Quote from: Artefact2 on June 11, 2011, 03:13:15 PM

Quote from: WNS on June 11, 2011, 02:50:31 PM

Eligius is already committed to the elegant kludge of Address as username

You see that as a kludge. I see it as an elegant solution.

I submit that it is both. The "right" way would be to modify the pool management daemon to not think in terms of username/password, but, as discussed, this has not been done. The daemon has instead been fooled into passing the address as username, a great worse-is-better solution, that solves the problem, without breaking anything, a brilliant kludge that does not need to be fixed.

Since the out-of-band data pathway has already been exploited, why stop there? We have one obvious piece of data that could be passed as well by using the same trick.

Quote from: Man From The Future on June 11, 2011, 02:54:19 PM

The issue here is, someone else can screw up your payout value by mining witha different setting with your address... which one should be used?

I don't really see a problem here if the value is sensibly constrained, perhaps more than my original suggestion, say 2 digits from 0.1BTC to 9.9BTC. Use the last value that came with a share (so the trickster must actually pay you in shares for the privilege of changing your threshold), I would be interested in a scenario in which such a prank would matter to the recipient.