原始文献 / 论坛帖 / Re: JSON-RPC password
Re: JSON-RPC password
Bitcointalk · 2010-07-19 16:20:50 UTC
所以是在 ~/.bitcoin 目录里放个设置文件，听起来更好。在"未设置密码"的警告里，可以告诉你文件在哪、该怎么做。
最流行最常见的设置文件格式是什么？
HTTP 基本认证也值得考虑。但实际中，网页开发者要搞明白怎么通过 HTTP 或 JSON-RPC 包装器的某个额外参数来指定密码，比直接在参数列表开头多加一个参数要费劲得多。你觉得呢？HTTP 基本认证能给我们带来什么额外好处吗？把它从参数列表挪走，但你还得在一个更冷门的地方指定它，我不确定这是不是净收益。
引用自：gavinandresen 于 July 19, 2010, 12:02:39 PM（https://bitcointalk.org/index.php?topic=461.msg4215#msg4215）
我一开始有点懵，因为密码在命令行里是放在最后的，但在 JSON-RPC 参数列表里却是放在最前的。我同意从文件里读命令行密码会更方便也更安全。
你也把我搞糊涂了，你什么意思？我做了什么意料之外的事吗？
英文原文
So you drop a settings file in the ~/.bitcoin directory, that sounds better. In the "no password is set" warning, it could tell you where the file is and what to do.
What is the most popular and common settings file format?
HTTP basic authentication should be considered. In actual practice though, it's more work for web developers to figure out how to specify the password through some extra parameter in the HTTP or JSON-RPC wrapper than to just stick an extra parameter at the beginning of the parameter list. What do you think? Does HTTP basic authentication get us any additional benefits? Moving it off the parameter list but then you still have to specific it in a more esoteric place I'm not sure is a net win.
Quote from: gavinandresen on July 19, 2010, 12:02:39 PM（https://bitcointalk.org/index.php?topic=461.msg4215#msg4215）
I was confused for a bit because the password is given LAST on the command line, but FIRST in the JSON-RPC params list. I agree that reading the command-line password from a file would be more convenient and more secure.
You're also confusing me, what do you mean? Did I do something unintended?