Re: [boinc_dev] [boinc_projects] Web RPC access control

2016-11-14 Thread David Anderson
I agree with Christian. If we have reasonably effective means to recognize and remove spam accounts/profiles/teams etc., that's good enough. On 11/14/2016 1:10 AM, Christian Beer wrote: I don't think account creation is the right place to fix it. Especially since it will break older Clients.

Re: [boinc_dev] [boinc_projects] Web RPC access control

2016-11-14 Thread TJM
Hello, I've been dealing with huge amounts of spam accounts for the past few months, averaging at 500k or more registration attempts weekly. My project was hit by some kind of large botnet. I had to modify lots of things but currently it looks like I'm winning the battle. Here's what I did +

Re: [boinc_dev] [boinc_projects] Web RPC access control

2016-11-14 Thread Christian Beer
On 14.11.2016 10:49, Jord van der Elst wrote: > 3. On the user account, completely visible to all, logged in or not. > Example in the field: > https://setiathome.berkeley.edu/show_user.php?userid=20272 > > This account and its URL can be read by logged in and not logged in > users. So one can link

Re: [boinc_dev] [boinc_projects] Web RPC access control

2016-11-14 Thread Jord van der Elst
3. On the user account, completely visible to all, logged in or not. Example in the field: https://setiathome.berkeley.edu/show_user.php?userid=20272 This account and its URL can be read by logged in and not logged in users. So one can link to this account to get people or things to follow the

Re: [boinc_dev] [boinc_projects] Web RPC access control

2016-11-14 Thread CM
Hey, I like the idea of access control, but not solely for 'known AMs' because the Gridcoin community plans on creating multiple AMs in the future (pools=AMs). In the 'spammer account attack' email thread I suggested a personal RPC/API access code that an user could generate from their user

Re: [boinc_dev] [boinc_projects] Web RPC access control

2016-11-14 Thread Christian Beer
On 11.11.2016 22:46, David Anderson wrote: > The create-account RPC is used by > - account managers (BAM!, etc.) > - the BOINC client > > If it were just account managers we could add some kind of access control > (i.e. accept RPCs only from known AMs). > But this would break the client. > > What