Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Suggestion- remove dangerous defaulted api.mymonero.com values from mymonero-utils #147

Open
CryptoGrampy opened this issue Mar 28, 2023 · 1 comment

Comments

@CryptoGrampy
Copy link

I'll preface this issue with, I know this is MyMonero's library and obviously it makes sense that these defaults are here.

There are a number of references to api.mymonero.com scattered throughout the mymonero-utils codebase as fallback default values for important api requests. I find these defaults to be highly dangerous for anyone building open source tools that use these libraries, in that a simple mistake, or a missed setting of a variable will result in the unintentional doxxing of private wallet data to MyMonero.

I recommend either setting these default values to localhost, adding in appropriate error handling in the event the values aren't set, and/or removing the references entirely as they are bad for privacy, not very helpful for the ecosystem, and they don't encourage anyone using or contributing back to these libraries. MyMonero should be able to set these values from their Apps.

constructor (netType = 'MAINNET', url = 'https://api.mymonero.com') {

@devinpearson
Copy link
Collaborator

Hey @CryptoGrampy thanks for taking the time to bring this up.

I’m happy to work with you to change it and work on defaulting it to Localhost.

if you are willing to put through a PR for the changes I’ll get our team to review them.

CryptoGrampy added a commit to CryptoGrampy/mymonero-utils that referenced this issue Mar 30, 2023
CryptoGrampy added a commit to CryptoGrampy/mymonero-utils that referenced this issue Mar 30, 2023
CryptoGrampy added a commit to CryptoGrampy/mymonero-utils that referenced this issue Mar 30, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants