diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/access.md | 6 | ||||
| -rw-r--r-- | docs/api.md | 6 |
2 files changed, 8 insertions, 4 deletions
diff --git a/docs/access.md b/docs/access.md index 43cd326..f7546aa 100644 --- a/docs/access.md +++ b/docs/access.md @@ -244,8 +244,10 @@ can't cut its node off. With `"signatures": "required"`, a change also needs a signature by the node it names ([`api.md`](api.md), Signed changes): every node then signs every change it makes, and one no signature vouches for yet waits, with whatever builds on it, until one does -(they come with the changes, or within a second on their own). A member can then no -longer write as another member; the user a change names is still its node's word. +(they come with the changes, or within a second on their own). A signature vouches for +its change and the node's changes it builds on, no others: a change made under another +node's actor is forged, refused, and logged as its sender's (`A peer brought changes +forged`). A member can then no longer write as another member; the user a change names is still its node's word. In a swarm without a registry, whatever a user would need, any member may. A refused change stays out, and so does whatever builds on it; the node logs it (`Refused a diff --git a/docs/api.md b/docs/api.md index 7d7a563..019f9cf 100644 --- a/docs/api.md +++ b/docs/api.md @@ -248,8 +248,10 @@ who wrote what, until a remake drops the history ([`remakes.md`](remakes.md)). Every node signs changes it commits with its node key: an Ed25519 signature over the change's hash, kept beside the document. One signature vouches for more than its change: a node's change builds on its previous one, and a change's hash covers what it -builds on, so a signed change vouches for all the node's changes before it. So not -every change is signed, only those that +builds on, so a signed change vouches for all the node's changes before it, those it +builds on. No others: anyone can make a change under a node's actor, and one in the +place of a change of the node's the document holds is forged, refused as its sender's, +not the node's. So not every change is signed, only those that * touch protocol data (`_continuum`), * touch a path listed in `_continuum/access/signed` (within it, or above it), a list |