Hacker Read top | best | new | newcomments | leaders | about | bookmarklet login

What do you expect them to do? Hardcode their clients to ignore that certain CID? That obviously won't work for a whole host of reasons.

That Uniswap UI is out there and literally nothing can stop it.



sort by: page size:

Why would they have to circumvent anything? The app relies on the user providing valid credentials, no circumvention needed. It just has to mimic an official client.

I’m not sure what you mean by “they aren’t doing it”. WEI doesn’t exist yet, obviously nobody is blocking clients who aren’t attested.

More to the point, even the author of this proposal has recognized this is an issue, identified it as so in the proposal, then failed to put forward a workable solution. That’s my problem.


They aren't possible for the network to unilaterally impose on unwilling users. They're still possible if the user actually wants it, by just setting their client's DoH server to one that does them.

I was referring to banning of users who use third party clients and I do not think it would be particularly hard to do if they really wanted to. You can for example use request patterns or the fact that the unofficial clients do not autoupdate. I doubt that they would go that far, but it would be trivial if they really wanted to.

They don’t and can’t disallow third party clients. The client is GPL.

I'm thinking they probably don't want unauthorized clients just to lower the support threshold. Some percentage of people will hold them responsible for broken third-party clients.

I think they could do literally anything, because it is closed source; including forging random keys or ignoring the notification setting, ...

In that case, wouldn't they whitelist 3rd party client apps then? At least on a case by case basis, and at least the biggest ones Apollo and co

no, they could just disable the AB API key...

From the wording is sounds like developers can't stop it from showing. (Except by not using using the APIs that would trigger it.)

My guess would be in the app.

Enforcing it at the bridge level would break so many setups, apps, custom integrations that even if they try this, they'll dial it back from the avalanche of outrage.


They'll probably just ban the API key people use for it.

I hope they gate webGPU behind a per domain allow/deny notification like they do with location and camera access.

This whole thing is just begging to be exploited by cryptominers.


They can’t censor transactions? They can’t block certain protocol updates by continuing to use old/custom clients?

The solution to that is to fix your infrastructure to not trust the client, rather than trying to enforce use of a particular client.

The customer won't allow any non-security related changes to the platform. That's the only reason.

Preventing interoperatibility is one thing. Rewriting user messages without their consent is another.

It sounds like an alternative where they just don't pretend they support the thing the don't support was proposed, and shot down because that means they won't show up in UI that only lists things that support the thing?

… And they also control the UI in question?


Ideally there should be no way for them to even know we're running custom clients.
next

Legal | privacy