{"type":"rich","version":"1.0","author_name":"npub17fjkngg0s0mfx4uhhz6n4puhflwvrhn2h5c78vdr5xda4mvqx89swntr0s","author_url":"https://nostr.ae/npub17fjkngg0s0mfx4uhhz6n4puhflwvrhn2h5c78vdr5xda4mvqx89swntr0s","provider_name":"njump","provider_url":"https://nostr.ae","html":"📅 Original date posted:2023-09-07\n🗒️ Summary of this message: Runes/macaroons don't protect against compromised machines. Validating RPCs manually is useful for payment-related operations, not for \"read\" RPCs.\n📝 Original message:\nHi William,\n\n\u003e What is wrong with runes/macaroons for validating and authenticating\n\u003e commands?\n\nRunes/macaroons don't provide any protection if the machine you are\nissuing the RPCs from is compromised. The attacker can change the\nparameters of your RPC call and your lightning node will still gladly\nexecute it.\n\n\u003e I can't imagine validating every RPC request with a hardware\n\u003e device and trusted display, unless you have some specific use case in\n\u003e mind.\n\nI think that this is because you have the wrong idea of which RPCs\nthis is supposed to protect. This is useful for the RPCs that actually\ninvolve paying something (channel open, channel close, pay invoice).\nThis isn't useful for \"read\" RPCs (listing channels).\n\nMaking an on-chain operation or paying an invoice is something that is\ninfrequent enough for the vast majority of nodes that it makes sense\nto validate it manually. Also, this is fully configurable: you can\nchoose which RPCs you want to protect that way and which RPCs you want\nto keep open.\n\nThanks,\nBastien\n\nLe mer. 6 sept. 2023 à 17:42, William Casarin \u003cjb55 at jb55.com\u003e a écrit :\n\u003e\n\u003e On Wed, Sep 06, 2023 at 03:32:50AM +0200, Bastien TEINTURIER wrote:\n\u003e \u003eHey Zman,\n\u003e \u003e\n\u003e \u003eI saw the announcement about the commando plugin, and it was actually\n\u003e \u003eone of the reasons I wanted to write up what I had in mind, because\n\u003e \u003ewhile commando also uses a lightning connection to send commands to a\n\u003e \u003elightning node, it was missing what in my opinion is the most important\n\u003e \u003epart: having all of Bolt 8 handled by the HSM and validating commands\n\u003e \u003eusing a trusted display.\n\u003e\n\u003e What is wrong with runes/macaroons for validating and authenticating\n\u003e commands? I can't imagine validating every RPC request with a hardware\n\u003e device and trusted display, unless you have some specific use case in\n\u003e mind.\n\u003e\n\u003e         Will\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/lightning-dev/attachments/20230907/eaf3421b/attachment.html\u003e"}