CPS-???? | On chain dApp and script audits

[matiwinnetou]

(rendered version)

[rphair]

@matiwinnetou - I sanitised the title from the / character since this has a way of throwing off scripts (and these documents are automatically formatted into other documents)

[rphair]

Thanks for posting this @matiwinnetou - marked officially as in Draft stage according to the document title & the rudimentary stage of development. When ready for review it can be marked as such.

[matiwinnetou]

@rphair I improved this PR and from my point of view it is ready for a proper review, let me know if there is something I am still missing for it to be accepted for a proper review, e.g. part of process?

[rphair]

thanks @matiwinnetou - it seems like a good start for collective review, so the current PR status should be fine...

[RSoulatIOHK]

I’d like to discuss your open questions:

1. I don’t think you can but people or DApp stores could always maintain a list of trusted auditors and not consider valid any “certificate” issued by others
2. Couldn’t the audit report refer to the different script hashes that have been audited and certified? We could even hash those hashes to link the certificate to a version of the DApp and not to each script individually.
3. I would expect that you don’t. I would expect new releases to require a new audit. It could be a lighter audit that only addresses the changes but it would be a new certificate issued.

[matiwinnetou]

@RSoulatIOHK

I’d like to discuss your open questions:

I don’t think you can but people or DApp stores could always maintain a list of trusted auditors and not consider valid any “certificate” issued by others

I like that it is a simple and alternative is that we need GPG or Keybase on Cardano. @rcmorano that now works for CF actually wanted to build it among a few other ideas he had :)

Couldn’t the audit report refer to the different script hashes that have been audited and certified? We could even hash those hashes to link the certificate to a version of the DApp and not to each script individually.

Sounds like an idea. We have not explored that yet.

I would expect that you don’t. I would expect new releases to require a new audit. It could be a lighter audit that only addresses the changes but it would be a new certificate issued.

This is what I thought but obviously reality is that dApp teams will want to save costs and shave you report for V1 which they claim is also valid for V2. This is one of the reasons for this CPS, we need some on chain dApp certification CIP.

[RSoulatIOHK]

@matiwinnetou

This is what I thought but obviously reality is that dApp teams will want to save costs and shave you report for V1 which they claim is also valid for V2. This is one of the reasons for this CPS, we need some on chain dApp certification CIP.

I mean, yes they will want to do that but I'm not sure we should accept it.
Maybe we could try to link to an history of certification for example through metadata and use old version of a dApp and its links to certificates to show that this dApp has an history of certification and thus could be trusted even without a new certificate but I would not want to trust the developers to say that their update don't have to be recertified. As an auditor, I don't think I would want my audit and certificate to be reused without me auditing the changes.

And I agree we need a CIP on certification.

[KtorZ]

As discussed in today's editors meeting, the problem stated in this CPS is the light of open questions raised by CIP-0052. I would suggest @simonjohnthompson to also join this conversation and perhaps, reach out to the auditors involved in the writing of CIP-0052. There's perhaps already something being cooked behind the scene in that regard.

[rphair]

... particularly @simonjohnthompson we mentioned that in the process of finishing (?) the updates begun in #406 that any polling of the current list of auditors could also include querying them about how they feel about this PR.

[RSoulatIOHK]

There is a working group about certification where some auditors are present. I can add discussing both #406 and our current point to next week's agenda.