todo

diff --git a/doc/todo/git-annex_proxies.mdwn b/doc/todo/git-annex_proxies.mdwn
index 13a8f56c060f06d90195a8a059e8d6a12a7a589c..85e4ec0cd8ff19faa5182846f385c9293488c3db 100644 (file)
--- a/doc/todo/git-annex_proxies.mdwn
+++ b/doc/todo/git-annex_proxies.mdwn
@@ -33,6 +33,15 @@ Planned schedule of work:
 * balanced= and fullybalanced= need to limit the set of repositories to
   ones with enough free space to contain a key.
 
+* document balancing algo well enough that someone else could implement it
+  from the design doc
+
+* picking a low UUID and picking keys that mod N == 0 would let an attacker
+  generate keys that balancing always puts on that UUID. To avoid this
+  use HMAC with the set of UUIDs and the key. Then any such attack can be
+  prevented by adding another UUID to the set, it could even be a dummy
+  UUID that is marked as having 0 size, so it will never be used.
+
 * Add `git-annex maxsize` command.
 
 * Implement [[track_free_space_in_repos_via_git-annex_branch]]