They could ship with IPFS/DAP/I2P/Tor native in Firefox right now, without any requirement of running external software, but choose not to. Instead, we get limited support for IPFS from a desktop-only addon that simply interfaces with an IPFS service already running on the host machine.

Take it a step further: Firefox could allow websites to open sockets and toss arbitrary packets around, and choose not to. If that capacity were available then Javascript could be harnessed to support all sorts of protocols and services. They could even provide Javascript access to monitoring network access point availability and connectivity management.

Imagine then a single page app you could share as an attachment through $messageService and it has all the stuff built in to create ad-hoc real networks in large gatherings that provide data resiliency against the dropping of nodes. You could have the cellular network shut down, protestors arrested, their phones taken, and the data they gathered still retained so long as any node managed to exit the area or the network itself expanded beyond the area of contention.

You have it backwards, stuff like Websockets are built by design to be incompatible with existing implementations. This is because Javascript code is untrusted/untrustworthy, and we already had a plethora of attacks due to foreign JS doing nasty things with what little they had, here's a couple examples:

- SMTP/IRC spamming using Web requests (Cross-protocol scripting, 2002) - https://www.eyeonsecurity.org/papers/Extended%20HTML%20Form%...

- Webpages that detect your router and leak your SSID (or worse) - Samy Kamkar "How I met your girlfriend" (2010), excerpt: https://www.youtube.com/watch?v=tRJMIMBVqFI

Web extensions should allow you to do normal sockets, many years ago I had a Chrome app (I still miss them) as my IRC client.

> Web extensions should allow you to do normal sockets

Not since 2017 or whenever it was that Firefox dropped XUL extensions and replaced them with WebExtensions. The legacy XUL extensions could do much, much more and there was correspondingly much, much more malware in browser extensions.

It's not like Websockets prevent this completely. eBay port scanning: https://www.ghacks.net/2020/05/25/ebay-is-port-scanning-your...

That's a pretty clever attack. It's clear everything can (will?) be exploited at some point, so it's usually down to features vs. user protection.

Unless everyone is ok going back to running random .exe files from emails, I guess.

So treat sockets as one currently treats web cameras and microphones.

> Firefox could allow websites to open sockets and toss arbitrary packets around, and choose not to.

There are very good security and privacy reasons that all browsers (not just Firefox) work extremely hard to prevent this from being possible.

The problem with that is that regular people (not super-techies) have a much better chance of understanding the implications of agreeing to microphone and webcam use than something called "socket access" - or any other more friendly term that tries to explain what's going on, because it's such a long way away from the level of abstraction that they are likely to understand.

"Allow this Website unrestricted access to the internet?"

Seems no more or less confusing or understandable than allowing access to microphone or camera.

I mean, I could honestly see a ton of confusion along the lines of “isn’t this website already on the internet? what??”

Also not knowing if disabling it will break the page, something even technically inclined people can't know ahead of time. It's not like push notifications where you would have to try hard to build pages that could break without the feature enabled. I could easily see people abusing this to serve pages over alternate protocols and making people expect to need to click "allow."

It's implied it will break or limit the page; just as denying access to microphone and video has that implication.

No it isn't? Unless you're doing something with the microphone or video there's no implication there.

Sure there is. If it needs hardware access for a function then without it that function breaks.

It's no more confusing than the warning provided for self signed certificates.

That requires people to know what "access to the internet" means.

A sizable portion of internet users think that the internet is what you get when you click the Facebook icon on your phone.

But they do at least understand what a microphone and webcam are for.

So make the default negative and appealing, and the positive option scary and diminished.

As Firefox does with self signed certificates and similar.

And your internal network.

Right - the original reason for same origin policies in browsers was to prevent scripts from stealing data from private corporate intranets.

An acquaintance of mine worked for Mozilla on a project to add tor to Firefox. Code was done, but Google, as it’s primary funder, squashed it.

That makes sense. Google wants users to be easily identified and tracked; elsewise their primary revenue model, surveillance capitalism, would be under threat.

>They could ship with IPFS/DAP/I2P/Tor native in Firefox right now

A bit of a tangent, but I really cannot stress enough that if you're using Tor to be private/anonymous that you should never use anything other than the official Tor browser, you will stand out like a sore thumb.

Firefox has worked with IPFS since early 2019 https://addons.mozilla.org/en-US/firefox/addon/ipfs-companio...

Brave just took the step of forcing you to always have the extension installed instead of making it optional, basically

I've tried IPFS a time or two and always found it to be INCREDIBLY slow (even worse than tor) with ZERO content discoverability.

This still requires external software to operate, and isn't available on mobile. It's effectively dead in the water by not being available to use without additional configuration, by default.

I'd argue this is worse than doing nothing. This gave Firefox the ability to say they care, and yet not deliver something meaningful.

I agree. It just leads to "Oh, IPFS? I tried that years ago, it was terrible. I don't recommend trying it."

What do you think firefox could have done to improve things?

And, as someone not well versed, is there any "killer demo" that uses IPFS currently?

I'm working on a collaborative photogrammetry solution (think async/distributed 3d mapping from overlapping pictures) that shares data via IPFS. Flattering myself heavily, I believe this sort of public-data consuming application fits like nothing else.

You where going to contact me end of this week (morphle at ziggo dot nl) for the plant/species identification software: https://news.ycombinator.com/item?id=31537487.

Your collaborative photogrammetry can be combined with the open and free species identification API and my custom OpenStreetMap data extensions and KartaView/OpenStreetCam/OpenStreetView to get more photogrammetry location integration and more free crowdsourced open data to add to photogrammetry. A demo of Seadragon/Photosynth [1] inspired me to work on this.

[1] https://www.ted.com/talks/blaise_aguera_y_arcas_how_photosyn...

That sounds fascinating! Can you elaborate or point me to more information on it? I would love to hear your perspective on it from a real use case.

With pleasure, drop me a mail and I'll get back to you next week (last three letters of my username here @ rest of my username dot artificial intelligence). I haven't put anything online yet though sorry!

Firefox had its time and it is basically on life support and 80% dependent on Google's money and almost always last to support such features. Brave seems to have made Firefox obsolete.

As for IPFS, the crypto-bros seem to already be winning for taking over that term and melding it as part of a layer in web3, just like they did for 'crypto' which that has become too late and that ship has long sailed.

Perhaps the reason why they are winning is because they keep building stuff like this [0] and existing companies are jumping on board with the term already? [1][2]

[0] https://skiff.com

[1] https://developers.cloudflare.com/web3

[2] https://stripe.com/blog/expanding-global-payouts-with-crypto

IPFS is a file system, Web3 is an idea/marketing term to promote blockchain services, so I'm not sure what you mean by that.

Brave is using IPFS for file storage but once the content address (CID) is known anyone can access the file you're looking for. So it remains to be seen how they will leverage IPFS to create scarcity of digital items for their merchandise store. It is a step backward and not what IPFS goals were. A huge number of books are currently on IPFS through libgen, and scihub is going to IPFS eventually. Web3 is just a step back from the greatness that the internet could be. With "decentralized" oracles (3 mining pools control Eth), and centralized front facing websites simply verifying some hash of something.

Again, people use these meme terms without understanding. If I pin a file on IPFS, share the link and decide to delete it tomorrow because I don't like it anymore, that file is then unavailable and anyone trying to retrieve it gets an error. That's because IPFS isn't file storage. It's not Web3. It's not a blockchain. It's decentralized but not everything that's decentralized is an archive.

Web 3.0 has been used for a long time to mean any P2P/distributed/... approach, not just blockchain, even if the blockchain people try to completely take over the term sometimes.

Web3 has also been used to describe web pages designed for easy parsing.

Reader view, tools for the visually impaired, and browser automation are actually useful and commonly used, so that definition win the title for me.

There are certainly useful distributed web tools (e.g. email, TOR, IRC, Matrix, self-hosting, bittorrent), but they're the opposite of recent trends towards monopoly.

The distributed meaning is absolutely poisoned by blockchain at this point.

Even blockchains are less monopolistic than web 2.0 (Google, Facebook, Amazon, etc). At least blockchains are powered by (largely) independent users, instead of a single corporate entity. But I still prefer further decentralized technologies like email or bittorrent

Web3 has a storage layer, a messaging layer, and an execution layer. Most popular Web3 apps use Ethereum for execution, IPFS for storage, and some custom websocket garbage for messaging, but there are many viable Web3 stacks out there that people are using.

What actually defines web3 software? Is sending emails with .exe attachments considered web3?

Like, if we compare this to RESTful servers, there's no set definition but nearly everyone agrees it's verbs and paths over a hierarchical API sending JSON back and forth over HTTP[S].

It seems like most people can't agree on anything except using etherium as a backbone.

So calling something web3 doesn't seem to do a good job describing things like REST or like something like you wrote above.

See also Web 2.0

It's not a technical spec.

That’s because ipfs is actually pretty bad in actual usage, as the anecdotes in this thread agree

Didn't realize 7+ years old is "new" in tech terms.