Dop: Distributed Object Protocol

Re:Dop: Distributed Object Protocol by bastawhiz on Saturday December 29, 2018 @10:17AM (#18783931)

From the website it's unclear how nodes are authenticated. How can one node enforce access control over objects if its connection is proxied?

[ Parent | on HN ]

Re:Dop: Distributed Object Protocol by josemaenzo on Sunday December 30, 2018 @10:09AM (#18789483)

There is no authentication system in dop. You decide if a client can subscribe to a specific object: https://github.com/DistributedObjectProtocol/web/blob/master... The same way you would do it with plain WebSockets

Also you decide what to do when a client call a specific function: https://github.com/DistributedObjectProtocol/web/blob/master...

[ Parent | on HN ]

Re:Dop: Distributed Object Protocol by aaaaaaaaaab on Saturday December 29, 2018 @10:35AM (#18784017)

I guess the server could sign the content.

[ Parent | on HN ]

Re:Dop: Distributed Object Protocol by bastawhiz on Saturday December 29, 2018 @11:00AM (#18784152)

Even still, if a node is connected to the owner through another (malicious) node, how do you prevent the malicious node from making mutation requests on behalf of the legitimate node?

I can see a number of ways that it can be accomplished that would take a good amount of work but it begs the question, is this worth the effort? You now have lots of security concerns, issues with nodes disconnecting, and nodes becoming overloaded. What benefit does this have over plain old fashioned AJAX? What problem does this solve?

[ Parent | on HN ]