Reddit DMs will not reach their destination if they contain certain text

Re:Reddit DMs will not reach their destination if they conta... by aserafini on Sunday June 10, 2018 @07:35AM (#17277641)

But how do you know that the build you verified yourself is the one that is running on their server? It would be amazing to solve this problem - are there any solutions?

[ Parent | on HN ]

Re:Reddit DMs will not reach their destination if they conta... by megous on Sunday June 10, 2018 @07:44AM (#17277658)

End-to-end yousually means client to client. So all you need to verify is client code.

[ Parent | on HN ]

Re:Reddit DMs will not reach their destination if they conta... by Boulth on Sunday June 10, 2018 @08:30AM (#17277805)

Intel SGX, if you trust Intel. But the amount of code that runs on SGX is limited so usually you'd run only critical parts there.

A practical example: https://signal.org/blog/private-contact-discovery/

[ Parent | on HN ]

Re:Reddit DMs will not reach their destination if they conta... by spinsser on Monday June 11, 2018 @07:30AM (#17283396)

Wow! That is an interesting issue.

I was thinking of having a third-party trusted services that compares the hash of the deployed application to the one they independently compiled themselves.

But the complexity is nontrivial and there is enough variations between the output of the same source code across different build environments that would make hashes useless.

Another possibility is having trusted compilers that would send link the source code to the build in a trusted repository.

[ Parent | on HN ]