quiet
quiet copied to clipboard
Each client should validate orbitdb data
We should do everything we can to validate messages (and other data like channels and users) at the orbitdb layer, or between the syncing layer and the state layer, on the receiving end.
https://github.com/orbitdb/orbit-db/blob/main/GUIDE.md#custom-access-controller
validate:
- signature
- sender
- message data, format, etc.
- message size limits
- add corresponding message size limits to the frontend
- channels
- users
- community name
We should discuss what makes sense here. The basic idea is that if someone is sending tons of invalid messages that will be ignored, we don't want to be storing them forever.
A this moment (we are on production version 1.8.0) we are validating point 1 - signature. So points 2-5 are still to be done.