4 ms·

Can you elaborate on the security/permission issues? It's something we spend a lot of time thinking about, would love to learn more about your concerns and how

Can you elaborate on the security/permission issues? It's something we spend a lot of time thinking about, would love to learn more about your concerns and how we can address them. I think there are two use cases for URLs as pointers, transient and persistent. In the transient case, you use the URL as a temporary representation, pass it around to the relevant hops, and then fetch it wherever the final resting place may be. In the persistent case (say you're building a web app where users upload content and you want a permanent link), there needs to be somewhere in the line that a service "guarantees" that the link will remain alive and true so that the resource it points to sticks around. So in our case, what we do is if the developer asks for a persistent link, we will take a snapshot of the content and persist it encrypted on our CDN for them, making sure the link stays alive

kstenerud 14y ago
Depending on the URL, you may need to be logged in to see the content. So in such a case, the service that responds to the URL provided would need to support granting permission to a 3rd party (in the case of the 3rd party copying the data and hosting it), or potentially granting permission to everyone (if the 3rd party is only going to host the URL, not a copy of the data). As well, you'd need to deal with abuse issues. If the 3rd party is going to host a copy, you need to make sure it can't be used as a DOS attack against the URL's original host, for example. The web is chaotic by nature. That is its strength, but it's also a weakness when it comes to data longevity. Without some kind of standard for guaranteeing data persistence that reaches critical mass (such as over 80% of content hosters implementing it), this will be a very tough nut to crack. Another problem I see is legal. DMCA takedowns are so easy to do that a dead URL is only a lawyer letter away, even if their claim is completely invalid. Now suddenly a single takedown will affect potentially hundreds of sites instead of just one (in the case of URL pointers rather than data copies). If a content site is DDOSed, suddenly the damage is magnified due to all of the other sites depending on a single point of failure.

kstenerud 14y ago

Depending on the URL, you may need to be logged in to see the content. So in such a case, the service that responds to the URL provided would need to support granting permission to a 3rd party (in the case of the 3rd party copying the data and hosting it), or potentially granting permission to everyone (if the 3rd party is only going to host the URL, not a copy of the data). As well, you'd need to deal with abuse issues. If the 3rd party is going to host a copy, you need to make sure it can't be used as a DOS attack against the URL's original host, for example. The web is chaotic by nature. That is its strength, but it's also a weakness when it comes to data longevity. Without some kind of standard for guaranteeing data persistence that reaches critical mass (such as over 80% of content hosters implementing it), this will be a very tough nut to crack. Another problem I see is legal. DMCA takedowns are so easy to do that a dead URL is only a lawyer letter away, even if their claim is completely invalid. Now suddenly a single takedown will affect potentially hundreds of sites instead of just one (in the case of URL pointers rather than data copies). If a content site is DDOSed, suddenly the damage is magnified due to all of the other sites depending on a single point of failure.