Thread · 3 tweets · 11 Jan 2023

I think that the policy we come up with has to depend on which promises we make in the ipfs: scheme. The SOP is needed because the HTTP web is full of side effects and so we clumsily restrict interaction to a smaller, safer group of side effects.

If we can guarantee that ipfs: loading is nicely composable (I'm handwaving on details) then I don't think that we need an SOP. Just load IPFS in IPFS all you want. Things are less clear with ipns: and we need to think carefully about IPVM interactions (and HTTP loading).

I'd love to hash the details out! This would benefit from some security/maths chops too.