Hacker News Reader

From the website it's unclear how nodes are authenticated. How can one node enforce access control over objects if its connection is proxied?

View on HN

There is no authentication system in dop. You decide if a client can subscribe to a specific object: https://github.com/DistributedObjectProtocol/web/blob/master... The same way you would do it with plain WebSockets

Also you decide what to do when a client call a specific function: https://github.com/DistributedObjectProtocol/web/blob/master...

I guess the server could sign the content.

Even still, if a node is connected to the owner through another (malicious) node, how do you prevent the malicious node from making mutation requests on behalf of the legitimate node?

I can see a number of ways that it can be accomplished that would take a good amount of work but it begs the question, is this worth the effort? You now have lots of security concerns, issues with nodes disconnecting, and nodes becoming overloaded. What benefit does this have over plain old fashioned AJAX? What problem does this solve?

Reply on news.ycombinator.com