Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Libra Is Architecturally Unsound

stephendiehl.com

Post reply on HN
Print view View original

191–200 of 347 posts

Re: Facebook Libra Is Architecturally Unsound

#191

Post by __MatrixMan__ »

semiotagonal wrote: post #177
__MatrixMan__ wrote: post #171

Earlier quoted context omitted.

> Measures that are not ready for prime-time are as good as nonexistent That's not how technology works. To become fruitful it requires patience and investment. Nobody is saying you have to be an early adopter of these currencies. > We're talking about money here! ...and particularly whether it's current feature set is amenable to fraud prevention. I work at a traditional payments company and the waste is infuriating…

> Nobody is saying you have to be an early adopter of these currencies. This here is probably the source of our disagreement. As far as I can tell, tons of people actually are saying "get in now", which means we're no longer in the patience and investment stage, and any deficiencies in the cryptocurrency ecosystem have real consequences.

Yeah, I think you're right. There are all of these people who bought in because they just wanted to make money, and they're getting impatient and trying to get the rest of the world in too.

I'm interested in the tech and I want to work on it--so I'm just arguing that we shouldn't dismiss it.

If you have the interest, now might be a good time to diversify in that direction, but it's nowhere near ready to compete with fiat currency in terms of usage by the masses.

Re: Facebook Libra Is Architecturally Unsound

#192

Post by afiori »

ummonk wrote: post #187
afiori wrote: post #124

Earlier quoted context omitted.

I would go even more minimalist and claim that a blockchain is any distributed consensus on an immutable log

Surely byzantine fault tolerance is a requirement for a distributed immutable log to be considered blockchain?

yep, I realize now that my definition was significantly lacking.

Re: Facebook Libra Is Architecturally Unsound

#193

Post by swensel »

kragen wrote: post #104
matthewdgreen wrote: post #56

I don't disagree with the article per se, but I think many technologists are missing the forest for the trees when it comes to the motivations here. Or perhaps they're being charitable and are evaluating Libra on purely on its stated motivations rather than the ulterior motive that Libra can't name out loud. For example, take this quote: "The possibility that a Libra node run by Mastercard or Andressen Horrowitz woul…

> The possibility that a Libra node run by Mastercard or Andressen Horowitz would suddenly start running malicious code is such a bizarre scenario It doesn't seem like a bizarre scenario at all. Consider: - Real-time control system nodes in Iran's nuclear energy project suddenly started running malicious code, destroying a large number of their centrifuges. - Crypto AG cipher machines sold to embassies around the wor…

> I don't think it's at all far-fetched to suggest that if Mastercard or Andreessen Horowitz is in a position to decide how much of other people's money they're entitled to, they might decide that the answer is "all of it". Paypal and Google do this on a regular basis. Here in Argentina, the banking system decided that the answer was "75% of it" in 2001, with respect to dollars; in the US, the Federal Government did precisely the same thing in 1933 with gold.

The consensus model of blockchain would at least require Mastercard, Andreessen Horowitz and other validator nodes to be in agreement about stealing / being entitled to the money, which seems less likely. That said, this is one of the flaws of having only a few nodes validating transactions. Libra went this route instead of Bitcoin's proof of work consensus model. With Bitcoin's proof of work consensus, 51% of the miners in the world would have to collude in order to steal funds.

All of the comments I see that say blockchain has no use case, seem to miss another point you raise, in that Bitcoin can not be seized, even by government (like the US government did with Gold), unless they had miner control and the public didn't continue to operate and spin up new miner nodes. This seems unlikely considering that the miners could lose their funds, if they did not prevent a counterparty having 51% control of the network. This is a protection that Bitcoin has, that Libra does not. The government could go to corporations in the Libra association and tell them to do what they want.

In terms of other use cases, I think having an immutable ledger, that can't be changed by one party, or even a few parties with DB access, also seems like a compelling use case for blockchain / cryptocurrency. Libra isn't really a cryptocurrency by this standard though, although Bitcoin is.

Also, just to put it out there, Mastercard, PayPal, Stripe, Visa and a few others already have left the Libra association.

Re: Facebook Libra Is Architecturally Unsound

#194

Post by brokensegue »

nradov wrote: post #173
pron wrote: post #37

The answer to the question implied in the article -- why does Libra make such unjustified design decisions -- is simple. Some people have become enamored with blockchain despite it having almost no good use cases, and this certainly isn't one. It seems like a classic example of focusing on the technology rather than on the problem. -- Regardless of the other, far more important sections of this article, I find the se…

The NIST has a helpful decision tree to determine whether a blockchain architecture is appropriate for your use case. https://www.nist.gov/publications/blockchain-technology-over... (page 42)

and someone turned it into a website http://doyouneedablockchain.com/#/1/0

Re: Facebook Libra Is Architecturally Unsound

#195

Post by baby »

amluto wrote: post #165

I have only studied Move by reading the whitepaper, but there's a gaping architectural hole that I found in five minutes: public withdraw_from_sender(amount:u64): Coin { let transaction_sender_address: address = GetTxnSenderAddress(); ... } Checking the global txn sender address is not a sound way to authorize a transaction in a smart contract language. Consider that a buggy or malicious function in a different smart…

There's no other ways to get the sender address, this is a built-in.

Re: Facebook Libra Is Architecturally Unsound

#196

Post by Mathnerd314 »

The author seems to have done no actual research beyond skimming the code. E.g., "none of these libraries have had security audits"

When in fact there has been a review, and probably more internal audits that haven't been published: https://blog.quarkslab.com/security-audit-of-dalek-libraries...

Re: Facebook Libra Is Architecturally Unsound

#197

Post by Acrobatic_Road »

jayd16 wrote: post #149
harikb wrote: post #98

Earlier quoted context omitted.

There are generally 3 kinds of fraud 1. A scammer cheating someone out of their life savings through social engineering 2. A central bank "unjustly" inflating currency and giving the newly printed money to specific industry/people etc 3. A person paying for merchandise with a stolen credit card or refusing payment after services/good is delivered. Fiat solves 1 and 3 (recovery) does not think 2 is a problem. Crypto s…

Your wallet can be stolen and when using crypto so it doesn't solve 3 very well. Credit card fraud is regulated such that the consumer is protected after a manageable amount of theft, $50 in the US last I looked. If you use a bank you receive some protections but at that point the implantation is abstracted and not that relevant. IMO Cryrto is significantly worse in case 3.

If you use a smart contract wallet you can actually protect yourself from losing all your money even if someone gets your private key.

You can set a withdrawal limit of say, $50 and you can set a few recovery addresses (of friends, family or other personal wallets).

So if I have $10,000 in my ethereum wallet and I post my private key in every forum and every chatroom on the internet then the most I lose is $50. Before 24 hours pass I send my remaining $9,950 to a pre-defined recovery address which is excluded from the withdrawal limit.

Consumer protections are actually pretty good. The trouble is getting these tools in the hands of users.

Re: Facebook Libra Is Architecturally Unsound

#198

Post by cloudhead »

The author correctly states that BFT algorithms are meant to handle arbitrary failures, but then explains how that is the wrong choice because one shouldn't handle malicious actors at the consensus level. Yet there are categories of faults that cannot be handled by basic FT systems, that BFT systems can handle, and are not due to malice. So all in all, BFT is the right choice.

Re: Facebook Libra Is Architecturally Unsound

#200

Post by pyrale »

AlphaWeaver wrote: post #76
pron wrote: post #73

Earlier quoted context omitted.

> but your final paragraph seems to imply the formalism isn't key to end quality? That's not what I said. I said that merely creating a verified formal specification of a language is not in itself a good path to increasing correctness, and I wouldn't focus on that as a significant cause for concern given all others. But even when you use formal methods in the development of your software -- and I'm certainly a propon…

> Security is defined with respect to certain threats, and blockchain is rarely the most secure with respect to the threats in a monetary system. Wow, this is a great way to frame this! What do you see as the largest threats to the effective operation of a monetary system?

Basically, scams. The ability to block a planned payment or ask your bank to chargeback is one of the keys to trust in online economy.

If our banking system had used something like bitcoin to implement online transactions, odds are that e-business would have had much less successs and much higher barrier to entry.

Post reply on HN