A distributed, tag-based pub-sub service for modern web applications

Re:A distributed, tag-based pub-sub service for modern web a... by ShaneWilton on Monday November 16, 2015 @07:29PM (#10578364)

This looks like a great project! I'm curious about the following caveat from the readme, however:

"Data flowing through mist is NOT touched in anyway. It is not verified in any way, but it MUST NOT contain a newline character as this will break the mist protocol."

I haven't read the code yet, but my gut reaction is that this suggests it would be possible to inject commands using malicious user input. Given the caveat, this may be allowed for by your threat model, but it may be worth some effort to mitigate.

EDIT: To clarify, this may not be the case at all, in which case I'd be curious to hear why this restriction is in place.

[ Parent | on HN ]

Re:A distributed, tag-based pub-sub service for modern web a... by tylerflint on Monday November 16, 2015 @07:42PM (#10578429)

This is referring to messaging being sent through mist. Mist doesn't care what the data looks like, and won't transform it.

Currently the public-facing websocket client is not allowed to publish messages until this is mitigated, as you mentioned. Any feedback here would be appreciated.

[ Parent | on HN ]

Re:A distributed, tag-based pub-sub service for modern web a... by zrail on Monday November 16, 2015 @08:23PM (#10578596)

Netstrings are for this exact use case:

http://cr.yp.to/proto/netstrings.txt

[ Parent | on HN ]

Re:A distributed, tag-based pub-sub service for modern web a... by viraptor on Monday November 16, 2015 @11:09PM (#10579119)

Actually this proposal is quite bad compared to simple "<4 bytes size><size bytes contents>". If you use netstrings recursively like djb recommends, you will end up copying / reallocing the strings many times. Since your top-level length depends on the lower level length, you cannot send it without actually calculating the whole contents. Asn1 DER has the same issue because of the weird size encoding.

RIFF is a bit better https://en.wikipedia.org/wiki/Resource_Interchange_File_Form... with strict length,tag,contents format.

[ Parent | on HN ]

Re:A distributed, tag-based pub-sub service for modern web a... by zrail on Tuesday November 17, 2015 @06:31AM (#10580407)

Wasn't suggesting they use the recursive feature. Just a flat netstring for the data segments, sort of how the Redis and Memcached protocols work.

[ Parent | on HN ]

Re:A distributed, tag-based pub-sub service for modern web a... by krakensden on Monday November 16, 2015 @11:56PM (#10579248)

I think tnetstrings are a pretty reasonable improvement, too

https://github.com/rfk/tnetstring/

[ Parent | on HN ]

Re:A distributed, tag-based pub-sub service for modern web a... by ShaneWilton on Monday November 16, 2015 @07:45PM (#10578443)

Cool, thanks for the response! If I get a chance later, I'll look through the code and see if anything jumps out at me.

[ Parent | on HN ]