Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Hyperledger – Open Payments Protocol

hyperledger.com

Post reply on HN
Print view View original

41–45 of 45 posts

Re: Show HN: Hyperledger – Open Payments Protocol

#41

Post by feichtinger »

cjg wrote: post #31

danoprey - it's not clear to me what the URL is for when creating a new ledger. Can you clarify?

Hi cjg,

The service is currently running on four nodes:

http://hyperledger-staging-1.herokuapp.com http://hyperledger-staging-2.herokuapp.com http://hyperledger-staging-3.herokuapp.com http://hyperledger-staging-4.herokuapp.com

You can create a ledger by POSTing to /ledgers at one of those 4 nodes and it will be replicated on the other nodes. The CLI is very rough at the moment but is probably the best place to see how to construct a valid message: https://github.com/hyperledger/hyperledger-cli/blob/master/b...

Re: Show HN: Hyperledger – Open Payments Protocol

#42

Post by regularfry »

feichtinger wrote: post #5
admax88q wrote: post #2

The FAQ dismisses 51% attack quite quickly, while casually mentioning that it's vulnerable to a 33% attack. What prevents an malicious actor from getting 34% of nodes, and then turning them all bad at the same moment?

Thanks for taking the time to read through! The wording on that could be improved a little because there's a bit of a distinction between total computing power and number of nodes. It's a proven result that in asynchronous systems with potentially malicious nodes, 1/3 is the maximum number of faulty replicas that can be tolerated. Here's a paper with a proof: http://zoo.cs.yale.edu/classes/cs426/2012/bib/bracha85asyn…

> Of course, with enough nodes it should be very unlikely for an attacker to get control of that many nodes at once.

I wouldn't bet on it. Look at the warnings that have gone out about the last couple of Rails RCE vulnerabilities: attackers can scan the entire Internet for vulnerable apps in a faster time than many sysadmins can get the upgrade deployed. Now, imagine this: a potential attacker, ahead of time, finds a way to reliably remotely fingerprint the version of Rails you've released as hyperledger. One scan later, they're sitting on a list of the IP addresses of some large proportion of hyperledger installs. All they now need to do is wait for the right vulnerability to be announced (or find it themselves), and then it's a race to gain control before a) the Rails team publishes a patch, b) you release a new version of hyperledger with the patch applied (or can announce that the patch doesn't break things via a gem upgrade), c) more than 66% of the sysadmins jump on the announcement. In the time for a), b) and c) to happen, they need to i) run a single exploit, and ii) simultaneously generate a bad transaction, across the servers they now control.

a), b), and c) are humans. i) and ii) are a for loop in a single bash script. That's not a race I'd want to be on the wrong side of.

Re: Show HN: Hyperledger – Open Payments Protocol

#43

Post by sorbits »

feichtinger wrote: post #38
sorbits wrote: post #28

As I understand it, it is required that people trading units in a ledger trust the ledger’s creator not to issue new units to enrich themselves. If so, is that much different from using a central service and trust its creator?

Hi sorbits, Yes, you must have some trust in the ledger owner, although, as mentioned in another post, depending on the type of asset it may not be such as issue. We built the system so that the issuing rules and payment guarantees were separate because we think that's a good thing. We have some ideas as to how we can improve trust and transparency in issuing parties in the future, but that can evolve separately from…

> Yes, you must have some trust in the ledger owner

Then I fail to see the advantage of a decentralised system, as we can let the ledger owner sign each transaction, instead of a consensus.

> although, as mentioned in another post, depending on the type of asset it may not be such as issue.

Can you elaborate or point me to that comment?

> Also, we think there is a benefit to payments not being centralised, even while issuance is. For a start, the ledger is signed by multiple parties which increases trust

I would consider the ledger owner’s signature more trustworthy than multiple third party signatures.

> and resilience against faults (malicious or not).

Making it decentralised has a much larger attack (and bug) vector, so I wouldn’t conclude that decentralised in itself is an advantage (which I think is really what you are saying).

Re: Show HN: Hyperledger – Open Payments Protocol

#45

Post by danoprey »

cjg wrote: post #31

danoprey - it's not clear to me what the URL is for when creating a new ledger. Can you clarify?

I think you mean the URL in the ledger creation command, e.g., 'hyperledger ledger register newcoin https://newcoin.com'. This would just be the official site of the asset or company, like bitcoin.org is for bitcoin. Currently, this is just used so people can get extra information, but it could be used in the future to remove spam currencies if there is no official site (although we would not be able to do this ourselves, it would require the consent of the entire consensus pool).
Post reply on HN