5

Let's say I want to download a golang.

How to understand which website is official for a project without referring to a some kind of authority like Wikipedia or a search engine rank?

Is there a mechanism to find which website is official and created by authors of the project and it is part of the project?

Which one is official website: go.dev, go.com, go.io, go.trustmebro ?

Assume that all of this websites identical and have the same certificate issuer like Let's encrypt.

2
  • Something like sudo apt install golang should be okay Oct 14, 2023 at 17:44
  • @HagenvonEitzen Thanks but I'm interested in a zero-trust identification of origin, not in particular solution for a particular case.
    – Lem
    Oct 15, 2023 at 12:24

4 Answers 4

2

This problem is an interesting case of Zooko's triangle trilemma.

Zooko theorized that in any name system, you can have any two of the following, but not all three:

  1. Human-meaningful names - i.e. names like nytimes.com instead of nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion

  2. Secure - i.e. a bad actor cannot impersonate someone else

  3. Decentralized - i.e. no need for a centralized authority like a CA.

So, you could get 2 and 3, by giving up 1. In other words, instead of the project being named 'golang', it might be named '6bbe074425f1f10512f9db02d6c1d28fbe8845b65575ed151dcee953a0f969be'. And, instead of your friend saying 'golang is cool, try it out', your friend would say '6bbe074425f1f10512f9db02d6c1d28fbe8845b65575ed151dcee953a0f969be is cool, try it out'.

The reason this works is that 6bbe074425f1f10512f9db02d6c1d28fbe8845b65575ed151dcee953a0f969be is not only a name, but also a public key. The project authors sign all of their documentation using the private key that corresponds with the public key 6bbe074425f1f10512f9db02d6c1d28fbe8845b65575ed151dcee953a0f969be.

So, when you arrive at the documentation for 6bbe074425f1f10512f9db02d6c1d28fbe8845b65575ed151dcee953a0f969be, you can verify that it is in fact the true and correct documentation for 6bbe074425f1f10512f9db02d6c1d28fbe8845b65575ed151dcee953a0f969be, using the public key 6bbe074425f1f10512f9db02d6c1d28fbe8845b65575ed151dcee953a0f969be to verify the signature.

Not very user-friendly, but it meets your objective of a 'zero-trust identification of an origin'. This is how systems like bitcoin and tor hidden services are secured, without the need for any central authority.

1
  • That is what I would consider an answer to my question! Thank you!
    – Lem
    Nov 17, 2023 at 0:35
2

This is an interesting question... Well behaving projects write in their documentation the URL for their main site. This one is the official one. But bad things can happen:

  • the URL has never been written into the doc, or the doc was not updated after a site and points to an inexistent site: you have lost because the project is not well behaving

  • an attacker has chosed to rewrite the documentation to make its site the official site in the doc they host: you have lost because you have no way to identify that. That being said, that is not the most current use case, because the site cannot pretend that the modification was not willingly made, and its owner could be prosecuted for counterfeiting or identify theft.

You must be aware that having a Let's Encrypt certificate for a site only proves that the certificate was delivered to someone having administrative privileges on the domain. The true physical identity of the real owner (the guy that could be responsible in a legal action) has no reason to be known by anybody. Said differently site certificates are technical protections, not legal ones. Only personal certificates when delivered with a face to face procedure have a legal value (but disclaimer: IANAL)

5
  • The question is not really about certificate but about more general formal method to find out a single point of origin for a particular project at the internet. We could say that time of creation IS a key factor but it's not a reliable metric also.
    – Lem
    Oct 14, 2023 at 14:31
  • "Well behaving projects write in their documentation the URL for their main site." - let's assume that we don't know where documentation is located also that project is new. Let's say we know nothing about a project only that our friends told us that "golang is cool try it out".
    – Lem
    Oct 14, 2023 at 14:40
  • I cannot imagine installing anything before reading its documentation at least partially. If no doc exists at all, it will be hard to use the thing... And if it does not present the project status (early development, beta, production grade) and the reference site, I will considere the project as dangerous. It does not mean do not use that, but really use it at own risk. Said differently I would only install it on a test machine that could easily be erased after the tests and never on a production system. At this point getting it from the official site is no longer a security concern IMHO Oct 14, 2023 at 17:56
  • 1
    @SergeBallesta that creates an interesting circular reasoning. If I read about "xpto project" somewhere and want to know more, I don't have documentation on it. Where do I find documentation? On the official site, but which one is the official site?
    – ThoriumBR
    Nov 16, 2023 at 21:04
  • @ThoriumBR: I admit that I would not considere a project if I cannot find any documentation about it. So I blindly assumed that the first place where I could find it either contains some doc or links to a site containing that doc. In any other case, I shall ignore it... Nov 17, 2023 at 8:39
1

Extended Validation (EV) Certificates used to provide this. Normal certificates states that the owner of the certificate is the owner of the domain. EV certificates state that the owner of the certificate represents a specific company. This way, it is possible to check whether the website really belongs to a specific company.

However, it turns out it didn't work in practice, and EV certificates are used less and less.

1
  • Interesting. It looks like it's really hard problem and it always requires a third party "trusted-by-default" entity.
    – Lem
    Oct 17, 2023 at 18:10
1

That's a difficult problem. As opensource is open, it's easy to simply fork any codebase, host it somewhere and register a domain for it. You can have countless sites claiming to be Golang, and no way to prove who is the official one because all of them can claim they are the official one.

For some applications, there will be a large community behind it: the main website, a forum, a Discord server, a Github account. Those are easy to find and it's hard to clone an entire community. But some less active software don't have much traffic, and it's easier to clone them.

What I consider the most secure way of knowing which one is the official is to find which one is considered the official one by major Linux distributions. If Canonical believes go.dev is the official one, I would believe more than a random go.trustmebro claiming to be the official repository.

I would not trust Google ads, or Microsoft Marketplace, Wikipedia or anything like that. Google ads can be bought by anyone. Microsoft Marketplace have its problems with fake software (fake Spotify, fake Crypto software, fake Google apps). Wikipedia is open for editing, so someone could edit the page for a software and point it somewhere else at any time.

2
  • It's good to see you understood my question! Trusting unix-family os mantainers is good real-world advice, but unfortunately, it's still not a solution for a general problem.
    – Lem
    Nov 16, 2023 at 21:26
  • For the general problem you either look at the activities on the sites claiming to be official. And if nothing looks "the official," you will have to trust one, or trust someone.
    – ThoriumBR
    Nov 16, 2023 at 21:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .