My question might be naive but wanted to clarify this anyway.

We see software being published as open source. Take for example Signal. We can audit the software since its public. But how do we verify if the code that gets deployed in their actual servers are same as the one available in their public code repositories?

I'm particularly concerned about things like data privacy and security. Let's say the open source version of an application (e.g. Signal) collects very little of my data. But unless I can verify if the same code has been deployed on to their servers, I cannot be sure. Signal may have another private code repository which may be doing much more than what is publicly available in their repo.

Having said this, how do I make sure the software running in Signal's server is same as the one available in its public code repository?

  • 1
    Are you talking about web applications deployed to servers? Or prebuilt binaries vs source packages? – curiousdannii Aug 5 at 7:51
  • @curiousdannii - I'm talking about web applications deployed to servers. Like say, the signal chat server. How do we verify if they are actually running the software version that gets published? Can we inspect their deployment pipeline? – Dwarak Aug 5 at 14:51
  • 1
    Only if they invite you to. But unless the software is AGPL licensed you don't have any right to verify it. Also how does Firefox fit? That's what confused me. – curiousdannii Aug 6 at 0:32
  • Related: AGPL v3 licensing: How does external party determine if modifications were made? (In particular, the last three paragraphs of my answer there.) But an answer to this question should clarify futher that the AGPL is the only extant FLOSS license that would ever require such verification. – apsillers Aug 6 at 0:48
  • 1
    This question is still extremely unclear. Why do you specifically list firefox, then "clarify" that you only meant software running on remote third-party servers - which implicitly limits this to AGPL, thus exempting firefox? – MadHatter Aug 6 at 8:16
up vote 5 down vote accepted

You simply can't do this, unless they granted you login access to their production servers. In other words, you cannot verify the behavior of any server you do not control. Also, unless they built their service using AGPL-licensed code, they do not have a legal obligation to expose the actual code of their service. (See the end of this answer.)

In the case of Signal and other security-oriented applications, you shouldn't need to do this: a securely-designed client should already assume worst-case behavior by any host outside of the user's control. Since the client application encrypts messages before it sends them to the server, a compromised (or otherwise malicious) server cannot do anything worse than simply refuse to deliver messages in a timely fashion. Even in the worst case, a service that only has access to encrypted messages cannot

  • read encrypted messages sent by clients, nor
  • misdirect messages to other recipients (as those wrong recipients would not be able to decrypt the messages), nor
  • replay past messages (since a well-designed protocol will use nonces or sequence numbers to uniquely identify messages).

I suppose a malicious operator could gather metadata about who is talking to whom, but this could be done simply by looking at their own system log files, without any modification to their service's code.

Finally, if any part of the service is based on code licensed under the Affero GPL (AGPL), the server operators have a license obligation to share the source of their deployed service. Of course, there is no way to know that this is done honestly; it is not possible to definitely prove that their deployed code matches the code that they share.

  • So in this case, we could never be sure of the user privacy with any of the hosted applications? – Dwarak Aug 6 at 17:52
  • 3
    @Dwarak If you send unencrypted data to a service, you cannot know what the service does or does not do with the data (beyond its observable effects within the service). On the other hand, if you send only data that is encrypted in a way that prevents the service from ever reading it (as is done in Signal), then you have a cryptographic guarantee that service has done nothing malicious with your data, because it cannot read your data in the first place. – apsillers Aug 6 at 18:03
  • Makes sense. Thanks for your answer – Dwarak Aug 6 at 18:06
  • While not currently possible in most settings, it may (in some cases) be possible in the future due to systems like TUF: The Update Framework & Uptane, though their primary purpose is so that the software itself can verify that any update it downloads is a real update that went through the proper channels, and not a malicious 'update' from some third party. – 3D1T0R Aug 7 at 23:50

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.