From 2be48af0d7aecf037de53936e13736d8cb7e7641 Mon Sep 17 00:00:00 2001
From: AJ ONeal <awesome@coolaj86.com>
Date: Sun, 13 Dec 2015 06:00:30 +0000
Subject: [PATCH] updates

---
 README.md | 19 +++++++++++++++++++
 index.js  | 12 ++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/README.md b/README.md
index 8e86dac..c14ba7c 100644
--- a/README.md
+++ b/README.md
@@ -51,6 +51,25 @@ than what makes sense to show in a minimal snippet.
 * [commandline (standalone with "webroot")](https://github.com/Daplie/node-letsencrypt/blob/master/examples/commandline.js)
 * [expressjs (fully automatic https)](https://github.com/Daplie/node-letsencrypt/blob/master/examples/express.js)
 
+### non-root
+
+If you want to run this as non-root, you can.
+
+You just have to set node to be allowed to use root ports
+
+```
+# node
+sudo setcap cap_net_bind_service=+ep /usr/local/bin/node
+```
+
+and then make sure to set all of of the following to a directory that your user is permitted to write to
+
+* `webrootPath`
+* `configDir`
+* `workDir` (python backend only)
+* `logsDir` (python backend only)
+
+
 See Also
 ========
 
diff --git a/index.js b/index.js
index e1ad0c5..96c6c8e 100644
--- a/index.js
+++ b/index.js
@@ -95,6 +95,18 @@ LE.create = function (backend, defaults, handlers) {
         return;
       }
 
+      //
+      // IMPORTANT
+      //
+      // Before attempting a dynamic registration you need to validate that
+      //
+      //   * these are hostnames that you expected to exist on the system
+      //   * their A records currently point to this ip
+      //   * this system's ip hasn't changed
+      //
+      //  If you do not check these things, then someone could attack you
+      //  and cause you, in return, to have your ip be rate-limit blocked
+      //
       console.warn("[SECURITY WARNING]: node-letsencrypt: validate(hostnames, cb) NOT IMPLEMENTED");
       cb(null, true);
     }