| 1 | | There's a little-used "control port" in the tahoe client, accessible |
| 2 | | through Foolscap by someone who can read |
| 3 | | {{{NODEDIR/private/control.furl}}} (which in practice means only the |
| 4 | | node admin). The original idea was to provide a Foolscap-based frontend |
| 5 | | with more features (or at least more security) than the HTTP-based |
| 6 | | frontend. But that never took off, and at this point, there are only two |
| 7 | | consumers: |
| | 1 | There's a little-used "control port" in the tahoe client, accessible through Foolscap by someone who can read {{{NODEDIR/private/control.furl}}} (which in practice means only the node admin). The original idea was to provide a Foolscap-based frontend with more features (or at least more security) than the HTTP-based frontend. But that never took off, and at this point, there are only two consumers: |
| 21 | | David-Sarah argues that it provides excess authority, specifically due |
| 22 | | to the fact that the upload/download methods accept local filenames |
| 23 | | (like {{{remote_upload_from_file_to_uri()}}} which accepts a local disk |
| 24 | | filename and uploads it to the grid, returning the filecap, which could |
| 25 | | be used to upload e.g. {{{~/.tahoe/private/aliases.txt}}}. This makes it |
| 26 | | unsafe to share {{{control.furl}}} with anyone who is not supposed to |
| 27 | | get control of the user account running the node. |
| | 15 | Daira argues that it provides excess authority, specifically due to the fact that the upload/download methods accept local filenames |
| | 16 | (like {{{remote_upload_from_file_to_uri()}}} which accepts a local disk filename and uploads it to the grid, returning the filecap, which could be used to upload e.g. {{{~/.tahoe/private/aliases}}}. This makes it |
| | 17 | unsafe to share {{{control.furl}}} with anyone who is not supposed to get control of the user account running the node. |
| 29 | | David-Sarah would like to remove it for 1.10. To do that, we'd need to |
| 30 | | either give up the automated performance and memory-footprint tests, or |
| 31 | | find a way to rewrite them (which would probably mean adding new |
| 32 | | authorities into the HTTP-based webapi, at least for get_memory_usage() |
| 33 | | and measure_peer_response_time()). |
| | 19 | Daira would like to remove it. To do that, we'd need to either give up the automated performance and memory-footprint tests, or find a way to rewrite them (which would probably mean adding new authorities into the HTTP-based webapi, at least for get_memory_usage() and measure_peer_response_time()). |
