IPFS Companion 2.2.0 brings window.ipfs to your Browser • Hacker News Board

Re: IPFS Companion 2.2.0 brings window.ipfs to your Browser

#21

Post by diggan » Fri, Apr 13, 2018, 4:52 AM UTC

kybernetikos wrote: post #18

asymmetric wrote: post #16

Is it possible to completely/selectively prevent websites from knowing I have IPFS running in my browser? Or does this extensions have the same issues as Metamask[0], which means there's no way to hide the fact that one has the extension installed? This is a pretty important privacy feature, because I'm pretty sure the presence of such an extension massively increases the accuracy of targeting.

I agree, and looking at their site, they don't seem to have taken steps to avoid this problem. I wonder if we could have a standard api, like window.requestAPI('ipfs' or 'eth' or whatever) returns a Promise, and the user gets a 'page is requesting' bar like we do with location requests. That way, you wouldn't be leaking information about your browser capabilities to pages that you don't wish to use those capabilities…

The reason why window.ipfs is so great is that it opens up for a very easy migration path for when IPFS is embedded directly in the browsers.

So as a application developer, you would check if window.ipfs exists on the page, and if it doesn't, load js-ipfs and then the rest of the page can function the same way, no matter how ipfs was loaded on the page.

Unless we can be sure that when browsers implement IPFS, window.requestAPI('ipfs') would be the API, going the route we're taking now is the safest bet, unfortunately.

(Disclaimer: I work on IPFS)

Re: IPFS Companion 2.2.0 brings window.ipfs to your Browser

#22

Post by diggan » Fri, Apr 13, 2018, 4:53 AM UTC

johnhenry wrote: post #2

I'd really love to see something like this show up as a proposal with the W3C (or the WHATWG -- I'm not entirely sure who's the authority on this?).

Yes, this is definitely something we're planning to once we get closer to a v1 of all the parts. Today it's probably a bit too early but specifications are a core part of our general pipeline (but we can still get better)

The goal is to end up with standardized implementations so we can have multiple implementations and a open protocol.

(Disclaimer: I work on IPFS)

Re: IPFS Companion 2.2.0 brings window.ipfs to your Browser

#23

Post by diggan » Fri, Apr 13, 2018, 4:57 AM UTC

fogzen wrote: post #3

Dat+Beaker is way ahead of IPFS in tooling, developer mindshare, consumer friendly UI, etc. With $250 million it's pretty shocking they don't seem more worried/focused on that.

Dat and Beaker seems to be more focused on building products than us currently (I work on IPFS) so the more consumer friendly UIs does not surprise me. However, we're (Protocol Labs) are trying to build standardized protocols that can be shared across projects rather than just for us, hence it's currently more focused on lower-level technologies. With that said, we also have higher-level projects, most of them can be found over here: https://github.com/ipfs-shipyard/

(Disclaimer: I work on IPFS)

Re: IPFS Companion 2.2.0 brings window.ipfs to your Browser

#24

Post by ghthor » Fri, Apr 13, 2018, 6:20 AM UTC

asymmetric wrote: post #16

Is it possible to completely/selectively prevent websites from knowing I have IPFS running in my browser? Or does this extensions have the same issues as Metamask[0], which means there's no way to hide the fact that one has the extension installed? This is a pretty important privacy feature, because I'm pretty sure the presence of such an extension massively increases the accuracy of targeting.

Thank you for bringing this up. I have a sticky task on my wall for this feature to bearded to metamask for this exact reason. Right now you're only protected by obscurity, the user needs to be able to whitelist domains or accept domain/dapp public keys.

Re: IPFS Companion 2.2.0 brings window.ipfs to your Browser

#25

Post by alwillis » Fri, Apr 13, 2018, 7:01 AM UTC

diggan wrote: post #23

fogzen wrote: post #3

Dat+Beaker is way ahead of IPFS in tooling, developer mindshare, consumer friendly UI, etc. With $250 million it's pretty shocking they don't seem more worried/focused on that.

Dat and Beaker seems to be more focused on building products than us currently (I work on IPFS) so the more consumer friendly UIs does not surprise me. However, we're (Protocol Labs) are trying to build standardized protocols that can be shared across projects rather than just for us, hence it's currently more focused on lower-level technologies. With that said, we also have higher-level projects, most of them can be…

I've been playing with command line IPFS since the early days, but a menu bar IPFS app for my Mac? Now that's pretty damn sweet.

Kudos!

Re: IPFS Companion 2.2.0 brings window.ipfs to your Browser

#26

Post by zaarn » Fri, Apr 13, 2018, 7:57 AM UTC

johnhenry wrote: post #19

fogzen wrote: post #3

Dat+Beaker is way ahead of IPFS in tooling, developer mindshare, consumer friendly UI, etc. With $250 million it's pretty shocking they don't seem more worried/focused on that.

It's interesting to point out that in addition to Dat support, Beaker initially had support for IPFS as well, but dropped it. Currently Dat's browser integration model requires the use of a specific browser (Beaker). Not that Beaker isn't awesome; I think Dat would garner more mindshare if it moved to browser-extension-based model like IPFS and didn't require a full installation of a new browser.

I think there is a plugin for firefox in development to enable the usage of dat:// urls. I recall seeing that in my mastodon feed.

Re: IPFS Companion 2.2.0 brings window.ipfs to your Browser

#27

Post by kybernetikos » Fri, Apr 13, 2018, 2:01 PM UTC

diggan wrote: post #21

kybernetikos wrote: post #18

Earlier quoted context omitted.

I agree, and looking at their site, they don't seem to have taken steps to avoid this problem. I wonder if we could have a standard api, like window.requestAPI('ipfs' or 'eth' or whatever) returns a Promise, and the user gets a 'page is requesting' bar like we do with location requests. That way, you wouldn't be leaking information about your browser capabilities to pages that you don't wish to use those capabilities…

The reason why window.ipfs is so great is that it opens up for a very easy migration path for when IPFS is embedded directly in the browsers. So as a application developer, you would check if window.ipfs exists on the page, and if it doesn't, load js-ipfs and then the rest of the page can function the same way, no matter how ipfs was loaded on the page. Unless we can be sure that when browsers implement IPFS, window.…

It's a pity that people aren't more concerned about the problems of leaking information to potentially hostile websites and polluting the window object with their project specific objects.

As the earlier poster mentioned, Metamask had this exact problem and it's been widely commented on. Of course the metamask problem is worse than the IPFS problem, as it marks a user as a potential target, whereas IPFS by itself probably doesn't do more than mark them as someone interested in the distributed web.

Your argument for why you do it seems to be a non-sequitur. Whatever you choose for how IPFS Companion exposes the api can be exactly the same as how the future browser exposes it. In fact as an early mover, you have an opportunity to do something positive and set a good direction for the built in functionality that comes later.

It's not a problem that there is consensus on how to solve yet, but I believe a standard solution built into browsers for exposing apis with capabilities we may not wish some sites to observe is needed. Polluting the window object with a host of api objects is likely to be a bad idea long term.