3 ms·

> In order to decentralize the web, we need a standard for the internal state of websites, that makes it easy for websites to re-use the state of other websites

> In order to decentralize the web, we need a standard for the internal state of websites, that makes it easy for websites to re-use the state of other websites. This is not coherent.

sagichmal 7y ago
To say more, state that can be modeled as an e.g. CRDT is always domain bounded, and almost always subject to domain constraints like, at a minimum, authn/authz. Even if you can come up with a domain whose state makes sense to share between website boundaries, making agnostic intermediaries like HTTP servers state-aware enough to perform semantic merges necessarily strips that state of any notion of privacy. This logic doesn't make sense to have at the transport or data layer of a public network.
- toomim 7y ago
  Your concern is that adding CRDT merge semantics somehow prevents a server from implementing access control? That's not the case. The Braid spec does not impede access control — that works just like it always has on the web. A client logs into a server. If a client does a GET request, the server decides whether the client can see the result. If a client does a PUT request, the server decides whether to allow it. The only difference is that these GET and PUT requests can now be broken into granular patches with a version history. And if you want to build a peer-to-peer network, then you will replace the server with a validation function running on each peer, and authentication with a crypto scheme. But we aren't at the point of trying to standardize that stuff yet.
  - sagichmal 7y ago
    > Your concern is that adding CRDT merge semantics somehow prevents a server from implementing access control? My concern is that this requirement means the state can't be encrypted. > if you want to build a peer-to-peer network, then you will replace the server with a validation function running on each peer, and authentication with a crypto scheme How do you break a GET request of some state blob into "granular patches" if the state is encrypted?

> In order to decentralize the web, we need a standard for the internal state of websites, that makes it easy for websites to re-use the state of other websites. This is not coherent.

sagichmal 7y ago

To say more, state that can be modeled as an e.g. CRDT is always domain bounded, and almost always subject to domain constraints like, at a minimum, authn/authz. Even if you can come up with a domain whose state makes sense to share between website boundaries, making agnostic intermediaries like HTTP servers state-aware enough to perform semantic merges necessarily strips that state of any notion of privacy. This logic doesn't make sense to have at the transport or data layer of a public network.

toomim 7y ago
Your concern is that adding CRDT merge semantics somehow prevents a server from implementing access control? That's not the case. The Braid spec does not impede access control — that works just like it always has on the web. A client logs into a server. If a client does a GET request, the server decides whether the client can see the result. If a client does a PUT request, the server decides whether to allow it. The only difference is that these GET and PUT requests can now be broken into granular patches with a version history. And if you want to build a peer-to-peer network, then you will replace the server with a validation function running on each peer, and authentication with a crypto scheme. But we aren't at the point of trying to standardize that stuff yet.
- sagichmal 7y ago
  > Your concern is that adding CRDT merge semantics somehow prevents a server from implementing access control? My concern is that this requirement means the state can't be encrypted. > if you want to build a peer-to-peer network, then you will replace the server with a validation function running on each peer, and authentication with a crypto scheme How do you break a GET request of some state blob into "granular patches" if the state is encrypted?