3 ms·
IMO the way we currently do APIs is backwards. APIs should offer a way to run your own code in a sandbox, close to where the data is. That way, you don't have
by miki123211 6y ago
IMO the way we currently do APIs is backwards.
APIs should offer a way to run your own code in a sandbox, close to where the data is. That way, you don't have to worry about fine-grained or coarse-grained requests. All clients make just one request, supplying the code needed to retrieve the data.
Of course, the untrusted code should only be allowed to use a restricted interface, depending on the scopes/permissions.
It would be even better if the code could be statically analyzed, to determine the best SQL queries to perform.
This would require a pretty radical rethinking of our stacks, but would bring great benefits. APIs would be simpler to make, and webpages would load much faster. We could even give third parties access to very sensitive information, as long as their code would be constrained in what it could return. Think of a service that requires KYC/AML verification. Your government could give it access to all your private information, but allow the code to return a single true/false response to preserve privacy. Much better than the current method of sending ID scans everywhere and praying they never get leaked.
- janekm 6y agoWhat you are describing used to be called "mobile information agents" in the late 90s ;) Sandboxing technology wasn't really quite ready for that at the time time... (not sure if it really is now, though arguably WASM is closer than JVM was) https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.544.6649&rep=rep1&type=pdf https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.54...
- HeyLaughingBoy 6y agoI completely forgot about information agent technology. It was supposed to be the Next Really Big Thing but seemed to fizzle out completely once the hype died down. Was it ever used for anything significant?
- janekm 6y agoNothing I’ve come across, though I feel one could make the case that many of the ideas live on in some shape (Web APIs, serverless/lambda, Etherium Solidity, Service oriented architectures...).
- sambroner 6y agoShould it be symmetric? Code + Data... either on the client or in the cloud. You'd just check which is bigger!
- miki123211 6y agoIn production apps, the code would probably get transferred to the server at compilation/bundling/release time. The cluent would only need to send some kind of hash that uniquely identifies the function to call, as well as supply the arguments.