If you’re using another JSON-RPC client that you wrote you can take care to protect the password, but using the bitcoin binary as the client and passing the password on the command line has the same issue as starting the daemon with it.  It’s still visible to every user that way.

So both the server and the client mode invocation need to use the file and not accept the password on the command line.  Generally programs like this refuse to start if the mode on the file isn’t 600 or something like that, because that means other users can read it.

Still need to know what’s the most typical settings file format on Linux.  Is there a standard file extension?  I’ve never seen a settings file using JSON, and it doesn’t look very human friendly with everything required to be in quotes.  I think what I usually see is like:
# comment
setting=value

Is there a settings file thing in Boost?

When you’re using bitcoind to issue commands from the command line as a client, can we have it get the password from the settings file then too?

Gavin pointed out I forgot to increment the column of numbers in CommandLineRPC, so the current -rpcpw= implementation doesn’t work right from the command line with non-string parameters.  (JSON-RPC is fine)  Still under construction.

73,509 total views, 44 views today

https://bitcointalk.org/index.php?topic=461.msg4577#msg4577