Show HN: IPFessay – Publish uncensorable essays to IPFS | Hacker News Reader

Show HN: IPFessay – Publish uncensorable essays to IPFS

gitlab.com

147 pointsstavros58 comments

For context: IPFS is a distributed content-addressable storage system that is web compatible. If you want to learn how to use IPFS directly (i.e. without using and trusting a public gateway), start with the Getting Started guide: https://ipfs.io/docs/getting-started/

(I'm not the OP, but) If you want to use IPFessay without installing IPFS, you can use it on my hardbin.com public writable gateway (most gateways are not writable) at:

https://hardbin.com/ipfs/QmQUrYJ6sCSDV6duC4Db7U8NXZG3DpNrVF7...

and the sample essay:

https://hardbin.com/ipfs/QmWFSuFDaApxK6DaBzEXdSXhb325fQY1hHn...

And if you want your resulting essay to stick around, you can pay a service like ipfsstore.it to pin it for you: http://ipfsstore.it/

EDIT: It doesn't actually work on my public gateway because it uses the IPFS node API instead of the standard writable gateway API. I'll submit a pull request to make it use the normal writable gateway API tomorrow.

EDIT2: StavrosK has updated it to use the gateway API! I updated the hash link so it does now work :)

Hey, thanks! Can we make it use your API by default, or perhaps as a fallback?

I'm not sure what the difference between the Node API and the Gateway API is, I had to hack around this by reading the js-ipfs code. If there's a better way to interface with the gateway without including the entire js-ipfs 2.5 MB file, please let me know.

It's not my API, it's the standard IPFS writable gateway API, documented here: https://discuss.ipfs.io/t/writeable-http-gateways/210

And there's an example usage here: https://github.com/jes/hardbin/blob/master/js/hardbin.js#L25

There is currently a bug which means you first need to DELETE the filename (in my case "content") that you are trying to replace if it already exists, but apart from that it is straightforward.

I started fixing the bug here https://github.com/ipfs/go-ipfs/pull/3931 but ran out of steam - hopefully I'll continue soon.

Sorry, I meant your gateway. Thanks for the documentation, I had no idea this existed. I'll have a look, but if you already know how to use this API and would like to issue a MR, I'd be grateful.

EDIT: I have updated it to use the Gateway API, thanks for letting me know.

Excellent! I updated my comment.

> Here's the permanent, immutable IPFS link to your essay: > /ipfsQmZo1JgakWB2ZYrA75P3b7eZxvwP1vKpDw2y7WJJhj8j7p

There's a "/" missing in here :)

Fixed, thanks! I have taken the liberty of linking things to hardbin.com, including the IPNS link:

https://hardbin.com/ipns/QmSWnBwMKZ28tcgMFdihD8XS7p6QzdRSGf7...

Thanks for your help!

IPFS isn't "uncensorable" and shouldn't be promoted as such. Nodes must openly host your content for it to be available in the network.

Everybody on the network is a node. As long as anybody who is hosting the content (even implicitly, in their cache) is online, it remains reachable.

Doesn't that create some legal issues?

By viewing some of these IPFS links higher up in the thread am I "distributing" their contents in the eyes of the law?

Unlikely. Even if you saw something "bad", you have a perfectly reasonable explanation. I don't think it'll be a problem.

I mean, people have had doors kicked down for operating Tor exits.

http://www.npr.org/sections/alltechconsidered/2016/04/04/472...

> Seattle police spokesman Sean Whitcomb says the department understands how Tor relays work, and they knew Robinson was a Tor host.

> "Knowing that, moving in, it doesn't automatically preclude the idea that the people running Tor are not also involved in child porn," Whitcomb says. "It does offer a plausible alibi, but it's still something that we need to check out."

As far as I understand, you only distribute objects when you pinned them.

https://discuss.ipfs.io/t/replication-on-ipfs-or-the-backing...

Pinning ensure that the content doesn't get pruned when your clear your node's cache. I think as long as you have a block of any file you'll be a provider as well.

I think this opens up an issue of copyright, there are several public IPFS Gateways available on via HTTP. If you host a bad file, you can essentially pull it through any of these public IPFS Gateways to create other seeders for your file.

Keep in mind, there is no guarantee to how long those seeders will have the file, but they do become seeders for your file for some amount of time, at least until they clear their cache or other files need the space and prune your file.

This is one reason I stopped running an IPFS Gateway. You don't have to look very hard to find copyrighted material being served via IPFS.

I've seen some IPFS links that are unreachable because of copyright issue.

Hm, I think what you've seen is some gateways who blocked access to some content because of copyright protections. go-ipfs or js-ipfs have no built-in way of blocking content.

It is effectively uncensorable because the world is not 1 government, but 200 something. And no matter how much kicking and screaming the US does, not every country will comply.

It also uses the fact that the IPFS cache is also used to deliver content to others, similar to the way Bittorrent allows downloading and uploading based on blocks of content.

There still has to be someone hosting it initially to spread. But even that can be done over Tor, given the patches from OpenBazaar and IPFS.

> not every country will comply.

Then host it in one of the non-compliant countries, no need for IPFS.

Then the other countries can just block that host.

Starting from May 18, 2018, the EU will enforce "the right to be forgotten".

Will it be illegal to run IPFS servers within the EU?

The right to be forgotten does not censure publication. It is censorship on search.

Exactly - the right to be forgotten only applies to the results of search engines when querying an individual's name, so publishing or hosting "forgotten" content wouldn't be illegal - https://en.wikipedia.org/wiki/Right_to_be_forgotten

Running IPFS by itself does not mean you're hosting all content in the IPFS network. Rather, you need to explicitly agree to share content for it to be served.

If you are hosting certain content, I guess someone can approach the node owner and request you to take the content offline. But nodes outside EU could still host the content.

> Rather, you need to explicitly agree to share content for it to be served.

Hmm, how do you do that? My node is sharing all content in its cache by default, AFAICT.

Accessing content puts it in the cache, which would be removed when `ipfs repo gc` is run (or automatically at certain points). However, content that is pinned will survive the GC, which is the explicit approval of content that should be seeded for as long as the node exists (or until you run `ipfs pin rm $HASH && ipfs repo gc`)

Ah, by "all content" you meant "all content", I see. Yes, but "explicit agreement" is just "loading the content", so it's not very explicit.

I think this might actually be covered by existing data protection legislation; if you're publishing personal information about someone, it doesn't make any difference whether that's on IPFS or whatever. You'll have to be amenable to takedown requests.

(Copyright will make this an issue first, though!)

Does it enforce Cross-Origin Policies?

Since the addresses are just path components and not subdomains this may be an issue.

It's just a feeling this might get relevant, especially with PUT/POST write API and so on. Even just running on localhost might pose issues.

Does what enforce it? The browser does, that's why you need to set CORS on your local node for it to work. What's the scenario you're thinking of?

So in order for this to work through a gateway, that gateway needs to set the CORS headers, or?

No because you'll be fetching it from the gateway, and then writing to the same gateway. No cross-domain going on.

But then is it not a security problem that other IPFS apps retrieved through the same gateway will be seen by the browser as being of same origin?

Yes, for now. There is code existing to set the Suborigin header, but browser support is limited, and I'm not even sure if that code is merged into mainline IPFS yet.

Different authors and documents are considered part of the same domain since the tokens are just path elements. The whole IPFS gateway might be considered one big domain.

So javascript in an essay can access/put the API.

I didn't really look into it too much, just wanted to give a pointer that this might need to be considered. In the sense that it might have security implications.

No, you're right in this, if you have it enabled, any app can put stuff to your endpoint. The people of IPFS are working on fixing this problem, but I personally think that the risk is low enough. Maybe I'm just not creative enough in thinking about attacks, though.

These are only as “uncensorable” as any other IPFS object, right?

Which is to say, not very. IPFS isn't even encrypted right now.

Yes, they are.

Although, how is IPFS censorable? As long as you can connect to a node, you can retrieve its content. You'd have to prevent connection to the entire network to censor something (minus the encryption that you correctly stated).

> You'd have to prevent connection to the entire network to censor something

That's not necessary if you can perform deep packet inspection or a MITM attack on IPFS traffic, which there's nothing to stop you doing right now.

Very soon it will be able to work over TOR hidden services.

It already does. Check out OpenBazaar's patches that include Tour and I2P functionality.

That's what I was referring to: their Tor support is not in mainline IPFS yet, AFAIK, although it should be soon.

Yeah, primarily, OpenBazaar did it a way, and the #ipfs team in freenode isn't sure if that's the best way.

It primarily has to do with Kadmelia and DHT. How does one consider an adapter or transit to IPFS as a "secure don't leak other addresses"? Does one run a secure IPFS for Tor and I2P? Should it be integrated with a flag on those interfaces?

The IPFS team wanted to get everything else settled, protocol-wise before going down the idea of secured, and hidden protocols, given IPFS's propensity of splattering all interfaces through it (even unroutable internal network addresses).

There's nothing to stop you now, but that's just because there's no encryption. Once encryption is implemented, this will be harder/impossible to do (especially since it's trivial for a client to verify that the content it got for some hash is correct).

Perhaps it'll be a great system if or when that happens. But it is a stretch to call it “uncensorable” when it isn't, and clearly hasn't been designed for it.

I don't know, when censorship entails deep packet inspection between all pairs of nodes on the internet, I'm good with "uncensorable" as a shorthand for "practically impossible to censor unless you control the entire internet".

You don't need to control the entire Internet.

See: Firewall of China.

You only need to control the big fiber paths of which there aren't many. Of just in general the exit and entry points between countries.

The Internet is not an open mesh.

Even with the firewall, you can't control what's going on inside of China, and you only need one node inside to fetch something from the outside, and that's it.

You can certainly control incoming traffic to china.

And once inside, you are subject to extreme government spying which can easily mean that everyone who gets a hold of unallowed content "vanishes".

Furthermore, this is an issue not even encryption can fully solve, you still need to do a key exchange which means you need to either find a source of trust in the other side via sidechannels (aka PKI, TOFU or similar) or you allow everyone to easily intercept the data without much effort (aka skip-verify on TLS)

The internet in china is not lacking in surveillance and censorship.

This is an issue that even Tor is still chewing on a lot, afaik plain Tor connections in China are not very welcome and even blocked.

So unless you claim that your crypt and security is better and more battletested than Tor, I'd say IPFS is anything but censorship resistant.

You can always have a USB-stick with the IPFS repository on it, and travel to china, setup your node within and start sharing it. People can trust the data is correct as they request the data based on the hash.

Another way to distribute once the data is within China is to do it via private networks built with cjdns or similar

This assumes that your USB stick doesn't get checked on the airport.

Secondly, people can exactly not trust the data because there is no way to trustlessly get those hashes to begin with from within IPFS and you get back to normal HTTP which... is censorable.

Lastly, this also assumes that the one running the node is not arrested either.

>Another way to distribute once the data is within China is to do it via private networks built with cjdns or similar

Which again, assumes cjdns and other methods do not get people into possibly lethal trouble or aren't censored/outright blocked to begin with.

edit: You also forgot about the government blocking IPFS within their own country.

So, is IPFS more than Freenet + a fresh coat of 2017 paint?

Yeah, I would say the biggest difference is in how content gets reshared. With Freenet, content gets reshared by nodes as soon as it enters the network, and users are unaware of what content exactly they are sharing.

While IPFS is not implicitly pushing content but nodes needs to request content and then reshare it.

This is very important, because it removes some of the most prevalent criticisms about Freenet. If you don't agree with some content (re: legality or any reason you wish), don't access it/share it. Freenet doesn't give you that choice, but IPFS does.

I don't think "essays" are in great danger of being censored on the internet.

Call me a romantic!

Germany has been raiding homes over Facebook posts. Right now they're considering a law to fine social media companies who don't remove certain posts within 24 hours. https://www.nytimes.com/2017/06/20/world/europe/germany-36-a...

Twitter already blocks known Nazi accounts in certain countries. https://twitter.com/map/status/869594711991963653

And you don't have true freedom of speech unless you allow speech you disagree with... I wonder how we got to the current "speech is free unless you're someone we don't like" society, and I say this as someone who dislikes Nazis.

I want to write a post on tolerance one of these days, and how tolerating things you like isn't really tolerance.

> how tolerating things you like isn't really tolerance

This idea was presented in section 1 of

https://slatestarcodex.com/2014/09/30/i-can-tolerate-anythin...

Yes, I had read that, it's a very interesting piece. I had some more thoughts on the matter, but that article is definitely worth a read.

Reply on news.ycombinator.com