59 ms·

Ask HN: If the Internet were redesigned today, what changes would you make?

• smsm42 5y ago
  Security by design. Old internet protocols have been built with the mind of "we're all friends here, we won't make each other's life hard, right?" Well, that didn't exactly work out. That's why we have spam, DNS hijacking, DDoS, botnets, etc. If some prophet could have convinced people that built early internet that security is as much of a concern as, say, availability and fault-tolerance - I am sure we would have much less of these problems.
• westoque 5y ago
  Personally. I'm targeting the browser. Web applications have evolved so much that we now need access to more hardware to further improve our web apps. Imagine having direct access to GPU and other things, we can then be running full apps in the browser, think Photoshop/Final Cut Pro, even games that required full 3D rendering. To an extent, this also requires us to remove the shackles from only having JavaScript as the only allowed scripting language in the browser.
• smoldesu 5y ago
  Separate the portions of the web into non-profit and for-profit sections. Web 2.0 ruined the internet with the introduction of paywalls and 'premium' content that was never premium in the first place. You're welcome to live in that dystopian hellscape, but I'd frankly prefer the ability to hit a switch and instantly disable all bullshit.
• londgine 5y ago
  I'm not sure how this can be done, but remove location association from IP. It annoys me to no end that google changes the language based on my location rather than my preference (sometimes with no obvious way to fix it). It would also stop the annoying country restrictions on websites.
  • p1mrx 5y ago
    There is no inherent location information in an IP address, but those packets have to physically go somewhere at 2/3 light speed. We could design a network like Tor where the routing is geographically oblivious, but then everywhere on Earth would have the same (very slow) ping time. It is saner to make a fast network, and then layer an anonymous one on top of it.
    • londgine 5y ago
      starlink is the current solution that I am hoping for
      • p1mrx 5y ago
        Starlink raises the speed from 2/3*c to 1*c, but IP addresses are still anchored to a location... otherwise the latency would suck. You can geolocate any fast internet connection by measuring its latency to various points on Earth.
        • londgine 5y ago
          > You can geolocate any fast internet connection by measuring its latency to various points on Earth. How would you be able to differentiate 20 degrees east of the server with 20 degrees west of the server?
          • p1mrx 5y ago
            Use multiple servers.
  • salawat 5y ago
    Geolocation of IP blocks is basically all Google et al's fault. Once you go around wardriving to map all the infrastructure.... Well.. you get what they paid for.
    • 5y ago
• rlt 5y ago
  Larger IP address space. E2EE for all major protocols from the start (DNS, HTTP, SMTP, etc) Protocols for controlling unwanted email and analytics (a not disastrous version of EU’s cookie consent)
• pengaru 5y ago
  HTTP should have had some kind of URI event pub/sub mechanism from the start, including notifications for URIs pending removal to facilitate archival without polling or whatever crazy ad-hoc madness you want to call archive.org's priceless efforts. Still an unresolved issue to this day AFAIK.
  • beebeepka 5y ago
    Yes but how would you implement this on a low level? How would a system know something had happened without some kind of polling lurking below?
    • pengaru 5y ago
      Whether the web server in question polls files in a posix filesystem for mtimes/ENOENT, employs inotify, or has a higher-level CMS type deal to trigger events when the CMS modifies/adds/deletes resources kept in an RDBMS is an irrelevant server implementation detail. I think the real challenge to implementing this kind of thing is preventing abuse. If servers were to accept subscriptions on resources under their purview in the form of an arbitrary URL to poke when there's an event, it's ripe for abuse without some additional steps. But I think something along the lines of what letsencrypt does would be sufficient; make the subscriber prove control over the domain to be poked by asking it to reply with some gibberish at a specific url under its purview before accepting the subscription at that domain, and you'd throttle/limit those operations, just like letsencrypt does. At least that way you're not turning subscriptions into DDoS attacks via notification events sent to unsuspecting domains...
• ergocoder 5y ago
  One small thing: spell referrer correctly.
  • flerovium 5y ago
    OP here. Yes!
• akmittal 5y ago
  Not sure if that should be part of internet or web. But a decentralised way to do an internet search. So an anbiased/no tracking search engine
• perryizgr8 5y ago
  No remote code execution is allowed on the web. You can download binaries and run them, but not in the browser's context.
  • CodeGlitch 5y ago
    So instead of running code in the browser's sandbox, you have to run it at user level? Sounds terrible and this is what things where like in the 90s. Say you wanted to do some banking, you would have to download and install the bank's application, which usually only ran on Windows. No thanks.
    • perryizgr8 5y ago
      I would prefer that over what we have today, yes.
• fahrradflucht 5y ago
  For DNS specifically, CNAME responses applying for the whole domain name instead of a specific record type was definitely a mistake in hindsight. It's just because of that decision that we can't have CNAMEs at the apex, which definitely is in the way in a bunch of situations.
• holomorphically 5y ago
  Cryptographic identity verification and trusted clocks. As in, cryptography would be built-in and everyone would have a set of keys that they could use to verify ownership of digital content by using cryptographic signatures and timestamps.
  • liveoneggs 5y ago
    how would you get those trusted clocks to agree with each other?
    • holomorphically 5y ago
      Through a synchronization protocol but it's obviously impossible to have perfectly synchronized clocks so the safest thing to do would be to use several timestamps from several clocks. Blockchains in a way are such clocks where the ordering of the blocks on the chain provide an implicit counter. But blockchains have too much overhead so by assuming some trust it would be possible to get rid of the proof of work mechanism and just use a signed timestamp from a trusted source.
      • yjftsjthsd-h 5y ago
        How is that different from the existing ntp infrastructure, which already supports encryption, integrity, and stratum one time servers?
        • holomorphically 5y ago
          Can I send a hash of some content and then get a signed response from the ntp server with a timestamp?
• wmf 5y ago
  Maybe make the DNS less US-centric (e.g. .com vs. .co.uk) and replace the PKI with DANE. We should have had DHCP prefix delegation for IPv4 so people wouldn't need NAT.
  • flerovium 5y ago
    What is DHCP prefix delegation?
    • feisuzhu 5y ago
      In DHCP-PD you get a subnet instead of a single IP.
  • p1mrx 5y ago
    DHCP-PD for IPv4 would eat up all the addresses on day one. It only makes sense to automatically delegate prefixes when those prefixes are an abundant resource.
    • wmf 5y ago
      Yes, and then the motivation for IPv6 would have arrived sooner.
      • p1mrx 5y ago
        So basically, we should have used IPv4 addresses more profligately in the '90s, in order to pull the runout date forward from 2014 to 199x-200x, increasing the urgency of the transition. That's not the worst idea I've ever heard.
• ollerac 5y ago
  Web app capabilities built in to the foundation of HTML and the browser. Elements that know they're user-editable (images with upload controls attached to them to replace the image that's there, dates that trigger calendar controls when clicked, and inline editing for other elements that actually works and is consistent across browsers). An offline database in the browser that has the concept of user accounts and resetting passwords baked in, as well as subscription payments, and has a universal API that can be automatically deployed to any hosting platform. All of this would make building web apps and games trivial for so many more people -- write some basic HTML, upload it to one of a million platforms of your choice with a click, and you have a testing ground for a product that can grow. It would be a way for anyone on the internet to build something useful and get it out there without learning a thousand technologies with a thousand nuances.
  • spullara 5y ago
    You are talking about the web, not the internet.
• IX-103 5y ago
  Can we fix email so that it provides authentication, integrity, and confidentiality protections by default? And also while we're at it make it support binary attachments so that we're not stuck wasting bandwidth and disk doing base64 for everything?
  • native_samples 5y ago
    Well, email is already kinda 'fixed'. You can't do much about laggards but they drop out with time. Authentication? DKIM, check. Integrity and confidentiality? SMTP-TLS, check. Oh, you meant against the provider? S/MIME, check. Base64 - irrelevant given the size limits most vendors apply to attachments. Email isn't a great file sharing system and trying to optimize it for that might be a bad idea. People use Google Drive etc links these days instead, which works better.
  • abakker 5y ago
    why not just extend the email protocol to really support open calendars, open social networks (decentralized) and open p2p chat? email is a nice way of addressing, but we underuse that address compared to all the balkanized post-email systems.
    • hkt 5y ago
      There are efforts in those directions: https://delta.chat/en/ https://delta.chat/en/ implements encrypted IM over email. https://jmap.io/spec-calendars.html https://jmap.io/spec-calendars.html is the calendaring spec for IMAP's likely successor https://webfinger.net/ https://webfinger.net/ is the (appallingly named) http protocol for finding named people such that social connections can be made and managed. Some extensions exist for services that commonly run with email that provide webfinger services.
      • I_complete_me 5y ago
        Delta chat look very interesting, thanks for mentioning it. What are the possible downsides? Looks like a winning tech to my non-tech eyes.
• Turing_Machine 5y ago
  The biggest mistake was making it trivial to forge email headers. While the spam problem is much better than it used to be, that's because there's a whole lot of behind-the-scenes (and expensive) infrastructure devoted to combating it. That infrastructure has also made it considerably more difficult to run your own mail server. While you can still do it, there are many hoops to jump through if you want to keep your mail from being dropped on the floor by the first overzealous spam filter it encounters. Unless you're big enough to devote a staff just to that (or you have a lot of free time) it's easier (but more expensive) to just use MailGun, MailChimp, or one of their brethren. I would guess that the annual cost of spam is somewhere in the billions.
  • DarknessFalls 5y ago
    >> The biggest mistake was making it trivial to forge email headers. Thanks to VoIP, we've seen a surge in phone numbers being spoofed with robocalling. I'd like to see some form of authentication applied to this and to email.
• ArtWomb 5y ago
  Already being re-designed today in QUANT-NET https://www.energy.gov/sites/prod/files/2020/07/f76/QuantumWkshpRpt20FINAL_Nav_0.pdf https://www.energy.gov/sites/prod/files/2020/07/f76/QuantumW... https://apps.dtic.mil/sti/pdfs/AD1096290.pdf https://apps.dtic.mil/sti/pdfs/AD1096290.pdf
• nickysielicki 5y ago
  IPv6 dates back to 1997 and it really should have been adopted more urgently. IPv4 isn’t a huge issue but it sucks that so much of the internet is dependent on cloud providers because it’s the simplest way to get a public IP address. The decentralized web didn’t happen, in part, because of this. Facebook was famously started and hosted in a dorm room. But this was only possible due to the history of Harvard within the advent of the internet and the fact that they had such an excess of addresses that Zuck could bind to a public IP address. We’ll never know what tiny services could have blown up if people didn’t hit this wall. I started off with computers by hosting garrysmod servers. My brother started off with computers by hosting a website dedicated to the digital tv switchover in Wisconsin (lol). This was only possible because my dad was a software engineer and paid a bit extra to get us 5 dedicated IP addresses. If he didn’t understand that, who knows what me or my brother would be doing today. Anyway, I say IPv6.
  • fy20 5y ago
    > the fact that they had such an excess of addresses that Zuck could bind to a public IP address VPS providers such as Linode were around at the time, and they weren't that expensive. $20/mo would have got you enough to get started. Or you just get shared PHP hosting which would have been cheaper or even free (with ads injected). And much simpler to deploy than today, just FTP the files and boom it's live. If you were lucky, your host had cPanel.
    • Azsy 5y ago
      > $20/mo would have got you enough to get started. What? Have you forgotten what your first time was like? There is a huge difference between thinking: > "I build my first shitty website, if i leave my PC on everybody in the world can use it. Who knows what will happen?" And instead being required to go: > "I'll spend 20$ a month to maybe entertain a couple of people for a couple of minutes by using someone else's hardware"
      • compsciphd 5y ago
        if your PC only consumes 50w (somewhat low for a desktop). and your power is 20c a KWH (a little high on average, but not crazy high, though perhaps 0 in a dorm room). you'll be spending $7-$8 a month just on electricity. So it's not "free" to run it on your PC. now, if you view that your PC runs 24/7 anyways, perhaps (much like the dorm room case) the marginal cost is 0. I'm simply making the case that it might not be, and it could very well be a significant %age of the linode cost.
• sjtindell 5y ago
  I have this experience where I come into new orgs or projects and I think if we could just start fresh with the old lessons, we could build it so much cleaner. It’s partially true. But mostly we end up building a really clean base, then as the business requirements come up, we need to add back in all the things I thought were kruft. I think lots of tech is this way. Try to build a new DNS, you’ll just end up reinventing a (probably worse version of) DNS.
  • quantisan 5y ago
    even before new requirements come up, some of the idiosyncrasies or edge cases would be overlooked in the new version and the project would take much longer than anticipated. if the current tech is so messed up to warrant a re-build, why would one expect that all the requirements are properly captured? having said that, stepping back and articulating the existing problems could be a viable first step. Identify and scope the problems before dreaming of solutions. /product engineer and party pooper hat off
• liveoneggs 5y ago
  DNS is far from perfect, TLDs are stupid and always have been, the arbitrary rules for records are stupid, MX records are ridiculous, UDP size constraints on answers.. nevermind I could keep going. DNS sucks.
  • cookiengineer 5y ago
    Also: DNS resolvers and ISPs are the reason for amplification attacks. ISPs should simply check where the UDP traffic is coming from, and filter out packets that have a different UDP source address inside them. This would literally make the internet DDoS free.
    • schoen 5y ago
      There are DDoSes that are based on botnets without specifically relying on amplification or reflection. There have even been DDoSes relying on user-contributed resources: https://en.wikipedia.org/wiki/Low_Orbit_Ion_Cannon https://en.wikipedia.org/wiki/Low_Orbit_Ion_Cannon Amplification makes a DDoS bigger, but isn't what makes it a DDoS.
      • cookiengineer 5y ago
        > Amplification makes a DDoS bigger, but isn't what makes it a DDoS. I know, but large botnets like MIRAI and similar usually take advantages of how UDP flooding works, because TCP RST packets don't scale as well. I was just mentioning that because ISPs could easily get rid of most UDP-based DDoS attacks if they would watch their networks' packet sources (what they're doing anyways). Usually it's literally just a comparison of IANA assigned IP ranges (of source+victim being inside or outside), and if they're mismatching, it's very likely to be a UDP flooding attack.
• Nevermark 5y ago
  End to end encryption and tracking-resistance at a low enough protocol level that most developers or users would never know the pain of even thinking about either. Imagine how many times security and privacy have been reimplemented in different contexts. And that patchwork approach will incentivize security breaches and manipulation through dark surveillance until ... no end in sight.
  • aaomidi 5y ago
    Technically tls is end to end encryption. Between you and the service provider.
    • smolder 5y ago
      No, the ends in "end to end encryption" don't ever refer to the service provider.
      • aaomidi 5y ago
        Generally the ends are defined when you're going to say E2EE. In some places it's implied (e.g. a messaging application), elsewhere it's not and should be defined.
  • cm2187 5y ago
    Though the lower you go, the harder it is to upgrade. SSL/TLS has been evolving regularly. In fact if you connect an old machine to the internet, it is the one thing that is likely to make it incompatible with the current internet.
  • bawolff 5y ago
    Distributing keys gets harder the lower you go. Although even non authenticated encryption is nice to prevent passive eavesdropping.
    • native_samples 5y ago
      Technically there's no reason that there couldn't be an automatic PKI over the entire IP space, in which routers and ISPs are CAs. It never happened because the IP world sees crypto as an app-layer problem, but it doesn't have to be that way. The protocols could be encrypted by default - all that's needed are protocols to let a device communicate to the router what its chosen public key is, and for that to communicate it back to the owner of the IP block, which has to operate an OCSP-like query service to vend certs.
• ohCh6zos 5y ago
  Get rid of most of JS to prevent 'appification' and keep the focus document centered. Edit: I think this would result in protocols over walled gardens. The problem is JS makes HTTP/HTML everything to everyone.
  • zarzavat 5y ago
    Be careful what you wish for. JS and HTML5 is why we don't have Adobe Flash anymore. There was a whole period in the noughties when web interactivity sucked and so external plugins like Flash, Silverlight and Java applets took up the slack. The alternative to JS is not "no scripting", it's websites that only function with proprietary plugins installed.
    • throwaway81523 5y ago
      > The alternative to JS is not "no scripting", it's websites that only function with proprietary plugins installed. Yes and those were websites that for the most part nobody gave a crap about. The important sites weren't willing to dump so many of their viewers. Heck, even post-JS, the web didn't suck so badly until the option of shutting off JS was removed from browser UI's. Before that, enough users shut off JS that sites wanting wide audiences had to be able to function without it.
      • teaearlgraycold 5y ago
        No one cared about YouTube? No one cared about Netflix?
        • throwaway81523 5y ago
          People were willing to set exceptions for sites they thought were important. Not important AND requires JS => bye.
          • vkou 5y ago
            I'm not sure the likes of YouTube and Netflix need further privileges compared to the rest of the web.
• bobajeff 5y ago
  I would prefer if the internet architecture was a mesh network and that sites/pages were content addressable.
• gorbachev 5y ago
  The number one change I'd make is not to trust users to behave.
• short12 5y ago
  No ads at all
  • mkl 5y ago
    Ads don't have anything to do with the design of the internet, and if you want free expression to be possible, so are ads. Otherwise you'd need every scrap of content anyone makes to go through a censor before being made available.
• hollerith 5y ago
  I would have tried to arrange it so that whatever method comes to the mind of the average person for publishing a document on the internet publishes a static document. The situation today of course is that the method that usually comes to mind when a person decides that something he or she has written should be put on the internet publishes what is essentially an executable for a very complex execution environment, and (except for a single non-profit with steadily decreasing mind share) the only parties maintaining versions of this execution environment with non-negligible mind share are corporations with stock-market capitalizations in the trillions.
  • yjftsjthsd-h 5y ago
    What's especially painful is that this isn't actually an inherent problem, just a shortcoming in tooling. If WordPress had defaulted to generating static HTML as its output, even just as a preferred caching method that was enabled by default, you would have basically solved this problem.
• joshu 5y ago
  identity as a core layer. having been in the wrong end of a large service that was relentlessly attacked and spam. i understand the value of anonymity but it probably should not have been the default.
  • yjftsjthsd-h 5y ago
    While I deeply disagree (go look at Facebook and tell me with a straight face that a real name policy fixes spam), I truly appreciate you actually saying that under your real name; the number of times I've seen anonymous posters arguing against anonymity...
    • joshu 5y ago
      i guess what i really want is idempotency of identity. i don’t need people’s real identities, i just need them to not make millions of accounts and spam with them.
• yjftsjthsd-h 5y ago
  Make the actual protocol for HTTP always be TLS, always port 443. Insecure HTTP is just self-signed.
• doctor_eval 5y ago
  I’d make sessions independent of IP addresses. So that as I move between wifi, fixed and mobile networks, my sessions would remain active even as my interface addresses change.
  • quesera 5y ago
    Session persistence can be achieved on top of IP. E.g. for ssh, there's mosh (uses UDP to work around the control part of TCP). Come to think of it -- everything I use is either stateless (http), or can use ssh for transport (ssh, sftp, sshfs, rsync, ...). I'm sure some other protocols still break, but I haven't felt that pain in years!
• AussieWog93 5y ago
  Performance, specifically making requests as parallel as possible. Does it really need to take 5 seconds to load a website whose contents total 500kB on a 100Mbit/s connection with a 6-core CPU?
• anonu 5y ago
  Just a thought experiment: but could we have designed better protocols to not need companies like Google (search) and Facebook (social network)... For example: a public index service (akin to DNS) where all pages upload all hyperlinks they were using. The end result is a massive graph that you can do PageRank on. You'd have to add some protections to avoid it getting gamed... Email was the first decentralized social network and with it came bulletin board services and groups. Could these concepts have been developed a bit further or been a bit more user friendly while remaining decentralized?
  • gfody 5y ago
    the first search engines worked this way - you'd submit your site to their index in a certain category with some keywords, and anyone could explore the index. they all seemed to realize around the same time that they ought to keep their indexes secret from one another and they vanished just like that.
• dredmorbius 5y ago
  DNS itself is certainly problematic. Incorporating a time dimension to domains, such that it's explicitly recognised, and greatly restricting transfers, would be one element. Ownership of domains should sit with the registrant, not the registrar. Characterspace should be explicitly restricted to 7-byte ASCII to avoid homoglyph attacks. It's not a shrine to cultural affirmation, it's a globally-utilised indexing system, and as such is inherently a pidgen. Other obvious pain points: - BGP / routing - Identity, authentication, integrity, and trust. This includes anonymity and repudiation. Either pole of singular authentication or total anonymity seems quite problematic. - Security. It shouldn't have been permitted to be baked on. - Protocol extensibility. Standards are good, but they can be stifling, and a tool for control. Much of the worst of the current Internet reflects both these problems. - Lack of true public advocacy. It's deeply ironic that the most extensive and universal communications platform ever devised is controlled by a small handful of interests, none answerable to the public. - More address space. IPv6 is a problematic answer. - Better support for small-player participation. Servers are still highly dependent on persistence and major infrastructure. A much more robust peered / mesh / distributed protocol set that could be utilised without deep expertise ... well, it might not make things better, but we'd have a different problem-set than we face presently. - Explicit public funding model for content, and a ban or very heavy tax on most advertising. - A much keener, skeptical, and pessimistic early analysis of the interactions of media and society.
  • poetaster 5y ago
    OLpC kind of dream?
    • dredmorbius 5y ago
      Sorry? (One Laptop Per Child I underststand. Not its relationship to my comments.)
      • poetaster 5y ago
        In the main, decentralized community (small player?) centered networking. Mesh ++. I admit it's some time since I thought about it but OLPC is what came to mind.
• jpgvm 5y ago
  Would redesign BGP with more resistance to Byzantine actors. Not so much because many folks announce routes maliciously (though that definitely) happens but because people always manage to screw it up accidentally. Make it easier and more equitable to obtain addresses and ASNs. Build protocol to make edge/cloud computing more fungible. Similar to folding@home but more flexible and taking into account networj connectivity rather than just CPU cycles. Probably looks a lot like Cloudflare Workers/Sandstorm but no vendor lockin. DNSSEC only. TLS only for HTTP/consumer facing web. Actually on the topic of that probably something simpler than TLS to replace TLS. It has too many features. x509 can stay but the protocol needs reworking for simplicity.
  • toast0 5y ago
    TLS 1.3 is kind of complex, but with less optional stuff is not too bad. X.509 is a nightmare of complexity, but at the same time is inflexible in useful ways. Certificate validation when not every node has the same list of CAs and some CAs are expiring is pretty hard to bulletproof.
• psion 5y ago
  IPv6 gets mentioned plenty, and I will take the side that it should have been rolled out WAY sooner than it did, and it should have been rolled out in a way that made it easier to do what I call the Apple Method: Just get it out there and the people will adapt to it. DNS is a horrid mess that should have been designed with ease of reading in mind. And I know that DNS was designed way before it, but I think a data transit format similar to JSON would have made the system a bit more extendable, and given people a chance to make it a more dynamic system. E-Mail was brilliant in it's time, but for the love of all things explosive and holy is it bad. Just the fact that in it's base design there is no E2E encryption going on is a problem. My biggest beef with the current internet is HTTP. Everything is built on it, and it isn't the greatest system. There have been so many systems and protocols implemented that did so many things, FTP/gopher/irc/etc, and most of them have gone the way of the dodo. A few hold-outs in the dedicated tech world will still use irc, but we could have done so much with cloud-based systems with FTP. And if we had a new spec for irc, would we need Slack/Discord/MS Teams/etc? They could then all talk to each other. We shouldn't be trying to reinvent the wheel, we should be using these older services in our platforms. And don't get me thinking about cloud. The worst term that a marketing team got a hold of. At it's core, it's just somebody else's computer. And again, so much of it is build on HTTP protocols. Not many people know or remember that xWindows and X for *nix systems had a distributed system built in. Log into a server, set one environment variable to your IP address as long as you were running one of these systems yourself, and you could runs programs on the server with the GUI on your computer.
  • hacker_homie 5y ago
    This touches on what I think is really wrong with internet innovation. We haven’t adopted a new wide spread protocol since the early 2000s because all big tech wants to silo their user base or make a protocol that gives them a massive first mover advantage(AMP, RCS). I wish we could make new protocols at all.
  • spc476 5y ago
    If you read the early RFCs (say, RFC-1000 or earlier) you'll find that FTP was the go-to protocol of the day, much like HTTP has become today.
• bryans 5y ago
  I think the most crucial functionality missing from a security standpoint, is the ability for one IP address owner to tell another that they're refusing service, and the owner of the refused IP being required to filter that traffic at THEIR routing layer. This would effectively eliminate nearly every type of DDoS, and it would also shift the responsibility to handle the attack away from the target's provider, and place it squarely on the providers of the compromised systems -- which is how it should be. Imagine a world without DDoS or Cloudflare's 3+ second redirect.
  • edgyquant 5y ago
    >the owner of the refused IP being required to filter that traffic at THEIR routing layer What's to stop a malicious actor from just ignoring the refusal?
    • bryans 5y ago
      Namely that an IP "owner" in this scenario could and should also be the participating upstream provider(s) between the requesting IP and malicious actor. If a particular provider isn't participating in the system, the traffic can still be blocked by one that is -- if not blocking the entire range.
  • laurent92 5y ago
    And that would also be used in rate-limiting and integrated to apps so no need to implement it manually.
• TheRealNGenius 5y ago
  Native payments, video, and search
  • salawat 5y ago
    You'll never get frictionless money transfers. Stop asking. Not trying to be glib, but it's a political and law enforcement necessity that not every Tom, Dick, Harry, and Jane be entry points to the financial system. I'm not saying I agree with the justification for it, but as someone who has seen how it works... It is alas, an incompatible outcome.
• mongol 5y ago
  I first understood the question as "what should have been done different if internet was designed today". I think it is a more interesting question. What mistakes were made that later needed less than optimal workarounds? What comes to my mind are character encodings and i18n. It was solved in many different ways in different protocols.
• reilly3000 5y ago
  Canonical User Identity. I know this is massively controversial but if we were starting at the beginning, an internet without anonymity would be a kinder, safer internet. One where data asymmetry and it’s enterprises wouldn’t have a toehold. A place that extends reality rather than contorts it. Privacy and anonymity have a place, and should be a right for consumption but never for creation.
  • salawat 5y ago
    Hard nope from me. No thanks. I want nothing to do with your system. Literally the only reason anyone wants to know who anyone is at all is to throw men with guns in their general direction. That is the one and only thing that the internet doesn't allow, and to be honest, I think that's for the best.
  • Kim_Bruning 5y ago
    The opposite is true. Privacy and anonymity are the best protection for the weak and marginalized. They are very closely correlated to the concept of free speech. And it is the ability to think and speak freely and work through matters that differentiates a civilized free society from the barbarians. Certainly, things like free speech, the right to a fair trial, privacy and anonymity also somewhat benefit "bad people". But unless you live a very boring life indeed, from time to time perhaps you will be the one who is going against the grain of society. (Or some small but significant segment thereof). And then you'll be glad that you have a safe harbor to fall back on.
  • nitwit005 5y ago
    People would just buy some fake identity from some poor island somewhere, and governments would spit out a few billion fake people for espionage and propaganda. And need some sort of identity management for all the automated processes to assume, which would be a huge nuisance.
  • tester756 5y ago
    >Privacy and anonymity have a place, and should be a right for consumption but never for creation. What makes you think so?
• soheil 5y ago
  I'd make it less transactional and more realtime. No http request, tcp packets instead more like old tv broadcasts where there is a continuous signal always being sent. If it was possible to have infinite radio frequencies to use. Then you could load every possible webpage of every website continuously broadcast on a different frequency. To load a page all you have to do is tune in to that frequency. You will then get an instant latest version of that site without having to wait. This gets more complicated for signed in websites. There is no reason you couldn't implement the same thing just add more frequencies for more users. This wouldn't work for POST requests, but I think any GET request would work fine.
  • snowycat 5y ago
    This would mean that in order to send something back to that server you would need to send an equally powerful radio signal that could reach back to where the server is. Its not the most convenient thing for some people to have a high power radio transmitter in their backyard.
    • soheil 5y ago
      The signal could get boosted by an intermediary station.
• aaronmdjones 5y ago
  Make BCP38 mandatory.
• EvanAnderson 5y ago
  1. SCTP instead of TCP (doesn't suffer from the maddening layering violation in TCP/IP w/ the host IP being part of the TCP tuple). This would solve mobile IP. 2. SRV RR's instead of "well known ports". Solves load balancing and fault tolerance as well as allowing lots of like-protocol servers to coexist on the same IP address. 3. Pie-in-the-sky: IPv4 semantics w/ a 96-bit address space (maybe 64-bit).
• mikewarot 5y ago
  First, you have to secure all the computers. Capability Based Security for everyone. This lets us all run mobile code without danger. (No more virus or worm issues) Next, we use 128 bit IP addresses, 32 bit port and protocol numbers, and absolutely forbid NAT as a way of getting more addresses. (no ip address shortage) Next, all email has to be cryptographically signed by the sending domain using public key encryption. (No more spam) Next, selling internet access [EDIT]ONLY is strictly prohibited. Either connections can host servers, or find a different business model. Any node of the internet should be able to run a small server. (No more censorship in the walled gardens) Yes, I know it's stupid to try to host a server on the upload bandwidth I get from a cable modem, but it shouldn't be prohibited. If I want to see my webcams from anywhere, it shouldn't require someone else's server. DNS should be done using a blockchain, it would need some iteration to get it right.
  • rlt 5y ago
    Mostly agree except instead of “prohibiting” certain things the systems we build should disincentivize them. e.x. No need to prohibit NAT if there are more than enough IPs to go around.
  • Koffiepoeder 5y ago
    > Next, selling internet access is strictly prohibited. Not sure if this is attainable, someone has to draw the cables and maintain them. What do you propose, that everyone does this for themselves? I don't think we'll be seeing much fiber cable, nor internet users then. What with trans-oceanic cables? In the end someone's got to pay the bill. I do agree however that DNS should be free and decentralized. The difficulty here would be to avoid domain hoarders. Maybe through some verification / vouching system? On the other hand that seems a lot like PGP keyservers, which also didn't turn out all too great. All in all, difficult problems. Maybe the current system isn't all too bad after all?
    • mikewarot 5y ago
      I edited my entry, I hope it makes sense... access is different than connection... access forces us to be consumers, connection lets us be suppliers.
• PhaseMage 5y ago
  I want a network that scales to trillions (or more) of top-level nodes (rather than the ~2 million supported by IP and BGP.) I want everyone to be able to host a router. I'd go source-routed isochronous streams, rather than address-routed asynchronous packets. I haven't updated my blog in a few years, but I'm still working on building the above when I have the time. (IsoGrid.org)
• cm2187 5y ago
  A mail protocol that guaranties the identity of the sender + e2e encryption. And making more top level domains available from the outset instead of the fetishisation of the .com domain.
• zdw 5y ago
  More client side retry built into protocols, and the ability to easily failover from the client-side. Protocols like DNS and SMTP are designed so that multiple servers that can handle traffic, and one going down isn't a big deal - the clients will just retry using and the entire system just keeps working. Compare to HTTP which don't have retry mechanisms which results in needing significant engineering to deal with single points of failure, fancy load balancers and other similar hard engineering challenges. Synchronization of state across HTTP requests would still be an issue, but that's already a problem in the load balancer case, pushed usually to a common backing database.
• graiz 5y ago
  I've thought about this a lot. I'd throw away HTML/CSS and start over with a client centric rendering protocol that is based on presentation first and semantics second. The language would be run-time compiled to describe exactly what needs to be rendered on the page and would be streamable to prevent rendering locks. Typical page size would go from 1M typical to 64K-128K being typical. Images would stream in after initial page renders but since most pages would fit in 1-3 packets, you'd see pages pop-in very quickly. This would also be very helpful for poor connection, mobile and the developing world. I'd fund a team to do this if I could figure out who would buy it.
  • hoten 5y ago
    Could you explain how this is different from SVG?
    • quickthrower2 5y ago
      That’s a cool side project! Build a modern site in svg. I guess you’d need JS to make it responsive
    • graiz 5y ago
      SVG is still a markup language, not one that is compiled or streamable. It's also not relational. While you can design a page with SVG it's not parametric in that you can't modify the content or the page and have it re-flow, resize or act responsivly. I would also describe SVG as a very verbose instruction set rather than a reduced instruction set.
  • biztos 5y ago
    How would this handle accessibility? 64-128K page size is perfectly doable in HTML today if anybody actually cares enough to do it. How much of the bloat in say an Amazon page is the JavaScript? Is there something about your protocol that would prevent the big players from re-normalizing 1M page size with it?
    • graiz 5y ago
• a1371 5y ago
  A slightly different answer: I would change the domain name ownership model. Right now to buy Kayaks you go to amazon.com, to travel to the amazons you go to kayak.com, it's confusing for end users . It's also empowering squatters and not the innovators. Also the whole .org debacle showed that community representation is not at the center of things.
  • franciscop 5y ago
    If you go to, say, apple.com can you buy apples or Apple computers? Would each page be like an index with subpages disambiguating things like https://en.wikipedia.org/wiki/Apple_(disambiguation) https://en.wikipedia.org/wiki/Apple_(disambiguation)? Or it would show about the fruit with a note for Apple Inc like https://en.wikipedia.org/wiki/Apple https://en.wikipedia.org/wiki/Apple?
• forgotmypw17 5y ago
  I would modularize-separate SSL and HTTP, so that the former was a local service which provided a local HTTP connection, and I could keep using browsers I love with most websites, not just my own.
• pgt 5y ago
  IP address per device instead of per network interface. Lisp instead of JavaScript.
  • kazen44 5y ago
    and how would routers work in this case?
• DarknessFalls 5y ago
  Several responses have mentioned removing anonymity from the equation to enforce good behavior. I think we could accomplish something similar just by having a global SSO that works for any website, totally decoupled from your actual identity or location. The only information it reveals might be some sort of quantifiable social standing based on how you interact with others on forums.
• wetpaws 5y ago
  Enstating a capital punishment for the use of any scripting language
• vfulco2 5y ago
  Use whatever technology is required to make it decentralized so tyrants and other evil do'ers have no chance of stopping free speech. The future of the world depends on it vs. the future of a relatively few self-annointed, banal, vile, narcissistic, wealth stealers.
  • visarga 5y ago
    I don't think free speech should be an absolute, there are situations such as vaccinations during a pandemic when free speech kills. Freedom vs security trade-off.
• deleted 5y ago
  [deleted]
• ChrisArchitect 5y ago
  What inspired you to ask this?
• visarga 5y ago
  I'd make a content addressable system to have better caching, balancing, backups and history of changes. I'd like the internet to preserve its knowledge into the future. As for security, I'd enhance the web browsers to do internet hygiene - removing unwanted bits and blocking information leaks. The browser should protect user accounts from being linked together. Another major issue is payments which today is a high friction backwards process and acts like a gatekeeper. We need an equitable solution for micro-payments without too large processing costs. The last one is search - users can't customize the algorithmic feeds it generates and startups can't deep crawl to support inventing new applications. Search engine operators are guarding their ranking criteria and APIs too jealously while limiting our options. So in short, ipfs/bittorrent like storage, nanny browser, easy payments and open search.
• ChrisArchitect 5y ago
  Plenty of recent related discussion: https://news.ycombinator.com/item?id=27663618 https://news.ycombinator.com/item?id=27663618
• tbabb 5y ago
  The "browser" is a blank execution sandbox with a rendering context. The remote server sends programs (using something like WASM) with a standardized ABI. The program can use the rendering context to put stuff on the screen or receive user input. Indexing and page interoperability is done by exposing standard functions which yield the necessary metadata. For example, if you want your site to be indexable by a search engine, you expose a function "contentText()" which crawlers will call (and which the client browser might also call and display using the user's own reader app). In the simplest case, the function simply returns a literal. Core resources like libraries would be uniquely identified, cryptographically signed, versioned, and shared. If someone wanted to make use of a browser pipeline like the standard one we have today, they might send code which does something like "DOMLibrary.renderHTML(generateDocument())". But someone else could write a competing library for rendering and laying out content, and it might take hold if it's better, and it wouldn't have to be built on top of the first one. Also, the browser wouldn't necessarily be a separate app (though someone could make one); it would be a standard built-in feature of operating systems, i.e. the sandboxing would be done at the kernel level. With security properly handled, there'd be no difference between a native app and a web app, except whether you load it from your own filesystem or a remote one.
  • nlitened 5y ago
    We already have that. It’s called Java
    • Nevermark 5y ago
      Java might have been that, if HTML and all the other web tech had never happened and Mosaic, Netscape Navigator, etc. had started out as Java sandboxes.
      • nlitened 5y ago
        If Java has obviously not outcompeted HTML, one should reflect, in which way HTML is obviously better in things that matter compared to a code sandbox.
• 6gvONxR4sf7o 5y ago
  Domain parking/squatting is disallowed. You’d have to make the rules in some imperfect way, but it’d be better than what we have today.
  • beebeepka 5y ago
    I have several domain names that I am not using but you're right
    • 8eye 5y ago
      i have like 10 but i agree as well
      • biztos 5y ago
        I have more than 10 but I also agree. I’m not squatting, I have a plan for each one, and the threat of losing them would be a great motivator to actually build all these little projects! OTOH there would probably just be “not squatting” services just like there were/are “under construction” landing pages.
        • wccrawford 5y ago
          The threat of losing my domains would cause me not to register them in the first place, which would hamper little people like me with small ideas, but probably not actually hurt squatters much since they'd be actively protecting their investments.
  • exporectomy 5y ago
    You want to replace highest bidder wins with first in first served? Is that really better? How? This sounds like naive market manipulation, which ends up being whack-a-mole or just a disastrous mess.
  • 02020202 5y ago
    i agree but then you have the email where you might not need the web at all.
• throwaway83736 5y ago
  Everything can always be improved. But there are some things that would make life for a lot of people easier. For one thing, operating systems' tcp/ip stacks. They should have come with TLS as a layer that any app could use just by making the same syscall they use to open a socket. For another, service discovery should not be based on hardcoded numbers, but querying for a given service on a given node and getting routed to the right host and port, so that protocols don't care what ports they use. Domain registration and validation of records should be a simple public key system where a domain owner has a private key, and can sign sub-keys for any host or subdomain under the domain. When you buy the domain you register your key, and all a registrar does is tell other people what your public key is. To prove you are supposed to control a DNS record, you just sign a message with your key; no more fucking about with what the domain owners email is, or who controls at this minute the IP space that a DNS record at this minute is pointing to. This solves a handful of different problems, from registrars to CAs to nameservers and more. The security of the whole web shouldn't depend on the security of 350+ organizations that can all independently decide to issue a secure cert for your domain. The public key thing above would be a step in the right direction. BGP is still ridiculous, but I won't pretend to know it well enough to propose solutions. Give IPv4 two more octets. It's stupid but sometimes stupid works better than smart. Give the HTTP protocol the ability to have integrity without privacy (basically, signed checksums on plaintext content). This way we can solve most of the deficiencies of HTTPS (no caching, for one) but we don't get MitM attacks for boring content like a JavaScript library CDN. And I would make it easier to roll out new internet protocols so we don't have to force ourselves to only use the popular ones. No immediate suggestion here, other than (just like port number limitations) it's stupid that we can't roll out replacements for TCP or UDP. And I would add an extension that encapsulates protocol-specific metadata along each hop of a network. Right now if a network connection has issues, you don't actually know where along the path the issue is, because no intermediate information is recorded at all except the TTL. Record the actions taken at each route and pass it along both ways. Apps can then actively work around various issues, like "the load balancer can't reach the target host" versus "the target host threw an error" versus "the security group of the load balancer didn't allow your connection" versus "level3 is rejecting all traffic to Amazon for some reason". If we just recorded when and where and what happened at each hop, most of these questions would have immediate answers.
• superasn 5y ago
  I would wish there was something better for SMTP. I tried to learn it a while ago and got super frustrated with how things are. The whole thing looked upside-down to me. I mean The DKIM, SPF, DMARC, Bayesian filtering, etc sound like band-aids upon band-aids to fix something that's really broken inside.
  • networkimprov 5y ago
    Have a look at TMTP from the mnm project.
• dustymcp 5y ago
  JavaScript would be murdered over and over again..
• laserlight 5y ago
  Here is an academic discussion [0]. It was published in 2005. It may not cover more recent problems, but the proposed design principles are still valid. [0] Tussle in Cyberspace: Defining Tomorrow’s Internet https://groups.csail.mit.edu/ana/Publications/PubPDFs/Tussle%20in%20Cyberspace%20Defining%20Tomorrows%20Internet%202005's%20Internet.pdf https://groups.csail.mit.edu/ana/Publications/PubPDFs/Tussle...
  • flerovium 5y ago
    OP here: this is...really great
• hkt 5y ago
  Security. I recall a possibly apocryphal story about TCP - namely that it was originally meant to be encrypted. Supposedly it was the NSA who had gentle words with implementors which led to the spec not including any mechanisms for encrypted connections. So, encrypted by default TCP, for a start. DNS should have a much simpler, possibly TOFU model to help with the usability elements. DNSSEC is just a nightmare and confidentiality is nonexistent. Somewhat controversially, I'd ditch IPv6 in favour of a 64bit IPv4.1 - blasphemy, I know, but the ROI and rate of adoption for IPv6 don't justify its existence, IMO.
  • kazen44 5y ago
    what would 64bit ipv4 solve that ipv6 doesnt? the migration path will still be just as painful.
• rini17 5y ago
  Some way to make spoofing harder. Complete cryptographic authentication and filtering of every packet is probably technically unfeasible even now. But certainly we can think of other "soft" measures.
  • ithkuil 5y ago
    Could that backfire? I mean, if something becomes harder to pull off, but still not hard enough to block bad actors from doing it, wouldn't we end up in a situation where strong authentication is perceived as not being "that important" because "what are the odds that somebody is spoofing the packets?"
    • rini17 5y ago
      Wouldn't that be still better than current situation where you can't run any public service anymore without DDoS protection? The attackers have it too easy. I don't see how would that preclude strong authentication. We would need TLS all the same.
• jotatoquote 5y ago
  Protocolls (?!) ...and the idea to pump 'content' - instead of launching it? Sounds elevating... P-: Disclaimer: 'This position is constructed to deal with typical cases based on statistics, wich the reader may find mentioned, discribed or tendency-based elaborated.' Sure, OT -but you may also like thinking other way about (-;
• geocrasher 5y ago
  Death to email.
• Kuinox 5y ago
  By making it truly decentralized: Like in a mesh network.
  • jiggunjer 5y ago
    then who'd own the cables and satellites?
    • Kuinox 5y ago
      Integrate the fact that you pay for transmitted data in the protocol, a company that would setup a cable will passively get money. This make the internet grid a true free market that anyone can participate in.
• DeathArrow 5y ago
  I would design a protocol to make access to porn handier.
  • djrockstar1 5y ago
    Finally, someone who actually understands the user requirements and expectations for the internet.
• austincheney 5y ago
  The web was once diverse, but now it is not. I would eliminate third party requests for page assets. If you need images, css, js, or such it would come from the same origin as the page that requests it. 1. This would eliminate third party tracking 2. This would eliminate abuse of advertising 3. This would eliminate CDNs and thus force page owners to become directly liable for the bandwidth they waste 4. It would make walled gardens more expensive —- I would also ensure that section 230 is more precisely defined such that content portals are differentiated from the technology mechanisms on which such traverse. The idea here is that Section 230 continues to protect network operators, web servers, and storage providers from lawsuits about content but not the website operators that publish such. 1. Sites like Facebook and Twitter would become liable for their users submissions regardless of moderation or not 2. Terms of service agreements would largely become irrelevant and meaningless 3. This would radically increase operational risks for content portals and thus reinforce content self-hosting and thus a more diverse internet —— I would ensure that identity certificates were free and common from the start. 1. The web would start with TLS everywhere. 2. This would make available models other than client/server for the secure and private distribution of content 3. This would, in joint consideration of the adoption of IPv6, also eliminate reliance upon cloud providers and web servers to distribute personal or social content
• DeathArrow 5y ago
  * A better IRC with security, anonimity, scalability so people don't actually need Slack, MS Teams, Zoom, Google Meet, Whatsapp, iChat and tens of other apps just to be able to talk with each other. * A protocol for running distributed binary apps. Transforming the browser in an operating system sucks for both users and developers.
• ebanana 5y ago
  it would have a constitution.
• nikanj 5y ago
  IPV6 is a monstrosity designed by numerous committees. I’d take ipv4 and add few more octets for address
• JoshTriplett 5y ago
  Asymmetric keys as the only addresses, and an authenticated version of Virtual Ring Routing as the routing protocol. That guarantees you're talking to the correct server for an address, that addresses never need to change, and that a server can have as many different addresses as it needs to. Build in a layer for onion routing as well, so that all the servers in the middle don't automatically know who you're trying to reach.
  • neilalexander 5y ago
    You have very closely described Yggdrasil, which is a proof-of-concept for these sorts of ideas: https://yggdrasil-network.github.io/ https://yggdrasil-network.github.io/
    • JoshTriplett 5y ago
      As far as I can tell, though, it sounds like Yggdrasil is still an overlay network, designed to bridge nodes running Yggdrasil across a network that isn't. I'd want to see that as part of the base network rather than as an overlay.
      • neilalexander 5y ago
        Indeed, because it’s pretty much the only way to feasibly scale-test something like this without asking people to replace their hardware or breaking them in other ways. Maybe one day we will see protocols like this at lower layers.
      • native_samples 5y ago
        Try looking at cjdns, it provides what you want but also at a base layer.
• arminiusreturns 5y ago
  Anonymity built in, ever since I heard Eben Moglens story about it.
• slightwinder 5y ago
  I would switch DNS to a pure tree and add discoverability as also locality-aspects. By which I mean, put the TLD at the front, not xyz.com, but /com/xyz. And in the first levels you would automatically get a listing of all valid entries back. Similar I would add local entries, like postal codes and states. So people could do something like /usa/texas/ and get a list of all cities, or /usa/postalcode/90210/ and you would get a list of all companies and websites in the area. I would also change HTTP to be modular, allowing to add new sub-protocols which would be automatically compatible with old clients. So we could do something like http/imap or http/ftp on top of http, and unprepared clients would still be somewhat compatible to this, but adapted clients could fully utilize those protocols. Thing is, http is not the most perfect protocol, but it's a very pragmatic and straight forward one, which IMHO is the main reason why it succeeded, where other protocols failed. SO instead of adding another batch of protocols that barely anyone will use and support, it would be better to high jack the existing solution, and slowly extend it. Also, I would make it Illegal to have proprietary protocols, data formats and obfuscated apps. Give the people the power they deserve. You can't open the cloud and business, but at least networks should be balanced for all involved sides.
  • SahAssar 5y ago
    > So people could do something like /usa/texas/ and get a list of all cities, or /usa/postalcode/90210/ and you would get a list of all companies and websites in the area. This could be done for those specific examples with cTLDs, since sites can be hosted on root domains. So your example would be us/texas/ and us/postalcode/90210/. I've thought about this too and with the increasing digitization of governments and government services this would be a nice way to add a discoverability.
• swebs 5y ago
  TLDs should be reversed. So instead it would be com.google.www/maps
• cmacleod4 5y ago
  I'm coming to this thread late, so I'm amazed that no-one has mentioned Named Data Networking - see https://en.wikipedia.org/wiki/Named_data_networking https://en.wikipedia.org/wiki/Named_data_networking and https://named-data.net/ https://named-data.net/ . The basic idea is to manage the "what" rather than the "where". This looks like the future to me.
• hyperman1 5y ago
  I'd add some micro payment system. Todays internet is based on ads because that's the only way to get some value out of users. If the internet had something like payd phone numbers, people could get actual money for their site without sleazy ad companies. Minitel did it, and it worked. I'd add a way to boot abusers from the network. Botnets would become the problem of the IOT device owner etc. This means protocols where routers could complain about an abuser to their upstream. If upstream receives eniugh complaint/votes, an end device gets booted off. I'd like some way to re-decentralize the internet. There are some wrong incentives in the current internet, causing centralization.
• WarOnPrivacy 5y ago
  That regulation be limited to those with proven proficiency.