3 ms·

How are you handling security-related issues such as user identity and IPFS namespaces, particularly as they relate to systems outside of IPFS (i.e. github)? Is

How are you handling security-related issues such as user identity and IPFS namespaces, particularly as they relate to systems outside of IPFS (i.e. github)? Is there a method by which someone who has lost control over a namespace may announce that unfortunate situ, and then form a new, "valid" one? Also, regarding the ability to "remove": could you clarify what this means? Given the nature of IPFS, is this really just the signaling the deprecation of a version or entire module using data posted to IPFS?

diggan 11y ago
I'm not exactly sure how you mean. If I publish lodash version 1.0.0 and get the hash "ABCDEF", that will always be the hash and you'll always the same contents. There is no sense of losing control over the published package. You can although lose control over the way you are distributing the hash itself, but that's a different problem. > regarding the ability to "remove": I'm not sure what you mean, could you refer the sentence where you see this, so I'm sure to respond in a good way. With IPFS, there will be no deletion or removal, how bad you may want it. The nodes you can control, you can tell them to stop sharing it, but the distributed nature of IPFS makes it impossible to guarantee that other people won't share it.
- jamespitts 11y ago
  Heh, I saw the "able to remove modules" under Problems Trying to Solve in https://github.com/EverythingStays/EverythingStays https://github.com/EverythingStays/EverythingStays and thought you meant that was a feature not a bug. I was definitely referring to control as opposed to removing a single version (impossible by design in IPFS). Conceptually though, the use case of remove is important, at least in the sense that an author wants to formally call out when a version contains breaking code, etc. I am wondering how an author can signal that the latest version is malware or should be ignored, or that the whole namespace, or even the author is no longer valid. Without human intermediaries (the primary benefit of centralized systems), we lose the ability to mitigate or moderate when things go awry -- e.g. an author loses control over the "keys to the house". As this concept gets developed, it would be good to develop protocols for identity management, release validation, module namespace registration, etc. Perhaps if not in IPFS, it can be implemented in blockchain tech like ethereum.
- jamespitts 11y ago
  I hope I am being more clear here! Let me know :)

diggan 11y ago

I'm not exactly sure how you mean. If I publish lodash version 1.0.0 and get the hash "ABCDEF", that will always be the hash and you'll always the same contents. There is no sense of losing control over the published package. You can although lose control over the way you are distributing the hash itself, but that's a different problem. > regarding the ability to "remove": I'm not sure what you mean, could you refer the sentence where you see this, so I'm sure to respond in a good way. With IPFS, there will be no deletion or removal, how bad you may want it. The nodes you can control, you can tell them to stop sharing it, but the distributed nature of IPFS makes it impossible to guarantee that other people won't share it.

jamespitts 11y ago
Heh, I saw the "able to remove modules" under Problems Trying to Solve in https://github.com/EverythingStays/EverythingStays https://github.com/EverythingStays/EverythingStays and thought you meant that was a feature not a bug. I was definitely referring to control as opposed to removing a single version (impossible by design in IPFS). Conceptually though, the use case of remove is important, at least in the sense that an author wants to formally call out when a version contains breaking code, etc. I am wondering how an author can signal that the latest version is malware or should be ignored, or that the whole namespace, or even the author is no longer valid. Without human intermediaries (the primary benefit of centralized systems), we lose the ability to mitigate or moderate when things go awry -- e.g. an author loses control over the "keys to the house". As this concept gets developed, it would be good to develop protocols for identity management, release validation, module namespace registration, etc. Perhaps if not in IPFS, it can be implemented in blockchain tech like ethereum.
jamespitts 11y ago
I hope I am being more clear here! Let me know :)