Warn instance admins wishing to install public video or file-sharing apps

[zamentur]

The problem

Video or file-sharing apps like lufi, jirafeau or jitsi are installed publicly by default (visitors mode). However, this kind of setup could easily be used for some criminal activities (phishing, pedo porn, etc.).

https://github.com/YunoHost-Apps/jitsi_ynh/blob/master/manifest.toml#L39

Possible solutions

• [x] List apps which could be concerned
• [ ] Details threat models
• [ ] Install in private mode by default (note: that some app could not really useful in private mode cause the share link is protected too...)
• [ ] Warn admins instance when configuring the app in public mode (install, permission and/or diagnosis)
• [ ] Add an anti-feature dedicated message ?
• [ ] Create documentation page to help instance admins facing this kind of situation
• [ ] Disable diagnosis warning if server is not exposed on the web ?

[zamentur]

List of apps with a high risk (no account needed)

In bold, apps where abuse has already been reported to some instance admin.

• image sharing (could be used to share pedoporn content)
  • [ ] lutim
• file sharing (could be used as phishing way to host phishing webpage or to share pedoporn content)
  • [ ] lufi
  • [ ] jirafeau
  • [ ] send
  • [ ] transfer.sh
  • [ ] bozon (p2p)
  • [ ] filepizza (p2p)
  • [ ] microbin
• link shortener (could be used to mask dangereous links for example inside mail attack to avoid to be classified as spam)
  • [ ] lstu
  • [ ] shlink
  • [ ] shuri
  • [ ] yourls
• video conf (public video conf platform with no account could be used to coturn moderation on social platform like instagram or as pedoporn webtv)
  • [ ] jitsi
  • [ ] galene
  • [ ] Peer-calls
  • [ ] screego
  • [ ] mirotalk
• wiki (need some test to see which wiki are editable directly)
• website farm
  • [ ] wordpress ?
• chat (public chat platform with no account are used to coturn moderation on social platform like instagram)
  • [ ] chitchatter ?
  • [ ] minchat ?
• paste (just a hunch)
  • [ ] zerobin
  • [ ] privatebin
  • [ ] haste
  • [ ] microbin
• bureautique > graphisme (might be used to host pedoporn image)

List of apps with account registration but requiring moderation

TODO