61–70 of 87 posts
If you -- or anyone in this thread -- want to build it together or to discuss ideas, please get in touch.
You can make a snapshot for free right now if you want to. This should solve your problem.
Let me know if you have any questions, but using terminal's snapshot feature you can distribute your web app at a known state.
Edit: it's like git versioning for machine state.
The only way you can do this is if the server is not fully under your control but partially controlled by the remote client. We've been here before: this is Trusted Computing. You need a Trusted Platform Module on your servers (thankfully you're picking the hardware, so you can make that a hard requirement). Your users can inspect and sign your code with their keys, that they generate and keep on the client side (you…
I think I picked this up off Hacker News originally, but there's apparently new Intel stuff (aka SGX) coming out to help with this. http://theinvisiblethings.blogspot.com/2013/08/thoughts-on-i... Unfortunately, I think the reason most open source people have a knee-jerk aversion to trusted platforms are that they've historically been designed to only serve the interests with the most money (read: the government and/o…
Bank: "For your security, you may only access our website with an officially supported browser"
The only way you can do this is if the server is not fully under your control but partially controlled by the remote client. We've been here before: this is Trusted Computing. You need a Trusted Platform Module on your servers (thankfully you're picking the hardware, so you can make that a hard requirement). Your users can inspect and sign your code with their keys, that they generate and keep on the client side (you…
I realize this doesn't meet your requirement re hosting it yourself -- but since I don't know the full background, perhaps that doesn't matter to you.
Earlier quoted context omitted.
Stallman is just recommending a way to have scripts self identify as free software. There's nothing that'll help there. Implementing as an API doesn't help much, and in fact might just make it easier to fake. This is because you have a reduced surface area that you need to check and modify. It's theoretically impossible if you assume full control of hardware. But most people are not capable of controlling hardware, s…
The first statement is untrue: Stallman is also advocating measures to replace obfuscated JavaScript web apps with free versions: "Browser users also need a convenient facility to specify JavaScript code to use instead of the JavaScript in a certain page. (The specified code might be total replacement, or a modified version of the free JavaScript program in that page.) Greasemonkey comes close to being able to do thi…
What about Intel TXT (maybe?) and the upcoming SGX? Although I've not seen details on how the key system works with SGX. But assuming each processor has a unique ID/public key signed by Intel, and assuming we trust Intel and assume it's not profitable/plausible for a darknet to undo Intel's hardware protection, SGX seems to be exactly what the OP is asking for.
The only way you can do this is if the server is not fully under your control but partially controlled by the remote client. We've been here before: this is Trusted Computing. You need a Trusted Platform Module on your servers (thankfully you're picking the hardware, so you can make that a hard requirement). Your users can inspect and sign your code with their keys, that they generate and keep on the client side (you…
Perhaps it's a stupid question, but how can a web client confirm that code is really running from inside the TPM? Since the source code is freely available from github, isn't there a chance that whoever controls the server (hacker or malicious owner) can simply override the TPM at some point in future, and run the unsigned, possibly altered, code directly, circumventing all the restrictions? As far as I understand th…
1. Site publishes its hardware public key, allows users to verify it can sign on behalf on an Intel processor.
2. Site publishes source and reproducible build, so everyone can agree on a hash of acceptable bits.
3. Users submit requests encrypted to that public key (there's also something missing, where the key is actually a combination of the public key plus the hash of the executable code. Maybe the processor signs another cert for a specific proc+code combo).
4. Server can only decrypt when it has access to the matching private key, which is only available after entering the secure enclave.
5. If the server could decrypt the request and sign a response, the user knows it was handled by the right bits.
This still has many problems, the main one being that users are not going to really verify anything anyways. Also the data storage and all important handling needs to be done with encryption, so an admin can't just change the data.
But in theory, assuming no one can break the secure enclave/trust chain, it's a pretty nifty solution.
Earlier quoted context omitted.
I think I picked this up off Hacker News originally, but there's apparently new Intel stuff (aka SGX) coming out to help with this. http://theinvisiblethings.blogspot.com/2013/08/thoughts-on-i... Unfortunately, I think the reason most open source people have a knee-jerk aversion to trusted platforms are that they've historically been designed to only serve the interests with the most money (read: the government and/o…
Remote attestation is most certainly anti- Free software. Bank: "For your security, you may only access our website with an officially supported browser"
Just make a snapshot on terminal.com and then the state of your web application can be distributed at an instant in time. You can verify its exactly what you say it is since the snapshot is bound to your user name. You can make a snapshot for free right now if you want to. This should solve your problem. Let me know if you have any questions, but using terminal's snapshot feature you can distribute your web app at a…
A solid example to keep in mind is MtGox. How can we run something and know no invalid trades are added, no fake password resets processed, etc etc.
Earlier quoted context omitted.
Remote attestation is most certainly anti- Free software. Bank: "For your security, you may only access our website with an officially supported browser"
On the other hand, it allows trusting otherwise untrusted third parties. For instance, you could use it to run a verifiably safe bitcoin tumbler. (Assuming you can trust Intel directly and against attackers.)
The essential idea behind software freedom is that your computer runs code wholly of your choosing and functions as your agent. The parties to a transaction voluntarily meet together by adhering to a mutually beneficial protocol.
Allowing other parties to know exactly what code you're running lets the more powerful party dictate that your code works for their benefit, effectively leaving you without a computer.