Proposal: Discontinue the exozyme API

a commented

2022-06-25 23:21:21 +00:00

Owner

I don't know how many of you were aware that we even had a REST API for exozyme, but we do! It's also full of security holes #147. The main use currently of the API is for registering new users, but I think it's equally fine to do this by email like we used to do.

Basically, the new registration flow would look like this:

Someone emails us to register an account.
We ask for what username they want and other follow-up questions.
That person replies.
We register the account manually with a temporary password.
The person logs in with their temporary password and changes it using passwd.

The advantage of this process is that we don't need to maintain a lot of API code like we currently do.

I don't know how many of you were aware that we even had a REST API for exozyme, but we do! It's also full of security holes #147. The main use currently of the API is for registering new users, but I think it's equally fine to do this by email like we used to do. Basically, the new registration flow would look like this: 1. Someone emails us to register an account. 2. We ask for what username they want and other follow-up questions. 3. That person replies. 4. We register the account manually with a temporary password. 5. The person logs in with their temporary password and changes it using `passwd`. The advantage of this process is that we don't need to maintain a lot of API code like we currently do.

a added this to the v9.0 milestone 2022-06-25 23:21:21 +00:00

a added the

enhancement

question

security

labels 2022-06-25 23:21:21 +00:00

a added this to the (deleted) project 2022-06-25 23:21:21 +00:00

a commented

2022-06-25 23:33:54 +00:00

Author

Owner

Here are the main advantages of discontinuing the API:

Less code and one less service to maintain. Maintaining the API is especially tricky since it's entirely written by us. Also, the API requires code from the website, nginx, and scripts repositories so it's a bit complex. To properly fix the security issues, we probably have to actually package the API instead of running it as root in tmux, which would also require maintaining an AUR or Nix package.
Fewer security issues. We currently run the API as root which is not great. #147

Here are some disadvantages:

We lose all the awesome API functionality! For instance, I wrote a cool endpoint a while back that runs neofetch and returns the result.
Registering a new account is more complicated and manual.

Here are the main advantages of discontinuing the API: - Less code and one less service to maintain. Maintaining the API is especially tricky since it's entirely written by us. Also, the API requires code from the website, nginx, and scripts repositories so it's a bit complex. To properly fix the security issues, we probably have to actually package the API instead of running it as root in tmux, which would also require maintaining an AUR or Nix package. - Fewer security issues. We currently run the API as root which is not great. #147 Here are some disadvantages: - We lose all the awesome API functionality! For instance, I wrote a [cool endpoint](https://git.exozy.me/exozyme/scripts/src/commit/33647c34a052e09ceb232f9650dfdf936b4c9d85/api#L38) a while back that runs neofetch and returns the result. - Registering a new account is more complicated and manual.

a commented

2022-06-25 23:34:21 +00:00

Author

Owner

I think we'll just go with discontinuing the API for now. If you would like to maintain it in the future, please reopen this issue!

a closed this issue

2022-06-25 23:34:21 +00:00

a commented

2022-06-25 23:37:10 +00:00

Author

Owner

This is done in scripts 1eadc49cf0, nginx bdd9c3f916, and website 91a8e164af.

This is done in scripts [1eadc49cf0](https://git.exozy.me/exozyme/scripts/commit/1eadc49cf09de184490e17a52be2cfd879b22927), nginx [bdd9c3f916](https://git.exozy.me/exozyme/nginx/commit/bdd9c3f916d175f0762504b4d2c2a08e6b59892d), and website [91a8e164af](https://git.exozy.me/exozyme/website/commit/91a8e164afa41c93682c5a37a03e29fb5e403ae7).

a referenced this issue

2022-06-25 23:37:46 +00:00

Investigate exozyme API security issues #147

a referenced this issue

2022-06-25 23:38:10 +00:00

Create an email system for password resets #106

a referenced this issue

2022-06-26 02:20:26 +00:00

We need more maintainers! #163

Proposal: Discontinue the exozyme API #162