3 ms·

Thanks for the link to beaker - this is really interesting. I was curious what the difference with IPFS (that I had heard of) and Dat (that I had not heard of)

Thanks for the link to beaker - this is really interesting. I was curious what the difference with IPFS (that I had heard of) and Dat (that I had not heard of) - they have a FAQ entry on this on their page: https://docs.datproject.org/faq#dat-vs https://docs.datproject.org/faq#dat-vs

mattlondon 8y ago
Just looking into this a bit more, the video briefly skims over their "Fritter" demo without going into detail. I didn't grok what it was doing from the video so dug deeper. This is basically a twitter clone (https://github.com/beakerbrowser/fritter/blob/master/README.md https://github.com/beakerbrowser/fritter/blob/master/README....), but the difference is that your profile and your posts (i.e. all your data) is stored in your own "archive" stored on Dat, and the APIs they have written simply load up that archive over Dat to get all your details (and cache it to provide some performance) WebDB source here that explains it: https://github.com/beakerbrowser/webdb https://github.com/beakerbrowser/webdb So you can go and edit/delete your posts and profile from the data on your computer, and it is updated in the Fritter application instantly. Posts you make from the app automatically appear in the files in your local archive too. That is pretty cool! In light of GDPR this is really interesting and potentially huge - you could imagine a lot of use cases for this where you are really in control of your data. I believe that only you can edit your own archive since only you have the private key - posts from Fritter made by you are writing to your own archive so that is how they handle auth I think. Question for anyone familiar with Dat: how do I properly secure access to my data? E.g. instead of the Fritter application, what if there was an ecommerce application? I put my home address, paypal/credit card etc data in my own archive that the ecommerce site uses. How can I make sure that only the ecommerce site can access that? I know in the FAQ it is basically relying on security by obscurity, but is there anything more concrete than that? It would be nice if asymmetric keys were somehow pinned to a Dat archive so that I could still edit my archive in plain text still and then have the application transparently encrypt it with the ecommerce site's public key so that I could be sure that only those with the ecommerce site's private key could unencrypt it. Also, are there common "micro-formats" for common applications? E.g. looks like Fritter has its particular format that it uses - is there a defined format for this that would allow me to reuse the same archive on another service? You can imagine the ecommerce one being very useful - no more entering your name, address and credit card over and over!
- zaarn 8y ago
  It's not that easy with GDPR, the dat protocol to my knowledge knows how to update but not how to delete. A delete is essentially a soft-delete in that case.
  - mattlondon 8y ago
    Yeah I guess there are questions how delete works in a distributed system like this. E.g. if I have the archive on my computer/server I control and delete it then bingo - the data is gone and the app cant access my data any more. However, what happens to nodes that are seeding my data? Presumably they'll hang onto it for as long as they want, and there would not be a way to "force delete" the shared data since that would break a lot of the other benefits. Same goes for any hypothetical "prevent seeding" type options.
    - zaarn 8y ago
      There is no sensible way to force delete tbh. Once someone has made a copy, you can't delete it. But I'd rather have social networks of the future have a DELETE call that atleast honest nodes will follow and delete the stuff.
- kickscondor 8y ago
  > Question for anyone familiar with Dat: how do I properly secure access to my data? E.g. instead of the Fritter application, what if there was an ecommerce application? I put my home address, paypal/credit card etc data in my own archive that the ecommerce site uses. No, there isn't a pattern for this kind of thing. There is a "session data" proposal[1] that begins work in this direction. However, there is an implicit attack vector here - if a phishing website were able to punk you into connecting to the address (and key, presumably) of your wallet - well, then they score all the good stuff. Beaker would need to have a keychain-type thing builtin that would store that dat address and private key. I think Beaker has a great start and they are grabbing a bunch of great low-hanging fruit. This is the first time I've seen compelling "static" applications. And it marks a return of the read-write browser. (Yes you can figure out how to run a TiddlyWiki locally from Firefox, but Dat lets you create a website right from its start page.) [1] https://www.datprotocol.com/deps/0006-session-data-extension/ https://www.datprotocol.com/deps/0006-session-data-extension...
tekknolagi 8y ago
If you're interested, I wrote a small paper about the Dat Project for my distributed systems class: https://bernsteinbear.com/dat-paper/ https://bernsteinbear.com/dat-paper/

mattlondon 8y ago

Just looking into this a bit more, the video briefly skims over their "Fritter" demo without going into detail. I didn't grok what it was doing from the video so dug deeper. This is basically a twitter clone (https://github.com/beakerbrowser/fritter/blob/master/README.md https://github.com/beakerbrowser/fritter/blob/master/README....), but the difference is that your profile and your posts (i.e. all your data) is stored in your own "archive" stored on Dat, and the APIs they have written simply load up that archive over Dat to get all your details (and cache it to provide some performance) WebDB source here that explains it: https://github.com/beakerbrowser/webdb https://github.com/beakerbrowser/webdb So you can go and edit/delete your posts and profile from the data on your computer, and it is updated in the Fritter application instantly. Posts you make from the app automatically appear in the files in your local archive too. That is pretty cool! In light of GDPR this is really interesting and potentially huge - you could imagine a lot of use cases for this where you are really in control of your data. I believe that only you can edit your own archive since only you have the private key - posts from Fritter made by you are writing to your own archive so that is how they handle auth I think. Question for anyone familiar with Dat: how do I properly secure access to my data? E.g. instead of the Fritter application, what if there was an ecommerce application? I put my home address, paypal/credit card etc data in my own archive that the ecommerce site uses. How can I make sure that only the ecommerce site can access that? I know in the FAQ it is basically relying on security by obscurity, but is there anything more concrete than that? It would be nice if asymmetric keys were somehow pinned to a Dat archive so that I could still edit my archive in plain text still and then have the application transparently encrypt it with the ecommerce site's public key so that I could be sure that only those with the ecommerce site's private key could unencrypt it. Also, are there common "micro-formats" for common applications? E.g. looks like Fritter has its particular format that it uses - is there a defined format for this that would allow me to reuse the same archive on another service? You can imagine the ecommerce one being very useful - no more entering your name, address and credit card over and over!

zaarn 8y ago
It's not that easy with GDPR, the dat protocol to my knowledge knows how to update but not how to delete. A delete is essentially a soft-delete in that case.
- mattlondon 8y ago
  Yeah I guess there are questions how delete works in a distributed system like this. E.g. if I have the archive on my computer/server I control and delete it then bingo - the data is gone and the app cant access my data any more. However, what happens to nodes that are seeding my data? Presumably they'll hang onto it for as long as they want, and there would not be a way to "force delete" the shared data since that would break a lot of the other benefits. Same goes for any hypothetical "prevent seeding" type options.
  - zaarn 8y ago
    There is no sensible way to force delete tbh. Once someone has made a copy, you can't delete it. But I'd rather have social networks of the future have a DELETE call that atleast honest nodes will follow and delete the stuff.
kickscondor 8y ago
> Question for anyone familiar with Dat: how do I properly secure access to my data? E.g. instead of the Fritter application, what if there was an ecommerce application? I put my home address, paypal/credit card etc data in my own archive that the ecommerce site uses. No, there isn't a pattern for this kind of thing. There is a "session data" proposal[1] that begins work in this direction. However, there is an implicit attack vector here - if a phishing website were able to punk you into connecting to the address (and key, presumably) of your wallet - well, then they score all the good stuff. Beaker would need to have a keychain-type thing builtin that would store that dat address and private key. I think Beaker has a great start and they are grabbing a bunch of great low-hanging fruit. This is the first time I've seen compelling "static" applications. And it marks a return of the read-write browser. (Yes you can figure out how to run a TiddlyWiki locally from Firefox, but Dat lets you create a website right from its start page.) [1] https://www.datprotocol.com/deps/0006-session-data-extension/ https://www.datprotocol.com/deps/0006-session-data-extension...

tekknolagi 8y ago

If you're interested, I wrote a small paper about the Dat Project for my distributed systems class: https://bernsteinbear.com/dat-paper/ https://bernsteinbear.com/dat-paper/