Hacker News Reader

How do you prove that onions.io is running https://github.com/onionsapp/Onions-Rails-API?

Right now I'm not sure yet. This is just my MVP, and I haven't quite figured that out yet. My first thought was a SHA hash of the Server vs. the same hash of the Github code. Unfortunately I'm not quite sure if that's feasible or realistic based on how things are set up.

Any thoughts on a good method for this? It's definitely something I want done.

That's trying to solve the wrong problem. Rather than try to prove the server is trustworthy (which is impossible), make the server untrusted.

Which means finding a way to securely, reliably do the encryption on the client. Which would be a useful thing to build, since all the current ways of doing that have problems.

Don't take these suggestions the wrong way: even though the security won't be perfect for a while (or ever), these projects, which make encryption available to the mainstream are priceless.

Crypto.cat uses a browser extension, I think (disregarding all of cryptocat's woes) that is the way to go.

Reply on news.ycombinator.com