1

I would like to run a web service (based on Node.js) and I'd be happy to be as transparent as possible with my users.

Ideally I'd like to give the users the possibility to verify somehow that my server is running a certain sourcecode. That is, I want the clients to be able to verify that I'm running some code posted online (for example in GitHub) that they can independently verify.

Are there hosting services (Azure, Amazon, etc) offering this kind of possibility? If not, what is the best method?

thanks a lot

IamMeeoh
  • 111
  • 1
  • 2
    sharing your source code of a website with active components might not be the best idea if you have vulnerabilities – schroeder Apr 16 '17 at 08:34
  • 1
    @schroeder Best way to fix that is by also having a bug bounty. – Nzall Apr 16 '17 at 10:48
  • @Nzall I'm not sure that that is a 'fix' – schroeder Apr 16 '17 at 11:26
  • It's ok for me to expose vulnerabilities. Basically I'm saying already "People, I'm running this code in my server, please trust me." I now want to replace "please trust me" with "please, verify it by yourself". – IamMeeoh Apr 16 '17 at 11:43
  • 1
    how about [github pages](https://pages.github.com/)? – gbr May 16 '17 at 18:09

1 Answers1

0

A possible idea for this might be a page that calculates a cryptographic hash of the code on your server, and exposing the code that calculates that hash. Then, you can have users verify that:

  1. Your hashing code does what it should;
  2. Your hashing code is the same as the one on your repository;
  3. Your hash matches the hash generated from the repository.

The other alternative is to enable read-only directory browsing on your site, probably through a page that can render any source code file on your site.

Nzall
  • 7,313
  • 6
  • 29
  • 45
  • 1
    How does it prove that it's indeed showing the right hashes and files, and is not just a big decoy and the real application is something totally different? – André Borie Apr 16 '17 at 17:23
  • @AndréBorie 1) The hashing code is publicly available in 2 places: the site and the repository, so they can be compared to be the same; 2) The user can generate their own hash from the source code in the repository and see that it matches the one from the site. – Nzall Apr 16 '17 at 20:24
  • 3
    @Nzall So what if a server admin was to put up the 'good' hash but actually has a different site running? – FMaz Apr 16 '17 at 20:49