4 ms·
Let's say though that someone publishes a trojan module? And for a while it becomes used in a bunch of other modules or what not, how does one handle that situ
by bhouston 11y ago
Let's say though that someone publishes a trojan module? And for a while it becomes used in a bunch of other modules or what not, how does one handle that situation? In that case removal or blocking of the malicious module is warranted.
It is sort of like revoking certificates I guess.
- goodplay 11y agoThe same way you'd handle a trojan module in a statically-linked project; you remove the trojen and republish. It's a issue with linking rather than dependency satisfaction.
- kefka 11y agoFortunately, because everything is a cryptographic sum, it would be trivially easy to state "IPFS Hash Qm....... is a trojan, please sanitize this hash on all machines". I would expect things like this coming from CERT or other security researchers in the coming months/years.
- fit2rule 11y agoWhat is missing here is an understanding of IPNS, which sits on top of IPFS and allows us to rename nodes and redirect things if the circumstances warrant. https://groups.google.com/forum/#!topic/ipfs-users/fr6dlQ8we7Q https://groups.google.com/forum/#!topic/ipfs-users/fr6dlQ8we...
- diggan 11y agoSomeone publishing a trojan module can be solved in a number of way. Probably the simplest way is to just republish the module and tell people the previous one is bad. You can also provide an optional blacklist (similar to how adblocking blacklists works) where the bad hash would be if needed. With signing, you would revoke the keys used for the signing.