Adding FLIP 332:Enforcing Domain-Based Networking Addresses for Nodes

[vishalchangrani]

Flip Issue: #332

Comment Period: 2 weeks (June 19th to June 3rd July)

[bluesign]

This is very convenient to have for sure, but think also need to think security side of things; slashing, routing etc. But maybe as we probably allow and suggest domain names already, those considerations are already done.

[vishalchangrani]

This is very convenient to have for sure, but think also need to think security side of things; slashing, routing etc. But maybe as we probably allow and suggest domain names already, those considerations are already done.

Hi @bluesign - do you mean slashing if someone stakes with an IP address?

[bluesign]

hmm we are adding another layer of direction, maybe that can lead to some slashing/routing problems.

imagine you are sending message to me ( node A to node B ) if I set my network address as your network address, maybe it can lead to some problems for example.

also for example DNS does not propagate ( or at least cached for different durations ) if I move my node, some of the peers can resolve my old address while some resolving new. ( not sure running 2 node with same key possible )

it basically creates some attack / bug surface for sure, but not sure how deep it is. ( I am not that well versed in flow-go )

[joshuahannan]

Seems like a good idea to me! Just FYI, we already have a construct in the contract make sure that once a networking address has been used, it cannot be used again, so we don't need to worry about people setting their network address to the same as someone else

[joshuahannan]

Still have the placeholders here

[vishalchangrani]

fixed it.

[bjartek]

Hou should probably mention what port that this is. IE what role it has for the node.

[bluesign]

Just FYI, we already have a construct in the contract make sure that once a networking address has been used, it cannot be used again, so we don't need to worry about people setting their network address to the same as someone else

Yeah that was my point: like dnz.dev today can point to 1.1.1.1, but tomorrow I can point it to where dappernode.com pointing etc

but probably it is not problematic yet, as we have verified nodes for roles and trust.

[vishalchangrani]

Hou should probably mention what port that this is. IE what role it has for the node.

added a line about the port here under Background.

[vishalchangrani]

Just FYI, we already have a construct in the contract make sure that once a networking address has been used, it cannot be used again, so we don't need to worry about people setting their network address to the same as someone else

Yeah that was my point: like dnz.dev today can point to 1.1.1.1, but tomorrow I can point it to where dappernode.com pointing etc

but probably it is not problematic yet, as we have verified nodes for roles and trust.

That is a fair point but that is part of the larger protocol autonomy initiative to make the network more secure against byzantine nodes.