Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How would you implement a verifiable open-source web application?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 87 posts

Re: Ask HN: How would you implement a verifiable open-source web application?

#21

Post by bcg1 »

This is not a technical solution, but you could release your code under AGPL and take code contributions.

By doing this, you are essentially telling the world that not only do they need to trust you, but that you are willing to make yourself legally culpable if you surreptitiously run different code on your servers (ie., you would be violating the copyright terms of your contributors whose code is licensed under AGPL and of which your application is a derivative).

It would be nice to have a technical solution as well, I'm not discounting any of the other suggestions here. Just saying that adding a legal dimension could help counterbalance the possibility that a technical protection could be defeated.

Re: Ask HN: How would you implement a verifiable open-source web application?

#22

Post by hmsimha »

I was trying to figure something like this out myself a while ago. The best solution I could come up with was a transparent Platform as a Service provider that had an option for the person(s) with access to allow anyone who wants to inspect the slug and application settings (minus any secret tokens) to do so. Essentially, it would be verifiable for any users of the application that the DNS resolves to the servers of the PaaS provider, and then from there they could look up the code deployed to the application, the Procfile, etc.

This would still require placing trust in a centralized entity though, and allow for administrators to manipulate or dump db info without the users knowing.

Re: Ask HN: How would you implement a verifiable open-source web application?

#23

Post by MichaelGG »

So you saw the news, how even major dark markets are unreliable, and figure, hey, apparently anyone can get in on that action? Basically want to run a dark market, but are aware of the trust implications? I'd imagine just being open source would be a good start.

The closest to actually trusted computing is, well, trusted computing. Remote attestation allows you to verify you're executing specific bits of code. But I don't know if the tech is exposed in a useful enough way. With DRM apps, the idea is that the hardware will be able to verify it's running known code. Then you provide encrypted input to that processor, knowing the only way to decrypt is to be in the trusted code. Still many remaining issues, such as extending the trusted code to cover all access to data storage and wallets.

You might look at other aspects, such as somehow creating community signatures. Like, I dunno, if main wallets needed sign off from 10% of the user population to do major changes. But that is rife with problems.

And really, users don't seem sophisticated enough to bother with this stuff anyways. You could just paste some JavaScript "verification" code and I'd guess you'd get loyal defenders that don't know the difference. The market that just went down did multisig, right? But since it's too difficult, people just ignored the option, no?

Forgive me if my main assumption about the motive being incorrect.

Re: Ask HN: How would you implement a verifiable open-source web application?

#25

Post by icebraining »

mpnordland wrote: post #18

Essentially anti cheat software in reverse. Instead of the client proving it is unmodified to the server, the server must prove itself unmodified to the client. You may be able to get somewhere by studying how open source network games prove they aren't modified to the server if they do that sort of thing.

Which they don't; they just make it harder to pretend they aren't modified. Cheating is very much still possible, and more still if you wrote it all yourself.

Re: Ask HN: How would you implement a verifiable open-source web application?

#26

Post by lmm »

The only way you can do this is if the server is not fully under your control but partially controlled by the remote client.

We've been here before: this is Trusted Computing. You need a Trusted Platform Module on your servers (thankfully you're picking the hardware, so you can make that a hard requirement). Your users can inspect and sign your code with their keys, that they generate and keep on the client side (you never see them). Or more likely, they sign that they trust a particular third-party auditor. Either way, their data is uploaded encrypted with their keys and only code they have signed will ever be allowed to decrypt it.

It won't be easy. You'll have to keep old versions of your code around in case users haven't signed the new versions. The TPM-handling libraries are immature, though they get better every day. But it's possible, particularly since you only need to make it work with one particular model of TPM.

Good luck!

Re: Ask HN: How would you implement a verifiable open-source web application?

#27

Post by mangeletti »

I thought of doing this with the last web app I was running, but I decided not to, and here's why:

1) Anyone, not just nice people, can view source code on GitHub

2) Source code can be used to find vulnerabilities (which is of course one of the great values of using open source code - vulnerabilities are usually spotted more quickly by a larger group)

3) A single vulnerability that allows access to private data OR can lead to corruption of loss of data could put your company out of business

Re: Ask HN: How would you implement a verifiable open-source web application?

#28

Post by MichaelGG »

rainmaking wrote: post #2

This is a noble goal. I would like to do this, too. It appears to me, however, to be theoretically impossible to achieve. The code is running on your hardware; there is simply at the moment no known way to give any kind of assurance about remotely running code. What would work, of course, would be to implement the entire app as a JavaScript application that only asks the backend for information when necessary. The bl…

Stallman is just recommending a way to have scripts self identify as free software. There's nothing that'll help there.

Implementing as an API doesn't help much, and in fact might just make it easier to fake. This is because you have a reduced surface area that you need to check and modify.

It's theoretically impossible if you assume full control of hardware. But most people are not capable of controlling hardware, so secure enclaves and remote attestation are likely to be a legitimate win if feasible.

Re: Ask HN: How would you implement a verifiable open-source web application?

#29

Post by arethuza »

LukeShu wrote: post #15

As rainmaking said, I don't believe that there is a way you can fingerprint the running code in a non-spoofable way. Whatever protections you put in the design could be bypassed by having a proxy layer dispatch two requests for each request received: one to the actual application, and one to evil_application. I believe that the best route to take that is most in-line with your goals would be to design it such that th…

"Don't trust the server with anything other than availability."

You probably shouldn't even be trusting any one server even with that!

Re: Ask HN: How would you implement a verifiable open-source web application?

#30

Post by rainmaking »

MichaelGG wrote: post #28
rainmaking wrote: post #2

This is a noble goal. I would like to do this, too. It appears to me, however, to be theoretically impossible to achieve. The code is running on your hardware; there is simply at the moment no known way to give any kind of assurance about remotely running code. What would work, of course, would be to implement the entire app as a JavaScript application that only asks the backend for information when necessary. The bl…

Stallman is just recommending a way to have scripts self identify as free software. There's nothing that'll help there. Implementing as an API doesn't help much, and in fact might just make it easier to fake. This is because you have a reduced surface area that you need to check and modify. It's theoretically impossible if you assume full control of hardware. But most people are not capable of controlling hardware, s…

The first statement is untrue: Stallman is also advocating measures to replace obfuscated JavaScript web apps with free versions:

"Browser users also need a convenient facility to specify JavaScript code to use instead of the JavaScript in a certain page. (The specified code might be total replacement, or a modified version of the free JavaScript program in that page.) Greasemonkey comes close to being able to do this, but not quite, since it doesn't guarantee to modify the JavaScript code in a page before that program starts to execute."

As for the second claim, actually implementing as an API does indeed help, because most of the code is then running in the browser and can be audited.

As for the third, the are no known ways to implement secure enclaves and remote attestation, that is what the questioner is asking. If you know of any, do share them.

Post reply on HN