4 ms·
To put context on that - it's still TLS, the cookie is just a password. The problem is that it's one password for the node network, and you either have it, or
by lostcolony 6y ago
To put context on that - it's still TLS, the cookie is just a password.
The problem is that it's one password for the node network, and you either have it, or you don't. So there's no real administrative control over access; it's shared password.
- qbasic_forever 6y agoAnd a browser can be tricked into sending the cookie if you accidentally misconfigure the server. You will have no indication or warning of this happening, from either the client or server side, if you get it wrong.
- lostcolony 6y ago>> if you accidentally misconfigure the server Sure, but I mean...
- gallexme 6y agoIf u use live book to print the erlangs distribution cookie, u still would need to steal the inter nodes certificate and be on the server network to do any shenanigans But how would u get into livenotebook in first place if u shouldn't have access to the container it and the connected nodes run on? I mean u can easily destroy a production system with couple erlang commands