You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -5,75 +5,167 @@ An open standard for Hive based apps.
5
5
-`Apps` - URL format and canonical linking schemes
6
6
-`BadActors` - accounts mischiefs or phishing attempts
7
7
-`BadDomains` - phishing domains
8
+
-`GoodDomains` - domains known to be safe
9
+
-`Spaminator` - larger imported lists maintained by the Spaminator project
8
10
9
11
# How to use this package
10
12
11
13
`yarn add @hiveio/hivescript`
12
14
13
-
## Canonical linking
15
+
## Files
14
16
15
-
On Hive, content is stored in blockchain and same information is accessible via different websites and services built on Hive. Canonical linking to origin of post is important for entire ecosystem to thrive.
`node scripts/validate.mjs` checks every data file: shape, sorting, duplicates, casing,
80
+
good/bad overlap, public suffixes and `apps.json` placeholders. CI runs it on every pull
81
+
request and again before publish. No dependencies to install.
82
+
83
+
The public suffix check reads `scripts/public-suffix-list.txt`, a snapshot of the
84
+
[Public Suffix List](https://publicsuffix.org/list/) refreshed by
85
+
`node scripts/update-public-suffix-list.mjs`. That snapshot is MPL 2.0, carries its upstream
86
+
notice, and is development tooling only: it is outside the `files` allowlist, so the npm
87
+
package stays MIT.
88
+
89
+
### Adding or changing an app
90
+
91
+
Open a pull request against `apps.json`. Entries are sorted by key. A `url_scheme` must be
92
+
`https`, must contain `{permlink}`, and must resolve to a real post page: no hash fragments
93
+
(`#!/...`), because search engines do not treat those as distinct canonical URLs. Entries
94
+
whose domain stops resolving, starts redirecting off-site or gets parked are removed, since a
95
+
stale entry sends every frontend's canonical links and the SEO authority behind them to
96
+
whoever holds the domain now.
97
+
42
98
## Bad actors
43
99
44
-
Bad actors, list of account that is mostly created with intention to take advantage of user mistype. Sometimes simple misspell can direct funds into wrong accounts, this list contain those reported accounts.
100
+
Bad actors, list of account that is mostly created with intention to take advantage of user
101
+
mistype. Sometimes simple misspell can direct funds into wrong accounts, this list contain
102
+
those reported accounts.
45
103
46
-
This section could be part of wallet page in your Dapp where user enters account name to transfer funds to.
104
+
This section could be part of wallet page in your Dapp where user enters account name to
105
+
transfer funds to.
47
106
48
-
```
49
-
import badActors from '@hiveio/hivescript/bad-actors.json';
107
+
Build a `Set` once at module load. The list is over a thousand entries and `Array.includes`
108
+
re-scans all of it on every keystroke.
50
109
51
-
if (badActors.includes(to_account)) {
52
-
console.warn("Use caution sending to this account. Please double check your spelling for possible phishing.");
// Hive account names are lowercase; normalise before comparing.
116
+
if (BAD_ACTORS.has(to_account.trim().toLowerCase().replace(/^@/, ""))) {
117
+
console.warn(
118
+
"Use caution sending to this account. Please double check your spelling for possible phishing."
119
+
);
120
+
}
121
+
```
57
122
58
123
## Bad domains
59
124
60
-
Phishing domains, list of phishing domains, we recommend Dapp/frontend developers check external link clicks and warn users about potential phishing domains.
125
+
Phishing domains, list of phishing domains, we recommend Dapp/frontend developers check
126
+
external link clicks and warn users about potential phishing domains.
61
127
62
-
This section could be part of content rendering or external link clicking event listener in your web/mobile/desktop apps.
128
+
This section could be part of content rendering or external link clicking event listener in
129
+
your web/mobile/desktop apps.
63
130
64
-
```
65
-
import badDomains from '@hiveio/hivescript/bad-domains.json';
131
+
Parse the URL rather than matching it with a regex. `newURL()` lowercases the host and
132
+
converts internationalised domains to punycode, which is what the list stores, so homograph
133
+
domains such as `șteemit.com` (`xn--teemit-2lc.com`) are caught. Then walk the parent domains,
134
+
otherwise `login.phishing-site.tk` slips past an entry for `phishing-site.tk`.
135
+
136
+
Because consumers walk parent domains, every entry in these lists has to be a registrable
137
+
domain. A public suffix such as `web.app`, `github.io` or `co.uk` would condemn every site
138
+
hosted under it, so list the specific abusive hostname instead. CI rejects entries that are
0 commit comments