NUT06: Add Mint TOS to mint info

[thesimplekid]

No description provided.

[prusnak]

ToS is usually a veeery long document. I think it would be better to replace the tos field with tos_url and provide link to the document instead so the info response is not so big.

As a bonus the document can be easily formatted - let's say in HTML or PDF format.

[prusnak]

Suggested change

	"tos": "Terms of Service of the mint.",
	"tos_url": "https://mint.host/tos.pdf",

[callebtc]

PDF is scary, can we just call it a normal URL?

https://mint.host/tos

[prusnak]

Suggested change

	- (optional) `tos` is the Terms of Service of the mint.
	- (optional) `tos_url` is the URL pointing to the Terms of Service of the mint.

[thesimplekid]

ToS is usually a veeery long document. I think it would be better to replace the tos field with tos_url and provide link to the document instead so the info response is not so big.

As a bonus the document can be easily formatted - let's say in HTML or PDF format.

You bring up a good point that including it directly in the info response would increase its size and as this is something that a wallet should fetch often we should avoid this. However, linking to a document without defining a structure or file type would make it very difficult for a client to render and show to an end user. I think the TOS should be just a text string to avoid making it difficult for a wallet to show when the mint is added.

[prusnak]

difficult for a wallet to show when the mint is added.

Maybe we should strongly recommend that ToS are in a format easily rendered by a browser/app such as plain-text, Markdown, PDF or HTML?

document without defining a structure

I don't think we can come up with any reasonable structure. Laws in different countries are different.

Btw, I just checked and the current cashu.me (i know that's a wallet not a mint) ToS are currently around 11 KB and they are pretty minimal.

[prusnak]

as plain-text, Markdown, PDF or HTML?

Thinking more about this and HTML is probably too dangerous because it can contain some code to deanonymize user when opened :-(

[callebtc]

I would vote for URL. Wallets can render it as a web page.

[ok300]

I agree the TOS URL is better than including the TOS in MintInfo.

I have two proposals:

First, the spec should limit the linked filetype to plaintext.

• this avoids confusion for wallets about how to render it
• this avoids possible attack or deanonimization vectors (HTML, JS, PDF, etc)
• this doesn't add extra dependency burdens on the wallet around rendering (markdown library, etc)
• this is a tried and tested format for policy and TOS-like documents (most GH projects have a plaintext LICENSE file, IETF RFCs are in planitext, most installers render TOS as plaintext)

Second, why not instead add a /tos endpoint to the mint? This could return a plaintext file and replace the need for tos or tos_url fields in MintInfo.

• this gives mint implementations more control (can offer a default TOS)
• this makes it simpler for mint operators to add or change the TOS (likely only editing a file on the mint installation, vs. finding a place to host the TOS file, or if self-hosted: correctly configuring the reverse proxy to point to it)
• this removes further attack or deanonimization vectors (e.g. when the TOS is hosted on a 3rd party and the wallet simply accesses it; 3rd party can add headers, cookies, JS, or log requests)

[prusnak]

Second, why not instead add a /tos endpoint to the mint?

I guess this really depends who do we want to optimize for:

a) individuals running the mint - where there is no web, only mint - for these it is easier to just drop tos.txt on the mint server and be done with it

b) companies running the mint - running the mint, running the web server and probably also having some legal team - where it might be beneficial to have a way how to update the tos without having to bother the mint admin to change the tos (as legal team can just ask the webadmin to refresh the tos on the webserver, not the mint server)

I am fine with optimizing for a) but I wanted to show there is also a b)

[callebtc]

IMO, nobody should have to download a PDF file to read the TOS. The TOS should be provided as a web link. It could be a HTML file, it could be a file on github, or anything that can be rendered in a browser. Even if it's an individual of group (a), if they put all the effort into writing a ToS, I'm sure they can find a way to host it somewhere.

Let's just use a URL.

[ok300]

I guess this really depends who do we want to optimize for

My proposals were aimed to optimize for the privacy and risk minimization of mint users, at minimal cost to the mint.

HTML, using a link that points anywhere on the web -- optimizes for the reverse: mint ease of setup, at the cost of mint user privacy leaks, deanonimization risks.