Insecure

[mkg20001]

Took me 5 min to write. Redirects all connections. Catches all dials.

Because I'm not evil I stop redirecting. But I could do that forever.

[mkg20001]

Oh and btw: To crash the server just do io.emit("ss-handshake")

[daviddias]

I was just explaining this to @lgierth yesterday. It's definitely not ideal. The initial plan (which continues to be) is to use a libp2p node for the rendezvous point that will authenticate all connections and so, instead of you announcing yourself, the node will node who is the real dialer.

[daviddias]

@mkg20001 are you still running this?

[mkg20001]

No but I might have crashed the server

[mkg20001]

To fix it only 1 change is required: Add if (typeof offer != "object") return after function forwardHandshake(offer) {

[daviddias]

@mkg20001 wanna contribute with that change and a test for it? :)

[Beanow]

So @mkg20001 if I understand correctly from your code in https://github.com/libp2p/js-libp2p-websocket-star-rendezvous the problem is that the ID needs to be proven, or you can assume another node's identity.

Wouldn't the leave endpoint need the same protection to protect against DOS attacks, as the discovery would give you all the IDs you need?

[mkg20001]

Yes. WIll fix this in a moment.