dchub:// URL Handler Protocols?

Use this forum to flesh out your feature request before you enter it in <a href="http://dcpp.net/bugzilla/">Bugzilla</a>.

Moderator: Moderators

Locked
DJ RRebel
Posts: 3
Joined: 2005-11-08 16:41
Location: CANADA
Contact:

dchub:// URL Handler Protocols?

Post by DJ RRebel » 2005-11-08 17:36

What exactly is the protocol for linking to a hub?

I know just to connect to the hub is dchub://hub.url.com

But what is the protocol if you want to include both username and password as well?

I know it sounds a little weird, but I'd be creating links dynamically.



Taken a bit from this: http://dcpp.net/forum/viewtopic.php?t=1 ... ight=dchub

and this: http://dcpp.net/bugzilla/show_bug.cgi?id=310
www.homeofmusic.com
Your Club Music Community!

GargoyleMT
DC++ Contributor
Posts: 3212
Joined: 2003-01-07 21:46
Location: .pa.us

Post by GargoyleMT » 2005-11-08 19:48

I really don't want this to happen, I think exposing usernames and passwords only makes sense in a few situations (yours sounds like one.)

If your goal is to allow users to download files, you can consider using magnets instead. But you're probably aware of them, since you've searched out the two best references to your existing question. :)

DJ RRebel
Posts: 3
Joined: 2005-11-08 16:41
Location: CANADA
Contact:

Post by DJ RRebel » 2005-11-08 20:02

Actually, eventually I'd like to use magnets as well, but they are a completely different thing.

Basically I want to simply offer a simple way for people to connect to my hub, as anything that can help simplify the process to people unfamilliar with DC++ is a big bonus.

I'm planning registration for my hub to actually be done through my site, including random password generation. I'd love to have a dynamic button on my site where if people were already logged into the forum they could automatically jump into the hub. If they weren't logged in, then they would get the standard URL link without user/pass.

I'm not too sure about your concern though, as most people would never even use this feature and therefore no harm would come of it?
www.homeofmusic.com
Your Club Music Community!

GargoyleMT
DC++ Contributor
Posts: 3212
Joined: 2003-01-07 21:46
Location: .pa.us

Post by GargoyleMT » 2005-11-08 20:11

DJ RRebel wrote:I'm not too sure about your concern though

The passwords are in plain text, so any link with them should be protected. And for public links, they don't make any sense, since usernames on DC are unique, so the first user to follow the link would take the username, leaving others stuck a connection loop until they stopped using it.

One idea for new users is to pre-generate their favorites.xml, and send that with their activation email (or offer it for download).

Carraya
Posts: 112
Joined: 2004-09-21 11:43

Post by Carraya » 2005-11-08 20:13

My concern about this is purely security wise, and I'm sure that's what Garg was thinking as well... Otherwise I think it's a fine idea... but since I'm know to be paranoid, and think this could be exploited, then really I'm concerned about it... (otherwise it would be simple enough to add it...)

Standard disclamer here being that I don't do any development on the actual dc++ :)
<random funny comment>

DJ RRebel
Posts: 3
Joined: 2005-11-08 16:41
Location: CANADA
Contact:

Post by DJ RRebel » 2005-11-08 21:47

Garg ... I don't think you actually got what I meant ...

There would be 2 different types of links generated dynamically

1- If they are not logged into my forum (or haven't registered for the hub yet) then they just get the hub address:

dchub://myhub.url.com

2- If they are logged in, then they get a dynamically generated link based on their hub registration details:

dchub://dcusername:[email protected]


The dcpassword would be as protected as their password for my site, nobody would be able access their password unless they had their forum password ... so security is really a non issue, as I private message them a random password anyhow ... so even without the link someone with access to their account could still get their password from their PM box.

The only difference, is that it makes things infinately easier to get new members into the hub! :)
www.homeofmusic.com
Your Club Music Community!

ivulfusbar
Posts: 506
Joined: 2003-01-03 07:33

Post by ivulfusbar » 2005-11-09 04:51

I can see one security-issue. It is user copy-pasting the hub-addr including the username/password if they are not sure what that part of the URL is. Do you think editing their own favorites is to much trouble?
Everyone is supposed to download from the hubs, - I don´t know why, but I never do anymore.

GargoyleMT
DC++ Contributor
Posts: 3212
Joined: 2003-01-07 21:46
Location: .pa.us

Post by GargoyleMT » 2005-11-09 09:38

DJ RRebel wrote:Garg ... I don't think you actually got what I meant ...

I did understand. I was explaining my position in general, not trying to rebut your proposed (careful) use of the feature.

Locked