Lets say we have a decentralized open source p2p chat client meant for secure communication. The main attack vector seems to be the (centralized) update mechanism. What methods and/or techniques can be used to minimize attacks during the update process. In the end a malicious developer can always introduce malicious code, so the best we can do is minimize those chances.
Some issues I have been thinking about just to get the ball rolling (but don't feel forced to answer those or limit yourself to those):
- Should auto updates be used? And should they be applied instantly or is it worth it to wait a fixed amount of time allowing it to be pulled back in the case of a hack (coming at the cost of security bugs being out in the open for x days)?
- Is a simple https connection (with pinned certificate?) be enough to prevent MITM attacks on the download file or should additional things be checked like a checksum downloaded from a different server maybe?
- Can any steps be taken against for example the government (the only party that can legally do so) seizing the server and uploading a new version? (I was thinking along the lines of some kind of system where the file needs to be hosted in different jurisdictions or something)
- Are there maybe ways to require at least
mparties (developers) to sign the new version?