A pointed question. Under threat models where you trust (or have verified) the code being executed, this allows you to use untrusted storage (e.g. cloud databases, S3, etc.) without worrying about passive attackers being able to read your data.
Using TLS and server-side encryption, a passive attacker could install a shim to intercept data.
In practice, one usecase of Minibone would be open-source electron-style web applications where you have the necessary code transparency AND signed code versioning.
Another would be self-written applications (assuming you trust yourself).
Another might be closed-source internal tooling (assuming you trust your company) that's hosted on cloud infrastructure.
If I've overlooked anything, please do let me know.
It's only impractical if you actually require end users to understand and apply all of these technologies. It's a lot more tractable if they're abstracted away.
The fact is that developers very (very) rarely have to interface directly with TLS or the Signal protocol, yet billions of non-technical users implicitly use them in our browsers and via Signal or WhatsApp.
In my view, the challenge in the adoption of secure/private-by-design tech is the simplicity and usability of the interfaces and the capabilities these tools provide.
We need secure tools to compete on capability in order to garner mass usage. Without (significant) feature superiority there's little reason for users to make the switch. I'm actively trying to solve some of these problems at Backbone [0]; aiming to build a usable, secure experience for end users and a simple, robust end-to-end-encryption interface for developers.
Seems interesting especially for the gaming industry, but it seems like it'd be exceptionally difficult to handle the edgecases in the real world; for instance multiple pairs of eyeballs staring at the screen.
This, alongside various privacy concerns of eyeball tracking, will likely nip this technology in the bud.
A few useful resources:
If you don't want your SSH server being found by trivial port-scanning, apply port-knocking:
https://github.com/moxie0/knockknock
A pointed question. Under threat models where you trust (or have verified) the code being executed, this allows you to use untrusted storage (e.g. cloud databases, S3, etc.) without worrying about passive attackers being able to read your data.
Using TLS and server-side encryption, a passive attacker could install a shim to intercept data.
In practice, one usecase of Minibone would be open-source electron-style web applications where you have the necessary code transparency AND signed code versioning. Another would be self-written applications (assuming you trust yourself). Another might be closed-source internal tooling (assuming you trust your company) that's hosted on cloud infrastructure.
If I've overlooked anything, please do let me know.