IPFS Maintainers Winding Down
ipshipyard.com
ipshipyard.com
*The IPFS Project is not sunsetting or shutting down* - just switching to individual maintainer grants instead of centralized implementation support within Shipyard.
Protocol Labs is moving and offering to pay (as far as I understand) the same maintainers and developers directly; just not via Shipyard.
It's still a a real loss, those are widely used products, but the signal that Protocol Labs is sending about IPFS in defunding this might be even worse for the ecosystem. Cloudflare, Brave, and now Protocol Labs have abandoned it.
Maintainers of IPFS are winding down is much more informative for those not in the space.
The end of IPFS at Shipyard: (Many) IPFS Maintainers Winding Down
In November 2023 Protocol Labs published a plan for exactly this situation: independent foundations, IP transferred out of Protocol Labs, the IPFS and libp2p teams becoming independent entities, and public goods funds that Protocol Labs made "a major pledge" to. https://pl.xyz/blog/advancing-ipfs-and-libp2p-governance/
Three years on, the entity those maintainers formed is winding down because that funding was not renewed, and the most detailed public account of what replaces it is a comment in this thread. pl.xyz still says Protocol Labs "continues to support those projects".
Shipyard's last day is September 30. Can you name who holds Kubo, Boxo and Helia on October 1? Not the funding mechanism, the people: who has commit and release rights, who receives an embargoed vulnerability report, and who decides when a fix ships. A grant that has not been awarded yet is a plan to make a plan.
Same for "one of many IPFS implementation maintainers". Which other team ships Kubo, Boxo or Helia? Iroh is a separate project, not a second maintainer of these.
These questions are already on the forum and unanswered: https://discuss.ipfs.tech/t/what-happens-to-ipfs-maintenance...
For anyone wondering, there are more sustainable (with a viable, focused business backing the project) options to do p2p, namely Iroh - https://www.iroh.computer/ which was built by ex-IPFS ex-Protocol Labs devs (I have no relation to the team beyond having worked with them back in the day).
Sadly Protocol Labs is doing.. ehh whatever now, except apparently supporting the projects it got its VC/crypto funding from.
If you want full ipfs functionality, we have a number of protocols you can combine: blobs https://github.com/n0-computer/iroh-blobs and gossip https://github.com/n0-computer/iroh-gossip .
There is one thing we do not have yet - global content discovery. The reason for this is that so far we have not found a way to do it in a way that just works.
It is a very hard problem, but I hope we can come up with a solution so we can cover the use cases that initially got me excited about IPFS many years ago.
And also working to replace the Radicle's networking stack with Iroh: https://radicle.zulipchat.com/#narrow/channel/369274-General...
Basically Tailscale but embedded into the app without the hassle of requiring users to setup accounts.
Besides just p2p streams seem to be much more useful, those are plug-and-play into most software, e.g. I wrote https://github.com/magik6k/git-remote-iroh that just plugs the git remote proto into iroh and lets you move repo commits between computers by just copying a string from one place to another on push. Doing that with blobs - not gonna happen, not that easily.
We realised that there are many more use cases for p2p streams than for blobs, so in the last year we have focused on getting iroh to 1.0, which involved implementing our own multipath QUIC implementation based on quinn. This was a lot of work and took the full focus of the team.
That being said, we plan to continue to work on blobs and get it to 1.0, which will involve some API changes and some internal changes, primarily to the blob store.
The blobs network protocol itself is just BLAKE3 verified streaming with a few tiny modifications (chunk groups) for efficiency, and hasn't changed since 2 years. Not because we don't have time for it but because it is done.
My personal goal is to have blobs working so well that you can forget about it, and also provide a solution for global content discovery.
The way I would put is as: Iroh + iroh-blobs == libp2p + UnixFS + Bitswap, and the latter three are some of the critical components that have defined most IPFS implementations.
inauthentic activity seems to move from one product space to another. in 3 years we'll be hearing about stripe shutting down openrouter for example.
IPFS, Freenet, and experiments like that mainly serve as a place for people to store and distribute pirated copyrighted material, child porn, hit lists, terrorism manifestos and plans, and the like.
Scratch a libertarian and, nine times out of ten, you'll find someone who advocates for no or minimal government because they want to do something the government legitimately bars them from doing. Scratch a libertarian decentralized P2P E2EE communication project and you'll find... well, this kind of material nearly every time.
Worse you can store child porn as paper pictures in your house and can privately communicate in there with other unknown people and mignt even be do something illegal there. Do you want to install some police security camera in your toilet?
Oh, and in some countries being LGBTQ+ person or political activist or women right activist is illegal and will land you to execution on chop chop square. Should we also let all the governments find these people too?
> a libertarian decentralized P2P E2EE communication project
Your argument makes sense for Freenet (though I'd personally defend that project too); but not so much for IPFS.
Firstly, IPFS doesn't have any encryption (E2E or otherwise).
Also, Freenet spreads data around the network (for robustness and plausible-deniability), so the peers providing a file are not the peers which inserted it. IPFS does no such thing: if you want your content to remain available, you'd better be running an IPFS node that provides it.
Either way, it feels like a pretty bad idea to host dodgy stuff on IPFS.
IPFS is much closer to HTTP. The difference is that content is immutable, and can be re-hosted by anyone that happens to have a copy (e.g. no need for mirrors, etc.).
(Note that HTTP was invented to disseminate physics research; not CSAM)
However - important clarification about the Shipyard post that I think a lot of folks are confused by:
While its sad to see the Shipyard team sunset, the IPFS project is decentralized & robust to a single party moving on. IPFS the project/network is not sunsetting or shutting down!
Current focus is lighter-weight stewardship from the IPFS Foundation via grants to individual maintainers, & development of decentralized public infra tools like the Service Worker Gateway.
DASL specifies CIDs, CAR and deterministic CBOR. It deliberately does not specify UnixFS, and it has no way to chunk a file into blocks. UnixFS is what ipfs add has produced since 2015, and what Kubo, Boxo, Helia and the gateways address today. So DASL is the naming layer, not "the core content addressing layer of IPFS". Writing a new format is easy. The stability people built on came from not rewriting this one, and from someone shipping it in the software they already run.
I run Kubo and Helia in production. "Robust to a single party moving on" would be easier to accept with answers to these:
- Who triages vulnerability reports and ships fixes for Kubo, Boxo and Helia after September? Does the contact in https://github.com/ipfs/community/blob/master/SECURITY.md still reach a person? - Will anyone cut releases, or should operators pin current versions and plan around that? Should we expect a community fork? - Who operates ipfs.io, dweb.link and delegated-ipfs.dev day to day after September, and with what experience running public infrastructure at that scale? - What happens to the Service Worker Gateway at https://inbrowser.link ? - What happens to Badbits at https://badbits.dwebops.pub ? Does it stop being updated when Shipyard turns the lights off?
A grant to an individual maintainer is not the same as a named owner with commit rights and a release process.
On the Service Worker Gateway as decentralized public infrastructure: the subdomain gateway spec requires a wildcard TLS certificate for the ipfs and ipns subdomains, plus a Public Suffix List entry so each CID gets its own origin. You also need a denylist, or you end up serving phishing. Very few people reading this thread can self-host that, and the ones who try will meet the abuse problem next.
The same questions are open on discuss.ipfs.tech. A direct answer there would help more than reassurance here.
A year or so ago I wrote IPFS-boot which allows serving webapps on IPFS while providing also an update path and without breaking content hashing:
https://github.com/rhodey/IPFS-boot
But now if you want to serve a secure webapp and not use IPFS IMO the only option you have is to tell users to install Tailscale and to host the webapp themselves and then to install Tailscale on all devices.
If you want to reference resources securely, https://developer.mozilla.org/en-US/docs/Web/Security/Defens... is available and widely supported.
Non technical users like pronounceable domain names. It's why we aren't just using IP addresses.
CAS is intimidating to non-technical types.
>I think something like IPFS is definitely needed. There is nothing stopping you from distributing a webapp on bittorrent but you'll also need to add a README for instructions on how to run the webapp on localhost so a browser can render it. So thats not something that any non-technical user wants to do.
This quoted comment assumes there's a web app that is sufficiently complex as to require a readme to run it, but that's too complex for normal people.
But somehow, a link that looks like `ipfs://12340-9q5ui1j2;lk3rjq;ladksfj` won't scare those same people off?
Color me extremely skeptical.
Why would non-technical users be looking at raw URLs? Surely links "look like" blue underlined text; or a button; or whatever?
Surely you jest. Have you heard of this thing called the address bar? Do you think non technical folks don't know what "Google.com" is?
How many normies working office jobs get it drilled into them "don't open links if you don't recognize the domain"?
How do normies share urls? They paste them into Whatsapp group chats.
Regarding an "update path", GNS has support for that built-in; though I've not been able to try it myself, since I can't get GNUNet to bootstrap :-(
For a real world example of a hybrid approach that works see bittorrent where torrents can optionally contain urls that point to alternate download sources in order to speed up the initial seeding phase.
There is already a perfectly good incentive mechanism: if someone wants to host some data, they can; and if nobody wants to host it, it doesn't get hosted.
That's worked perfectly well for HTTP, without any shitcoin needed. The advantage of IPFS is that its URLs resolve to anybody who cares enough to host that data; so links will only 404 when nobody cares (unlike HTTP, which relies on a single point of failure).
Edit: Okay, so a couple of people have downvoted but no-one has answered.
Why would you use tailscale to secure a web app?
One important thing I'd like to see IPFS or a similar decentralized web technology achieve, is getting rid of the necessity of filling out a Google form in order to tell the Shipyard people what I think about their maintenance of IPFS.
Seriously it bugs me when people who ostensibly care about decentralized or privacy technology use a centralized service hosted by a gigantic tech company to accomplish a task because it's convenient (if you already have an account with them), and don't even try to make a decentralized version available. It would have been better if they simply invited people to send them an email.
Google demands logins if the Form includes any attachments at all.
This is the last gasp of a blockchain hype cycle solution that never found its problem.
Sort of an interesting market signal. "Don't bother building for me unless you're absolutely pure". Funny stuff.
I remember in 2015 having the IPFS concept blow my mind its such a memorable moment when it really felt like someone designed something significantly different that current mainstream paradigms. But in the end it seems like it was still a case of a cool technology looking for a use-case not solving a real problem.
I gave my static photo album website image files paths that consisted of /ipfs/ as directory name and ipfs hash as file name.
Brave browser was able to figure out that this meant they were available on IPFS, and asked me if i wanted to load the files from IPFS instead of from the web server itself.
So over time if hosting files on IPFS got popular, it could have been used automatically by browsers later to load the files from IPFS instead of the web server of the site. Saving bandwidth for the website operators and distributing storage of content which might also help it remain available for longer time.
That sort of thing would have been one great outcome, for example, where this sort of hosting your own http gateway for your own IPFS files makes sense like I was doing. Mind you, the web server setup for this was completely straightforward and requires no running of the IPFS services on the web server itself. On the web server it really was plain old directories and file names. As long as they are real IPFS hashes. And calculating the IPFS hash itself I did on my laptop when adding photos.
Very sad to hear in this thread that Brave browser has actually removed IPFS support :(
Unfortunately that hasn't panned out; but it still feels more feasible than getting Microsoft and Apple to add it to their OS network stacks.
It kinda feels like the AWS or Azure of file distribution, so much stuff so confusing. Also apparently with Protocol Labs owning several of those things despite not operating those things?
Ironically seems quite a fragile setup.
Regardless, very sad news.
See: https://pickipedia.xyz/wiki/Cryptograss:Delivery-kid
If IPFS is starting to wane, does anyone else have a suggestion of a replacement about which I might start to educate my fans?
The problem was that there was no good client for it that was better than current torrent clients. When I tested it you had to keep a duplicate of the files in the ipfs cache directory and the client was CLI based which would alienate most users. There's probably no way to have private trackers or to track seed/leech ratios for communities too.
Maybe I need to put my music on Arweave.
I know a lot of people on HN are going to call me overly cynical. But this pattern should be so obvious by now. Any cynicism to any new ground breaking technology which is gonna solve a problem that exists because of capitalism, that this cynicism is more than warranted.
At this point we should all be cynical of any new technology.
Being cynical about the tech itself is a bridge to nowhere, though, because it does not preclude its existence or usage, it just cuts you away from any benefits that you can personally get out of it - but you're still affected by all the downsides.
Don't be cynical about tech. Be angry at the people who want to own it all and use it to exploit you.
btw,I thought it was an Initial Coin Offering, not an actual fundraise.
How hard would it be for a country to block the clients and browser extensions you need to use it in the first place? Or to develop a firewall technology that’s capable of blocking the traffic?
Probably not that hard, especially since nobody uses IPFS for anything business critical since it’s not all that great at doing things that you need from file storage systems.
Most reasons you store files somewhere benefit from not being decentralized. You usually want some combination of performance, security, durability, and availability. Decentralization is not generally a demand of file storage.
The only reason it’s decentralized is because blockchain and crypto was hype 10 years ago.
IPFS is not "blockchain" or "crypto"(currency).
It's much closer to git-over-bittorrent. Note that both of those things were decentralised long before "blockchain" and "crypto" existed.
The makers of IPFS also made a crypto thing called Filecoin; but that's a different project. Avoiding IPFS because of crypto is like avoiding the Web because of social media.
I guess the user base has proven this out in the end. Torrents are good enough.
But that didn't pan out.
An ICO is a type of fundraise.
About 800k unique DHT clients are seen weekly.
- ATProto ecosystem (built on IPFS content addressing, used by Bluesky): https://atproto.com/guides/tutorials
- IPFS contribution guide: https://docs.ipfs.tech/community/contribute/contribution-tut...
- libp2p maintainers call (networking layer of IPFS & other p2p networks): https://libp2p.io/get-involved/
Existing bittorrent software is heavily optimized for batch downloads of big files, but that isn't in the protocol.
> We are the core maintainers of IPFS, libp2p, and other foundational open-source web3 primitives.
So they just stopped funding every project mentioned on their site? What's left?
> Protocol Labs is an innovation network driving breakthroughs in computing to push humanity forward. PL connects more than 750 tech startups, funds, accelerators, foundations, open source projects, service providers, and other organizations.
What happened to them? Seems like they drank their own "Web3" Fla-Vor-Aid.
I could never shake the feeling there is an unnecessary layer of grift embedded in all the protocols.
It felt like a really cool demo that never got cleaned up to work as a real production product.
Remember Filecoin? The original concept was that you could buy perpetual storage with a one time payment. It was funded by a crypto asset which was a derivative of mass storage prices, or something like that. Lighthouse supposedly sold such a product.[1] They no longer do.[2]
[1] https://www.lighthouse.storage/blogs/Permanent%20Storage%20P...
I'm personally quite disappointed because I just built an IPFS based system built on top of Kubo that I was hoping would take off. Now this throws future maintenance of Kubo into question.
I believe the fundamental problem of those protocols is everyone fear ending up serving child porn just by running a "node" and taking a chance at explaining the future P2P internet to a judge.
IPFS got a CID deny list [0] but it was too little too late
I get the incentive to drive views but the cost is a substantial number of comments being about the mismatch and not the content
(Couldn't it be that the caching behavior of intermediate nodes still make it a possibility?)
For the endowment setup no one knows if their economic thinking will hold up 100 or even 10 years in the future, so the claims that it's permanent are impossible to verify. I wouldn't call it a scam but I'm not fully convinced.
You are going to see a lot more shutdown posts around decentralized or federated technologies if you do not support those tools.
tried to be the change I wanted to see
given where the concept actually found staying power (liquidity pools, instead of collectibles) it wholly needs a new name
“NFT” is distracting at this point, they should just called them 721-structs so people don’t get distracted by the fumbled poorly implemented art use case
I still think it's pretty obvious that on sufficiently long time-scales that some variant of NFTs will be the winner for event tickets.
right now outside of the web3 space, all promotion companies release tickets in different ways. the ability to resell them is unknown, the quantity for sale is unknown and opaque, the service fees make no sense for the last 20 years, the ability to transfer them is unknown, and the ability to lose your money on an attempted resale transaction is absurdly high. in comparison, all NFTs in the blockchain space inherit solutions to all of those problems and all marketplaces are just UI's on top of data already there in a uniform way, alongside new problems that are mostly education based and won't be solved with a different user experience (akin to how debit and credit cards introduced new problems with automated teller machines many decades ago, that never were solved but didn't deter the concept)
can a centralized marketplace and issuer that conforms solve all of it? of course, but that hasn't been the rubric for nearly a decade....
developing in the blockchain space isn't to attract non-blockchain users - at least for anything that actually earns revenue - its solving frictions for existing blockchain users because they are there, numerous and its lucrative
it's a parallel economy that you either accept the existence of or you don't, there are a lot of people trying to act like it has merged with other economies or asking you to use a big stake of money on blockchain assets with the hope that it becomes a bigger stake of money if they did merge, but that's really a distraction that has little to do with what's already happened and functioning fine
The image is a wholly separate thing that a token points at, and multiple tokens can point at the same thing just fine. NFTs be be funge-free but images are fully fungible.
Insane.
I think a lot of the AI skepticism comes from the fact that the last major New Thing (tm) pushed by this industry was crypto. People are very, very burned by that.
That and how badly social media turned out, but that's a whole different discourse.
What would I have owned exactly? What would have ownership entitled... All very reasonable question. Mostly entirely ignored or handwaved...
And of course there's no reason why a NFT has to be used to represent ownership of some kind of digital art - there are other uses for NFTs, such as modeling transferable network permissions or resources.
Ultimately NFTs are a just a specific application of blockchain technology, to represent some kind of resource on a blockchain which could in principle be digital art. If people care about ownership of NFTs representing digital art, that's a social fact about what kinds of art there is market demand for; and whether it matters that the bytes of the digital art are on a blockchain or linked from somewhere else (where they could get taken down or bitrot) is also a social fact.
I actually agree that treating NFTs that merely contain a link to some bytes elsewhere that worked at one point in time is a pretty dumb thing to care about, or have a market for (and the use cases for NFTs where the bytes are actually on-chain are, at best, fairly limited, although I wouldn't say completely nonexistent). And certainly the NFT market of 2021 or so, which had a lot of such NFTs, was driven by a weird social mania and people attempting to grift upon that social mania. This has never bothered me though, because I feel the same way about many markets for physical pieces of art; and ultimately it needs to be possible for people to create markets for things I personally think are dumb or at least don't care about.
There is a difference between markets for things I don't care about and markets for things I do care a lot about, just not in a positive way. I don't think it's necessary to allow an open market exchange for phone scammers, for example, and it has nothing to do with how uninterested I am in buying people's information. Not all NFT had to fall towards that kind of thing, it's just there was so little practical usage actually being done that 99% of it ended up being that way.
Btw it's weirdly annoying to get the json payload for one of these
We are building systems that live in the same space as projects like IPFS, Secure Scuttlebutt, Automerge, Tailscale, etc.
For folks who are already experts in this space, able to come in and hit the ground running, remote is an option.
For high growth folks, we have in-person in Austin.
For folks w/ a U.S. security clearance - we have in-person in DC.