Page 1 of 1

Standalone version verification - trusted code assurance

Posted: Mon Jul 07, 2014 9:31 am
by fedaykinofdune
Not really sure how to word the title there, but after looking around on the forums here and on Github a bit I'm coming up empty handed, though I found the IcVCS stack export features on Github very interesting and will be trying it out on my current projects. Anyways, I'm in the cryptocurrency business and currently developing a slew of apps with various cryptocoin related features, but one thing that's pretty much universal in the crypto world is paranoia, and rightfully so, with all the malware and wallet-stealer apps in the wild. The problem is, it is hard to get people to download apps they don't recognize, especially apps developed by people you don't know well, and I for one encourage this type of attitude strictly for security purposes. Even though I'm becoming well-known in certain circles of the crypto world, others won't know me and know me at all and would be extremely reluctant to run a standalone app on their PC or mobile phone unless there was a way to ensure that the exact code coming from the stack is what's going into the standalone app (minus all the runtime stuff, of course). It'd be only too easy to release my "source" alongside my standalone, with some extra-sneaky functions in the standalone, get it? Please forgive me if I haven't been thorough enough to find that there's already an existing feature that does so, but is there a way to perform such an audit?

There doesn't seem to be many LiveCoders within the cryptocoin community, but I am working to change that, the HTML5 stuff is going to pave the way for some serious action! Being able to prove my code's trustworthiness would be a huge help to me, lots of people in the crypto biz love to claim to be trustworthy, but far fewer take steps to demonstrate it!

Thanks in advance for any enlightenment!
Fedaykin aka Edric

Some of my mining pools:
888.fedaykin.us
denarius.fedaykin.us
brd.fedaykin.us

Re: Standalone version verification - trusted code assurance

Posted: Mon Jul 07, 2014 12:02 pm
by n.allan
What you could do here is place the main source code for your app in another livecode file, then do an md5 digest on the external file before "using" it...

put md5Digest url "binfile:myFunctionsAndCommands.livecode" into tDigest
if tDigest = gMyStoredDigest then start using stack "myFunctionsAndCommands.livecode"

This way, if the file was tampered with, it would not be loaded.

You could also pair this with public / private key encryption but still keep everything open source.

I am not entirely up on the whole public private key encryption thing but I do know that if the private key is kept private, then it is very very very tough to crack, and it is trusted by the open source community too.

BTW I am (slowly) mining bitcoin as we speak using 4 * 2.5 ghash USB bifiry asics. I will check out your mining utils!