Hacker News Reader

The visitor needs to chose to run IPFS and cache it

He just needs to happen to have IPFS running. Any website can make a request to localhost via Javascript or even without.

Scenario:

Attacker sends you harmless looking link to a page that contains some invisible JS that sends a request to localhost and pins kiddypon on your IPFS node. Attacker then sends the police to you.

um, cross origin blocking has been a thing for... like a really really long time now.

The IPFS API isn't exposed like that, there is actually a whitelist for hashes that can access the API (the IPFS webui is in the whitelist by default), and hashes that are blocked will get a 403.

Reply on news.ycombinator.com