Hacker News Reader

Ipfs exposes a JSON API locally. Not sure why the author didn't just use a JavaScript front end making calls to the local API.

https://ipfs.io/docs/api/

EDIT: I'd encourage the HN community to look past the technical merits of the code, and focus on the idea presented (and even perhaps fork and contribute back an improved version).

View on HN

As you suggest, looking past the code quality / implementation choices I believe the idea if solid and it is a creative use of IPFS to attempt to 'solve' a real world problem, I'm excited to see more projects like this.

Hm what prevents some malicious website from pinning unwanted content on a visitors machine?

The visitor needs to chose to run IPFS and cache it

He just needs to happen to have IPFS running. Any website can make a request to localhost via Javascript or even without.

Scenario:

Attacker sends you harmless looking link to a page that contains some invisible JS that sends a request to localhost and pins kiddypon on your IPFS node. Attacker then sends the police to you.

The IPFS API isn't exposed like that, there is actually a whitelist for hashes that can access the API (the IPFS webui is in the whitelist by default), and hashes that are blocked will get a 403.

um, cross origin blocking has been a thing for... like a really really long time now.

Reply on news.ycombinator.com