rgb-archive / bifrost Goto Github PK

Implement something along the lines of BIP157/158 that would
allow users to check whether a Bifrost server contains a proof for one of their UTXOs without
having to explicitly ask the server

• Protocol design: Design the protocol. This is already partially done on the
  spec repo
• Implement the protocol: Implement and integrate the protocol in the Bifrost repository

Just brainstorming here, but one way to constrain access to the server (which in turn somewhat reduces DOS risk), is to demand proof that the user controls a key, any key, relevant to the asset. E.g. the issuer can prove they have the key the spend the issuing UTXO, anyone who's ever received the asset can prove they have the key to spend that output (whether or not it's already been spent).

This could be a one-off thing, where the server checks the proof and then returns a token that's valid forever, for subsequent requests.

One obvious potential downside is that this authentication mechanism itself it a bigger DDOS risk than the one it's trying to prevent.

Could also just require Lightning payments :-)

Natively support Tor and Onion addresses

Similar to rgb-archive/kaleidoscope#18
It makes debugging/testing more comfortable

Designing an incentive system to protect against spam (people uploading a lot of data to
Bifrost servers)

Since you're already running internal-rgb-bifrost.herokuapp.com it would be great if you can share the steps to deploy that. Are you using https://github.com/emk/heroku-buildpack-rust ?

When running your own server, it could be useful to give it an asset whitelist, maybe through a simple ENV config? It's not the perfect anti DDOS measure, but it does protect others from accidentally uploading stuff to your server that you might then accidentally delete.