I didn't know what IPFS was, clearly I'm living under a rock.

From the above link;

>>The InterPlanetary File System (IPFS) is according to the Wikipedia description: “a protocol, hypermedia and file sharing peer-to-peer network for storing and sharing data in a distributed file system.”. It works a little like bittorrent and you typically access content on it using a very long hash in an ipfs:// URL. Like this:

ipfs://bafybeigagd5nmnn2iys2f3doro7ydrevyr2mzarwidgadawmamiteydbzi

My understanding is that the curl position was around making sure UX (defaults) are safe and don't tie the user to any third-party gateway.

Default behavior in the merged curl PR got adjusted and now the only gateway that is used implicitly is the localhost one. Using an external, potentially untrusted public gateway requires explicit opt-in from the user via IPFS_GATEWAY env variable.

FWIW, in recent years IPFS ecosystem made content-addressing over HTTP viable and useful. Standards and specifications got created. Verifiable responses have standardized content types registered at IANA.

For practical info, see:

"Deserialized responses" vs "Verifiable responses" at https://curl.se/docs/ipfs.html

"Deserialized responses" are designed to be used on localhost, "Verifiable responses" are something one would use with a gateway they don't trust

Client docs at https://docs.ipfs.tech/reference/http/gateway/#trustless-ver...

Server specification at https://specs.ipfs.tech/http-gateways/trustless-gateway/