Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How would you implement a verifiable open-source web application?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 87 posts

Re: Ask HN: How would you implement a verifiable open-source web application?

#31

Post by ianbicking »

I think there's value in being able to say: here's the code I am claiming to use on this service, and the only way it isn't is if I have deliberately and actively lied.

That means that if someone hot-edits the files on the server, the resulting edits should be visible, and/or the site is clearly unverified. If you deploy from a branch someone doesn't know about, it should be clear. If you just don't document that you made a deployment, someone should be able to figure that out.

Of course that can be spoofed, but spoofing a solid claim on what is running is very different than not making any claim about the code that is running, so you've made yourself accountable.

Re: Ask HN: How would you implement a verifiable open-source web application?

#32

Post by rainmaking »

lmm wrote: post #26

The only way you can do this is if the server is not fully under your control but partially controlled by the remote client. We've been here before: this is Trusted Computing. You need a Trusted Platform Module on your servers (thankfully you're picking the hardware, so you can make that a hard requirement). Your users can inspect and sign your code with their keys, that they generate and keep on the client side (you…

Is it known how exploit prevention is done in a remote trusted computing scenario? It is well known that TCM implementations on behalf of Microsoft are being circumvented left and right.

Re: Ask HN: How would you implement a verifiable open-source web application?

#33

Post by akerl_ »

mangeletti wrote: post #27

I thought of doing this with the last web app I was running, but I decided not to, and here's why: 1) Anyone, not just nice people, can view source code on GitHub 2) Source code can be used to find vulnerabilities (which is of course one of the great values of using open source code - vulnerabilities are usually spotted more quickly by a larger group) 3) A single vulnerability that allows access to private data OR ca…

You're simultaneously claiming that open source code is great because large groups of people can look at it to spot vulnerabilities and that it's not great because large groups of people can look at it to spot vulnerabilities.

There are people on both sides of that fence, but you do need to be on one side or the other.

Re: Ask HN: How would you implement a verifiable open-source web application?

#34

Post by vbezhenar »

Client code could be hard to verify too. Browser do not support this functionality and there are no popular addons to verify JavaScript I'm aware of. You can't just download script.js with curl and assume that server will serve the same file to your browser.

Re: Ask HN: How would you implement a verifiable open-source web application?

#35

Post by diminoten »

lmm wrote: post #26

The only way you can do this is if the server is not fully under your control but partially controlled by the remote client. We've been here before: this is Trusted Computing. You need a Trusted Platform Module on your servers (thankfully you're picking the hardware, so you can make that a hard requirement). Your users can inspect and sign your code with their keys, that they generate and keep on the client side (you…

Wait, so you "sign" the version of code you're okay with using, and if you haven't "signed" the new version off, you're actually served by the old version of the code (the "newest" version you've "signed")?

Wicked. :)

Re: Ask HN: How would you implement a verifiable open-source web application?

#36

Post by oneeyedpigeon »

You could convince me that your server has a checked-out copy of a given body of code by a) giving me push access to a single 'throwaway' file in your repository b) generating a fingerprint of the codebase and serve it. You can't then just return a hardcoded fingerprint, but this doesn't guarantee that you aren't running other things in addition to that code.

Re: Ask HN: How would you implement a verifiable open-source web application?

#38

Post by frik »

Do it like AAA games that disallow modifications. They ship with a text file that contains every file and its file-hash (crc32, md5, sha1, etc.). And the game executable checks the hash of text file and then checks the hash of files listed in the text file.

Re: Ask HN: How would you implement a verifiable open-source web application?

#40

Post by BoppreH »

Simple, cute solution that anybody can understand: record yourself setting it up.

A video feed from a camera and another from the screen itself. Starting from a fresh system, install the dependencies, download the source, verify the hashes, and run the server. Then show the server response from another machine.

Sure it doesn't guarantee 100%. The OS image could have been tampered, or you mucked with the network and intercepted requests. But it's easy to record, easy to understand and much more secure than a black box server.

Post reply on HN