4 ms·
Very cool, but the FAQ doesn’t address the questions people will ask: open source is fine, but what guarantee do we have that the source code matches the deploy
by macintux 5y ago
Very cool, but the FAQ doesn’t address the questions people will ask: open source is fine, but what guarantee do we have that the source code matches the deployed code? Or that the deployment is done in a secure environment?
- rank0 5y agoYou have to implement the encryption logic client side. But then now the client has to verify the JavaScript they receive upon visiting the URL matches what is published in the open repository. I’m not sure what convenient method exists to do this for the client. You’d have to compare hashes and idk how that could be done in a easy and trustworthy manor.
- gigamick 5y agoThis is a problem for all OSS and it's something ive been pondering but I don't know how to satisfy this concern.
- annoyingnoob 5y agoIf its really all open source, the way you know is to roll your own.
- joemazerino 5y agoIf your threat model is the service roll your own. Otherwise, trust but verify.
- annoyingnoob 5y agoIn this case, verify how? Ask and trust the answer?
- corycal 5y ago> what guarantee do we have that the source code matches the deployed code? What is the answer to this question in general? Genuinely asking, I never considered this but it seems like a real concern for any OSS.
- macintux 5y agoI don't know that there is an answer, but I'd think the FAQ should at least mention the concern.
- gigamick 5y agoFair - I will add this.
- endisneigh 5y agoFor an app that exists solely on the client it’s easy to provide a md5 hash that can be verified. This was and still is a popular solution if you torrent to make sure you’re getting what the original seeder intended. The same philosophy applies here. For back end apps it’s inherently not possible.
- charcircuit 5y agoPlease do not use md5 in 2021. At least use something like sha256.
- endisneigh 5y agoAgreed, it was broken a while ago.
- gigamick 5y agoYeah I wondered this myself and my colleagues at the day job and myself were kinda stumped. How does any OSS prove that the repo linked is what is actually deployed?
- fsflover 5y agohttps://reproducible-builds.org/ https://reproducible-builds.org/