bitshares / bitshares-ui

Fully featured Graphical User Interface / Reference Wallet for the BitShares Blockchain
https://wallet.bitshares.org
MIT License
518 stars 569 forks source link

Faucet configuration checks #1773

Open grctest opened 6 years ago

grctest commented 6 years ago

Is your feature request related to a problem? Please describe. When connecting to a private testnet, the client will attempt to use the default configured public/prod faucet without warning. The user may think that they're connected to their private testnet, but they're attempting to create user accounts on the public testnet.

When you configure an alternative faucet, no checks are performed against the configured faucet, errors which occur during registration could potentially have been detected during faucet configuration (eg ping/port checks, available balance, chain id comparison between faucet and connected nodes).

No details are provided about the configured faucet, such as who the registrar will be, how much referral fee % do they take, their remaining faucet balance.

Faucet repos & the private testnet guides are outdated. I attempted to deploy two seperate faucets using docker - bitshares/faucet and GrapheneLab/tapin, without luck. I failed to get 'faucet' working due to mysql unix sockets not being created (mysql not running?) where as tapin got to a fully built state but any user registrations would just hang without any error/debug messages appearing in the UI (nor tapin terminal).

Describe the solution you'd like Perform checks against configured faucet, accounting for chain id of connected network.

Display info about configured faucet, if possible.

Provide more debug messages during stalled user registration scenario.

Describe alternatives you've considered Rather than use a private testnet, just use the public testnet. Obviously inadvisable for security research..

Continue trying to configure bitshares/facuet - it's the repo referred to in the bitshares docs, so it'll probably work once past the glitch.

Debug tapin, investigating why the user registration process hangs without any warnings.

Additional context We aught to ensure that security researchers are able to quickly and easily produce their own private bitshares testnet, so as to reduce the risk of accidental public disclosure of their security research.

sschiessl-bcp commented 6 years ago

Would you be able to update the documentation since you've gone through the process?

As of right now there is no out of the box deployment for faucet. Tapin should work just fine, maybe you had a non responding node configured?

The reference faucet is the business version of Tapin. Please be aware that faucets are for profit and it is thus understandable that open source code is scarce.

grctest commented 5 years ago

Would you be able to update the documentation since you've gone through the process?

Sorry, I abandoned efforts due to related private testnet issues (white screen of death for one), If HTD pays out I might check it out again. I forwarded the request to update this documentation to the BTS docs team several months ago.

As of right now there is no out of the box deployment for faucet. Tapin should work just fine, maybe you had a non responding node configured?

Perhaps, it would hang on attempted registration without producing any interesting/workable debug warnings.

The reference faucet is the business version of Tapin. Please be aware that faucets are for profit and it is thus understandable that open source code is scarce.

I can understand why the source/docs aren't perfect due to fears of losing business, however this blocked my private testnet security research outright, if others are experiencing the same blockage then they may risk performing security research on the public testnet (risky & a breach of HTD TOS). We should worry about BTS' business, not an external business though, BTS first 👌

sschiessl-bcp commented 5 years ago

We should worry about BTS' business

That is true, possibly @xeroc could offer free faucets through BitShares Europe for private testnets?