3

I'll explain my case as an example, but I think the problem applies to other web projects as well:

I have developed a Telegram bot in Python and made its source public. Then, I have deployed the bot on Heroku, where it is running now. The question is, how can I assure users that the bot runs on the shared code and not on a modified version?

I'm asking for web applications in general, but if there are specific tools or methods for Python or Heroku, I'll be happy to learn about them to use in this project.

EDIT: Judging by the comments and answers, I think the task is not possible as long as the server's contents cannot be reached by the users. I do not know if Heroku allows access to the app's files, but some tools for other kinds of projects exist. For example, a webpage repository on Github can be configured to be hosted in github.io, and the source on Github is guaranteed to be the same as the hosted site's source.

Please let me know if you know of a tool or method that applies to my case.

8
  • 3
    If you're asking "how can I prevent other people from modifying my publicly-available source code and running their own version of my bot," the answer is "you can't." – Robert Harvey Jan 29 at 18:21
  • 3
    @RobertHarvey: I understand the question as "I am publishing my source code and I am publishing a web API, how can I prove that the web API is running the published source?" My first reaction to that was "you can't", but I will modify that to "you maybe can with some highly sophisticated cryptography, so the easier solution is to make sure you are trustworthy enough so that you don't have to prove it and they believe you". – Jörg W Mittag Jan 29 at 18:25
  • 1
    @JörgWMittag Yes, this was the question I was trying to ask :) – cildiracagim Jan 29 at 18:29
  • 1
    @cildiracagim I think you may want the term "assure" rather than "ensure." – 8bittree Jan 29 at 20:03
  • 1
    @8bittree You are right, I've corrected the question. – cildiracagim Jan 29 at 20:05
2

You are already doing the most effective thing you can do by making the source code available. Anyone can download the app and run it on their own server and verify that it behaves identically.

Of course, if your bot's behavior depends on something in addition to the source, like some form of data, you'd need to make that available too.

Because a skeptic can verify your claim by running their own instance, most people will be happy to accept your assurance without actually carrying out this procedure. They will reason that you wouldn't have made the assurance and offered the tools to verify it if you thought there was any chance you'd be shown to be misleading them.

0

Post an article (or, better, guide in the source repo) which explains in detail how to build the code and then also deploy it in a way that produces effects similar to the running instance.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.