search

mymonero / mymonero-utils

A collection of npm packages providing the core functionality to the web, desktop, and android apps
13 stars 19 forks source link

Suggestion- remove dangerous defaulted api.mymonero.com values from mymonero-utils #147

Open CryptoGrampy opened 1 year ago

CryptoGrampy commented 1 year ago

I'll preface this issue with, I know this is MyMonero's library and obviously it makes sense that these defaults are here.

There are a number of references to api.mymonero.com scattered throughout the mymonero-utils codebase as fallback default values for important api requests. I find these defaults to be highly dangerous for anyone building open source tools that use these libraries, in that a simple mistake, or a missed setting of a variable will result in the unintentional doxxing of private wallet data to MyMonero.

I recommend either setting these default values to localhost, adding in appropriate error handling in the event the values aren't set, and/or removing the references entirely as they are bad for privacy, not very helpful for the ecosystem, and they don't encourage anyone using or contributing back to these libraries. MyMonero should be able to set these values from their Apps.

https://github.com/mymonero/mymonero-utils/blob/7cf0805af1c3c28723fee29b1f135155d8ba72d5/packages/mymonero-wallet-manager/src/WalletManager.js#L8

devinpearson commented 1 year ago

Hey @CryptoGrampy thanks for taking the time to bring this up.

I’m happy to work with you to change it and work on defaulting it to Localhost.

if you are willing to put through a PR for the changes I’ll get our team to review them.