@amark. Please implement this Forum as multiple threads initiated by each user, not a single thread currently. It is just a mess. Shift this Forum to reddit, and leave gitter?
@amark how can I change the username or alias for gun.user()?
@amark. I want to implement state management on the Clent-side using gundb. I want to expose only a subset of nodes e.g. gun.get("sessionid") on Client-side. I searched a lot, but still have doubts what if client-side hacking may access full gun graph network using XSS/code-injection. What security measures should I take? Is including SEA library enough security measure?
@amark. I am implementing gundb for a production grade app.
// Clear out localstorage to give Gun a fresh start on every load
localStorage.clear()
// Import Gun as a dependency
import Gun from 'gun'
/
var gun = Gun();
/
const server = require('http').createServer().listen(8080);
const gun = Gun({web: server});
var items = gun.get('items');
$('form').on('submit', function(e){
e.preventDefault();
items.set($('input').val());
$('input').val("");
})
items.map().on(function(item, id){
var li = $('#' + id).get(0) || $('<li>').attr('id', id).appendTo('ul');
if(item){
$(li).text(item);
} else {
$(li).hide();
}
})
const gun = Gun( / settings /)
and you are good to go
5 replies
Hi,
Sorry if this is a silly question, but I've been going over the docs today and I don't quite understand conceptually how the scopes work. So I think I get how user contexts work with storing data like in the following snippet:
$('#said').on('submit', function(e){
e.preventDefault();
if(!user.is){ return }
user.get('said').set($('#say').val());
$('#say').val("");
});
where the get/set/map methods apply to that users space, but if any endpoint can set data into the global space doesn't that mean that the global data set can be flooded? or is there some logic in the relay servers that I'm not understanding that prevents arbitrary data from being ingested and stored?
thoughts on how i would achieve key pair rotation for users created with user.create? reading the docs, it seems that gun users are essentially key pairs generated with SEA.pair(). does this mean i need to keep my own way of mapping usernames/alias to a pair, something like:
SEA.pair(({pair}) => {
gun.get('users').
('@some_username').get('activePublicKey').put(pair.pub)
// use `.activePublicKey` to encrypt, certify, etc.
})or will (nope that would return a "user already exists" error.) gun.user().create(oldUsername, oldPaassphrase) automatically update the keys?
1 reply
Second of all, if someone decides to dump a lot of data in your network, the only problem is that you will end-up storing it for them and nothing else. The apps you build will not care about that data and they won't download it on their clients. If you still want to restrict write access to the network based on some rules, you can have a loot at https://github.com/zrrrzzt/bullet-catcher but I haven't used it myself, I only know of it. The problem is that it goes against the Gun philosophy on long term where everybody should be able to donate their relays to the network and we all use and enjoy the network together (with the purpose of better redundancy, wider distribution around the world and at lower costs)
1 reply
@awaisnazir21 :) :wave: . Sorry, :( that makes it hard for me to answer people versus a thread. I'm more than happy for the community to use a forum, but if a question fallsback to me... it needs to be accessible for me to process. :/
I think all you have to do is
gun.get('@newAliasYouWant').set(user) (where user is logged in)XSS is sadly every app owner's responsibility to handle, tho I think I figured out a new way to fix this, and hope to be demoing a prototype soon. The Iris app does do a local-only GUN peer for indexing tho, by
local = GUN(); gun = GUN(peers);. Does this help?Congrats!! How many active users does your app currently have!?
@shecky2000 a few days! Oh noooo! THat's not good, the rule is 5min!! (partly cause sometimes it takes a day to get a reply). :clap: @dweorh_twitter was fast tho! Were you able to get it fixed? Seems like it. Remember, browsers still require :( :( bootstrapping peers to make WebRTC connections or sync. Tho we're working with browsers... (they're so slow) to maybe fix this in the future. NodeJS is able to access UDP multicast tho, so its more powerful than browsers.
@magnusfurcifer_twitter :wave: . :clap: :clap: @rococtz:matrix.org well said! Also: User space only allows the user to write to it. Public space can be written to by anyone, yes. If you're worried about that, just don't use the public space - that's fine. But its an important feature for some apps. We'll be building DDoS protection and stuff into AXE, but not there yet (the real 60 million users is DDoSing things enough, that I'm trying to scale up for, not even bots!).
@SuaYoo :clap: @dweorh_twitter tho yeah, Iris plans to enable key rotation management in the future, but even it (probably the most advanced app on this stuff so far) hasn't built it yet either. So key rotation is important, but I haven't seen it demoed yet.
@dweorh_twitter hmmm. Any JS function should be allowed to be
async, this would be very mysterious if true. Can you replicate?
UntrustedApp.com -> iframe.src = TrustedApp.com -> sandboxIframe
The whole reason I was adding a trusted iframe between the sandboxIframe is to STOP/PREVENT sandboxIframe being able to talk to UntrustedApp.com, but so far... untrusted sandbox code injected into the sandbox could still postMessage to UntrustedApp.com, I need to stop this. How?
@amark , I found something. gun.get("some").get("test") is not exactly the same as gun.get("some/test")
the first one, obey the reference / soul. the second one, it straight up doesn't give a shit about reference.
meaning using the example on the docs
gun.get('user/ambernadal/husband/name') // will result undefined 😭
gun.get('user').get('ambernadal').get('husband').get('name') // will resut Mark Nadal 💑
I haven't tested with null value, but my guess is, you can bypass the null value, by directly accessing the node using /
edit : just tested it. Yup, it straight up ignore the null value.
11 replies
both of these command will result the same thing:
gun.get('user').get('nadal').once(console.log)
gun.get('user/nadal').once(console.log)note that you can't do :
gun.get('user/nadal').put({
firstName : "Mark"
})it will throw error. because you need at least 2 get if you want to put something.
so, instead you can do :
gun.get('user').get('nadal/firstName').put("Mark")and it exactly will result the same
gun.get('user').get('first/second/third').put({"four" : "five"})