HelloZeroNet / HelloZeroNet/ZeroNet
content.json: File permissions / Rate limiting
- 主要语言
- JavaScript
- 星标
- 18.8k
- 派生
- 2.3k
- PR 合并指标
- 30 天内没有已合并 PR
描述
### Suppose:
1. User can modify their own `data.json`
2. `data.json` contains list of messages (e.g. forum posts)
3. User can add as many posts as they want since they don't have any restrictions
4. ???
5. FLOOD or MODIFYING POSTS AFTERWARDS!11
## Possible solutions:
### Storing history of file modifications with timestamp
#### Problems:
1. Need to verify timestamp somehow
2. Need to implement history/blockchain
3. 51% attack
### ~File per post + Rate limiting + File permissions:~
1. Allow to add one file per `content.json` update
2. Rate limit modification of `content.json` (check via `modified` key)
3. One file contains one post
4. User can only create files, not modify
#### Problems:
~1. Many files~
1. We can't rely on `modified` timestamp
### ~Smarter ways to check modifications of JSON data:~
1. Ability to restrict addition of one item to `data.json` list per `data.json` update via `content.json` rules
2. Ability to restrict items modification
3. Rate limit modification of `data.json` or `content.json`
#### Problems:
1. (Possible) DoS attack via big JSON files (each node should check modification of files)
2. If all nodes is offline, you can create as many posts as you want
### ~Maybe even ~JS~ CoffeeScript/Python scripts to check files modification~
#### Problems:
1. Kinda dangerous (sandbox's required)
贡献指南
这个仓库没有索引到贡献指南
调研方向
首先阅读 issue 中针对 content.json 和 data.json 提出的更新规则,包括每篇文章一个文件和速率限制这两种替代方案。确定可以明确规定哪些滥用案例和信任假设,然后记录已决定的方案及其验证标准;目前,该 issue 尚未指出实现文件或测试。
由索引模型根据 Issue 内容生成。
评估
- 领域
- security
- Issue 类型
- 功能
- 难度
- 5/5
- 预计耗时
- 一周以上
- 活跃度
- 停滞
- 描述清晰度
- 需要澄清
- 新手友好度
- 15/100