Robin Berjontweets archive

Thread · 2 tweets · 11 Jan 2023

Robin Berjon @robinberjon ·

Replying to @lidelOrg and @dietrich, @BrendanEich, @boscolochris, @darrello, @csuwildcat, @gordonbrander, @brave, @shivan_kaul, @fmarier

I think we need to be a bit more specific, unfortunately! If you're looking only at eg. script@src=ipfs:cid then yes. But if you consider <iframe src="ipfs:cid/?foo=x"> then you have the problem that this could transitively load from HTML, pass the param, and mutate remote state!
Robin Berjon @robinberjon ·
That's what I mean by hashing the details out: there are IMHO very cool promises that we can make with IPFS in terms of changing the SOP but we need to fully work stuff out. Eg. iframed IPFS should load with CSP "default-src 'self' ipfs: ipns:; img-src 'self' ipfs: ipns: blob:"