Allow sites to use localresources, IndexedDB, WebSql, etc

[thesoftwarejedi]

This would require adding "allow-same-domain" to iframe sandbox. I somewhat understand the security implications, and this would allow other sites access to each others' localresources, but I wanted to open this ticket to track this request. Ultimately, in an effort to provide a rich user experience, this same domain issue will need to be conquered.

Short term, I'd like to see localresources opened up, maybe with an explicit user permission per site, and an explanation of the risks?

[thesoftwarejedi]

Primary risk I see is the ability of a site to unsandbox itself entirely and control the parent page. I'm unclear on the risks there.
Secondary 'risk' is storing things in LocalResources like IndexedDB would be accessible to other pages - a developer should know not to put sensitive data in there and only leverage it for indexing large amounts of public data for local querying.

[HelloZeroNet]

Yeah, the main problem is all site is using the same domain. Permission requesting is a good idea (maybe with other http://www.html5rocks.com/en/tutorials/security/content-security-policy/ features)
Later we can pack a sqlite server, so the clients can do queries via websocket api.

Util then please use flat json files or any format supported by alasql

Please let me know if you have any benchmark results on indexedDB vs flat json vs alasql.

[thesoftwarejedi]

Will try alasql for some things. I'd like to see some sort of decentralized read, centralized yet disconnected write, secure, database synchronization framework ultimately.

I think the model makes sense for publishers of data to connect to a node, transmit changes, then unplug. Then, be able to remain offline and receive messages back when connecting - ala bitmessage.

I should write a tech doc for what I'm envisioning here.

[genecyber]

Can this system execute serverside nodejs?

[HelloZeroNet]

Not directly, but you can write files using the API. (see ZeroBlog example)

[HelloZeroNet]

Now its possible to use browser's localStore with ZeroFrame API:
http://zeronet.readthedocs.org/en/latest/site_development/zeroframe_api_reference/#wrappergetlocalstorage

[danimesq]

@HelloZeroNet @shortcutme
Do you consider implementing IndexedDB?
It can make Riot.im run inside ZeroNet.
@anoadragon453

[HelloZeroNet]

Not really, but you can use sqlite as indexed key-value storage

[danimesq]

@anoadragon453
Can it be used to port Riot.im?