Re: Proper form for a public FMS outproxy?

--=-=-=
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Hi,

[email protected] writes:

> Now, my idea is this: You set up a public (onion or clearnet) frontend
> where you can make and read posts, with its back-end being FMS.
=E2=80=A6
> Frontends would be disposable and dime-a-dozen; a front-end with too
To get to this situations, you must make it very, very easy to host
them. This might be a major endeavor (but one which would benefit
Freenet a lot).
=E2=80=A6
> My idea is that each user posting would get some kind of unique name
> (e.g. truncated salted IP hash, or for Tor users a cookie they need to
> solve say 20 captchas to get - maybe you could do JS PoW or something
> like that). Then the frontend would post with its key but that
> name. It would also assign message trust slightly above zero, but no
> list trust.
>
> Do you think this would work? It's a bit ugly taking the IPs, but not
> disastrously bad. The server wouldn't need to do any IP banning of
> pathological cases. It could carry out basic spam filtering
> (e.g. Bayes), but it wouldn't have to. Captchas might be possible to
> replace with rate limits.

I=E2=80=99m thinking about this as I would an attacker to do. If I did not =
like
your forums, I would simply DoS them by posting from many different IPs.

Providing this with an ID just tied to solved captchas via cookies could
work. That would then be ephemeral identities. If combined with limited
posting rate and limited lifetime (i.e. solve one additional captcha per
week so you cannot just collect IDs and then use them all at once
without maintenance cost) would prevent using this system to DoS FMS.

> Specifically, a user that didn't like this would set list trust of the
> master identity to 0. Do you reckon this would happen?

Yes, I think this would happen, because one bad apple would spoil the
whole identity.

But if you would find a way to pre-generate IDs and then assign them to
new users (so the standard FMS spam-defense would work), then this idea
could work.

If the proxy had a main ID which gives trust-list-trust to these IDs,
then people could decide whether they want to see the new IDs.

Best wishes,
Arne
=2D-
Unpolitisch sein
hei=C3=9Ft politisch sein
ohne es zu merken

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE801qEjXQSQPNItXAE++NRSQDw+sFAl0yycgACgkQE++NRSQD
w+vGqA/9HcaiQji9PkYtvQ2d4yoEpMYDuX4MIGhIWB7/0YJHru/9xo8HoPSE5wsb
/0awV9QPcLGVnor7P8P2TRPj7jJ47VB6DfLYtdTG8jzF6xQPOhMX+Ipgru0oi+V5
sNT8MrjPWkO3m9hDK6acyRHNAkGTj687qJSdZ1PEhRDTzo+4HfBKrUXoxbxBxQ+e
gQRoQpNt0f02oNKaiodah0S77NR5/WkyJ7CMvHvpmTUFW5YEhpnS23RReG0Nwu/H
fxQ44wA8pFALtv6kJ63D4I+ozUzVWSACbKAijNzYzPr4u2OiMTNeSgLBbxILtFwu
MOR8dTfVOojFOpX1cKrdZvevusYdMOdQqc20yX3Tv97FnrMqYAE3YSMDA/uN8pf7
rkmuZCBDA9bjwrhMKIY9xAtL7f14fWqJDN70kl8ZwErUpZilkwAeksIST6Pb2cNc
BOlRsSfQVoi1BY4Nhu43OcKw6brBmB6Rj32fSigk5JVVspQ2UEjthI1NYbg2Lk0V
DSoITJoWVeO/X+VbRn8/866kfDhrY0JucxjRYjsA9V6SP1zs0lbQnBnpk1D23+Mw
LdlrIrhaR+8wXU07blM+kRbEi2unVbry6BLn4pZtqHwjxLLkGjE1zfMNZehqmLJb
SBA72Ft0QzCxowNYt/OFv3nYOUhF3MEgj3D++coCtpiTgwoxKJWIswQBAQgAHRYh
BN0ovebZh1yrzkqLHdzPDbMLwQVIBQJdMsnIAAoJENzPDbMLwQVIlqoD/1tYW2qK
t6btEN8Z7bVv0m5uYAvAFLURzYeiLh5VNRqn4WX6JZzUzCQaBUszkbAZrEZkBfsL
04GBve/k/dCLnWvVCU+mJ5UuX32bShrnk9+lu9aK2SbiFjhuHqNwN/RX7922VCjb
9Vp/uDeieBoLMe09sssJzoLlW55jg47rqylZ
=ND4t
-----END PGP SIGNATURE-----
--=-=-=--