You're right, that was a misleading example. I changed it to data.json to be more clear.

> If you publish a dat archive, how do you notify Hashbase to pin it? Can you do it through dat? Does it require setting up an account on Hashbase, providing an email address, linking a credit card, etc.?

The "Pinning" system is very similar to Git remotes. You can pin using any endpoint that complies with https://www.datprotocol.com/deps/0003-http-pinning-service-a.... So, similar to a git remote, you do need some kind of authentication with the pinning service - unless somebody writes one that's open for anybody to push to.

The UX flow will be similar to a git remote as well, you use an HTTPS to tell the server to sync the dat. So, it's an explicit user action.

We've got two nodejs implementations of the pinning service API you can self-deploy, https://github.com/beakerbrowser/hashbase and https://github.com/beakerbrowser/homebase, and then we run a Hashbase instance at hashbase.io

> You're right, that was a misleading example. I changed it to data.json to be more clear.

CORS doesn't preflight GET, POST or HEAD methods unless they have custom headers or content-type other than application/x-www-form-urlencoded, multipart/form-data or text/plain.

So a simple GET bar.com/data.json works just fine in today's browsers.

https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

To some extent, you're conflating some of the requirements to avoid preflighting with cross-origin requests simply being allowed, and they're not the same.

While fetch doesn't preflight for GET, it does require an Access-Control-Allow-Origin header. You can specify `no-cors` in the mode to circumvent this, but then you cant access the response body (https://developer.mozilla.org/en-US/docs/Web/API/Request/mod...)

Open the console in an empty Chrome window and paste this:

  fetch('https://pfrazee.hashbase.io/feed.xml')
    .then(response => response.text())
    .then(str => console.log(str))

    fetch('https://beakerbrowser.com/dat.json')
      .then(response => response.text())
      .then(str => console.log(str))

application/json is a content-type other than application/x-www-form-urlencoded, multipart/form-data or text/plain, and thus a request for it will fail unless the required CORS headers are present

Additionally, you're thinking about the "wrong" Content-type header: the limitation you're mentioning about urlencoded and so on is a limitation on request headers, not response headers.

The CORS headers are required for the GP's described request to succeed, but not for the reasons you give.

Servers and financial institutions will never go away, no matter how hard we try. I'm hoping that we can make surveillance go away by sharing much less data with organisations who rely on surveillance to survive.

Hashbase is not "centralized" in the sense that you are always free to choose a different provider of its hosting services. You can host your own Hashbase: https://github.com/beakerbrowser/hashbase

You can even choose multiple providers at once, providing you with resilience in case one of your chosen providers violates your trust, eg. by losing your data or using it to spy on you.

CORS applies to XHR. Including GETs and POSTs, and including fetching images over XHR.

There's some other sibling comments here discussing preflight requests, which it sounds like you might be referring to, but CORS is not limited to just preflight requests.

This is completely incorrect. You can not make any XHR GET or POST requests cross-origin without CORS.

Fonts also do not require CORS, you can link to them in your CSS/styles/etc without technical restrictions (might be legal restrictions of course).

You do this for example with `fetch('./any-resource', {mode: 'no-cors'})`.

You can then for example do a `.then(x => x.blob())` and then use the resulting blob as an image.

This is provided by hashbase in their ui. Sign up for an account and add your dat. It is email based, no credit card/address unless you go over the data cap.

If you are uncomfortable using the service you can run your own node, it is open source: https://github.com/beakerbrowser/hashbase

It depends on what you want to do with the image: https://developer.mozilla.org/en-US/docs/Web/HTML/CORS_enabl...