News for hackers. Stuff that matters.

Ask HN: How to Security Audit for Noobs?

Hello, I started working on a side project during my free time, and I was thinking of converting it into a side hustle. The side project involves ensuring data-integrity and ownership of a file by storing metadata about it in blockchain (the actual file isn't stored). I was thinking of letting others use it, but what if it's not secure enough? What if people use it and something happens, would I be in hot water?

Once I develop the project enough, I do plan to make it open source, and only after that I would launch. At least that's the plan. I was wondering how to do good enough security audits on your own when the software is finally built. As I am merely a sophomore in college, I can't afford professionals for the same.

What do you guys suggest?

( 5 comments | on HN )
Re:Ask HN: How to Security Audit for Noobs? by dontbenebby on Saturday June 25, 2022 @01:48PM (#31877214)
Use an existing framework, focus on the basics. And don't use blockchain.
Re:Ask HN: How to Security Audit for Noobs? by riksucks on Saturday June 25, 2022 @02:14PM (#31877436)
Interesting, why not blockchain, thought of it because suppose the website shuts down, people can still verify the files.
Re:Ask HN: How to Security Audit for Noobs? by wrycoder on Saturday June 25, 2022 @02:54PM (#31877724)
Use non-overwriting backup, with very long retention cycles for any live data and configuration.
Re:Ask HN: How to Security Audit for Noobs? by dontbenebby on Saturday June 25, 2022 @05:46PM (#31878985)
>why not blockchain

Why blockchain? Many things involve integrity checks other than blockchain.

Are you not educated on the alternatives, and thus only suggestion what you know?

Re:Ask HN: How to Security Audit for Noobs? by riksucks on Saturday June 25, 2022 @06:19PM (#31879210)
Again, blockchain seemed like a good solution because I am trying to make the whole verification independent of my platform. I don't want the data to be gone if my site goes down. Here by blockchain, I mean public blockchains