Live web branching

draft · placement in the milestones is open

Any hosting muppet can act as a collaborative overlay for any existing website, a kind of “git for the web”. Asking a muppet disco for

https://xtxp.link/en.wikipedia.org/wiki/Browser@origin

leads to Wikipedia’s page as it is now, and to the sessions forked from it that the disco lists. A domain owner who has claimed @origin decides, through the bouncer, which of those are listed and what’s officially relayed.

There is no special proxy address. A website is addressed like any other document, and the @{ref} says which version: @origin is the website as its origin server publishes it, and any other ref is a session.

The first visit fetches the canonical page and makes it the genesis state (vector 0). Links and form actions are rewritten to stay inside XTXP, each carrying a ref. Edits POSTed by users become XTXP operations on a session, and the origin site is never touched.

Select the diagram to view it full screenPlantUML source

The origin site is a peer

Origin pages keep changing after the genesis fetch. XTXP treats the origin as an upstream peer: the differences between successive fetches become that peer’s operations. Its session is @origin. Other sessions take in upstream changes the same way they merge anyone else’s edits.

HTML is not XML

Genesis needs an HTML5 parser that produces a tree the CRDT can hold. It also needs node IDs that stay stable when the page is fetched again. Without them, every re-fetch looks like the whole page was deleted and re-inserted, and every overlay edit gets orphaned.

Safety requirements

An open rewriting proxy is a phishing kit by default

Without safeguards, anyone could edit a bank’s login page and serve it from an XTXP host. Browsers’ safe-browsing lists would flag that host’s domain quickly, and any disco that lists it. xtxp.link doesn’t serve pages itself, which limits the damage to it but doesn’t remove the risk.

These apply to every muppet that hosts sessions of websites, and to every disco that lists them, from the first deploy, not as later polish:

1. No credentials pass through. Never forward cookies, auth headers or form submissions to origin sites.
2. Origin forms are disabled in overlays. Only XTXP edit forms submit.
3. A persistent, visible frame marks every session page as an edited copy and links to @origin and to the original. The ref in the URL does the same job before anyone clicks: @origin means unedited, anything else means a session.
4. Bare links default to @origin, so following a plain link never lands someone on an edited session by surprise.
5. Origins can opt out, through robots rules, a response header or their bouncer, and hosts and discos honour it.
6. Takedown handling with a published contact and process.
7. Sensitive categories (login, payment and account pages) are read-only or excluded.

Prior art worth studying: Hypothesis’s via proxy, which overlays annotations on any page, and the Genius Web Annotator, which drew sustained criticism from site owners for overlaying content on their pages without consent. See prior art.