{"action":"created","issue":{"url":"https://api.github.com/repos/ipfs/ipfs.js/issues/1","labels_url":"https://api.github.com/repos/ipfs/ipfs.js/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/ipfs/ipfs.js/issues/1/comments","events_url":"https://api.github.com/repos/ipfs/ipfs.js/issues/1/events","html_url":"https://github.com/ipfs/ipfs.js/issues/1","id":120577845,"number":1,"title":"Implementation suggestion","user":{"login":"cloutier","id":1014864,"avatar_url":"https://avatars.githubusercontent.com/u/1014864?v=3","gravatar_id":"","url":"https://api.github.com/users/cloutier","html_url":"https://github.com/cloutier","followers_url":"https://api.github.com/users/cloutier/followers","following_url":"https://api.github.com/users/cloutier/following{/other_user}","gists_url":"https://api.github.com/users/cloutier/gists{/gist_id}","starred_url":"https://api.github.com/users/cloutier/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cloutier/subscriptions","organizations_url":"https://api.github.com/users/cloutier/orgs","repos_url":"https://api.github.com/users/cloutier/repos","events_url":"https://api.github.com/users/cloutier/events{/privacy}","received_events_url":"https://api.github.com/users/cloutier/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-12-05T18:26:34Z","updated_at":"2015-12-06T06:29:50Z","closed_at":null,"body":"I stumbled upon [this](https://hacks.mozilla.org/2015/09/subresource-integrity-in-firefox-43/) and it made me think: \r\n\r\n     <script src=\"ipfs.js\"></script>\r\n     <img src=\"//failover.com/tree.jpg\" ipfs=\"QmbhfRQtxEdWN2HzwQveahspuMaRcMT6cUMk1t38omKDQT\" />\r\n\r\nWith the multihash automatically translated to the integrity tag syntax. It would provide graceful degradation if no connection to ipfs can be found (from maybe a \"fascist\" firewall or if javascript is disabled) with the same content integrity check and it will be futurproofed for when ipfs will be integrated directly into every browser! :grin: "},"comment":{"url":"https://api.github.com/repos/ipfs/ipfs.js/issues/comments/162278759","html_url":"https://github.com/ipfs/ipfs.js/issues/1#issuecomment-162278759","issue_url":"https://api.github.com/repos/ipfs/ipfs.js/issues/1","id":162278759,"user":{"login":"jbenet","id":138401,"avatar_url":"https://avatars.githubusercontent.com/u/138401?v=3","gravatar_id":"","url":"https://api.github.com/users/jbenet","html_url":"https://github.com/jbenet","followers_url":"https://api.github.com/users/jbenet/followers","following_url":"https://api.github.com/users/jbenet/following{/other_user}","gists_url":"https://api.github.com/users/jbenet/gists{/gist_id}","starred_url":"https://api.github.com/users/jbenet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jbenet/subscriptions","organizations_url":"https://api.github.com/users/jbenet/orgs","repos_url":"https://api.github.com/users/jbenet/repos","events_url":"https://api.github.com/users/jbenet/events{/privacy}","received_events_url":"https://api.github.com/users/jbenet/received_events","type":"User","site_admin":false},"created_at":"2015-12-06T06:29:50Z","updated_at":"2015-12-06T06:29:50Z","body":"note: a hash in ipfs is the hash of _the dag_ that represents the file, not just the file. so the hashes here will be different in non-ipfs things. this is ok if the js file included is ipfs-aware, but not if it's just multihash aware.\r\n\r\nThis may be ok if the path has the full: `/ipfs/<hash>/...` construction, as the `/ipfs` prefix denotes the protocol. So, _strictly for subresource integrity using ipfs_: \r\n\r\n```\r\n... integrity-ipfs=\"/ipfs/...\" ...\r\n... x-integrity=\"/ipfs/...\" ...\r\n```\r\nor something.\r\n\r\n---\r\n\r\nAlso, note that \"failover\" is the goal of the https://ipfs.io service. the goal was to allow:\r\n```html\r\n<script src=\"ipfs.js\"></script> <!--- or even without this line in browsers natively with ipfs -->\r\n<img src=\"//ipfs.io/ipfs/QmbhfRQtxEdWN2HzwQveahspuMaRcMT6cUMk1t38omKDQT/tree-in-cosmos.jpg\" />\r\n```\r\nto be used everywhere, and then:\r\n- if `ipfs.js` exists and works (or the browser natively implements ipfs), halt load, and load using ipfs, removing the `//ipfs.io` prefix\r\n- if not, just use the http link as is.\r\n- the `ipfs.js` impl could -- if fetched from http -- construct the objects and check all the hashes clientside too.\r\n- a page could also override the gateway: `ipfs.globalGateway = 'https://ipfs.pics'` and rewrite the `https://ipfs.io` links.\r\n\r\nThis enables all the subresource integrity stuff without needing a different attribute. \r\n\r\n\r\n---\r\n\r\nWe're prepared to handle load on the https://ipfs.io service -- it hasn't been a problem yet. if it's slow we can see about improving it or directly connecting it to popular webapps. \r\n\r\n---\r\n\r\n> @jbenet Is there someone working on this? \r\n\r\n@cloutier not yet! go for it! but let's maybe craft a full plan before starting-- would be good to pull in same direction.\r\n\r\n> think I have read that webRTC is not yet implemented in go-ipfs, \r\n\r\nwe could start on that effort again, using something like https://github.com/xhs/librtcdc -- seems to have some use. we could also implement websockets as a transport today :) \r\n\r\n> but I could make it fetch content over http and store it in html5 local storage for now and work on the rest when it is ready.\r\n\r\nsounds good to me. you can use the `ipfs.io` gateway for all this. we should be able to take the load.\r\n\r\n"}}