Full private mode

[josecelano]

Should we add the option to run the Index in fully private mode? (you need to sign up for anything. No public pages).

cc @da2ce7 @cgbosse @WarmBeer @mario-nt @grmbyrn

[mickvandijke]

Yes I think that would be very useful.

[cgbosse]

Totally.

[mario-nt]

I would say yes, but we need to consider that giving full control to the end user to chose the level of privacy (enabling full private mode) should increase the number of users and popularity of the project.

But it will also increase the chances of having people using the project for illegal/illicit uses, whether this affect our reputation or not, it's unclear, and probably nothing we should worry about a lot, I think it is still something we should consider, regardless of what we decide to do.

[alexohneander]

Can someone explain to me why Private Mode returns the torrents as a list. In which use case do you want to see the torrents but not be able to download them?
For me the definition of private is that you are not allowed to see anything except the login page.

[josecelano]

Hi @alexohneander, I opened this discussion because I reached the same conclusion as you :-).

The tracker allows several modes, one of them is the "private" mode, but the Index doesn't have a "mode". It runs always the same way so you can end up having a private tracker connected to the Index which can't not be private. Rigth now, what you can see is hardcoded in the Index and from my point of view you can't not run a private Index.

We have made some changes (like adding Casbin to the authorization service) to allow those changes in the future, but it's not possible now (at least not only using stable configuration options).

Besides, we are focused on public Indexes features since it seems to be where Torrust Index fits better at the current state. There are a lot of missing features (for example, user's statistics) that private Indexes usually have.

cc @da2ce7 @mario-nt

[alexohneander]

@josecelano Yes, I totally understand, but then this private mode in the index is a bit misleading.
I mean the first step would be a HTTP 401 and display the login page again and everything else can only be achieved with an AccessToken/Cookie right?

[josecelano]

@alexohneander Yes, as you described, guests should only be able to access the login and registration page (if registration is enabled). Any other page should return 401 until you sign in.

Maybe what was misleading for you is the name "Full Private". I called it "full" because we were using the word "private" because you need to be authenticated to download the torrent. Someone called it "semi-private", but for me, it does not make sense; I don't know why it was built this way. Maybe it could be a way to incentivise people to join the Index by showing its contents, but you have to register to be able to download.