https://mega.co.nz/#blog_4 MEGA's first week - a retrospective 一月 27, 2013 It's been seven busy days for us since MEGA went live. As millions of users were hitting 50,000 freshly written and barely tested lines of code and dozens of newly installed servers, teething troubles were inevitable - it took us almost 72 hours to resolve the major bottlenecks, and we would like to apologize to all users who were affected. MEGA复活以来是整整七天的忙碌日子。上百万位使用者持续冲击着50000行 刚写好又没甚麽测试的程式码、和数十台新装好的伺服器，难免会有刚长牙 的疼痛──我们花了将近72小时解决主要的瓶颈，对於受到影响的用户深感 抱歉。 As expected, the public debate about MEGA revolves primarily around our cryptographic security model and can be classified into five categories: 如同预期，有关MEGA的公开辩论基本上都环绕在密码安全模型上，并可分为 以下五类：(以下五点皆与密码安全模型有关 略过) Actual bugs. Two (an XSS hole and the invalid use of CBC-MAC as a secure hash) were reported by the community so far and fixed swiftly. To all the bright minds going through our amorphous code: Thank you for your efforts! We will make our JavaScript more readable and launch a bug bounty program shortly. Design flaws exacerbating the potential impact of weak user passwords. We acknowledge that our current approach is based on the assumption that all of our users choose strong passwords, which is probably a bit naive. We are going to improve the sign-up interface (better user education and rejection of overly weak passwords). We'll also reduce the offline password cracking risk for users who do use weak passwords and fall victim to someone intercepting their e-mail or obtaining their user record from our central database. Weak random number generation: We have added WebKit's crypto.getRandomValues() into the mix and will collect mouse/keyboard timing entropy explicitly before generating the RSA key pair rather than informing the user that we are doing so only after the generation has already started. Deduplication - clause 8 of our Terms of Service has caused some confusion and concern. The reality is quite harmless: We deduplicate based on the full encrypted file. That's it. Polemic in the "if you can break SSL, you can break MEGA" category. No comment. Other issues: 其他议题: Within hours after the launch, Hotmail started blackholing our e-mails (silently discarding potential ham is actually quite a rude thing to do!). Apparently, our sudden surge of activity triggered some heuristics designed to guard against spam botnets. Please do not use a Hotmail address to sign up while we're working with them unblock our IP range. 1. 复活後内的好几小时内，Hotmail过滤掉了我们的e-mail(blackhole)。显然， 我们突如其来的活耀浪潮启动了某些自动防堵垃圾邮件机制。请暂时别用 Hotmail注册，而我们会继续和他们联系，希望能将我们的IP解锁。 Uploads would sometimes restart from scratch in case of intermittent network issues. This has been fixed. 2. 本来上传有时会因为网路问题导致重新开始。现在已经修正了。 We would also like to thank everybody who submitted suggestions and feature requests. Our to-do list is growing! --- 先前有遇到这两个问题的网友可以再试试看 是不是解决了 --

※ 发信站: 批踢踢实业坊(ptt.cc) ◆ From: 1.162.201.56