Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How would you implement a verifiable open-source web application?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 87 posts

Re: Ask HN: How would you implement a verifiable open-source web application?

#41

Post by teraflop »

stefanks wrote: post #12

Ethereum is a distributed virtual machine, based on blockchain technology. It appears to be what you are looking for. https://ethereum.org/

I've seen Ethereum mentioned before, but it's really really hard to figure out whether it's a proposal or a thing that actually exists.

Are there any applications actually using Ethereum yet? Almost everything linked to from the home page consists of "roadmaps" or "coming soon" pages. Is there a public network that's up and running? How many nodes does it have?

Re: Ask HN: How would you implement a verifiable open-source web application?

#42

Post by ethbro »

oneeyedpigeon wrote: post #36

You could convince me that your server has a checked-out copy of a given body of code by a) giving me push access to a single 'throwaway' file in your repository b) generating a fingerprint of the codebase and serve it. You can't then just return a hardcoded fingerprint, but this doesn't guarantee that you aren't running other things in addition to that code.

How do you know that the pull the server made & hashed is actually the running code?

Again, this requires a root of trust on the server, otherwise, anything returned from the server including any information you would need to verify code the server is running could be spoofed.

Re: Ask HN: How would you implement a verifiable open-source web application?

#43

Post by towelguy »

NoMoreNicksLeft wrote: post #6

> So basically I started wondering if it is possible to implement a way people could verify that the same code they see on the Github repo is the code that's also running on the live hosted site? If Github wanted to get into the hosting business, they could offer this... you'd be trusting what they say when they tell users that the code is identical in both. I can't think of any clever way to prove it otherwise. Thou…

I doesn't necessarily need to be GitHub itself, any hosting with a reputation could host your software and verify which git commit it is pointing to.

Re: Ask HN: How would you implement a verifiable open-source web application?

#44

Post by ethbro »

lmm wrote: post #26

The only way you can do this is if the server is not fully under your control but partially controlled by the remote client. We've been here before: this is Trusted Computing. You need a Trusted Platform Module on your servers (thankfully you're picking the hardware, so you can make that a hard requirement). Your users can inspect and sign your code with their keys, that they generate and keep on the client side (you…

I think I picked this up off Hacker News originally, but there's apparently new Intel stuff (aka SGX) coming out to help with this. http://theinvisiblethings.blogspot.com/2013/08/thoughts-on-i...

Unfortunately, I think the reason most open source people have a knee-jerk aversion to trusted platforms are that they've historically been designed to only serve the interests with the most money (read: the government and/or content industry).

There's nothing inherently anti-open source about the schemes, and they would provide innumerable benefits to increasing security confidence in a networked world.

However, when you can rattle off enough failed or botched encryption initiatives involving a hardware component to fill one hand just from the top of one's head (CSS, AACSS, HDCP, UEFI/SecureBoot, FairPlay), confidence is not inspired...

Re: Ask HN: How would you implement a verifiable open-source web application?

#45

Post by towelguy »

frik wrote: post #38

Do it like AAA games that disallow modifications. They ship with a text file that contains every file and its file-hash (crc32, md5, sha1, etc.). And the game executable checks the hash of text file and then checks the hash of files listed in the text file.

The software runs on your server so you could spoof the checker.

Re: Ask HN: How would you implement a verifiable open-source web application?

#46

Post by kancer »

jewel wrote: post #16

The answer is cryptography. You need to have the client encrypt everything before sending it to the server, removing even the option for wrongdoing. This only works if the client is a program, app, or browser extension that the users can compile themselves. There's not (yet) a way to verify the client code that is running in the browser. If the server needs to do stuff with the data, then what you want probably not p…

Homomorphic encryption is the solution when you want the server to process the data, if it every becomes efficient.

Re: Ask HN: How would you implement a verifiable open-source web application?

#47

Post by mitchtbaum »

ianbicking wrote: post #31

I think there's value in being able to say: here's the code I am claiming to use on this service, and the only way it isn't is if I have deliberately and actively lied. That means that if someone hot-edits the files on the server, the resulting edits should be visible, and/or the site is clearly unverified. If you deploy from a branch someone doesn't know about, it should be clear. If you just don't document that you…

Ah.. Now I get it.

So, if each branch's code was signed and contained an embedded key and chosen encryption algorithm, then if the app used those during processing and users received verifiable transmissions, that app's output could be verified by users as having come from that advertised branch.

Re: Ask HN: How would you implement a verifiable open-source web application?

#48

Post by random28345 »

> I would host the product on my own servers

Don't do that. If you're targeting your product for the tinfoil hat crowd, that's simply not going to work. Instead, you create a build script that will generate your application from source, and (for example) generate a docker image. This image could be run on your servers, on a third-party server (AWS, DO, etc.) or on the user's own hardware, depending on the level of inconvenience/security tradeoff they are willing to endure.

I know you're probably looking for the consistent revenue streams of a SaaS, but unless user data can be completely encrypted during storage (e.g. email, backup, etc.), the truly paranoid don't want to trust their information to a 3rd party.

Re: Ask HN: How would you implement a verifiable open-source web application?

#49

Post by eevilspock »

akerl_ wrote: post #33
mangeletti wrote: post #27

I thought of doing this with the last web app I was running, but I decided not to, and here's why: 1) Anyone, not just nice people, can view source code on GitHub 2) Source code can be used to find vulnerabilities (which is of course one of the great values of using open source code - vulnerabilities are usually spotted more quickly by a larger group) 3) A single vulnerability that allows access to private data OR ca…

You're simultaneously claiming that open source code is great because large groups of people can look at it to spot vulnerabilities and that it's not great because large groups of people can look at it to spot vulnerabilities. There are people on both sides of that fence, but you do need to be on one side or the other.

> you do need to be on one side or the other

binary, black and white thinking.

Re: Ask HN: How would you implement a verifiable open-source web application?

#50

Post by zokier »

Heck I think even enforcing local trusted computing effectively is a challenge enough, doing it remotely with attestation sounds like quite a feat.

Does anyone know what the state of executable signing for Linux is these days? I found some unmaintained DigSig project, and some noise about SecureBoot related patches from couple years back. And that would be just a start, I haven't heard anything that would allow enforcing code signing for "dynamic" code (like JS or Python)

Post reply on HN