Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.
Sign up[security] Don't automatically download changes to libraries #20
Comments
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
equivalentideas
commented
Sep 28, 2017
|
There's also no obvious way I can close this connection as a user. |
e-e-e
added
help wanted
high priority
labels
Sep 28, 2017
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
e-e-e
Sep 28, 2017
Member
Thanks @equivalentideas. This happens because after selecting download the entire library it keeps the connection open. For now if you close and reopen dat library after downloading everything, it will reopen in sparse mode and only download the metadata that is freshly added.
We will fix this so that after downloading everything the dat is placed into sparse mode again.
Thanks for discovering this!
|
Thanks @equivalentideas. This happens because after selecting download the entire library it keeps the connection open. For now if you close and reopen dat library after downloading everything, it will reopen in sparse mode and only download the metadata that is freshly added. |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
e-e-e
Oct 1, 2017
Member
@equivalentideas I have opened a pr here mafintosh/hyperdrive@3c17e09 which should hopefully expose an interface in hyperdrive to solve this issue.
|
@equivalentideas I have opened a pr here mafintosh/hyperdrive@3c17e09 which should hopefully expose an interface in hyperdrive to solve this issue. |
added a commit
to samiz-dat/dat-cardcat
that referenced
this issue
Oct 22, 2017
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
e-e-e
Oct 22, 2017
Member
This is fixed in this commit - samiz-dat/dat-cardcat@31551b6
Will be release with the next version of dat-library.
|
This is fixed in this commit - samiz-dat/dat-cardcat@31551b6 Will be release with the next version of dat-library. |
equivalentideas commentedSep 28, 2017
After selecting 'Download entire library' for a new library, when a new book was added to that library, it was automatically downloaded to my computer. This means the library owner can put any file they like on my computer.
That's a security problem for me, because while I trust the person who gave me the key for the library, I don't know if they're the owner and I don't know who the owner is. I can't trust this person I don't know to not use this as an attack, e.g. to send files to my computer that could put me in trouble with da law, plant evidence, etc. .