HelloZeroNet / HelloZeroNet/ZeroNet

content.json: File permissions / Rate limiting

未关闭
#1,071 15 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
JavaScript
星标
18.8k
派生
2.3k
PR 合并指标
30 天内没有已合并 PR

描述

### Suppose:
1. User can modify their own `data.json`
2. `data.json` contains list of messages (e.g. forum posts)
3. User can add as many posts as they want since they don't have any restrictions
4. ???
5. FLOOD or MODIFYING POSTS AFTERWARDS!11

## Possible solutions:
### Storing history of file modifications with timestamp
#### Problems:
1. Need to verify timestamp somehow
2. Need to implement history/blockchain
3. 51% attack

### ~File per post + Rate limiting + File permissions:~

1. Allow to add one file per `content.json` update
2. Rate limit modification of `content.json` (check via `modified` key)
3. One file contains one post
4. User can only create files, not modify

#### Problems:
~1. Many files~
1. We can't rely on `modified` timestamp

### ~Smarter ways to check modifications of JSON data:~

1. Ability to restrict addition of one item to `data.json` list per `data.json` update via `content.json` rules
2. Ability to restrict items modification
3. Rate limit modification of `data.json` or `content.json`

#### Problems:
1. (Possible) DoS attack via big JSON files (each node should check modification of files)
2. If all nodes is offline, you can create as many posts as you want

### ~Maybe even ~JS~ CoffeeScript/Python scripts to check files modification~
#### Problems:
1. Kinda dangerous (sandbox's required)

贡献指南

这个仓库没有索引到贡献指南

调研方向

首先阅读 issue 中针对 content.json 和 data.json 提出的更新规则,包括每篇文章一个文件和速率限制这两种替代方案。确定可以明确规定哪些滥用案例和信任假设,然后记录已决定的方案及其验证标准;目前,该 issue 尚未指出实现文件或测试。

由索引模型根据 Issue 内容生成。

评估

领域
security
Issue 类型
功能
难度
5/5
预计耗时
一周以上
活跃度
停滞
描述清晰度
需要澄清
新手友好度
15/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。