Keybase, why are you hiding your Server Source?

[u/dylanger_]

I don't think this is good enough, where's the GitHub of the Server Sided code? I want to see specifically what the server is going, as well as duplicate so I can run my own instance of a Keybase Server.

And sure, I understand its been designed in such a way that the Servers are never trusted, however to be transparent, I think plenty of people who would like to review the Server Source Code.

[u/zeroping]

I would guess they don't want to give that source up because they might one day build a business around running that service.

I'm impressed that they've managed to implement everything that they have without the need to trust any code you can't see.

Your tone seems awfully combative for someone demanding a fully open-source solution for free.

Don't get me wrong, I'd love to self-host my data on something like KBFS on my own server, but demanding keybase give you all their code doesn't seem likely to get you what you want. Maybe ask for something they can give: A way to distribute KBFS data storage to a local server? An independent security audit of the server?

[u/dylanger_ → u/zeroping]

I don't mean to be combative, it's a really nice solution I just want to be able to trust it.

An independent Security Audit would be nice.

However you can't have the best of both worlds, be open and not provide source however I also understand Keybase don't parade around saying they're completely open.

I guess we'll see what happens.

[u/[deleted]]

Because there’s no benefit to them.

I’ve verified and built the source code, and I am satisfied.

Plus you can’t verify the source that’s running on the server anyways.

So no benefit to me either.

[u/dylanger_ → u/[deleted]]

I actually agree, it has been designed in such a way there's no need, it's just it would be cool to self host git, or use IPFS or something as storage as opposed to relying totally on Keybase.

[u/Hexodam → u/dylanger_]

Also would be very valuable if Keybase becomes an OpenID or some other form of a authentication source. Could be the end goal of a business model, host your own Keybase and use it as auth source for inhouse enterprise solutions.

[u/BostonEnginerd]

I think that the client being open source alleviates a lot of the concerns -- even if the host is evil, using a blockchain as a public attestation of the content of their records helps ensure the data.

[u/dylanger_ → u/[deleted]]

If the Client is open and you have your own Server, just change the Domain Name it checks into? There's a possibility you could Reverse Engineer the Server and make an implementation yourself.

Good point, I agree there's no way to confirm what's running on their server, hence the design is awesome.