5 ms·

Tor isn't the answer, it's broken. What's needed is a replacement for the modern web. At the protocol level it's busted in so many ways it isn't salvageable. Th

Tor isn't the answer, it's broken. What's needed is a replacement for the modern web. At the protocol level it's busted in so many ways it isn't salvageable. The sooner we recognize that the sooner we'll be able to create its replacement.

mrep 8y ago
How would you design a replacement for the modern web then?
- 3pt14159 8y ago
  I'm working on a prototype. It's (obviously) hard. But there are a couple must haves: 1. No more "any device can talk to any device" it won't work. It leads to horrible hacks like half the internet relying on cloudflare and email centralizing in an oligopoly. We need a web-of-trust at the connection layer robust enough to be embeddable in our network gear. 2. No more "I'm a packet from xyz because I say so" and of course no more untrusted, unsigned, unencrypted streams (ie, no plain UDP). 3. No more third party connections. We don't really need them. Just put whatever data you want in the URL like we do with OAuth. Everything else is adware or malware or trackware. I'm not blaming people, I understand how incentives shape behaviour. They shape mine too. We exist in the paradigm that we find ourselves in. But I envision a better world. 4. Simplified character sets within contexts. No more zero-width characters where we don't expect them (see zachaysan.com/zero for more info) or any of that shit. 5. I don't know how to fix JavaScript, but it needs fixing. JSON is cool, but it needs a complete / strict formalization to stop some edgecases. 6. No stupidness with PDFs. It's not worth it. There will be 0days in PDFs for as long as we use them. They're too fucking complicated. Just use HTML, SVG, or images. CSS is smart enough to make print formats for A4 and Letter. 7. Ideally either make a new HTML that is JSON based instead of XML based and either way make the web-of-trust default to downgrading trust on entities that pass malformed documents. Parsing broken XML is bug prone. 8. DNS is so fucking dumb it's painful. Just use the WoT and fallback trust nodes for when calamity hits (someone steals your keys). There is more to it, but I'm just getting back from a comedy show and I've had a couple and I already feel like I'm not being as coherent as this topic deserves so I'll end it there. If you're interested in being part of a beta group contact me.
  - lufte 8y ago
    Where can I read more about this project?
    - 3pt14159 8y ago
      It's not public yet. Sorry. If you subscribe to my RSS feed you'll be sure to hear about it when I start talking about it. https://www.zachaysan.com/writing/feed.xml https://www.zachaysan.com/writing/feed.xml
  - repsilat 8y ago
    > We need a web-of-trust at the connection layer In practice, this might mean the end of net neutrality, and could entrench the Googles of the world -- "shoot, I can't send a packet to them, but they trust Google, so I guess I will too." > No stupidness with PDFs I hold out hope for sandboxing. WASM could kill browser PDF plugins easily enough. Hell, JS probably could already... Could you say a little more about "third party connections"? Do you mean no loading resources from other domains? No CORS? Or something else?
  - deleted 8y ago
    [deleted]
  - danShumway 8y ago
    > No more third party connections. We don't really need them. Just put whatever data you want in the URL like we do with OAuth. I'm a bit confused with this. Are you talking about deprecating CORS? How would putting information in a URL mean that you didn't need a third party request anymore? > I don't know how to fix JavaScript, but it needs fixing. JSON is cool I may also be misunderstanding here, but are you talking about getting rid of clientside scripting? Or moving all scripting serverside? If that's the case, do you have any plans on how to get businesses, devs, and users on board with that? I understand that there's a sizable population on HN that would prefer if the web be a static document service and not an app platform, but even if they're right they have almost zero chance of getting anyone else to agree with them. If that's not what you're talking about and you just hate JS, then you should look into web assembly as a compile target. > We need a web-of-trust at the connection layer robust enough to be embeddable in our network gear. This just screams vendor lock-in to me. It's very important that connection information and permissions be user-configurable. It also seems at first glance like it might be problematic for security. Baking trust models into firmware means that it's a lot harder to patch them when the models need to be updated. > no more untrusted, unsigned, unencrypted streams I'm pretty sure Chrome is already heading in this direction. Archivists are mad about it, but I suspect HTTP will be deprecated sometime in the future. > DNS is so f---- dumb it's painful. Completely agreed. I would love to see DNS put out of its misery.
snomad 8y ago
Completely agree about broken protocol. Unfortunately, I doubt their will ever be a real impetus to abandon it; we will just keep muddling along strapping ever more duct tape. But let's dream, what would your protocol be? For some reason I have always had a hang up on the headers. The lack of real concrete specs, forging clients, and now the ugly monstrosity of CSP. I love the effect, but in my dream new protocol we have to opt into features during some kind of app / client handshake.
- 3pt14159 8y ago
  I answered elsewhere. I completely agree on CSP; which is essentially saying: "Oh shit, we fucked up, but lets leave the default as horrible because ¯\_(ツ)_/¯ the nerds that care about this will think they have a solution."
- djsumdog 8y ago
  > muddling along strapping ever more duct tape Let's strap some sockets to HTTP and run them through a web server. We'll call them Web Sockets. Chat? I have this crazy idea called WebRTC. .. although our original idea was a huge security hole and now it's pretty much just used for games .. because browsers don't do Datagrams so let's just do some more hacking with WebRTC. Anyone remember when Firefox was the lightweight version of Mozilla and web browsers were used to browse the web? I feel like all modern web browsers are in a pretty sad state of bloat, are pretty much mini operating systems, and Javascript is taking over the world. It's frighteningly like that parody talk about "Yavascript"
- omginternets 8y ago
  Why is the Tor protocol broken?

mrep 8y ago

How would you design a replacement for the modern web then?

3pt14159 8y ago
I'm working on a prototype. It's (obviously) hard. But there are a couple must haves: 1. No more "any device can talk to any device" it won't work. It leads to horrible hacks like half the internet relying on cloudflare and email centralizing in an oligopoly. We need a web-of-trust at the connection layer robust enough to be embeddable in our network gear. 2. No more "I'm a packet from xyz because I say so" and of course no more untrusted, unsigned, unencrypted streams (ie, no plain UDP). 3. No more third party connections. We don't really need them. Just put whatever data you want in the URL like we do with OAuth. Everything else is adware or malware or trackware. I'm not blaming people, I understand how incentives shape behaviour. They shape mine too. We exist in the paradigm that we find ourselves in. But I envision a better world. 4. Simplified character sets within contexts. No more zero-width characters where we don't expect them (see zachaysan.com/zero for more info) or any of that shit. 5. I don't know how to fix JavaScript, but it needs fixing. JSON is cool, but it needs a complete / strict formalization to stop some edgecases. 6. No stupidness with PDFs. It's not worth it. There will be 0days in PDFs for as long as we use them. They're too fucking complicated. Just use HTML, SVG, or images. CSS is smart enough to make print formats for A4 and Letter. 7. Ideally either make a new HTML that is JSON based instead of XML based and either way make the web-of-trust default to downgrading trust on entities that pass malformed documents. Parsing broken XML is bug prone. 8. DNS is so fucking dumb it's painful. Just use the WoT and fallback trust nodes for when calamity hits (someone steals your keys). There is more to it, but I'm just getting back from a comedy show and I've had a couple and I already feel like I'm not being as coherent as this topic deserves so I'll end it there. If you're interested in being part of a beta group contact me.
- lufte 8y ago
  Where can I read more about this project?
  - 3pt14159 8y ago
    It's not public yet. Sorry. If you subscribe to my RSS feed you'll be sure to hear about it when I start talking about it. https://www.zachaysan.com/writing/feed.xml https://www.zachaysan.com/writing/feed.xml
- repsilat 8y ago
  > We need a web-of-trust at the connection layer In practice, this might mean the end of net neutrality, and could entrench the Googles of the world -- "shoot, I can't send a packet to them, but they trust Google, so I guess I will too." > No stupidness with PDFs I hold out hope for sandboxing. WASM could kill browser PDF plugins easily enough. Hell, JS probably could already... Could you say a little more about "third party connections"? Do you mean no loading resources from other domains? No CORS? Or something else?
- deleted 8y ago
  [deleted]
- danShumway 8y ago
  > No more third party connections. We don't really need them. Just put whatever data you want in the URL like we do with OAuth. I'm a bit confused with this. Are you talking about deprecating CORS? How would putting information in a URL mean that you didn't need a third party request anymore? > I don't know how to fix JavaScript, but it needs fixing. JSON is cool I may also be misunderstanding here, but are you talking about getting rid of clientside scripting? Or moving all scripting serverside? If that's the case, do you have any plans on how to get businesses, devs, and users on board with that? I understand that there's a sizable population on HN that would prefer if the web be a static document service and not an app platform, but even if they're right they have almost zero chance of getting anyone else to agree with them. If that's not what you're talking about and you just hate JS, then you should look into web assembly as a compile target. > We need a web-of-trust at the connection layer robust enough to be embeddable in our network gear. This just screams vendor lock-in to me. It's very important that connection information and permissions be user-configurable. It also seems at first glance like it might be problematic for security. Baking trust models into firmware means that it's a lot harder to patch them when the models need to be updated. > no more untrusted, unsigned, unencrypted streams I'm pretty sure Chrome is already heading in this direction. Archivists are mad about it, but I suspect HTTP will be deprecated sometime in the future. > DNS is so f---- dumb it's painful. Completely agreed. I would love to see DNS put out of its misery.

snomad 8y ago

Completely agree about broken protocol. Unfortunately, I doubt their will ever be a real impetus to abandon it; we will just keep muddling along strapping ever more duct tape. But let's dream, what would your protocol be? For some reason I have always had a hang up on the headers. The lack of real concrete specs, forging clients, and now the ugly monstrosity of CSP. I love the effect, but in my dream new protocol we have to opt into features during some kind of app / client handshake.

3pt14159 8y ago
I answered elsewhere. I completely agree on CSP; which is essentially saying: "Oh shit, we fucked up, but lets leave the default as horrible because ¯\_(ツ)_/¯ the nerds that care about this will think they have a solution."
djsumdog 8y ago
> muddling along strapping ever more duct tape Let's strap some sockets to HTTP and run them through a web server. We'll call them Web Sockets. Chat? I have this crazy idea called WebRTC. .. although our original idea was a huge security hole and now it's pretty much just used for games .. because browsers don't do Datagrams so let's just do some more hacking with WebRTC. Anyone remember when Firefox was the lightweight version of Mozilla and web browsers were used to browse the web? I feel like all modern web browsers are in a pretty sad state of bloat, are pretty much mini operating systems, and Javascript is taking over the world. It's frighteningly like that parody talk about "Yavascript"
omginternets 8y ago
Why is the Tor protocol broken?