Hi Brian, > On 17 Apr 2019, at 20.58, Gix, Brian <brian.gix@xxxxxxxxx> wrote: >> From: Michal Lowas-Rzechonek >>> + uint64 token ImportLocalNode(string config_file) >> >> I am somewhat uncomfortable with passing a file path here. The caller would >> need to create a temporary file, which is a little cumbersome, and might fail if >> the daemon is running on another machine. >> >> Not sure what are the size constraints (if any), but I think it might be better >> to pass the JSON as a string. > > Indeed, this has been discussed internally as well, and is still subject to the change you mention. We are still wait8ing for input from all stakeholders, and your preference is noted. > will be composing all Config Client messages (except for OTA key messages) Passing a file name like that could also be a security vulnerability: you’d allow a non-privileged process (the D-Bus client) to request a privileged process (meshd) to go open and read a file that the non-privileged process otherwise would have no access to. The non-privileged process could then e.g. make some inferences of the content of this file based on subsequent meshd behaviour (logs, etc). So either a file descriptor or just a string parameter sounds saner to me. Johan