vexsoftware/votifier — pull request #70 by coelho (2014-03-31 09:38:21+00:00)
Title: Rewrite in favor of ProtocolV2

The current protocol (v1) is insecure. To fix this, we'll introduce ProtocolV2.

ProtocolV2 uses JSON for messages. An example message is below:
```
{
"service": "MinecraftServerList", // name of the service
"signature": "YmFzZTY0ZW5jb2RlZHNpZ25hdHVyZQ==", // sha256withrsa signature
"payload": "{
"domain": "myservername.com", // the host that we are connecting to (useful for vhosting)
"username": "etc", // username of the originating voter
"address": "123.123.123.123", // ip address of the originating voter
"timestamp": 1396257969 // unix time
}"
}
```

Every voting website will have an RSA key pair. (php generator @ https://gist.github.com/coelho/9887580) It will allow users to add it to their config.yml as such:
```
host: 0.0.0.0
port: 8192
debug: false
listener_folder: plugins/Votifier/listeners
enable_old_protocol: true
websites:
test: https://example.com/votifier/public.key
```
This RSA key pair will be used to perform SHA256withRSA signature signing on the payload. The Votifier server can then validate the signature against the payload and public key (retrieved from the website).

A vote will become invalid when it's timestamp has exceeded 10 minutes. For this, servers and server lists must have an accurate system clock. We will also store old votes in memory to ensure that they are not susceptible to a replay attack.

If the public key is not loaded over SSL, there will be a warning in console stating that it is insecure.
Usage of the old protocol after this has become the standard will result in a warning in console that it is insecure.

Pros:
1) This is secure.
2) We provide compatibility towards V1 and V2 at the same time.
3) This is much easier for server owners to setup in the long run.
4) This protocol is so much more beautiful (I mean JSON oh my god).

Cons:
1) We can't do this on our own. Every server list owner must see the importance in this and implement it. We can help them by creating some useful libraries for Ruby and PHP.
2) The new setup process may be confusing at first for server owners.