{"action":"created","issue":{"url":"https://api.github.com/repos/orbitdb/orbit-db/issues/515","repository_url":"https://api.github.com/repos/orbitdb/orbit-db","labels_url":"https://api.github.com/repos/orbitdb/orbit-db/issues/515/labels{/name}","comments_url":"https://api.github.com/repos/orbitdb/orbit-db/issues/515/comments","events_url":"https://api.github.com/repos/orbitdb/orbit-db/issues/515/events","html_url":"https://github.com/orbitdb/orbit-db/issues/515","id":385722968,"node_id":"MDU6SXNzdWUzODU3MjI5Njg=","number":515,"title":"🐃Head exchange is not signed, easy denial of service","user":{"login":"DanielVF","id":837,"node_id":"MDQ6VXNlcjgzNw==","avatar_url":"https://avatars1.githubusercontent.com/u/837?v=4","gravatar_id":"","url":"https://api.github.com/users/DanielVF","html_url":"https://github.com/DanielVF","followers_url":"https://api.github.com/users/DanielVF/followers","following_url":"https://api.github.com/users/DanielVF/following{/other_user}","gists_url":"https://api.github.com/users/DanielVF/gists{/gist_id}","starred_url":"https://api.github.com/users/DanielVF/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DanielVF/subscriptions","organizations_url":"https://api.github.com/users/DanielVF/orgs","repos_url":"https://api.github.com/users/DanielVF/repos","events_url":"https://api.github.com/users/DanielVF/events{/privacy}","received_events_url":"https://api.github.com/users/DanielVF/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-11-29T12:54:14Z","updated_at":"2018-11-30T21:18:34Z","closed_at":null,"author_association":"NONE","body":"When a new DB connects and begins to sync, the exchange of heads is purely an array of multihashs. (Correct me if I'm wrong!) This means that anyone can respond with a list of malicious multihashs, which Orbit DB will then download and attempt to process, even if the responder was not an allowed writer on the database. \r\n\r\nThis could be used to get the user to download huge files as a DOS, download illegal content, or force them into hosting your IPFS content.\r\n\r\nA variation on this attack would be to target a specific user. Given that OrbitDB databases identify themselves by peer ID, and do DB to DB syncing, it might be possible to use this to keep a specific person out of a conversation, or from accessing a specific database."},"comment":{"url":"https://api.github.com/repos/orbitdb/orbit-db/issues/comments/443342489","html_url":"https://github.com/orbitdb/orbit-db/issues/515#issuecomment-443342489","issue_url":"https://api.github.com/repos/orbitdb/orbit-db/issues/515","id":443342489,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MzM0MjQ4OQ==","user":{"login":"shamb0t","id":2730657,"node_id":"MDQ6VXNlcjI3MzA2NTc=","avatar_url":"https://avatars3.githubusercontent.com/u/2730657?v=4","gravatar_id":"","url":"https://api.github.com/users/shamb0t","html_url":"https://github.com/shamb0t","followers_url":"https://api.github.com/users/shamb0t/followers","following_url":"https://api.github.com/users/shamb0t/following{/other_user}","gists_url":"https://api.github.com/users/shamb0t/gists{/gist_id}","starred_url":"https://api.github.com/users/shamb0t/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shamb0t/subscriptions","organizations_url":"https://api.github.com/users/shamb0t/orgs","repos_url":"https://api.github.com/users/shamb0t/repos","events_url":"https://api.github.com/users/shamb0t/events{/privacy}","received_events_url":"https://api.github.com/users/shamb0t/received_events","type":"User","site_admin":false},"created_at":"2018-11-30T21:18:34Z","updated_at":"2018-11-30T21:18:34Z","author_association":"COLLABORATOR","body":"Hey @DanielVF thanks for opening an issue! The head exchange actually sends the full entries which are signed, not just a list of multihashes so I believe the situation you describe isn't a concern. You can take a closer look [here](https://github.com/orbitdb/orbit-db/blob/c2d1dec6c153b88ae8dc4879507d09606e263097/src/exchange-heads.js#L37)"}}
{"actor":{"display_login":"shamb0t"}}