Yup. That's why I don't post my SSN everywhere. A single data server with all the comments without any moderation won't survive. But a group of data servers with different rules and many entry points via extensions or websites, can survive.
The extension does two things:
- It sends sha1 of the url to the data server to check the numebr of comments, but doesn't pull the comments.
- It renders an <iframe src="comntr.github.io#foobar.com"> to show the comments.
Thus the extension has very little code and doesn't need much updates.
Why is this a problem? I even considered MD5, to be honest. Afaik, the only reason MD5 or SHA1 are considered "insecure" now is that it's possible to use sophisticated techniques called differential analysis to carefully craft two binary files that would have the same hash. But if the space of possible inputs is limited (we can't put arbitrary stuff in the URLs), then good luck finding a collision. Discovering a collision with an existing input is a much harder problem (is it even solved for arbitrary data?). In any case, SHA1 here isn't a security mechanism, but is just a way to hide URLs from the data server and organize comments as a nice hashmap. If someone wants to put anything sensitive in the comments, they shouldn't and I've clearly warned about this with a big yellow banner. If someone ever needs security, the only way to go is to use your own data server, or encrypt comments themselves with ed25519+aes256.
The idea is very similar, but I can't agree with a few implementation details:
- The extension shouldn't need to have access to the page. Inserting an iframe into the page seems wrong.
- The extension shouldn't own the comments. It should be a window to the comments, not a gatekeeper. It should be possible to implement alternative UIs and alternative extensions and connect them to the same comments.
- The extension should allow to switch the UI and the data server.
I like the inline annotations, but likely it'll need full access to DOM.
No, I agree that this problem has to be solved before this idea can hope to get wide adoption. Mr A posts something really evil on Mr B's facebook page. What happens next? Mr B files a complaint to facebook. Since this is a legal matter, the complaint gets escalated to the top. FB realises that this is out of their control and proceeds with a complaint to FBI. Now what if the data server with that comment is hosted outside the US? Right, the browsers will quickly ban this extension. However the owner of the extension can also change the default data server url in the config and the comment will be gone.
However I think that this hypothetical scenario will never happen because the idea will never reach this wide adoption. It'll inevitably be fragmented into a few segments with rules and moderation. Want comments from the theoretical physicist community? Subscribe to sci.data.org in your extension config. Want to know what 4chan folks think? Add unfiltered.comments.com to your config - it'll be an unreadable mess anyway and you'll need to make some non-trivial effort to add that url.
But I think there will be an archive with all the comments for research purposes: physically, it will be a big data server that keeps connections with all other data servers and pulls all the comments it can.
So it effectively runs arbitrary javascript in the current page? I mean, if I run it on my online banking page, it'll have access to everything. The extension isn't ideal either - access to the current URL is too much - but at least it can't run arbitrary JS in the page itself.
I think there should be many data servers with different rules. Some will blindly accept and serve any comments. Some will have mods and a buffer of comments waiting for review. Some will review only those comments that are flagged by their scripts. All these data servers should form a well connected network and exchange with comments. What's the incentive to exchange with comments? If a greedy data server refuses to give comments, others will block it. And users will be able to have multiple data sources, if (when) one big data server tries to use its monopoly power.
There should be at least basic formatting filter that would block 1 MB comments or clearly non human written comments. This won't stop the spammers, of course. It should be time consuming to create a user id. It should be anonymous, but it should take a few minutes of your time (not your CPU time) to generate a valid user id. once this is done, it'll be easy to spot one spammer's comment, find all others (since comments are signed with ed25519) and dump them all. The spammers then won't be able to delegate the work to scripts.
[2] is very similar to what I want to do. They chose to insert an iframe into the current page and I don't agree with this decision: the extension should have as little access as possible to the page, ideally it only gets a hash of the url.
Currently nothing. But I've only mentioned this extension to a small technical audience, so I wouldn't expect a flood of spam. In practice, this needs some sort of "local captcha" that doesn't involve 3rd parties, i.e. the storage server returns a puzzle (like guess what's shown on this 3d image) and if solved correctly, it results in a proper hash that's easy to verify. A simpler, but uglier solution is to ask the user to produce a hash with N leading zeros.
Yep, I didn't have to do much other then doing if(chrome.contextMenus){...} to make this extension run on Firefox and Firefox Android. But I intentionally chose the <iframe> approach to minimise the browser-dependent surface, so the <iframe> draws the UI and the extension only makes a few basic things like updating the icon color.
Wow, it's surprising how much difference a proper post title makes. The v1 of this post had a long, but technically correct title without a link, but with a long, boring description about technical details with links. The post got like 5 upvotes and 1 reply. So I've deleted that post, shortened the title, removed the description and set the link to github instead. Now it has 150 points and 120 comments. And I really appreciate all the attention to my little project!
Apart from encrypting the comments so the server wouldn't be able to read them, I've been thinking that it's actually possible to leave private messages: it would be a comment on SHA1(user.publicKey), and the message would be encrypted with that public key. The extension uses the ed25519 crypto system (WebCrypto notoriously avoids implementing it, so I had to use a WASM module). That seems like a very cool idea, albeit it's attracting exactly 0 attention from the public so far :)