miguelfreitas / twister-core

twister core / daemon
MIT License
1.42k stars 251 forks source link

how to solve the spam and DoS using DHT store? #311

Open bitcard opened 9 years ago

bitcard commented 9 years ago

It seems that twister using DHT store to save bio and avatar, one node can put many items to the DHT network launching a spam attach. how to solved it? thanks.

miguelfreitas commented 9 years ago

twister ddos protection is made of several enforced limits, which include total number of posts, max post size, max size of DHT entries etc. DHT have further restrictions on items persistence (unknown items are only kept for a limited time) but your are right that one can create multiple accounts and store multiple bio/avatar.

i don't think we can (or should) limit the number of accounts per "real person" but maybe account creation could be turned into something even more resource expensive to limit this kind of attack.

bitcard commented 9 years ago

thanks for your reply. the limit posts is well design. every node should limit store items and size on DHT network , also can be set expire time except bio and other must items, about accounts limitation, how about using altcoin inside twister, every account must consume amount of coins?

iShift commented 9 years ago

every account must consume amount of coins

This is very bad for new users...

bitcard commented 9 years ago

@iShift just registration, consume coins, or mining account like bitcoin. for security and stability, it is necessary.

miguelfreitas commented 9 years ago

a little bit of mining is already required per user. but it should be more costly and adjustable.

bitcard commented 9 years ago

that's a good news. freedom is not free.