3 ms·
Fair enough. I guess if the testing framework of the language used would take into account the hash of the current file and imported sources and generate a sig
by jiehong 2y ago
Fair enough.
I guess if the testing framework of the language used would take into account the hash of the current file and imported sources and generate a signature based on that, it could detect on which content it ran, and certify this, somehow.
But I guess it's your DRM idea: the testing lib should not be tampered with in the first place.
- viraptor 2y agoThat's an area of TOCTOU issues. You can either hash the file and then replace it before running, or replace the code which was supposed to do the hashing with a constant value you want, or just run in a VM, freeze it, and replace the hash in memory at the time you want. Unless you perfectly control everything: drive, system, application - you can't validate anything. That is unless you want to run in a signed trusted computing enclave, but those have at least one security failure a year in practice.