Doug Crockford's Seif Project – how to save the web [video] | Hacker News Reader

Doug Crockford's Seif Project – how to save the web [video]

youtube.com

35 pointscpr20 comments

The problem I see here is that it's a complete re-invention of everything, from the transport protocols to the UI, everything gets redone. He didn't talk about how the client will be implemented yet, but it's certain that it's going to be a presentation layer based on Qt without any HTML or CSS involved.

This is not a web technology, by definition. It's not the future of the web, it's some other thing that may be better or worse than the web (probably both). It's a new internet technology designed to replace the web in its entirety.

I'm curious how the entire stack is going to work, and I'll be one of the first people to make a toy project with it, but it looks like it's going to be some time until anyone can actually try it out. What this project requires even more than technology is clout and visibility, so Crockford is probably one of very few people who meet the prerequisites to give this a shot.

you mean, just like http and html were even everyone was happy with bbs and telnet? yeah, should never work.

I'm afraid you misunderstood my comment entirely.

Summary:

http://www.seif.place

"HTML free based application delivery system based on [stripped down] node.js and QT"

He describes a "Helper Application" that he wants to convince browser vendors to install.

Features as I gleaned them from this talk.

- Replace DNS addressing with <publickey>@<ipaddress>/<referral> (since these are not human friendly: QRcodes and Petnames)

- Replace HTTP with a "Secure JSON over TCP"

- Content based addressing through file hashes

- communicate with QT through a messaging protocol

- For some reason reinvents an RNG(!) (what?) (EDIT: this originally said "running in Javascript(!)", based on the git repository that's probably not true)

- apparently no password will be needed ever again

All of it sounds a bit hyperbolic...

(OK I admit it, I stopped taking it seriously when he mentioned the awesome idea of adding microphone/camera input into the RNG for randomness, that just sounds like something which seems common sense on the surface, but is a totally incorrect thing to do in practice).

Based on the information that's in there, this makes mutual authentication based on TLS certifictes (or some other public-key-scheme) mandatory, and uses it for addressing. The only information that this talk contains about how to solve the introducton,authentication problem is this (paraphrasing):

"I don't trust Verisign to prove someone's identity, but I trust google's search results"

(As in "I googled for ACME Bank, and this is the address/public key that was returned, I am going to trust it")

The whole thing feels like something someone would come up in an afternoon with lot's of handwaving potential problems away.

> is a totally incorrect thing to do in practice

Can you elaborate on this? I understand that there are many sources of entropy for random number generation, and it seems like this would be as good a way as any to store* a pool of some for future use.

(* Is it that the storage is the inherent problem?)

Hi, sorry for the late reply.

I meant it in the sense that it seems intuitively correct that you'd be able to get some random data out of a microphone somehow, but that intuition doesn't serve as a good adviser in cryptography.

I bet just looking at a recording from a computer microphone, it's possible to make deductions about it's structure. Let's say there are people in the room who talk with a certain pitch, the frequency of the AC current as it get's into the computer, things like that which all make the microphone output non-random.

So it might be that there is a way to generate true random numbers like that, but it's probably not as easy as just using the microphone as a source of entropy.

I saw this same talk live at forwardjs, I think his ideas are the perfect blend of being ambitious (enough to capture interest) and yet tempered by past failed attempts at "revolutionizing the web". I hope the project garners more attention and interests, we have fundamentally broken tools and maybe it's time to start building new tools that we can begin to shift to.

For all the broken tools - there seems to be no shortage of awesome websites that serve their purpose pretty darn well.

> there seems to be no shortage of awesome websites that serve their purpose

This is not an effort to defeat the web, just to provide a security-oriented application platform that sits alongside it.

It appears Crockford's time at PayPal has led to this focus?

[minor edit]

Although I make heavy use of the web (largely because there is no other way to access most things I want to read on the internet) there are very few web sites that IMHO serve their purpose pretty darn well.

I'm not saying most web sites are objectively bad, just that they frustrate and annoy me much more than any of the other software I use.

(I have no opinion on whether Crockford's proposal would ameliorate my frustration.)

I can't find any textual summary about what "the seif project" is supposed to be. All I can find are talks and announcements for these talks.

There is a github repository[0] that doesn't have a description and a pretty useless Readme.

Does anyone know what this is about ?

EDIT: you can skip at least the first 30 minutes in, he's still just complaining about how HTTP,HTML,CSS and Javascript are terrible and a description of television.

[0]https://github.com/paypal/seifnode

It's very early stages, Douglas mentioned in the talk I attended that he has purposefully tried to refrain from giving anyone set dates for deliverables in attempts to prevent rushed code at this stage.

The talk linked from this post was pretty easy to digest, perhaps you should watch the whole thing before asking what it's about?

The television-standards bit, while probably longer than necessary, was meant to drive home the point that the responsibility for improving application security on the Internet should not be placed with the user.

Douglas Crockford's JSON license-griefing has done quite a lot of harm to open-source software:

* https://en.wikipedia.org/wiki/Douglas_Crockford#.22Good.2C_n...

* https://bugs.php.net/bug.php?id=63520#1403112940

* http://apebox.org/wordpress/rants/456

* https://wiki.debian.org/qa.debian.org/jsonevil

As a open-source software developer, I have wasted at least a day of my life on headaches resulting from this gag. The same is true of several of my immediate colleagues, and of a great many people in the open-source software community at large.

Someone who acts with contempt and disrespect toward his peers in the industry does not deserve recognition or confidence. We cannot trust him to be a good steward of open standards. This casts a long shadow on his proposals.

You could say the same thing about the GPL. It's not just "griefing" — it's using your software as a political wedge (however small) to try to change the world. I'd strongly consider using a similar license if I were ever to release something as important as JSMin. (Or maybe something more specifically itemized: "not for military use, not to be used as an aid to violence" etc.)

The problem isn't pushing an agenda (which I think everyone agrees is fine), it's adding something subjective with no legal definition to your license.

Since no one can say objectively "we do good", you're banking on not getting sued or having enough money and time to defend the lawsuit, which makes it unpalatable to many people.

Additionally, it makes it non-free software, by definition, so a lot of distros can't include it or anything that depends on it.

In all of those cases, writing the libraries in question again with a different licenses would solve the problem. If you are going to use his code, you should respect his wishes.

Otherwise, you're being both evil and lazy.

Where there is humor, it will be lost.

He didn't waste your time. He just shown you how much of your time gets wasted (ridiculously) by lawyers and copyright. Too bad you didn't get the message and just got angry at quirky thing not the whole abysmal bureaucracy it clashed against.

Reply on news.ycombinator.com