SN-1445 已核对来源，附原文与上下文。
我不认为在没有 conf 文件、或配置文件不含 "rpcpassword" 时就该默认禁用认证，但如果配置文件里写的是 "rpcpassword=" 呢？
I don't think authentication should be disabled by default if there's no conf file or the config file doesn't contain "rpcpassword", but what if it contains "rpcpassword="?
两边的道理我都懂。
I can see both points.
如果程序员搞不定用他们的语言（Fortran 之类）做 HTTP 认证，或者他们的 JSON-RPC 库压根不支持呢？应不应该允许他们显式关掉密码要求？
What if the programmer can't figure out how to do HTTP authentication in their language (Fortran or whatever) or it's not even supported by their JSON-RPC library? Should they be able to explicitly disable the password requirement?
话又说回来，如果有个模板 conf 文件，里面是
OTOH, what if there's a template conf file, with
rpcpassword= # 在这里填入密码
rpcpassword= # fill in a password here
许多系统不允许无密码登录。比如这个论坛。Gavin 的观点看起来更有力。
There are many systems that don't allow you to log in without a password. This forum, for instance. Gavin's point seems stronger.
顺便说一句，我没测过，但我希望 conf 文件里 rpcpassword=（空值）是合法的。只有用 -server 或 -daemon 或 bitcoind 时才该报错警告。如果不需要密码，就应该没事。是这样吗？
BTW, I haven't tested it, but I hope having rpcpassword= in the conf file is valid. It's only if you use -server or -daemon or bitcoind that it should fail with a warning. If it doesn't need the password, it should be fine. Is that right?
