How to use IPFS to securely serve your content

Transcript

so hello good morning um thanks for being here um so today i'm going to talk about like how you can use ipfs to securely serve your content first of all a brief introduction about myself so like i'm researching in an engineer at clafla which is like a web security company mainly i'm focusing on like distributed web project like ipfs ethereum um and basically how we can use these tools to like upgrade and like improve uh the web experience you have like on a daily

basis um also as you are gonna see i like croissant and so like so if we meet like later on after the talk um have you take croissants or coffee and like whatever uh like definitely like super nice to uh to get that um before i get started um i just want to get like a show of hand in terms of like how many people did get a croissant while they were in paris this week yeah actually quite a lot of people so that's a good choice and actually like what we're going to talk about is not much different from like uh like crosstalk experience like you got this week um so basically you imagine you're at a cafe and so like what you do is usually like you're sitting and like you're asking someone like on your behalf because

you're at the cafe say okay like hey bonjour can i have a croissant um and yeah i mean they come back they have a croissant and like yeah i mean beautiful croissant like the crust is golden uh it's like possibly hot like just like i mean the great crosstalk experience the thing is i mean that's what you imagine and like you just said okay i want a cross saw but really sometimes the meaning of a croissant can really vary in france you will likely have this one but sometimes you may have something that is called a croissant but is not a croissant and so what you really want is like you want to be able to know that like when you're old vega croissant that like when you're like getting the

croissant be able to know okay like i'm actually getting the crust some i was asking for um and so that's one of the thing in a similar way like a way uh to like how you can use ipfs to like securely serve your crystal um so we're gonna talk now in like more technical details in terms of like how you can do that but overall that's the idea like you want to be able to verify and validate the thing you were asking for so we first gonna do like a like small introduction about like how a request works uh for ipfs then i'm gonna discuss naming and like the various naming method um that you can have and finally i'm going to discuss like how you actually serve the content on the web to users and what

that means for security so first of all um ipfs and before ipfs you may want to know how does like a normal request in a web browser works um so usually when you make a request like on http you would like be like on your web browser which like would be running on your local machine this web browser when like you will request like example.com for instance um it needs to like do the matching from example.com to an actual ip of a server so like you ask a dns resolver which gives you back an ip address now that you have the ip address you can contact this ip address using http like still asking for the content of example.com ipfs is not that different

the main difference is instead of of example.com what you would have is you will have like a content id which is basically the hash of the content and so what you will do instead of a web browser you have like a local node so like you will ask that local node for the content using the ipfest protocol and first what that node needs to do is okay so like you gave it like a hash but you don't know where the hash is or like who is providing the hash and so what you're doing is you will do like a dht lookup uh to say okay like so like for like these buffet hash um who is providing it and so like you will discover that like uh qm1 um is providing wi-fi um content in a similar

way that like the waiter is providing the crystal um and so now that like you have discovered the peer you will look using ipfs protocol reach out to this peer um which is like at qm1 and the po will return you the content and like then it will be displayed so in great and high level that's how ipfs would work and how it enables you to like then verify and validate that the content that was served by the peer is actually the one like you were hoping for without actually knowing the peer beforehand now the hash is a great medium to like actually like um like verify and validate cryptographically that like the content you're serving is actually the one you were expecting however it's not

very like friendly in terms of names and so one of the naming techniques that you can use is you can have a bookmark so you can say okay like i have like this hash and like i will just like store it in my web browser and have a bookmark it's rather easy so like in this case you have a resolver which like is your web browser so like every time you want to know okay this bookmark which cid you just go to your web browser the web browser stores like a map of your bookmark to the cid in a local storage and the trust tank of in this case is just your local storage you're trusting that like the storage that you have will just not be corrupted um and and that's how it works like very basic simple

then ipfs also introduced ipns so in a similar way that like you can discover content on the dht um people and peers that like are participating in the dht are also able to advertise for like their unique public key a content that is associated to it this content is signed with a private key and so when you're like discovering and like making the content resolution you're able to validate that search appear validates like he's providing a specific content um ips has some limitation in some of like um speed propagation etc um and so and the other limitation is like you will still have like this hash because

that's just how it works so it's not human-friendly but like you already have some mutable entity the thing you're probably the most familiar with is like dns and like dns in the names like decentralized name servers and so that's what you use like on the web normally for instance when you access example.com you will actually like make a dns request um and how that works is like you will use like a recursive resolver uh for dns which will like just recursively uh make queries to like name authorities and these name authorities are like trusted by uh icann and like denoted like um in cryptography uh by the dns sec um rootkey so like you have a tree of dns sex signatures which go basically

from like the root of dns up into your domain and so it's also cryptographically verified it's like well integrated in the infrastructure today and then definitely something like you can use um to actually like serve and name your content finally uh one other protocol i wanted to mention is ens um so what ens tried to um to provide is dns but on the serum blockchain and so the idea is like it follows exactly the same model with like a resolver and a registry um from usually from your browser you would like contact like the resolver like an fpc api or like via local node but the local node may not be in everyone's computer therefore the like apc api which will like allow you to like get to

the registry smart contract and the trust and codes like the ethereum states it's great because like then it's like more transparent and like a bit more trustless however the need to have access to the ecm state is also a big burden because it's like doesn't allow you to have like a concise proof uh for that state and for that name great so we've seen a lot of like naming method now um so actually how does it look like to serve your content um i'm mainly going to focus on like http gateways because that's actually how most people at the moment are like accessing ipfs content and like if you want to like have a website that is like broadly

accessible today like with a web interest like that we have that's also probably what you're going to use so that kind of like street three strategies um you can use like a pass gateway and so basically what that will look like is you will have like the domain of the gateway such as like cloudflightgfs.com and then you have a pass like slash ipns example.com and actually it's quite good because in terms of trust you know who you're reaching out so like you're reaching to cloudflare um and then you're asking cloudflare to actually like access example.com on your behalf which is like very good in term of like um knowing what's happening in terms of like who's serving the content how like the transparency is great however the way the web has been modeled um it

always assumed that like one origin is actually controlled by one people by one person and so like you don't have like the same origin policy um which prevents you from like using quite a lot of like web apis um should be like sexual local storage uh or like i don't know webos and apis or like various um apis on that another way what you probably want to do is just can i just access example.com if i have an ipfs content if i just say example.com point to my ipfs content and yeah you can do that and so like that's dns link it's like quite flexible to access gateways it's a bit less transparent to the user basically the user like will access example.com so it will not know

who is serving it uh but we'll know that like still be able to like validate um the ipf's content associated and also i mean you benefit from like like marketing standpoint you just have example.com you don't have like any fuzzy complex um or third party provider involved it just work in browser as a normal website um and so that's what most of the people or like businesses like would use finally there's like a kind of like cert contender which is like the uh it's a sub domain gateway um and so the idea is that instead of like accessing cloud ipfs.com ipns slash your domain you will access like a subdomain of cloudflare ipfs.com um

and so while it's like very convenient because like then you have like the same origin policy as you had with example.com you can access any arbitrary content and especially like you can like access like direct access cids or et cetera um it has some kind of tricks for instance like you see it's not example.com it's like example.com um which is weird but it's also how like the web is modeled um dns like is like like working on a recursive model and like in order to like provide like ease of access and integration with like tls certificate etc that's kind of the trick that has been adopted by the community another part which you need to care about when you're serving content on the

web should it be ipfs or something else it's like of course you will be able to validate that the content that you have is that is being served to user the user is being able to validate that the content is actually the one they expect however the web is a bit more complex than that and like when you're doing some like integration um there's a lot of like work that has been done in order to model um the like sandboxing of the user et cetera and so like you will have i think one of the things i mentioned before is like the x509 certificate also known as ssl certificate even though ssl is not an encryption for the web um so we need to integrate with like a nexus 509 certificate so you need to have like a domain in order to get um to get the traffic encrypted between

like your server and the the actual user another thing you need to care about is like the the course rule which is kind of like very constrained especially in an ipfs model where like you know actually exactly like what content is going to be served um and um most gateway will like um include like the access control allow origin for like everything meaning your website is able to access everything um you can like and prove you should just restrict that as you're serving the content finally ipfs has immutable content but it doesn't mean that like the content will be fined and it doesn't mean that like sometimes i don't know you access example.com something that doesn't exist well it

doesn't exist so you need to be able to serve an error to the user and so like now you have like custom four or four pages finally uh briefly what does that mean in terms of like securing the content um that you're serving um ipfs like is has definitely evolved and like usage has grown um and so in terms of like http content providing still like in constant evolution names um have been hard historically for the web and like they are also hard for immutable content serving especially if you won't like to keep the same trust guarantee that you have with this immutable content storage finally there are integration in browsers i like coming more and more

and this is being worked on and yeah that's it for me more information on the blog if you want and yeah questions open [Applause] anyone i have a question no well thank you [Applause] you