The point of Blockstack is to eliminate centralised points of control on the internet. As a user I am in control of my own data and it’s not stored by another organisation.
But what is to stop someone from storing blockstack app user data on another system? Since blockstack apps are web apps they could just push data to their own database. For example, let’s say I develop a new social network app on Blockstack that completely blows away the competition. Its features are so incredible people start gravitating away from Facebook and the app is getting millions of new users. In order to monetise the app I start pushing app user data to another database which I can then use to sell to advertisers and other interested parties. Is there anything within Blockstack that stops me from doing this?
I suppose this would be considered a big violation of trust since users of Blockstack are expecting their data to be handled ethically. On the other hand the app maybe so useful that it’s difficult for people to leave.
I don’t know I keep asking similar questions but either nobody responds to the post or depending on what platform I am on it magically disappears Even when I ask the question how truly decentralized is block stack At this point I’m starting to think about moving back over to eth ipfs and maidsafe Which I know eth isn’t exactly 100% decentralized
I think this is a fair question and one that I feel like has been answered a few times, but I might be wrong. I can’t speak for Blockstack, but I do have a few points I think I can make as an app dev that may be helpful.
ANY app (decentralized or not) requires trust. It’s just the level of trust required that varies. Ethereum, p2p, Blockstack—whatever it is requires the end user to place a certain amount of trust in the app.
That being said, the app developers have methods for making that trust easier. The first is to open source their code. I think this is imperative in the decentralized space. I would be wary of any decentralized app that is closed source, and I say this knowing there are good, trustworthy Blockstack apps that are not open source. I think a part of being in this space means accepting that you cannot operate the way companies have operated in the past. You have to operate in the open.
The actual deployed code can live in a p2p network which would allow users to verify on the fly that anything being served up matches what is shown in the open source repository. Blockstack has toyed with this idea, and there are already websites entirely hosted on IPFS. So it’s possible.
That is correct – nothing stops you. It is true for any application platform where the client is allowed to make arbitrary network accesses, so it’s unlikely to change without a custom Web browser that prevents this.
However, an application isn’t considered a Blockstack application if it doesn’t observe these three design principles. If the user doesn’t own their data and identities independent of the application, or if the user doesn’t have free choice in the client they use to interact with it, then it’s not a Blockstack application (even if it uses technology developed by Blockstack).
Since you’re storing your data in Gaia, your users will own their own data outside of your application. An enterprising user would simply fork your client or write a new one in order to excise the ad network code.
Yup. It’s not a Blockstack application if it doesn’t respect the users’ ownership of their data.
I’ve been mulling over a similar concern recently about Blockstack apps theoretically being able to load user data from Gaia in the client (e.g. browser) then scrape it from the page once unencrypted there and trigger any number of network requests that then siphon that unencrypted data away to who-knows-where.
As @jude points out, this is a possibility with any platform that loads data into a standard Web browser, I suppose unless the user has gone to extraordinary efforts to customize or config the browser not to make arbitrary network calls.
I wonder if a solution Blockstack or the community could provide is provide a browser plugin / extension for Chrome, etc. that monitors all network calls attempted by a client-side app and prevents it from siphoning off Gaia-based data? Is there an elegant way to do this theoretically without getting into a cat-and-mouse game with malicious app creators?
cc @larry since he may also have thoughts on or interest in this possibility
