Re: [9front] 4chan hacked rc-httpd

[Kurt H Maier <khm@sciops.net>]

On Thu, Mar 31, 2022 at 11:54:22PM +0000, Avalon Williams wrote:
> Another note to have with this is just to have better data security, in a modified version of werc I'm using I added a number of security features (though they were all designed to run on plan9port rather than on 9front itself and I never bothered porting them or contributing them because they relied on some Linux-specific commands), including a salted password hash storage system (I used sha-256 but was planning on moving it to use argos2 via a go utility).
> 
> Leaks are always going to happen, its better to make the data harder to access after the fact as well as trying to prevent them in the first place.

You're doing the right thing, but I'd personally prefer to see werc not
have an in-house user system at all; there are better protocols to allow
folks access to the underlying directories werc serves.  Putting all
your content in a shared 9p-served filesystem, or even some kind of
dvcs, removes a huge attack surface from webshit.  

Even if you do need interactivity over http, werc can happily
operate by receiving a USER header from whatever is calling its CGI.
Short of that it really should be using hashed passwords etc, but we've
never really had enough use of the werc-auth stuff to motivate
development.

khm