Small Technology Foundation, Small Web, Aral Balkan

[boris]

The Small Technology Foundation, which is a small non-profit composed of Laura Kalbag and Aral Balkan.

Small Web key points (from Small Tech home page)

• Don’t trust the server
• Trust the client
• Owned by individuals
• Call people “people”
• A server has one owner

Also, Aral’s Aug 2020 blog post:

What is the Small Web?

From https://source.small-tech.org/small-web/protocols/-/blob/master/README.md, very preliminary protocols.

A Small Web Place:

• MUST be free and open source (and released under a “share alike” license, e.g., AGPLv3 or later)
• MUST be a single page web app that contains source code only (no data). This is so that we can use out-of-band verification (e.g., a browser extension) to verify that the downloaded web app is what we expect it to be (integrity verification). All other resources included MUST use subresource integrity.
• MUST, on first use, generate with at least 100 bits of entropy a single DiceWare passphrase on the client side. From this passphrase it MUST derive via cryptographically secure means all other key material, including the Ed25519 signing keys, the Curve25519 encryption keys, and the SSH keys.
• The server hosting a Small Web place MUST have the root account disabled, have one account set up for the owner of the server and permit access only via SSH. The server MUST NEVER come into possession of the owner’s private key material.

URL conventions

The following URLs are reserved:

• /id: the identity of your place (an Ed25519 public key).
• /private: the section of a place accessible only to the owner (the person who holds the private key).

[boris]

Also learned about from Aral’s blog post, the Public Suffix List. Basically, we might submit *.fission.app to make it clear that the * part is “user controlled”, and has impact for how browsers treat various elements.

Heroku is listed:

// Heroku : https://www.heroku.com/
// Submitted by Tom Maher <tmaher AT heroku.com>
herokuapp.com
herokussl.com

So, yeah, we should add ourselves to this.