11–20 of 63 posts
> the gateway is in full control and can inspect and tamper with the data as much as it likes Inspect, yes, but tamper? IPFS content IDs are hashes, so it seems like it should be possible to verify what you have been sent if you really cared enough to do so.
> the gateway is in full control and can inspect and tamper with the data as much as it likes Inspect, yes, but tamper? IPFS content IDs are hashes, so it seems like it should be possible to verify what you have been sent if you really cared enough to do so.
IPFS content IDs are hashes of the DAG of the content. That DAG chucks up the data and includes it directly in itself. There isn't a tool today that can verify an IPFS address without actually downloading that file's DAG, which is basically downloading the entire file.
The same argument basically applies to DoH (DNS over HTTPS).
So basically CURL will get support for IPFS by using a proxy service (which is bad for user privacy). And said proxy could bounce your request around for max 30 hops before a random IPFS-proxy honors the request. This is horrible for user privacy. Brave browser [1] at least has a native support for IPFS and no need for proxies at all. > Other IPFS privacy concerns: Brave, the browser, has actual native IPFS support (…
It literally says: I have insisted, in the PR for ipfs support to curl, that the IPFS URL handling code should not automatically follow such gateway redirects, as I believe that adds even more risk to the user so if a user wants to allow this operation, it should be opt-in.
Earlier quoted context omitted.
IPFS content IDs are hashes of the DAG of the content. That DAG chucks up the data and includes it directly in itself. There isn't a tool today that can verify an IPFS address without actually downloading that file's DAG, which is basically downloading the entire file.
That's what he said: you can veify the file's hash after you downloaded it, to make sure it wasn't tampered with...
Imagine if I gave you a file out of a git repo, and the long commit hash. It's insufficient on its own to verify integrity, you need the intermediate nodes.
With ipfs you can infer that it used the reference chunker and try to reproduce the DAG but there is no guarantee it will work.
Better to just speak ipfs to the p2p net and get the DAG.
It needs censorship-resistance added. It needs user privacy added.
Both of those could be enabled by combining data blocks semi-randomly. Ie. rather than downloading the data you're looking for, you download a block of data containing what you're looking for and some other data. Then nobody knows what it was you were looking at. Some combined blocks might contain a few bytes of data from thousands of files.
For censorship resistance, rather than users pinning individual files, the network needs to assign them blocks they must store (or be kicked off the network). Some of those blocks will be combined blocks which contain a few bytes some users may not wish to store - and that's fine, it means IPFS isn't for them.
Remember that data can be encrypted by content hash, so there is no way to know what you're storing unless you go scouring the public internet for a key to decrypt it.
This is silly. You could say the same for files CURLd from servers over http today. Did you know that when you download files from the internet, you're putting yourself at risk of the server tampering with your file before serving it to you??
a better analogy than http urls would be git commit hashes.
The same argument basically applies to DoH (DNS over HTTPS).
IPFS isn't fit for purpose. It needs censorship-resistance added. It needs user privacy added. Both of those could be enabled by combining data blocks semi-randomly. Ie. rather than downloading the data you're looking for, you download a block of data containing what you're looking for and some other data. Then nobody knows what it was you were looking at. Some combined blocks might contain a few bytes of data from t…
http and tcp, other transport systems, also do not have censorship resistance. it's the wrong place for it.
you can use ipfs to build a censorship resistant system, just like you can with tcp, but that is the purview of a higher layer.
Also you can use the CID (which is a hash), to verify the content hasn't been tampered with.