Hacker News Reader

Comment by mappu | Hacker News Reader

>I'm not really sure how I can prove that the code I'm running is the code you'll find on GH though.

I think this attestation is something Amazon (and other cloud providers) could offer in the future - they're the only ones who can really prove it.

"I, Amazon AWS, do solemnly declare that the code running on {service} is {git hash}"

View on HN

https://zeit.co/now has a way to get the source, by going to /_src on a deployment. It's turned off by default for paid accounts, but can be turned on. It also has a way to get it from the API, along with the URL of the deployment. Glitch comes to mind, too.

Only issue with that aspect is if they still allow configuration (I mean they'd sorta have to) and what if you could exploit a testing configuration to do whatever activity you want to hide? You could get the badge from AWS but still do what you wanted.

Honestly not sure there is a good solution for that.

You could always have a script which strips down things to only necessary configuration values for production and then generates a tarball that could be verified. It seems like it would be possible to get down to a subset of settings that could take on any value while still allowing you to trust the service. Of course, if the settings don't have to be secret, they could also just be baked in as well.

yeah, I guess thats how Docker does it. Automated builds tied to a github repo.

That lets you trust the image. Trusting software which is actually running somewhere seems harder.

Reply on news.ycombinator.com