentication info, tokens and things which shouldn't be under source control anyway, would be available on Github. Anyone would also be able to set up a self-hosted version of the product, and if anyone wanted to contribute, I would accept pull requests, etc.

The idea behind that was that, since it would be targeted mostly at a tech-savy crowd and deals with personal information, I would like to introduce some level of trust that I'm not doing anything sneaky or unexpected behind the scenes (like storing information I shouldn't be).

So basically I started wondering if it is possible to implement a way people could verify that the same code they see on the Github repo is the code that's also running on the live hosted site? I will be working with node.js, but I don't think the tech stack is too relevant here.

The client-side part, as I imagined it, would be relatively trivial to verify - run the build part locally, compare fingerprint of the live code and the local version.

But my idea got stuck on the server side. Since there, even if I would make a server side endpoint that returns the fingerprint of the live code, there is no way for someone to check what is actually going on, I could just as well return a static file with a hardcoded fingerprint.

I'm sure someone has dealt with or thought about similar problems before, and I would be happy to hear some insights. Feels like this might be a pipe dream, but at least some level of verification would be nice to achieve.

Re: Ask HN: How would you implement a verifiable open-source web application?

#2

Post by rainmaking » Thu, Mar 19, 2015, 4:29 PM UTC

This is a noble goal. I would like to do this, too.

It appears to me, however, to be theoretically impossible to achieve. The code is running on your hardware; there is simply at the moment no known way to give any kind of assurance about remotely running code.

What would work, of course, would be to implement the entire app as a JavaScript application that only asks the backend for information when necessary. The blockchain.info bitcoin wallet does something to this effect. So does the web version of the LastPass vault. There is, of course, still no assurance that you will not occasionally inject compromising code when it is difficult to spot, but this is the closest that I have seen.

Richard Stallman is also advocating something to this effect: https://www.gnu.org/philosophy/javascript-trap.html

Re: Ask HN: How would you implement a verifiable open-source web application?

#3

Post by decasia » Thu, Mar 19, 2015, 4:31 PM UTC

Neat question. I guess there are really two separate things a user could want to verify:

* the application isn't broken/still fulfills its API contract

* the application isn't compromised in a malicious way

As far as the first point, I wonder if it could be possible for users to run some sort of a test suite against the public API? Like a crowd-sourced test suite that verifies that production server behavior is still as advertised.

The second point I think can only be partially addressed by partial methods, since it's impossible to guarantee that some sneaky compromise hasn't happened. But you could allow outside auditing, let people have some form of read-only access to the directory tree that stores the code (if it's separate from the config), etc.

Re: Ask HN: How would you implement a verifiable open-source web application?

#4

Post by nickysielicki » Thu, Mar 19, 2015, 4:39 PM UTC

This is funny, I was just daydreaming about this yesterday during class.

What I was thinking is allowing anonymous SSH access with a VERY locked down shell (/bin/rbash [1]) and let them view that everything is in order with their own eyes.

You still REALLY can't make a system that the user can conclusively see isn't just for show. You could be shoving them into a jail/chroot that provides the illusion of transparency, but be serving them elsewhere.

I think that this might be the closest you'll ever come to user software freedom on hardware that they don't own. There are a lot of security concerns, though, so I think it's out of the question for any type of production environment. I'd love to see a proof of concept from someone though.

[1]: https://www.gnu.org/software/bash/manual/html_node/The-Restr...

Re: Ask HN: How would you implement a verifiable open-source web application?

#5

Post by scardine » Thu, Mar 19, 2015, 4:39 PM UTC

Lets start a startup for certifying the code running at some service is the same on the public repo.

Small bitcoin fee would be charged to the privacy nuts willing to confirm it.

Re: Ask HN: How would you implement a verifiable open-source web application?

#6

Post by NoMoreNicksLeft » Thu, Mar 19, 2015, 4:39 PM UTC

> So basically I started wondering if it is possible to implement a way people could verify that the same code they see on the Github repo is the code that's also running on the live hosted site?

If Github wanted to get into the hosting business, they could offer this... you'd be trusting what they say when they tell users that the code is identical in both.

I can't think of any clever way to prove it otherwise. Though, if you could, it would have broader implications... imagine Microsoft handing the code to an app over (for viewing), and then being able to prove that the shipped version of the app was the same. They could verifiably claim that their software has no backdoors (save those that are also in the source code, but obfuscated... those are rare, but exist apparently).

This is an idea worth exploring. Good luck.

Re: Ask HN: How would you implement a verifiable open-source web application?

#7

Post by sacheendra » Thu, Mar 19, 2015, 4:41 PM UTC

This would allow users to verify if a SaaS provider is running unmodified software. Provided of course that they open source all their stack.

Re: Ask HN: How would you implement a verifiable open-source web application?

#8

Post by jdiez17 » Thu, Mar 19, 2015, 4:42 PM UTC

One way of doing this (for your particular use case, but not for the general case) would be for your "business logic" to be implemented in the client side, which as you said, can be verified easily. Then make your backend be a dumb data storage.

For example, if you want to store people's names and date of birth, you would encrypt those on the client-side and only ever send ciphertext to the server.

The encryption key could be derived via a passphrase composed of a user name and a password. Of course, this means that if someone loses their credentials, they lose their data forever.

Re: Ask HN: How would you implement a verifiable open-source web application?

#9

Post by towelguy » Thu, Mar 19, 2015, 4:42 PM UTC

The only way I can think of is giving trusted auditors periodical access to the server and have them make fingerprints of the code/data for others to compare. I think this is what some bitcoin exchanges do, for example.

Re: Ask HN: How would you implement a verifiable open-source web application?

#10

Post by eli » Thu, Mar 19, 2015, 4:43 PM UTC

nickysielicki wrote: post #4

This is funny, I was just daydreaming about this yesterday during class. What I was thinking is allowing anonymous SSH access with a VERY locked down shell (/bin/rbash [1]) and let them view that everything is in order with their own eyes. You still REALLY can't make a system that the user can conclusively see isn't just for show. You could be shoving them into a jail/chroot that provides the illusion of transparency…

Not only is this possible to fake, it's probably easier to fake than to implement for real.