[HN Gopher] How we put IPFS in Brave (2021)
___________________________________________________________________
How we put IPFS in Brave (2021)
Author : behnamoh
Score : 146 points
Date : 2022-05-24 16:56 UTC (6 hours ago)
(HTM) web link (blog.ipfs.io)
(TXT) w3m dump (blog.ipfs.io)
| EGreg wrote:
| What I wonder is, how to handle cross-domain security in browsers
| when you have IPFS? Is there any standard for this yet?
| eminence32 wrote:
| (2021)
| ChrisClark wrote:
| The actual title is "How we put IPFS in Brave" and that is a lot
| more interesting.
| behnamoh wrote:
| corrected. HN's algorithm had removed "how".
| elpocko wrote:
| I have noticed that "How" at the beginning of submission titles
| seems to get removed automatically for some inexplicable
| reason.
| TeeMassive wrote:
| Plug and play implementations like this is really how
| decentralized tech should be done and promoted.
| aftbit wrote:
| I've had extremely bad luck running go-ipfs at any scale. GC is
| braindead (literally deletes the whole cache on a timer),
| networking is slow and drops tons of packets (apparently too much
| UDP?), and by default it stores each object 2 or 3 times. I'm
| sure it'll work fine for people using http://dweb.app, and
| probably go-ipfs will work okay for super casual browsing, but as
| soon as someone tries to download any substantial IPFS dataset,
| expect lots of resource limits.
| zcw100 wrote:
| It does not delete the whole cache on a timer. It will delete
| blocks that are not pinned periodically or when it reaches a
| high-water mark. It does not store each object 2 or 3 times.
| First, it doesn't refer to anything as an object but rather
| blocks and a block is only stored once. It will only be
| replicated if you're running a cluster in which case
| replication is the point.
| ushakov wrote:
| IPFS is especially heavy on bandwith
|
| if you plan to host IPFS at home and meanwhile do things on the
| internet then IPFS isn't for you
|
| although it'd be a good excuse to upgrade your home network
| tamrix wrote:
| There's different profiles you can select from. You might
| have the server profile enabled. Powers save probably
| consumes the least abs you can opt out of sharing altogether.
| But the entire point is p2p.
| salmonlogs wrote:
| That seems like an insane usability trade off that would
| limit adoption quite heavily
| kevincox wrote:
| Yup, I had a (tiny, spinning rust) home server that was slowed
| to nearly a halt. SSH logins would take minutes even when
| limiting IPFS to 2GiB of the 16GiB of RAM. Stopped go-ipfs and
| it was instantly snappy again.
|
| My impression of the IPFS project is that the goals are
| excellent, the core protocol is quite good however they like
| rewriting the higher level layers far too frequently (for
| example they have deprecated UnixFS which seems to be the most
| used format and they keep switching between JSON, Protocol
| Buffers and CBOR) and go-ipfs seems to be a pretty garbage
| codebase.
| stavros wrote:
| Yep, I made an IPFS pinning service (the second one to exist,
| IIRC, and the first usable one), and I wish I hadn't. It's a
| bit of a trash fire.
| zcw100 wrote:
| If you have any specific complaints or experiences you'd like
| to share I would be interested in hearing about the but "it's
| a bit of a trash fire" is unhelpful.
| thomashop wrote:
| Same experience here. It's a real shame. I have the feeling
| IPFS is trying to do too much and became a bit of a bloated
| mess.
|
| I love the idea of decentralized content-addressed storage and
| wish there were a more lightweight way to get there.
| [deleted]
| trhr wrote:
| The 4th biggest tech article of today... is year and a half old
| news. Even the startup community is getting old and slow, it
| would seem.
|
| "Move fast and break hips."
| [deleted]
| jeroenhd wrote:
| It's a little sad that Firefox isn't the first mobile browserto
| receive and experiment with new tech like IPFS. I do wonder if
| they have solved the privacy issues with IPFS before they put it
| into Brave.
|
| IPFS is probably the best contender for Web3 right now and I hope
| it'll see more use before the crypto bros take over the term
| completely
| dleslie wrote:
| They could ship with IPFS/DAP/I2P/Tor native in Firefox right
| now, without any requirement of running external software, but
| choose not to. Instead, we get limited support for IPFS from a
| desktop-only addon that simply interfaces with an IPFS service
| already running on the host machine.
|
| Take it a step further: Firefox could allow websites to open
| sockets and toss arbitrary packets around, and choose not to.
| If that capacity were available then Javascript could be
| harnessed to support all sorts of protocols and services. They
| could even provide Javascript access to monitoring network
| access point availability and connectivity management.
|
| Imagine then a single page app you could share as an attachment
| through $messageService and it has all the stuff built in to
| create ad-hoc real networks in large gatherings that provide
| data resiliency against the dropping of nodes. You could have
| the cellular network shut down, protestors arrested, their
| phones taken, and the data they gathered still retained so long
| as any node managed to exit the area or the network itself
| expanded beyond the area of contention.
| Hamcha wrote:
| You have it backwards, stuff like Websockets are built by
| design to be incompatible with existing implementations. This
| is because Javascript code is untrusted/untrustworthy, and we
| already had a plethora of attacks due to foreign JS doing
| nasty things with what little they had, here's a couple
| examples:
|
| - SMTP/IRC spamming using Web requests (Cross-protocol
| scripting, 2002) - https://www.eyeonsecurity.org/papers/Exten
| ded%20HTML%20Form%...
|
| - Webpages that detect your router and leak your SSID (or
| worse) - Samy Kamkar "How I met your girlfriend" (2010),
| excerpt: https://www.youtube.com/watch?v=tRJMIMBVqFI
|
| Web extensions should allow you to do normal sockets, many
| years ago I had a Chrome app (I still miss them) as my IRC
| client.
| solarkraft wrote:
| It's not like Websockets prevent this completely. eBay port
| scanning: https://www.ghacks.net/2020/05/25/ebay-is-port-
| scanning-your...
| spicybright wrote:
| That's a pretty clever attack. It's clear everything can
| (will?) be exploited at some point, so it's usually down
| to features vs. user protection.
|
| Unless everyone is ok going back to running random .exe
| files from emails, I guess.
| TedDoesntTalk wrote:
| > Web extensions should allow you to do normal sockets
|
| Not since 2017 or whenever it was that Firefox dropped XUL
| extensions and replaced them with WebExtensions. The legacy
| XUL extensions could do much, much more and there was
| correspondingly much, much more malware in browser
| extensions.
| dleslie wrote:
| So treat sockets as one currently treats web cameras and
| microphones.
| stevetodd wrote:
| An acquaintance of mine worked for Mozilla on a project to
| add tor to Firefox. Code was done, but Google, as it's
| primary funder, squashed it.
| worble wrote:
| >They could ship with IPFS/DAP/I2P/Tor native in Firefox
| right now
|
| A bit of a tangent, but I really cannot stress enough that if
| you're using Tor to be private/anonymous that you should
| never use anything other than the official Tor browser, you
| will stand out like a sore thumb.
| simonw wrote:
| > Firefox could allow websites to open sockets and toss
| arbitrary packets around, and choose not to.
|
| There are very good security and privacy reasons that all
| browsers (not just Firefox) work extremely hard to prevent
| this from being possible.
| dleslie wrote:
| So treat socket access as one does Microphone and Web Cam
| access.
| skrowl wrote:
| Firefox has worked with IPFS since early 2019
| https://addons.mozilla.org/en-US/firefox/addon/ipfs-companio...
|
| Brave just took the step of forcing you to always have the
| extension installed instead of making it optional, basically
|
| I've tried IPFS a time or two and always found it to be
| INCREDIBLY slow (even worse than tor) with ZERO content
| discoverability.
| dleslie wrote:
| This still requires external software to operate, and isn't
| available on mobile. It's effectively dead in the water by
| not being available to use without additional configuration,
| by default.
|
| I'd argue this is worse than doing nothing. This gave Firefox
| the ability to say they care, and yet not deliver something
| meaningful.
| spicybright wrote:
| I agree. It just leads to "Oh, IPFS? I tried that years
| ago, it was terrible. I don't recommend trying it."
|
| What do you think firefox could have done to improve
| things?
|
| And, as someone not well versed, is there any "killer demo"
| that uses IPFS currently?
| TheaomBen wrote:
| I'm working on a collaborative photogrammetry solution
| (think async/distributed 3d mapping from overlapping
| pictures) that shares data via IPFS. Flattering myself
| heavily, I believe this sort of public-data consuming
| application fits like nothing else.
| trompetenaccoun wrote:
| IPFS is a file system, Web3 is an idea/marketing term to
| promote blockchain services, so I'm not sure what you mean by
| that.
| detaro wrote:
| Web 3.0 has been used for a long time to mean any
| P2P/distributed/... approach, not just blockchain, even if
| the blockchain people try to completely take over the term
| sometimes.
| andy81 wrote:
| Web3 has also been used to describe web pages designed for
| easy parsing.
|
| Reader view, tools for the visually impaired, and browser
| automation are actually useful and commonly used, so that
| definition win the title for me.
|
| There are certainly useful distributed web tools (e.g.
| email, TOR, IRC, Matrix, self-hosting, bittorrent), but
| they're the opposite of recent trends towards monopoly.
|
| The distributed meaning is absolutely poisoned by
| blockchain at this point.
| px43 wrote:
| Web3 has a storage layer, a messaging layer, and an execution
| layer. Most popular Web3 apps use Ethereum for execution,
| IPFS for storage, and some custom websocket garbage for
| messaging, but there are many viable Web3 stacks out there
| that people are using.
| spicybright wrote:
| What actually defines web3 software? Is sending emails with
| .exe attachments considered web3?
|
| Like, if we compare this to RESTful servers, there's no set
| definition but nearly everyone agrees it's verbs and paths
| over a hierarchical API sending JSON back and forth over
| HTTP[S].
|
| It seems like most people can't agree on anything except
| using etherium as a backbone.
|
| So calling something web3 doesn't seem to do a good job
| describing things like REST or like something like you
| wrote above.
| nl wrote:
| See also Web 2.0
|
| It's not a technical spec.
| joshcryer wrote:
| Brave is using IPFS for file storage but once the content
| address (CID) is known anyone can access the file you're
| looking for. So it remains to be seen how they will leverage
| IPFS to create scarcity of digital items for their
| merchandise store. It is a step backward and not what IPFS
| goals were. A huge number of books are currently on IPFS
| through libgen, and scihub is going to IPFS eventually. Web3
| is just a step back from the greatness that the internet
| could be. With "decentralized" oracles (3 mining pools
| control Eth), and centralized front facing websites simply
| verifying some hash of something.
| [deleted]
| spullara wrote:
| Didn't realize 7+ years old is "new" in tech terms.
| baggiponte wrote:
| I don't understand what this implies/enables O.o could somebody
| be kind enough to explain? Thanks!
| k__ wrote:
| You can use ipfs protocol instead of http.
|
| It will start a local ipfs node in the background. Which is
| basically a local webserver.
| eminence32 wrote:
| Specifically, it's a local process that participates in the
| global IPFS p2p network, and also exposes content via a local
| web server
| igorkraw wrote:
| Sounds like fun in jurisdictions where seeding a torrent
| can get you a copyright lawsuit like my native Germany
| zcw100 wrote:
| This is a common misperception of IPFS. IPFS does not
| push any content onto your node or force you to host
| random content. It will only host content you have added
| or requested to be added to your node.
___________________________________________________________________
(page generated 2022-05-24 23:00 UTC)