I’ve been asked (not paid) to post a public explainer on how to leverage the permaweb in order to bolster the security of Zcash projects. (These techniques could apply to any project but Zcash protects your anonymity as you deploy the defenses suggested herein.) Any relevant comments, questions, or criticism are welcome.
Ground rules: DYOR, use onion routing and onion websites whenever possible, and assume that DNS is sometimes lying to you, even about this forum.
The whole point here is to harden ourselves against Web2 vulnerabilities, first and foremost Github, which is absurdly one of humanity’s most centralized dependencies. Even multiple data center redundancy isn’t robust enough in the era of agentic attacks.
Everyone here depends on the integrity of binary executables (such as APK packages for Android apps). Nobody wants to trust an app store, let alone one tied to one’s banking details. It’s therefore preferable to sideload an APK with a robustly verifiable hash, at least for those who know what they’re doing.
Some of us also depend on source code. These days, it’s not hard to imagine an attack in which an agent swarm steals, say, your Gitlab credentials and uses them to publish a malware app on your repo. You might eventually recover control but how far did the fire spread in between times? How many downstream compromises happened as a result, which might not manifest for years? While you can only do so much to ensure that your own upstream package dependencies are clean, you can, at least, ensure that your downstream consumers install the intended executable or read the source code that was actually used to compile it. Reproducible builds and signed executables (ideally, multisig) are a good starting point but they don’t protect you from Web2 mutability. We just had a major docs hack this week, so this advice applies to that as well.
Back to the permaweb (Arweave blockchain). As the name suggests, it’s just like the normal web but readonly. You pay some AR to upload a file and, usually within half an hour, it settles on chain. Oh no! Someone stole your AR wallet keys? Nevermind. They can’t alter files that have already finalized. Files larger than 12MiB (12,582,912) are not guaranteed to be served but we all know how to deal with that.
Now you can go back to yourdomain[.]com and point everyone to an immutable copy of your code, docs, and executables (ideally, your entire website) on Arweave. The links will look like this:
https[:]//arweave[.]net/abc123…
where that junk at the end is a TxID that you can view in an Arweave explorer, along with its SHA256. Any given explorer can lie to you but there are plenty of them.
Problem solved! Now you’re immune to a whole zoo of attack species. But wait: yourdomain[.]com lives on Web2, as well. So maybe a hacker can break into it and post their own fake Arweave link to your “new improved app” and distribute malware.
Enter Arweave Name Service (ArNS). It allows you to register yourdomain, but instead of yourdomain[.]com, you get yourdomain[.]ar[.]io as well as yourdomain followed by hundreds of other suffixes. Those suffixes are known as “gateways” and each of them should point to the same Arweave object. A rogue gateway could redirect visitors to a malware site, just as someone could theoretically redirect github[.]com, but users who are made aware of this hazard (by your installation docs) will know that they should form a consensus across a multitude of active gateways browsed from random IPs using random DNS providers. The gateway list is public at:
https[:]//gateways[.]ar[.]io/#/gateways
Just like any conventional website, the gateway website itself is susceptible to redirection, so it’s useful to record some suffixes for future reference and list them in your docs. But hacking the gateway website will not redirect yourdomain[.]ar[.]io. That can only be done by a Solana wallet.
It works like this: every time you want to update your website, you just make a new home page, upload it to Arweave, and point to it from yourdomain via an ArNS transaction on Solana. (You must have control of the wallet which owns yourdomain.) That control can be spread across a quorum using MPC wallet services which already exist on Solana. However, my sense from the ARIO team (who maintain ArNS, although someone else could also do it) is that they’re enthused about adding native multisig support in the future. At least you can choose which wallet to use and you’re not trapped in the Web2 walled garden.
ARIO allows you to rent or buy an ArNS domain using their Solana token of the same name (but watch for fakes). Their registration site is:
https[:]//console[.]ar[.]io/arns
but in theory you could do so directly via a smart contract interaction. Anyway, once a domain is registered, it works fine. However, the registration process itself is still a bit buggy and requires some simple workarounds…
https[:]//github[.]com/ar-io/ar-io-sdk/issues/775
https[:]//github[.]com/ar-io/ar-io-sdk/issues/774
If that scares you off then at least you know about all this and you can wait until they fix the issues, I would guess later this month. Or just lease for a year in order to minimize risk, as you can always top up later. Just don’t forget because anyone else can legitimately seize your domain the moment it expires.
For its part, AR is available from various CEX and crosschain services. Wander and arweave.app work in Tor but just use them for whatever small amounts you need for uploading.
Full disclosure: you can see my wallet history and all its ArNS domains (no affiliation apart from my own name, just speculative investments) at:
6ZPCznNwW2fqhB39cypYQsN3w9LpX3MbjqHSYqqVQvUY
on Solscan. All of them were acquired through the (buggy) registration flow. You can DM me if you want to ask about any of that but this thread is focussed on ArNS and the permaweb. (Tech support scams will be routed to AI.) For the record, I’ve also submitted bug reports and feature requests against the zodl-inc repo on Github, including about ArNS security hardening and AR swap support, but they have not replied. I have no affiliation with Zodl or ARIO but I’m a fan of both, frustrations notwithstanding.