On 22/07/2014 20:44, Tony Arcieri wrote: > On Tue, Jul 22, 2014 at 11:12 AM, Guido Witmond <[email protected] > <mailto:[email protected]>> wrote: > > That way you could host all your javascript at the site. (but not > at the > CDN). > > > If Subresource Integrity (SRI) were actually implemented by browsers, > serving JS via a CDN would be fine (and could even be done safely over > plaintext HTTP) because the parent page includes a digest of each > subresource, forming a Merkle tree with its root at the parent page: > > http://www.w3.org/TR/SRI/ > > Of course, we're still left with the bootstrapping problem of getting > an authentic parent page. > > -- > Tony Arcieri Trust no one, the saying goes. According to Snowden & Co. that seems to be true.
That would irremediably wipe out everything DNS/ICANN related and its ludicrous conundrum "Trusted Community Representatives" root ceremony. Should 7 billions potentially online human beings trust a bunch of confidential internet übermenschen? "A list of names and country of citizenship of the TCR candidates will be published, but any details (e.g. references) submitted will be kept confidential." The answer is NO. The answer is Namecoin, too. :-) Let us not be misled. Having one's private data being sold is for free. I guess you don't need examples. Exchanging data securely on a network built to infinitely reproduce data at almost no cost has a non negligible cost. It requires a huge amount of work. We could rely on a slightly wider bunch of people that we really trust. Or on an even wider bunch that we slightly trust. So, that's the GPG Web of Trust and the free software community, where work is done because it benefits the workers, their employees, their users/clients/believers/comrades and, as a side effect, the community at large. Or the blockchain, where work for distributed trust gets done because there is a direct financial incentive. If you know of any other distributed trust system, please, let me know. :-) If the ideas behind the app are good or promising, coders will code, reviewers will review, users will use, and a few people might even certify your GPG key, with which you could sign the SHA256 checksum of your code (JavaScript is text also, isn't it?). Of course it means using GPG or a MonkeySphere add on to check the certifications, which in turn needs... Trust requires so much work, it can only be crowd sourced, or the user data risks being freely available (as in free of charge). The work might be done by miners running a blockchain (the project's own blockchain, as in Twister) or by using THE blockchain. You can put a hash of your script on a Bitcoin address (standard address is 20 bytes and the latest OP_RETURN spec limit is 40 bytes). The add on to verify hashes on blockchain remains to be written I'm afraid. FreeSpeechMe would be a good start. The blockchain also gives you timestamping, proof of publication, peer discovery and anti-DOS measures. And micro-payments. And it's a good basis for Distributed Hash Tables. You could waist a few bitcoins on Proof-of-Burn to show the world that you really believe in your app! But why stick to JavaScript and the browser after all? These are endangered species. In the US, mobile apps made up 47% of Internet traffic at the beginning of this year, overtaking the PC (45%). Mobile browsers accounted for only 8% of the traffic. The rest of the world is following at an even greater pace. Willy-nilly, crypto for the masses will be on mobile app, or never will be. Among the happy few GPG people, how many delay answering because they're away from their laptop and couldn't be bothered to replicate the complicated process of setting up GPG with APG/K9 mail, plus generating a subkey for signing on a less secure device? How many Android apps are written in JavaScript? A signed native app on FreeDroid repo that runs on Replicant, CyanogenMod (or Android if you like to live on the edge) could become the encryption killer app. The (heavily centralized) Blackphone has sold out, even though it's compatible with nothing. IMHO, real liberation technologies can only be based on decentralized trust systems. cryptomars -- "Few people understand the psychology of dealing with a highway traffic cop. A normal speeder will panic and immediately pull over to the side. This is wrong. It arouses contempt in the cop heart. Make the bastard chase you. He will follow."
-- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at [email protected].
