Hacker News Reader

Comment by pyre | Hacker News Reader

The issue with browser-based encryption, is that you would have to check the source code every time that it's served to you.

View on HN

They could release an api that let you upload with your own client (maybe they have already?)

edit: Apparently there is an API, problem solved.

Not really.

You can verify it once and generate a secure hash from it. Then the second time you could just check the hash.

It wouldn't be too difficult to write a browser extension that did it automatically, or a javascript bookmarklet for it.

But then you have to generate the hash each time the source code changes. And you also have to verify the source code each time yourself because you can't know if it's a regular update from mega (they probably update daily or weekly) or if someone compromised the source code.

You can solve it with something like this: http://perspectives-project.org/

That sounds like normal software to me. Nobody is forcing you to update unless the ABI changes. And you can start a mailing list that talks about updates if you like.

Many sites (like blockchain.info) offer a browser extension which does the checking for you every time automatically. Mega also has a browser extension which does downloading, but I'm unsure if it does checking.

Not really. If enough people audit the code at random times, then the host would not be able to get away with serving malicious code for very long.

Reply on news.ycombinator.com