protocol.html

<!DOCTYPE html>
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />

<title>UNHOSTED - Freedom from web 2.0's monopoly platforms</title>
</head>
<body>
<div style="color:red;"><h1>Original UJ/0.1 protocol spec; provided for historic reference</h1>
See <a href="https://github.com/unhosted/website/tree/94f40baad96ed7fc8c8e13870524d5">our website repo</a> for full history of the unhosted.org website.
</div>
<div class="preload"></div>
<div class="preload2"></div>
<header>
<div class="container_12">
<div id="title" class="grid_6">
<h1>Unhosted</h1>
<h2>Freedom from web 2.0's monopoly platforms</h2>
<p>
<strong>Unhosted is a project for strengthening free software against hosted software</strong>. With our protocol, a website is only source code. Dynamic data is encrypted and decentralised, to per-user storage nodes. This benefits <strong>free software</strong>, as well as <strong>scalability</strong>, <strong>robustness</strong>, and <strong>online privacy</strong>.
</p>
<a class="button download" href="https://github.com/michiel-unhosted/unhosted/tarball/v0.1">Download the code at gitHub</a>
<a class="button manifesto" href="manifesto.html">Read the manifesto</a>
</div>
<div id="island" class="grid_6"><figure></figure></div>
</div>
</header>

<table><tr><td align="center"><p><table width="80%"><tr><td><p>

<H2>UJ/0.1</H2>

UJ/0.1, or UJ/0.1-over-PubSign, is a protocol in which an unhosted web app that is running in a browser, makes an AJAX call to a storage node, to which the storage nodes responds. The call is made to the root of the domain, with the HTTP POST method.
<br><br><br><br>
<H3>PubSign-compatible command POST content:</H3>
Although at some point we will probably change to the MagicEnvelope that Salmon uses, version 0.1 uses &quot;PubSign&quot; to <strong>sign</strong> things you <strong>publish</strong>. There are four commands, two of which follow the PubSign convention, which is as follows:
<ul>
<li> "protocol": &lt;name of the specific PubSign-compatible protocol>
<li> "cmd": &lt;whatever it is you want to publish - should adhere to protocol chosen above>
<li> "PubSign": &lt;raw hex RSA-signature signing the content of "cmd" above>
<li> &lt;other field/value pairs allowed by specific protocol...>
</ul>
<br/>
The content of the POST must be exactly one of the following four possible commands (valid responses are below each one):
<br><br><br><br>
<H3>SET command POST content:</H3>
<ul>
<li> "protocol": "UJ/0.1"
<li> "cmd": &lt;a JSON string, which decodes to:>
<ul>
<li> "method": "SET"
<li> "chan": &lt;the channel, so for 'test@example.com', chan='test'>
<li> "keyPath": &lt;an ascii name for the key in the key-value store>
<li> "value": &lt;the value you want to store, can be any JSON object>
</ul>
<li> "WriteCaps": &lt;password for writing/receiving this chan on this storage node>
<li> "PubSign": &lt;raw hex RSA-signature signing the content of "cmd" above>
</ul>
Response: "OK" or "ERROR:" followed by some error message in English
<br><br><br><br>
<H3>GET command POST content:</H3>
<ul>
<li> "protocol": "UJ/0.1"
<li> "cmd": &lt;a JSON string, which decodes to:>
<ul>
<li> "method": "GET"
<li> "chan": &lt;the channel, so for 'test@example.com', chan='test'>
<li> "keyPath": &lt;an ascii name for the key in the key-value store>
</ul>
</ul>
Response: the JSON that was in the "value" field of the last SET command for that chan and keyPath, or "ERROR:" followed by some error message in English
<br><br><br><br>
<H3>SEND command POST content:</H3>
<ul>
<li> "protocol": "UJ/0.1"
<li> "cmd": &lt;a JSON string, which decodes to:>
<ul>
<li> "method": "SEND"
<li> "chan": &lt;the channel, so for 'test@example.com', chan='test'>
<li> "keyPath": &lt;an ascii name for a mailfolder within the chan's message store>
<li> "value": &lt;the body of the message, encrypted to the chan's public key>
</ul>
<li> "PubSign": &lt;raw hex RSA-signature signing the content of "cmd" above>
</ul>
Response: "OK" or "ERROR:" followed by some error message in English
<br><br><br><br>
<H3>RECEIVE command POST content:</H3>
<ul>
<li> "protocol": "UJ/0.1"
<li> "cmd": &lt;a JSON string, which decodes to:>
<ul>
<li> "method": "RECEIVE"
<li> "chan": &lt;the channel, so for 'test@example.com', chan='test'>
<li> "keyPath": &lt;an ascii name for the key in the key-value store>
<li> "delete": &lt;boolean indicating whether to delete or leave on server>
</ul>
<li> "WriteCaps": &lt;password for writing/receiving this chan on this storage node>
</ul>
Response: an array of messages, or an empty array, or "ERROR:" followed by some error message in English
<br><br><br><br>
<H3>Additionally, the storage node should:</H3>
<ul>
<li> respond with correct CORS headers, in response to both HTTP POST and HTTP OPTIONS.
<li> check the HTTP referer that the browser sent, and make sure it keeps all data of one referer completely separate from the data of another.
</ul>
If any of this is unclear or ambiguous, then check the reference implementation at:
<a href="https://github.com/michiel-unhosted/unhosted/tree/v0.1" target="_blank">https://github.com/michiel-unhosted/unhosted/tree/v0.1</a>
<br/>
This protocol is part of the alpha-release of the <a href="http://www.unhosted.org/">Unhosted project</a>. It is likely to be changed to the next version before Unhosted reaches beta. For instance, the storage node could easily take advantage of the presence of PubSign signatures, and then we could get rid of the WriteCaps. Also, it has been suggested we should do at least the GET command with an HTTP GET method and not an HTTP POST.
<br><br>
<a href="/">[back]</a>
</p></td></tr></table></p></td></tr></table>

<div class="clear"></div>
<footer>
<div class="container_12">
<div id="twitter">
<a href="http://twitter.com/unhosted" target="_blank" id="icon">Follow us! @Unhosted on Twitter</a>
<h4>Follow us on <a href="http://identi.ca/unhosted" target="_blank">identi.ca</a> or
<a href="http://twitter.com/unhosted" target="_blank" id="twittitle">twitter</a>
<span>@Unhosted</span>
</h4>

<ul id="twitter_update_list"></ul>
<script type="text/javascript" src="http://twitter.com/javascripts/blogger.js"></script>
<script type="text/javascript" src="http://twitter.com/statuses/user_timeline/unhosted.json?callback=twitterCallback2&amp;count=1"></script>

</div>
<div id="participate">
<div class="icon"></div>
<h4>Participate</h4>
<p>Unhosted is an <strong>open source</strong> project, and entirely altruistic. <strong>If you want to help, please join</strong> <a href="http://groups.google.com/group/unhosted" target="_blank">the mailing list</a>, and open a thread about what you think should happen next.</p>
</div>
</footer>

</body>
</html>