7 ms·

IPFS Pics

330 points by andars 11y ago

Breefield 11y ago
[edit] derp I am dumb, was not familiar with https://ipfs.io/ https://ipfs.io/ this explains my questions
- steckerbrett 11y ago
  It's just POSTing the image to a web server running from something else. I don't understand why they are doing dumb things like passing everything to a shell when PHP has curl support of its own, and imagemagick.
  - Gigablah 11y ago
    Not to mention that index.php contains only HTML.
- deleted 11y ago
  [deleted]
- derefr 11y ago
  To hazard a guess, they're probably copying the file into a directory which is mounted as an IPFS FUSE server.
- shaunol 11y ago
  It looks like the PHP code is the front facing web code which then makes curl calls into the server.js code as you suspected. Presumably server.js is run using node which listens on port 8090 and exposes a few ipfs methods which just calls into the local ipfs binary on the system using exec calls. IPFS is an interesting project and this is a pretty cool usage of it.
mrmondo 11y ago
Great idea and use case for IPFS. I'm not sure I want to run php just to host images though. I always have this 'oh... It's in PHP...' moment with things like this and I generally end up not wanting to play with or host them, either because I don't find php attractive as a language or because of the various security issues around hosting php applications.
- Gigablah 11y ago
  It's worse than that, his PHP scripts make cURL calls to a local nodejs server which then exec() the ipfs commmands.
  - toomuchtodo 11y ago
    Ipfs exposes a JSON API locally. Not sure why the author didn't just use a JavaScript front end making calls to the local API. https://ipfs.io/docs/api/ https://ipfs.io/docs/api/ EDIT: I'd encourage the HN community to look past the technical merits of the code, and focus on the idea presented (and even perhaps fork and contribute back an improved version).
    - eis 11y ago
      Hm what prevents some malicious website from pinning unwanted content on a visitors machine?
      - Natanael_L 11y ago
        The visitor needs to chose to run IPFS and cache it
        eis 11y ago
        He just needs to happen to have IPFS running. Any website can make a request to localhost via Javascript or even without. Scenario: Attacker sends you harmless looking link to a page that contains some invisible JS that sends a request to localhost and pins kiddypon on your IPFS node. Attacker then sends the police to you.
        ossreality 11y ago
        um, cross origin blocking has been a thing for... like a really really long time now.
        11y ago
pervycreeper 11y ago
>where you can know for sure your pictures will be available forever. This is certainly untrue, but it would be interesting to know what reasonable conditions would need to be true for an IPFS file to become unavailable.
lenish 11y ago
My concern with the IPFS claims of permanence, like "Where you can know for sure your pictures will be available forever" is that, AFAICT, files are only uploaded to the network once another party requests them. An example: $ipfs init $echo 'agdkjagka' > test $ipfs add test added QmTtmsSSTH5fMQ9fn9NRXWtcZXnBBazxR8fidXcE5KB76h test $rm -R ~/.ipfs $ipfs init $ipfs cat QmTtmsSSTH5fMQ9fn9NRXWtcZXnBBazxR8fidXcE5KB76h Error: merkledag: not found In English, `ipfs add` does not upload anything to the network. The only way a hash becomes distributed on the network is for another party to request that hash. Even then, I believe that the data only exists on that party's system. That is, if both you and the requester leave the network, the data is gone.
- toomuchtodo 11y ago
  Right. At this time, you'd need a forced persistent host for content (S3?). Hopefully that need would drop away as more hosts joined the network. Note to self: Build an S3 backend/gateway/persistent-store-of-last-resort for ipfs.
  - lenish 11y ago
    Well, it doesn't matter so much how many hosts join the network. You still need to convince some members of the network to view your content at least once in order to distribute the data. I suppose you could argue that nonvaluable content would vanish over time justifiably, but then it's not really a, "Permanent Web." Edit: Apparently I can't reply to your reply to this comment, but thanks for the link. I hadn't seen that.
    - toomuchtodo 11y ago
      I believe IPFS was partially intended to help the Internet Archive in that regard. They'll be the consumer of last resort for all objects, thereby bringing about the Permanent Web. https://ipfs.io/ipfs/QmNhFJjGcMPqpuYfxL62VVB9528NXqDNMFXiqN5bgFYiZ1/its-time-for-the-permanent-web.html https://ipfs.io/ipfs/QmNhFJjGcMPqpuYfxL62VVB9528NXqDNMFXiqN5...
hitchhiker999 11y ago
This may be somewhat immature as far as its development but IMHO it's the beginning of the future. My guess is that we'll now be seeing almost complete server/client decentralization of many of the most popular apps (social / search / sharing). 5+ years from now.
- deleted 11y ago
  [deleted]
- steckerbrett 11y ago
  I bet strongly against that. "Decentralized" systems do not scale, and are impossible to keep clear of spam.
  - toomuchtodo 11y ago
    The system only distributes requested objects. If no one requests spam objects, they won't be replicated or distributed, thereby not wasting resources (in theory).
  - chriscool 11y ago
    So Git for example doesn't scale and is impossible to keep clear of spam?
    - nickodell 11y ago
      Git's not that decentralized, though. You've got centralization at a technical level (everybody contacts the same server to push code) and at an organizational level (if you want to add code you need to be the repository owner or someone authorized by them). That brings up an important point, though: you can make your system partially decentralized, and gain many of the benefits of a totally centralized system with a fraction of the complexity.
      - eis 11y ago
        Git does not need any centralized server. Git is fully distributed. It is a DVCS, D standing for Distributed. That some/many organizations tend to centralize parts of Git, doesn't mean that Git itself is inherently centralized.
abricot 11y ago
So, we would blindly host other people's pictures. Does noone see the danger in that?
- mburns 11y ago
  ipfs doesn't rehost a file unless you explicitly opt-in to do so.
- derefr 11y ago
  Also see: Freenet, Perfect Dark, etc. The difference here is that the content you're opting in to rehosting is sitting in cleartext on your machine. So it's not blind, per se; you can delete (un-rehost) whatever you don't want to be there, or run a nudity detection algorithm (yes, those exist) to automatically prevent re-hosting of any porn, etc.
  - AndrewGaspar 11y ago
    Similar to this, you could suscribe to a good-faith censor that removes known illegal images from your ipfs enlistment (using known hashes, for example). Obviously wouldn't catch everything, but I suspect would remove any legal obligation on your part (IANAL).
  - astrobe_ 11y ago
    Still, you might not be able to tell whether or not a file is legal. One has to have some sort of "trust network" on top of this.
  - sbierwagen 11y ago
    Nudity detection doesn't work on black and white photography.
- archagon 11y ago
  A scheme like this should really have some sort of encryption or chunking wherein the image files wouldn't be reconstructible any one person's machine. I like the idea of a P2P image hosting service but I definitely don't want to feel responsible for hosting CP or other terrible garbage.
cherioo 11y ago
So, this is like eMule? What's the benefit of this over eMule? Faster/better/hype?
- jmnicolas 11y ago
  No this is Imageshack decentralized.
PlzSnow 11y ago
It seems to be a huge problem that random people can store crazy pictures on your computer. Maybe it would have been better if the images were stored encrypted in some manner, and decrypted on the client. However I applaud the initiative and newness of this!
- hohenheim 11y ago
  This is not true. You only store pictures you have requested.
unclesaamm 11y ago
I realize this may not be constructive, but it definitely qualifies as "glorious": I clicked "Random" and this was what I got: http://ipfs.pics/QmPJddhYZb2kXtn2vzeGTAagPcPyfCb7fuoPxQ3mqpEL4G http://ipfs.pics/QmPJddhYZb2kXtn2vzeGTAagPcPyfCb7fuoPxQ3mqpE... Excellent project.
- xp3ll3d 11y ago
  While we are sharing, this is what random threw up for me http://ipfs.pics/Qmcim5DzJSW7xpmonxALaEw9oVbhYM9RjqUhAjSws4FEeF http://ipfs.pics/Qmcim5DzJSW7xpmonxALaEw9oVbhYM9RjqUhAjSws4F...
- reirob 11y ago
  http://ipfs.pics/QmeJ1o38pSJ64PYwkGbQKDubEHrFC2Cad7zZsFi4ZLabMq http://ipfs.pics/QmeJ1o38pSJ64PYwkGbQKDubEHrFC2Cad7zZsFi4ZLa...
reitanqild 11y ago
It seems to be licensed under AGPL which means it is unusable for a whole lot of stuff.
- Kototama 11y ago
  It seems to be licensed under AGPL which means it is usable for a whole lot of stuff.
  - mnx 11y ago
    But for less stuff then if it was licensed under MIT.
    - Kototama 11y ago
      Yes but the argument is unidirectional. AGPL answers different needs than more permissive licenses. Also it would be good to recognize the work done before shooting out "wrooooong license (for me)", specially when it still is licensed under a free software license.
      - reitanqild 11y ago
        > Yes but the argument is unidirectional. I'd say yes. IMO there isn't a single thing you can do with a AGPL licensed piece of SW that you cannot do with a MIT licensed one, -the other way around, -quite a bit. > Also it would be good to recognize the work done before shooting out "wrooooong license (for me)" Sorry. Wasn't my intention but I can clearly see it being read that way. I just wanted to point it out as I personally don't like AGPL and wanted others to avoid the disappointment had.
        jordigh 11y ago
        > IMO there isn't a single thing you can do with a AGPL licensed piece of SW that you cannot do with a MIT licensed one Sure there is. You can prevent others from imposing restrictions. If someone takes your non-copyleft software and uses it to build something that forbids people from knowing what's in it, how it works, or what it does with their data, then you are helpless to stop it.
buster 11y ago
Bonus points for that gif: http://ipfs.pics/QmYqA8GiZ4MCeyJkERReLwGRnjSdQBx5SzjvMgiNwQZfx6 http://ipfs.pics/QmYqA8GiZ4MCeyJkERReLwGRnjSdQBx5SzjvMgiNwQZ...
scrrr 11y ago
Can a user delete a picture he or she has uploaded?
- mtgx 11y ago
  I imagine no, just like you can't delete a picture after someone else has downloaded on their PC.
lewisl9029 11y ago
Does IPFS have a client-side JS library for building apps that interact with the IPFS DHT? Something similar to https://github.com/feross/bittorrent-dht https://github.com/feross/bittorrent-dht. I've been looking into developing distributed client-side apps for IPFS, and it would be great if we could just tap into the native IPFS DHT rather than having to depend on a separate IP-based DHT for peer discovery in our apps.
- diggan 11y ago
  A fully client side implementation of IPFS is in the works. Right now, you'll have to run the daemon on your server and interact with it, so not fully distributed until either the client-side implementation of IPFS is done (node-ipfs on Github/NPM) or the public gateway can accept calls from the JS api client that works in the browser too (node-ipfs-api on Github/NPM).
muyuu 11y ago
Without an extension many forums won't let you embed these images.

IPFS Pics

330 points by andars 11y ago

Breefield 11y ago

[edit] derp I am dumb, was not familiar with https://ipfs.io/ https://ipfs.io/ this explains my questions

steckerbrett 11y ago
It's just POSTing the image to a web server running from something else. I don't understand why they are doing dumb things like passing everything to a shell when PHP has curl support of its own, and imagemagick.
- Gigablah 11y ago
  Not to mention that index.php contains only HTML.
deleted 11y ago
[deleted]
derefr 11y ago
To hazard a guess, they're probably copying the file into a directory which is mounted as an IPFS FUSE server.
shaunol 11y ago
It looks like the PHP code is the front facing web code which then makes curl calls into the server.js code as you suspected. Presumably server.js is run using node which listens on port 8090 and exposes a few ipfs methods which just calls into the local ipfs binary on the system using exec calls. IPFS is an interesting project and this is a pretty cool usage of it.

mrmondo 11y ago

Great idea and use case for IPFS. I'm not sure I want to run php just to host images though. I always have this 'oh... It's in PHP...' moment with things like this and I generally end up not wanting to play with or host them, either because I don't find php attractive as a language or because of the various security issues around hosting php applications.

Gigablah 11y ago
It's worse than that, his PHP scripts make cURL calls to a local nodejs server which then exec() the ipfs commmands.
- toomuchtodo 11y ago
  Ipfs exposes a JSON API locally. Not sure why the author didn't just use a JavaScript front end making calls to the local API. https://ipfs.io/docs/api/ https://ipfs.io/docs/api/ EDIT: I'd encourage the HN community to look past the technical merits of the code, and focus on the idea presented (and even perhaps fork and contribute back an improved version).
  - eis 11y ago
    Hm what prevents some malicious website from pinning unwanted content on a visitors machine?
    - Natanael_L 11y ago
      The visitor needs to chose to run IPFS and cache it
      - eis 11y ago
        He just needs to happen to have IPFS running. Any website can make a request to localhost via Javascript or even without. Scenario: Attacker sends you harmless looking link to a page that contains some invisible JS that sends a request to localhost and pins kiddypon on your IPFS node. Attacker then sends the police to you.
        ossreality 11y ago
        um, cross origin blocking has been a thing for... like a really really long time now.
        11y ago

pervycreeper 11y ago

>where you can know for sure your pictures will be available forever. This is certainly untrue, but it would be interesting to know what reasonable conditions would need to be true for an IPFS file to become unavailable.

lenish 11y ago

My concern with the IPFS claims of permanence, like "Where you can know for sure your pictures will be available forever" is that, AFAICT, files are only uploaded to the network once another party requests them. An example: $ipfs init $echo 'agdkjagka' > test $ipfs add test added QmTtmsSSTH5fMQ9fn9NRXWtcZXnBBazxR8fidXcE5KB76h test $rm -R ~/.ipfs $ipfs init $ipfs cat QmTtmsSSTH5fMQ9fn9NRXWtcZXnBBazxR8fidXcE5KB76h Error: merkledag: not found In English, `ipfs add` does not upload anything to the network. The only way a hash becomes distributed on the network is for another party to request that hash. Even then, I believe that the data only exists on that party's system. That is, if both you and the requester leave the network, the data is gone.

toomuchtodo 11y ago
Right. At this time, you'd need a forced persistent host for content (S3?). Hopefully that need would drop away as more hosts joined the network. Note to self: Build an S3 backend/gateway/persistent-store-of-last-resort for ipfs.
- lenish 11y ago
  Well, it doesn't matter so much how many hosts join the network. You still need to convince some members of the network to view your content at least once in order to distribute the data. I suppose you could argue that nonvaluable content would vanish over time justifiably, but then it's not really a, "Permanent Web." Edit: Apparently I can't reply to your reply to this comment, but thanks for the link. I hadn't seen that.
  - toomuchtodo 11y ago
    I believe IPFS was partially intended to help the Internet Archive in that regard. They'll be the consumer of last resort for all objects, thereby bringing about the Permanent Web. https://ipfs.io/ipfs/QmNhFJjGcMPqpuYfxL62VVB9528NXqDNMFXiqN5bgFYiZ1/its-time-for-the-permanent-web.html https://ipfs.io/ipfs/QmNhFJjGcMPqpuYfxL62VVB9528NXqDNMFXiqN5...

hitchhiker999 11y ago

This may be somewhat immature as far as its development but IMHO it's the beginning of the future. My guess is that we'll now be seeing almost complete server/client decentralization of many of the most popular apps (social / search / sharing). 5+ years from now.

deleted 11y ago
[deleted]
steckerbrett 11y ago
I bet strongly against that. "Decentralized" systems do not scale, and are impossible to keep clear of spam.
- toomuchtodo 11y ago
  The system only distributes requested objects. If no one requests spam objects, they won't be replicated or distributed, thereby not wasting resources (in theory).
- chriscool 11y ago
  So Git for example doesn't scale and is impossible to keep clear of spam?
  - nickodell 11y ago
    Git's not that decentralized, though. You've got centralization at a technical level (everybody contacts the same server to push code) and at an organizational level (if you want to add code you need to be the repository owner or someone authorized by them). That brings up an important point, though: you can make your system partially decentralized, and gain many of the benefits of a totally centralized system with a fraction of the complexity.
    - eis 11y ago
      Git does not need any centralized server. Git is fully distributed. It is a DVCS, D standing for Distributed. That some/many organizations tend to centralize parts of Git, doesn't mean that Git itself is inherently centralized.

abricot 11y ago

So, we would blindly host other people's pictures. Does noone see the danger in that?

mburns 11y ago
ipfs doesn't rehost a file unless you explicitly opt-in to do so.
derefr 11y ago
Also see: Freenet, Perfect Dark, etc. The difference here is that the content you're opting in to rehosting is sitting in cleartext on your machine. So it's not blind, per se; you can delete (un-rehost) whatever you don't want to be there, or run a nudity detection algorithm (yes, those exist) to automatically prevent re-hosting of any porn, etc.
- AndrewGaspar 11y ago
  Similar to this, you could suscribe to a good-faith censor that removes known illegal images from your ipfs enlistment (using known hashes, for example). Obviously wouldn't catch everything, but I suspect would remove any legal obligation on your part (IANAL).
- astrobe_ 11y ago
  Still, you might not be able to tell whether or not a file is legal. One has to have some sort of "trust network" on top of this.
- sbierwagen 11y ago
  Nudity detection doesn't work on black and white photography.
archagon 11y ago
A scheme like this should really have some sort of encryption or chunking wherein the image files wouldn't be reconstructible any one person's machine. I like the idea of a P2P image hosting service but I definitely don't want to feel responsible for hosting CP or other terrible garbage.

cherioo 11y ago

So, this is like eMule? What's the benefit of this over eMule? Faster/better/hype?

jmnicolas 11y ago
No this is Imageshack decentralized.

PlzSnow 11y ago

It seems to be a huge problem that random people can store crazy pictures on your computer. Maybe it would have been better if the images were stored encrypted in some manner, and decrypted on the client. However I applaud the initiative and newness of this!

hohenheim 11y ago
This is not true. You only store pictures you have requested.

unclesaamm 11y ago

I realize this may not be constructive, but it definitely qualifies as "glorious": I clicked "Random" and this was what I got: http://ipfs.pics/QmPJddhYZb2kXtn2vzeGTAagPcPyfCb7fuoPxQ3mqpEL4G http://ipfs.pics/QmPJddhYZb2kXtn2vzeGTAagPcPyfCb7fuoPxQ3mqpE... Excellent project.

xp3ll3d 11y ago
While we are sharing, this is what random threw up for me http://ipfs.pics/Qmcim5DzJSW7xpmonxALaEw9oVbhYM9RjqUhAjSws4FEeF http://ipfs.pics/Qmcim5DzJSW7xpmonxALaEw9oVbhYM9RjqUhAjSws4F...
reirob 11y ago
http://ipfs.pics/QmeJ1o38pSJ64PYwkGbQKDubEHrFC2Cad7zZsFi4ZLabMq http://ipfs.pics/QmeJ1o38pSJ64PYwkGbQKDubEHrFC2Cad7zZsFi4ZLa...

reitanqild 11y ago

It seems to be licensed under AGPL which means it is unusable for a whole lot of stuff.

Kototama 11y ago
It seems to be licensed under AGPL which means it is usable for a whole lot of stuff.
- mnx 11y ago
  But for less stuff then if it was licensed under MIT.
  - Kototama 11y ago
    Yes but the argument is unidirectional. AGPL answers different needs than more permissive licenses. Also it would be good to recognize the work done before shooting out "wrooooong license (for me)", specially when it still is licensed under a free software license.
    - reitanqild 11y ago
      > Yes but the argument is unidirectional. I'd say yes. IMO there isn't a single thing you can do with a AGPL licensed piece of SW that you cannot do with a MIT licensed one, -the other way around, -quite a bit. > Also it would be good to recognize the work done before shooting out "wrooooong license (for me)" Sorry. Wasn't my intention but I can clearly see it being read that way. I just wanted to point it out as I personally don't like AGPL and wanted others to avoid the disappointment had.
      - jordigh 11y ago
        > IMO there isn't a single thing you can do with a AGPL licensed piece of SW that you cannot do with a MIT licensed one Sure there is. You can prevent others from imposing restrictions. If someone takes your non-copyleft software and uses it to build something that forbids people from knowing what's in it, how it works, or what it does with their data, then you are helpless to stop it.

buster 11y ago

Bonus points for that gif: http://ipfs.pics/QmYqA8GiZ4MCeyJkERReLwGRnjSdQBx5SzjvMgiNwQZfx6 http://ipfs.pics/QmYqA8GiZ4MCeyJkERReLwGRnjSdQBx5SzjvMgiNwQZ...

scrrr 11y ago

Can a user delete a picture he or she has uploaded?

mtgx 11y ago
I imagine no, just like you can't delete a picture after someone else has downloaded on their PC.

lewisl9029 11y ago

Does IPFS have a client-side JS library for building apps that interact with the IPFS DHT? Something similar to https://github.com/feross/bittorrent-dht https://github.com/feross/bittorrent-dht. I've been looking into developing distributed client-side apps for IPFS, and it would be great if we could just tap into the native IPFS DHT rather than having to depend on a separate IP-based DHT for peer discovery in our apps.

diggan 11y ago
A fully client side implementation of IPFS is in the works. Right now, you'll have to run the daemon on your server and interact with it, so not fully distributed until either the client-side implementation of IPFS is done (node-ipfs on Github/NPM) or the public gateway can accept calls from the JS api client that works in the browser too (node-ipfs-api on Github/NPM).

muyuu 11y ago

Without an extension many forums won't let you embed these images.