5 ms·

Doug Crockford's Seif Project – how to save the web [video]

35 points by cpr 11y ago

yoo1I 11y ago
I can't find any textual summary about what "the seif project" is supposed to be. All I can find are talks and announcements for these talks. There is a github repository[0] that doesn't have a description and a pretty useless Readme. Does anyone know what this is about ? EDIT: you can skip at least the first 30 minutes in, he's still just complaining about how HTTP,HTML,CSS and Javascript are terrible and a description of television. [0]https://github.com/paypal/seifnode https://github.com/paypal/seifnode
- jamesmcintyre 11y ago
  It's very early stages, Douglas mentioned in the talk I attended that he has purposefully tried to refrain from giving anyone set dates for deliverables in attempts to prevent rushed code at this stage.
- keville 11y ago
  The talk linked from this post was pretty easy to digest, perhaps you should watch the whole thing before asking what it's about? The television-standards bit, while probably longer than necessary, was meant to drive home the point that the responsibility for improving application security on the Internet should not be placed with the user.
jamesmcintyre 11y ago
I saw this same talk live at forwardjs, I think his ideas are the perfect blend of being ambitious (enough to capture interest) and yet tempered by past failed attempts at "revolutionizing the web". I hope the project garners more attention and interests, we have fundamentally broken tools and maybe it's time to start building new tools that we can begin to shift to.
- alexashka 11y ago
  For all the broken tools - there seems to be no shortage of awesome websites that serve their purpose pretty darn well.
  - keville 11y ago
    > there seems to be no shortage of awesome websites that serve their purpose This is not an effort to defeat the web, just to provide a security-oriented application platform that sits alongside it. It appears Crockford's time at PayPal has led to this focus? [minor edit]
  - hollerith 11y ago
    Although I make heavy use of the web (largely because there is no other way to access most things I want to read on the internet) there are very few web sites that IMHO serve their purpose pretty darn well. I'm not saying most web sites are objectively bad, just that they frustrate and annoy me much more than any of the other software I use. (I have no opinion on whether Crockford's proposal would ameliorate my frustration.)
yoo1I 11y ago
Summary: http://www.seif.place http://www.seif.place "HTML free based application delivery system based on [stripped down] node.js and QT" He describes a "Helper Application" that he wants to convince browser vendors to install. Features as I gleaned them from this talk. - Replace DNS addressing with <publickey>@<ipaddress>/<referral> (since these are not human friendly: QRcodes and Petnames) - Replace HTTP with a "Secure JSON over TCP" - Content based addressing through file hashes - communicate with QT through a messaging protocol - For some reason reinvents an RNG(!) (what?) (EDIT: this originally said "running in Javascript(!)", based on the git repository that's probably not true) - apparently no password will be needed ever again All of it sounds a bit hyperbolic... (OK I admit it, I stopped taking it seriously when he mentioned the awesome idea of adding microphone/camera input into the RNG for randomness, that just sounds like something which seems common sense on the surface, but is a totally incorrect thing to do in practice).
- yoo1I 11y ago
  Based on the information that's in there, this makes mutual authentication based on TLS certifictes (or some other public-key-scheme) mandatory, and uses it for addressing. The only information that this talk contains about how to solve the introducton,authentication problem is this (paraphrasing): "I don't trust Verisign to prove someone's identity, but I trust google's search results" (As in "I googled for ACME Bank, and this is the address/public key that was returned, I am going to trust it") The whole thing feels like something someone would come up in an afternoon with lot's of handwaving potential problems away.
- keville 11y ago
  > is a totally incorrect thing to do in practice Can you elaborate on this? I understand that there are many sources of entropy for random number generation, and it seems like this would be as good a way as any to store* a pool of some for future use. (* Is it that the storage is the inherent problem?)
  - yoo1I 11y ago
    Hi, sorry for the late reply. I meant it in the sense that it seems intuitively correct that you'd be able to get some random data out of a microphone somehow, but that intuition doesn't serve as a good adviser in cryptography. I bet just looking at a recording from a computer microphone, it's possible to make deductions about it's structure. Let's say there are people in the room who talk with a certain pitch, the frequency of the AC current as it get's into the computer, things like that which all make the microphone output non-random. So it might be that there is a way to generate true random numbers like that, but it's probably not as easy as just using the microphone as a source of entropy.
Udo 11y ago
The problem I see here is that it's a complete re-invention of everything, from the transport protocols to the UI, everything gets redone. He didn't talk about how the client will be implemented yet, but it's certain that it's going to be a presentation layer based on Qt without any HTML or CSS involved. This is not a web technology, by definition. It's not the future of the web, it's some other thing that may be better or worse than the web (probably both). It's a new internet technology designed to replace the web in its entirety. I'm curious how the entire stack is going to work, and I'll be one of the first people to make a toy project with it, but it looks like it's going to be some time until anyone can actually try it out. What this project requires even more than technology is clout and visibility, so Crockford is probably one of very few people who meet the prerequisites to give this a shot.
- gcb0 11y ago
  you mean, just like http and html were even everyone was happy with bbs and telnet? yeah, should never work.
  - Udo 11y ago
    I'm afraid you misunderstood my comment entirely.
atdt 11y ago
Douglas Crockford's JSON license-griefing has done quite a lot of harm to open-source software: * https://en.wikipedia.org/wiki/Douglas_Crockford#.22Good.2C_not_Evil.22 https://en.wikipedia.org/wiki/Douglas_Crockford#.22Good.2C_n... * https://bugs.php.net/bug.php?id=63520#1403112940 https://bugs.php.net/bug.php?id=63520#1403112940 * http://apebox.org/wordpress/rants/456 http://apebox.org/wordpress/rants/456 * https://wiki.debian.org/qa.debian.org/jsonevil https://wiki.debian.org/qa.debian.org/jsonevil As a open-source software developer, I have wasted at least a day of my life on headaches resulting from this gag. The same is true of several of my immediate colleagues, and of a great many people in the open-source software community at large. Someone who acts with contempt and disrespect toward his peers in the industry does not deserve recognition or confidence. We cannot trust him to be a good steward of open standards. This casts a long shadow on his proposals.
- archagon 11y ago
  You could say the same thing about the GPL. It's not just "griefing" — it's using your software as a political wedge (however small) to try to change the world. I'd strongly consider using a similar license if I were ever to release something as important as JSMin. (Or maybe something more specifically itemized: "not for military use, not to be used as an aid to violence" etc.)
  - azylman 11y ago
    The problem isn't pushing an agenda (which I think everyone agrees is fine), it's adding something subjective with no legal definition to your license. Since no one can say objectively "we do good", you're banking on not getting sued or having enough money and time to defend the lawsuit, which makes it unpalatable to many people. Additionally, it makes it non-free software, by definition, so a lot of distros can't include it or anything that depends on it.
    - deleted 11y ago
      [deleted]
- angersock 11y ago

35 points by cpr 11y ago

yoo1I 11y ago

I can't find any textual summary about what "the seif project" is supposed to be. All I can find are talks and announcements for these talks. There is a github repository[0] that doesn't have a description and a pretty useless Readme. Does anyone know what this is about ? EDIT: you can skip at least the first 30 minutes in, he's still just complaining about how HTTP,HTML,CSS and Javascript are terrible and a description of television. [0]https://github.com/paypal/seifnode https://github.com/paypal/seifnode

jamesmcintyre 11y ago
It's very early stages, Douglas mentioned in the talk I attended that he has purposefully tried to refrain from giving anyone set dates for deliverables in attempts to prevent rushed code at this stage.
keville 11y ago
The talk linked from this post was pretty easy to digest, perhaps you should watch the whole thing before asking what it's about? The television-standards bit, while probably longer than necessary, was meant to drive home the point that the responsibility for improving application security on the Internet should not be placed with the user.

jamesmcintyre 11y ago

I saw this same talk live at forwardjs, I think his ideas are the perfect blend of being ambitious (enough to capture interest) and yet tempered by past failed attempts at "revolutionizing the web". I hope the project garners more attention and interests, we have fundamentally broken tools and maybe it's time to start building new tools that we can begin to shift to.

alexashka 11y ago
For all the broken tools - there seems to be no shortage of awesome websites that serve their purpose pretty darn well.
- keville 11y ago
  > there seems to be no shortage of awesome websites that serve their purpose This is not an effort to defeat the web, just to provide a security-oriented application platform that sits alongside it. It appears Crockford's time at PayPal has led to this focus? [minor edit]
- hollerith 11y ago
  Although I make heavy use of the web (largely because there is no other way to access most things I want to read on the internet) there are very few web sites that IMHO serve their purpose pretty darn well. I'm not saying most web sites are objectively bad, just that they frustrate and annoy me much more than any of the other software I use. (I have no opinion on whether Crockford's proposal would ameliorate my frustration.)

yoo1I 11y ago

Summary: http://www.seif.place http://www.seif.place "HTML free based application delivery system based on [stripped down] node.js and QT" He describes a "Helper Application" that he wants to convince browser vendors to install. Features as I gleaned them from this talk. - Replace DNS addressing with <publickey>@<ipaddress>/<referral> (since these are not human friendly: QRcodes and Petnames) - Replace HTTP with a "Secure JSON over TCP" - Content based addressing through file hashes - communicate with QT through a messaging protocol - For some reason reinvents an RNG(!) (what?) (EDIT: this originally said "running in Javascript(!)", based on the git repository that's probably not true) - apparently no password will be needed ever again All of it sounds a bit hyperbolic... (OK I admit it, I stopped taking it seriously when he mentioned the awesome idea of adding microphone/camera input into the RNG for randomness, that just sounds like something which seems common sense on the surface, but is a totally incorrect thing to do in practice).

yoo1I 11y ago
Based on the information that's in there, this makes mutual authentication based on TLS certifictes (or some other public-key-scheme) mandatory, and uses it for addressing. The only information that this talk contains about how to solve the introducton,authentication problem is this (paraphrasing): "I don't trust Verisign to prove someone's identity, but I trust google's search results" (As in "I googled for ACME Bank, and this is the address/public key that was returned, I am going to trust it") The whole thing feels like something someone would come up in an afternoon with lot's of handwaving potential problems away.
keville 11y ago
> is a totally incorrect thing to do in practice Can you elaborate on this? I understand that there are many sources of entropy for random number generation, and it seems like this would be as good a way as any to store* a pool of some for future use. (* Is it that the storage is the inherent problem?)
- yoo1I 11y ago
  Hi, sorry for the late reply. I meant it in the sense that it seems intuitively correct that you'd be able to get some random data out of a microphone somehow, but that intuition doesn't serve as a good adviser in cryptography. I bet just looking at a recording from a computer microphone, it's possible to make deductions about it's structure. Let's say there are people in the room who talk with a certain pitch, the frequency of the AC current as it get's into the computer, things like that which all make the microphone output non-random. So it might be that there is a way to generate true random numbers like that, but it's probably not as easy as just using the microphone as a source of entropy.

Udo 11y ago

The problem I see here is that it's a complete re-invention of everything, from the transport protocols to the UI, everything gets redone. He didn't talk about how the client will be implemented yet, but it's certain that it's going to be a presentation layer based on Qt without any HTML or CSS involved. This is not a web technology, by definition. It's not the future of the web, it's some other thing that may be better or worse than the web (probably both). It's a new internet technology designed to replace the web in its entirety. I'm curious how the entire stack is going to work, and I'll be one of the first people to make a toy project with it, but it looks like it's going to be some time until anyone can actually try it out. What this project requires even more than technology is clout and visibility, so Crockford is probably one of very few people who meet the prerequisites to give this a shot.

gcb0 11y ago
you mean, just like http and html were even everyone was happy with bbs and telnet? yeah, should never work.
- Udo 11y ago
  I'm afraid you misunderstood my comment entirely.

atdt 11y ago

Douglas Crockford's JSON license-griefing has done quite a lot of harm to open-source software: * https://en.wikipedia.org/wiki/Douglas_Crockford#.22Good.2C_not_Evil.22 https://en.wikipedia.org/wiki/Douglas_Crockford#.22Good.2C_n... * https://bugs.php.net/bug.php?id=63520#1403112940 https://bugs.php.net/bug.php?id=63520#1403112940 * http://apebox.org/wordpress/rants/456 http://apebox.org/wordpress/rants/456 * https://wiki.debian.org/qa.debian.org/jsonevil https://wiki.debian.org/qa.debian.org/jsonevil As a open-source software developer, I have wasted at least a day of my life on headaches resulting from this gag. The same is true of several of my immediate colleagues, and of a great many people in the open-source software community at large. Someone who acts with contempt and disrespect toward his peers in the industry does not deserve recognition or confidence. We cannot trust him to be a good steward of open standards. This casts a long shadow on his proposals.

archagon 11y ago
You could say the same thing about the GPL. It's not just "griefing" — it's using your software as a political wedge (however small) to try to change the world. I'd strongly consider using a similar license if I were ever to release something as important as JSMin. (Or maybe something more specifically itemized: "not for military use, not to be used as an aid to violence" etc.)
- azylman 11y ago
  The problem isn't pushing an agenda (which I think everyone agrees is fine), it's adding something subjective with no legal definition to your license. Since no one can say objectively "we do good", you're banking on not getting sued or having enough money and time to defend the lawsuit, which makes it unpalatable to many people. Additionally, it makes it non-free software, by definition, so a lot of distros can't include it or anything that depends on it.
  - deleted 11y ago
    [deleted]
angersock 11y ago