stebalien changed the topic of #ipfs to: Heads Up: To talk, you need to register your nick! Announcements: go-ipfs 0.4.18 and js-ipfs 0.33 are out! Get them from dist.ipfs.io and npm respectively! | Also: #libp2p #ipfs-cluster #filecoin #ipfs-dev | IPFS, the InterPlanetary FileSystem: https://github.com/ipfs/ipfs | Logs: https://view.matrix.org/room/!yhqiEdqNjyPbxtUjzm:matrix.org/ | Forums: https://discuss.ipfs.io | Code of Con
mcgriff has quit [Quit: Leaving]
mauz555 has quit [Remote host closed the connection]
thomasanderson has joined #ipfs
thomasanderson has quit [Remote host closed the connection]
mauz555 has joined #ipfs
daMaestro has joined #ipfs
mauz555 has quit [Ping timeout: 258 seconds]
mauz555 has joined #ipfs
mischat has joined #ipfs
thomasanderson has joined #ipfs
thomasanderson has quit [Read error: Connection reset by peer]
thomasanderson has joined #ipfs
sammacbeth has joined #ipfs
cwahlers has joined #ipfs
cwahlers_ has quit [Ping timeout: 250 seconds]
mauz555 has quit [Ping timeout: 240 seconds]
sammacbeth has quit [Ping timeout: 258 seconds]
sammacbeth has joined #ipfs
mauz555 has joined #ipfs
mauz555 has quit [Ping timeout: 250 seconds]
thomasanderson has quit [Remote host closed the connection]
sammacbeth has quit [Ping timeout: 258 seconds]
<TimMc>
I'm not referring to any particular data format; my mention of XXE is for the purpose of analogy. Perhaps SSRF is a better example?
sammacbeth has joined #ipfs
jesse22 has joined #ipfs
<TimMc>
With a classic SSRF situation, user input causes a server to go out and fetch a URL, and the server doesn't restrict the URLs. Maybe it's going out and grabbing an image for the user's avatar, I don't know.
<TimMc>
maybe it just acts as a proxy, like for displaying HTTP images on an HTTPS site
<TimMc>
If the server is hosted on Amazon, the attacker can ask it to grab http://169.254.169.254/latest/meta and voila, they've received private configuration information. With a couple more requests, they potentially have AWS access keys.
<TimMc>
This works because the server has privileged access to LAN resources, which can be dereferenced from URLs the attacker has the ability to submit, even though the attacker cannot directly access that LAN.
<TimMc>
I guess it's a type of confused deputy attack, too.
<TimMc>
The whitepaper talks about using IPFS for all sorts of things, including filesystems, databases, and a permanent web. I would hope each of those IPFS-based systems to have its own resolver, because otherwise a server that is designed to proxy the IPFS permanent web might happily resolve files from its own IPFS filesystem, if the attacker were to glean a hash ID.
sammacbeth has quit [Ping timeout: 258 seconds]
alexgr has quit [Ping timeout: 245 seconds]
toxync01- has quit [Ping timeout: 246 seconds]
toxync01 has joined #ipfs
<TimMc>
The difference I see between this and the SSRF problem is that with SSRF, there's a way to look at a URL (or at least the resolved domain name) and tell whether it refers to a privileged resource or not.
<TimMc>
With an IPFS link, all you know is that it's a hash of... something.
<Kolonka[m]>
There are probably simple libp2p functions for just that.
ligi has joined #ipfs
aarshkshah1992 has joined #ipfs
rcsheets has joined #ipfs
<postables[m]>
For encryption of data? Unfortunately I haven't found much I had to write my own golang program to encrypt data before sending it to IPFS
<postables[m]>
TimMc: those are definitely valid concerns however I think the easiest most immediate solution is to pop your sensitive data onto a private IPFS network and write an API in front of it to control Access to add and read the data. Really I don't think putting sensitive data onto a public IPFS network is even a good idea at this point in time
Aranjedeath has joined #ipfs
<TimMc>
aschmahmann[m]: Yeah, I think that's a good description of what I'm worried about, thanks!
aarshkshah1992 has quit [Remote host closed the connection]
aarshkshah1992 has joined #ipfs
<TimMc>
The point about preferring to interact with IPFS directly from clients is well taken.
<TimMc>
That also helps make solutions involving encryption more effective. If the decryption is done by and at the client, rather than using some sort of decryption gateway (think AWS's S3 encryption that relies on EC2 host roles), there's less opportunity for a confused deputy vulnerability.
<TimMc>
postables[m]: I *think* as long as separate IPFS systems have separate resolvers, it's OK. (Even if a private system's resolver uses location-based authorization, such as source IP address).
<postables[m]>
IPFS is really modular so I don't think you'll have much difficulty putting something like that together
aiaiste has quit []
<TimMc>
I guess this makes my concern much more limited: Someone might decide to be clever and make a multi-resolver that asks each system it knows about and returns what it finds. That would be vulnerable. But maybe no one will write that. :-)
<TimMc>
(It could be tempting because we know there's no chance of collision.)
hphs^ has joined #ipfs
<TimMc>
Thanks, I think I understand this a lot better now!
mischat has quit [Ping timeout: 252 seconds]
Aranjedeath has quit [Quit: Three sheets to the wind]
vivus has quit [Remote host closed the connection]
can has quit [Quit: ZNC 1.6.6+deb1ubuntu0.1 - http://znc.in]
can has joined #ipfs
aarshkshah1992 has quit [Remote host closed the connection]
mauz555 has joined #ipfs
mauz555 has quit [Ping timeout: 272 seconds]
aarshkshah1992 has joined #ipfs
mauz555 has joined #ipfs
user_51 has quit [Ping timeout: 250 seconds]
user_51 has joined #ipfs
}ls{ has quit [Ping timeout: 272 seconds]
}ls{ has joined #ipfs
mauz555 has quit [Remote host closed the connection]
mauz555 has joined #ipfs
<postables[m]>
Well it depends what we mean when we talk about each system. is it just a bunch of IPFS nodes on the public network, or is it a bunch of different nodes on varying private IPFS networks? If it's private networks you've ultimately got the swarm key controlling whether or not they can access, so unless an adversary gets that they won't be able to resolve anything on your net
<postables[m]>
Also for the really paranoid you can even use a different multiformat hash which the rest of the network doesn't support so that can be an extra layer of obfuscation
mischat has joined #ipfs
aarshkshah1992 has quit [Remote host closed the connection]
mauz555 has quit [Ping timeout: 245 seconds]
aarshkshah1992 has joined #ipfs
cwahlers has joined #ipfs
aarshkshah1992 has quit [Remote host closed the connection]
cwahlers_ has quit [Ping timeout: 268 seconds]
aarshkshah1992 has joined #ipfs
lassulus_ has joined #ipfs
mischat has quit [Ping timeout: 268 seconds]
mauz555 has joined #ipfs
lassulus has quit [Ping timeout: 240 seconds]
lassulus_ is now known as lassulus
Belkaar_ has quit [Read error: Connection reset by peer]
}ls{ has quit [Quit: real life interrupt]
BeerHall has joined #ipfs
Belkaar has joined #ipfs
Belkaar has joined #ipfs
aarshkshah1992 has quit [Read error: Connection reset by peer]
cwahlers_ has joined #ipfs
cwahlers has quit [Ping timeout: 272 seconds]
Vaelatern has quit [Ping timeout: 240 seconds]
spinza has quit [Quit: Coyote finally caught up with me...]
<fiatjaf>
I think I'll have to create my own dynamic linking scheme. the problem is how to make gc keep my objects and delete others.
maxzor has quit [Ping timeout: 268 seconds]
mischat has joined #ipfs
}ls{ has joined #ipfs
}ls{ has quit [Changing host]
}ls{ has joined #ipfs
alexgr has joined #ipfs
random_yanek has quit [Quit: random_yanek]
_whitelogger has joined #ipfs
random_yanek has joined #ipfs
random_yanek has quit [Max SendQ exceeded]
mischat has quit [Ping timeout: 252 seconds]
random_yanek has joined #ipfs
random_yanek has quit [Max SendQ exceeded]
random_yanek has joined #ipfs
mentos1386 has joined #ipfs
Mottengrotte has quit [Quit: Mottengrotte]
mentos1386 has quit [Quit: mentos1386]
<fiatjaf>
can I make my own gc by just listing 'ipfs refs --local' and deleting those that are not saved in my own mfs?
ligi has quit [Quit: leaving]
maxzor has joined #ipfs
mischat has joined #ipfs
malaclyps has quit [Read error: Connection reset by peer]
malaclyps has joined #ipfs
Steverman has joined #ipfs
kapil____ has quit [Quit: Connection closed for inactivity]
cwahlers_ has joined #ipfs
cwahlers has quit [Ping timeout: 268 seconds]
vivus has joined #ipfs
nimaje has joined #ipfs
mischat has quit [Ping timeout: 252 seconds]
kapil____ has joined #ipfs
canthink[m] has left #ipfs ["User left"]
purisame has joined #ipfs
<TimMc>
postables[m]: In the scenario I was worrying about, since it's a confused deputy attack, the attacker doesn't need access or keys to the private network.
cwahlers has joined #ipfs
cwahlers_ has quit [Ping timeout: 258 seconds]
mauz555 has joined #ipfs
mischat has joined #ipfs
mauz555 has quit [Ping timeout: 258 seconds]
xcm has quit [Quit: WeeChat 2.2]
<kagar[m]>
pburton: this is a great article. Thanks for sharing. I didn't know about this at all. Exciting, I think!
xcm has joined #ipfs
Steverman has quit [Ping timeout: 268 seconds]
mischat has quit [Ping timeout: 252 seconds]
chiui has joined #ipfs
maxzor has quit [Remote host closed the connection]
lidel` has joined #ipfs
BeerHall has quit [Ping timeout: 250 seconds]
lidel has quit [Ping timeout: 258 seconds]
lidel` is now known as lidel
obensource has joined #ipfs
henriquev has joined #ipfs
chiui has quit [Ping timeout: 272 seconds]
mischat has joined #ipfs
mauz555 has joined #ipfs
<postables[m]>
TimMc: ah okay
Steverman has joined #ipfs
kapil____ has quit [Quit: Connection closed for inactivity]
aarshkshah1992 has joined #ipfs
thomasanderson has joined #ipfs
mischat has quit [Ping timeout: 252 seconds]
chiui has joined #ipfs
thomasanderson has quit [Ping timeout: 245 seconds]
ylp has quit [Quit: Leaving.]
jesse22 has joined #ipfs
xdecimal has joined #ipfs
cwahlers_ has joined #ipfs
cwahlers has quit [Ping timeout: 258 seconds]
xdecimal has quit [Client Quit]
jesse22 has quit [Ping timeout: 252 seconds]
<Swedneck>
is it possible to use IPFS with s3 compatible stuff? I found [this issue](https://github.com/ipfs/go-ipfs/issues/2016) but i can't decypher whether it's currently implemented and if yes, how to use it
aarshkshah1992 has quit [Remote host closed the connection]
aarshkshah1992 has joined #ipfs
mauz555 has quit [Ping timeout: 250 seconds]
aarshkshah1992 has quit [Ping timeout: 246 seconds]
<postables[m]>
There is an S3 data store backing for IPFS but it's not in the main go-ipfs repo
<Swedneck>
to be clear: what i mean isn't using s3 to store data for ipfs, i mean replacing s3 with ipfs
<aphelionz[m]>
replace in what way?
<aphelionz[m]>
it seems if you have your own IPFS server with pinning space / capabilities you kind of get that out of the box, but I'm probably lacking your specific context
<Swedneck>
being able to plug IPFS into things that otherwise use s3
<r0kk3rz>
we use s3 as a poor man's IPFS, storing objects under CID keys
<Swedneck>
so ipfs uses the same API or whatever
<postables[m]>
i mean you could use that S3 interface with stuff like Minio, which would leverage an S3-compatible backing for IPFS. That being said, writting an S3 compatible API for IPFS shouldn't be too hard
<r0kk3rz>
that would need to be ipfs + something, where the something handles the adds
<r0kk3rz>
the other issue is mostly the keys, with s3 you can choose bucket+key where as with ipfs you're stuck with CID
<Swedneck>
ye, a compatibility layer
<Swedneck>
do you have a link where i can read up about that?
<r0kk3rz>
you have used s3 before right?
<Swedneck>
i've never touched s3 before, myself, i just know loads of other people depend on it
<r0kk3rz>
ah ok
<r0kk3rz>
its not exactly complicated, its just namespace { key => value }
mischat has joined #ipfs
<aphelionz[m]>
Honestly I think the main feature of S3 is "cheap storage" followed by the lifecycle rules and static website hosting
<aphelionz[m]>
I guess IPFS could benefit from more fine-tuned lifecycle (aka garbage collection) rules
<aphelionz[m]>
but it already does static hosting
<r0kk3rz>
sure, but API compatibility helps
<r0kk3rz>
you could always run a simple express node.js server on top of MFS
<aphelionz[m]>
good call
rno_ has joined #ipfs
rno has quit [Ping timeout: 240 seconds]
jhulten has joined #ipfs
spinza has quit [Quit: Coyote finally caught up with me...]
discopatrick has quit [Quit: Connection closed for inactivity]
mischat has quit [Remote host closed the connection]
cblgh has quit [Quit: Bye for now! ^_^]
cblgh has joined #ipfs
florianH_ has quit [Quit: Connection closed for inactivity]
<postables[m]>
my dudes ipns pubsub is LIT holy smokes i didn't actually bother monitoring time improvements and its like seconds
<postables[m]>
*edit:* ~~my dudes ipns pubsub is LIT holy smokes i didn't actually bother monitoring time improvements and its like~~ -> my dudes ipns pubsub is LIT holy smokes i didn't actually bother monitoring time improvements and its like seconds
<postables[m]>
jeeez
<postables[m]>
*edit:* ~~jeeez~~ -> jeeez resolution is like 3x as quick too
Ai9zO5AP has quit [Quit: WeeChat 2.3]
ruby32 has joined #ipfs
mischat has joined #ipfs
mischat has quit [Remote host closed the connection]
<postables[m]>
Hmm I don't have much more 900-1200 is my ratio
jhulten has joined #ipfs
<Magik6k>
@swedneck: it only works for propagating updates. Basically when you call `name resolve`, you subscribe to a topic for a given ipns key, and when owner of the key does `name publish`, a message is sent to the topic
<Magik6k>
(there is no active discovery, only owner of the key ever speaks on the channel)
<Swedneck>
took 2 minutes to publish
<Swedneck>
maybe i'm just expecting too much :P
<Magik6k>
(also both sides need to run with --enable-namesys-pubsub)
<Magik6k>
Running with namesys-pubsub doesn't turn off dht, that's probably why
ruby32 has quit [Remote host closed the connection]
mischat has joined #ipfs
jhulten has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
mischat has quit [Ping timeout: 246 seconds]
Jesin has quit [Quit: Leaving]
cavariux has quit [Quit: bye, bye!]
spinza has quit [Quit: Coyote finally caught up with me...]
Jesin has joined #ipfs
cratliff has quit [Ping timeout: 250 seconds]
aarshkshah1992 has joined #ipfs
aarshkshah1992 has quit [Ping timeout: 258 seconds]
spinza has joined #ipfs
plexigras has quit [Ping timeout: 250 seconds]
<postables[m]>
Is it just a fluke that it was very quick this time? 🤔
<postables[m]>
Also if one side has namesys pub and the other doesn't, would you just default to normal IPNS record resolution
cwahlers has joined #ipfs
<postables[m]>
Although I've slightly changed how I publish IPNS in the backend with a dedicated IPFS node built from scratch that strips out all the unneeded portions except those that are needed to publish on IPNS that's probably it
cwahlers_ has quit [Ping timeout: 250 seconds]
mischat has joined #ipfs
mischat has quit [Ping timeout: 246 seconds]
sammacbeth has quit [Ping timeout: 245 seconds]
cratliff has joined #ipfs
ljhms has quit [Quit: Bye]
ygrek has joined #ipfs
xcm has quit [Remote host closed the connection]
xcm has joined #ipfs
chiui has quit [Ping timeout: 268 seconds]
Steverman has quit [Ping timeout: 258 seconds]
apiarian has quit [Quit: zoom!]
ikari` has quit [Quit: This computer has gone to sleep]
<Swedneck>
hmm, the 58GB add operation on my server seems stuck at 100%
jhulten has joined #ipfs
jhulten has quit [Remote host closed the connection]
aarshkshah1992 has joined #ipfs
cratliff has quit [Ping timeout: 250 seconds]
jhulten has joined #ipfs
thomasan_ has joined #ipfs
<postables[m]>
how long has it been stuck?
aarshkshah1992 has quit [Ping timeout: 258 seconds]