Live data from Hacker News

Facebook Libra Is Architecturally Unsound

stephendiehl.com

291–300 of 347 posts

Re: Facebook Libra Is Architecturally Unsound

#291
post #112

Earlier quoted context omitted.

No, not "hence the inflation". You have not explained why; you've explained why you think we should have inflation. And why someone thinks something should be is a long way from explaining why something is.

But I did. The same amount will be worth less in the future! That's really all there is to it. A certain amount of money is not value, money is a number that has a value associated with it, that value will continuously change depending on what you can do with it. Inflation (deflation) simply reflect the change in value for doing something today versus tomorrow. When the economy works well you have inflation, when the…

> The same amount will be worth less in the future! ... When the economy works well you have inflation, when the economy works badly it becomes deflation.

This is backward, actually. If the economy is working well then withholding consumption (i.e. saving) means that more goods are available for others to either consume or invest. The portion that ends up invested should result in higher future productivity and, in the absence of currency supply manipulation, decreasing prices (deflation), a natural reward for producing more than one consumes.

Only in an economy which is consuming capital—investing so little that productivity is actually decreasing—should prices increase over time. In that case we need more investment to bump up production—the investments don't need to be all that good to be better than the status quo, and anything with a positive return is superior to just waiting for prices to increase further. In the deflationary case, however, we should be more selective about where we invest. It's better for the economy to simply hold our funds in reserve rather than actively compete against more competent investors to expend resources—not just money, but the labor and material it represents—on ventures that will provide lower-than-average returns.

If we expand the currency supply to manufacture inflation and thus make it look like we need more investment when we actually don't then the net result is malinvestment, wasted resources, and a lower average rate of return. It's not good for the economy or the average citizen, but the extra transactions and higher nominal prices directly benefit the bankers and tax collectors with influence over monetary policy.

Re: Facebook Libra Is Architecturally Unsound

#292

> Not many people who work on financial infrastructure speak publicly about their work... This was a bit of a throw away line, but I found it insightful. As someone who isn't in this space, my question is: why is this? Is it contractual, or is that just not part of the space's ethos? Feels like we need to overcome this some how to achieve progress?

It's hard to speak about the infrastructure because:

1) it's complex and relies on a bunch of concepts that are niche/uncommon in tech field, so it's really hard to make a short answer that makes your point understandable without adding an essay-length explanation about why some assertion of fact is actually true, or how some aspect of the financial system works slightly differently than the common understanding and has serious implications that usually doesn't matter only because the system is carefully engineered to ensure that this never happens, but for a different system it would matter.

2) you can't have a purely technical discussion because pretty much every factor of infrastructure is part technical, part legal, part financial, and you can't really separate these aspects because they put serious constraints on each other.

3) it's a bit emotionally unpleasant because multiple important, relevant aspects have political connotations and invite passionate debate about things that I'd like to assume as axiomatic and offtopic to the main point. For example if we want to debate why technical payment systems are the way they are and what other technical payment systems are plausible in the short-term, aspects like the need for reversibility are pretty much an undisputable unavoidable constraint from the legal/economic side to the technical part; IMHO any productive technical debate is possible only about how to best design systems within these non-technical constraints (and what exactly are the actual constraints), but a lot of the discussion here is centered whether these constraints "should" be there - which is interesting but a completely different topic, to note the "is-vs-ought" distinction, debating whether reversibility (or, say, KYC/AML) ought to be a requirement has absolutely no relevance to the debate whether and when it is a requirement. But it's hard to make a technical description of how/why something works without getting sidetracked into a political discussion of whether some must-have requirement should have a right to exist.

There's not really an ethos of secrecy (at least for the main infrastructure side), all the technical and legal (but not financial) details are generally available to whoever is interested but they are large and details matter, and key details differ between countries. Seriously, when getting started in the industry when I had spent months reading on various details of e.g. card issuing/acquiring process, I thought I had a reasonable understanding.... and now I know how a bunch of that understanding was slightly but dangerously wrong.

Re: Facebook Libra Is Architecturally Unsound

#293

Earlier quoted context omitted.

> Give me a justification for why you think money should be worth more later My justification is freedom of choice. Or, in other words, the reason is "because I want it to, and I am justified in making my own free decisions". I believe it is people's right to choose which money system that they want, and you should not have the right to prevent other people's voluntary choice to use a different money system. I am jus…

> My justification is freedom of choice. Or, in other words, the reason is "because I want it to, and I am justified in making my own free decisions". You're intentionally not answering my question which is: explain to me what benefit to society could potentially arise from money being worth more over time? I'm not saying you can't do it I'm asking you why . It seems you and everyone else can't point to anything othe…

Short version: Deflation benefits society by preventing malinvestment in ventures with a below-average (i.e., below-deflation) rate of return which would divert labor and materials from actually profitable investments.

Long version: https://news.ycombinator.com/item?id=21457114

Re: Facebook Libra Is Architecturally Unsound

#294
post #179

>For a system that is designed to be run in a consortia of highly regulated multinational corporates, all running Facebook signed code and access controlled by Facebook it simply makes no sense to deal with malicious actors at the consensus level. Why is this system designed to be byzantine tolerant at all rather than just maintaining a consistent audit log for compliance checks. The possibility that a Libra node run…

For the case of "A transaction can of course be reversed simply by making the inverse transfer." the equivalence is broken by the technical authorisation required - in most systems if I'm able to make a transfer, I'm not able to simply make the inverse transfer, that other person is able to make the inverse transfer. So the question of reversals essentially is whether the inverse transfer can be made (and if so, under what conditions) against the wishes of the original recipient.

And when there's a good answer to that, the next question is what are the exact consequences to reversals (or attempted reversals) of money that's "not there anymore" - e.g. there's a valid transfer from A to B; followed by a transfer from B to C; followed by a need/decision to reverse the A to B transaction (which is a very, very common scenario in e.g. scam resolution). For systems that treat money as the conceptual equivalent of "stuff" (e.g. Bitcoin) that's a very hard question; most of our financial infrastructure (probably for millenia) treats money as the conceptual equivalent of "debt relationship" i.e. a metric of who owes whom how much, and then it's a bit easier but still not trivial.

Re: Facebook Libra Is Architecturally Unsound

#295
>For a system that is designed to be run in a consortia of highly regulated multinational corporates, all running Facebook signed code and access controlled by Facebook it simply makes no sense to deal with malicious actors at the consensus level. Why is this system designed to be byzantine tolerant at all rather than just maintaining a consistent audit log for compliance checks. The possibility that a Libra node run by Mastercard or Andressen Horrowitz would suddenly start running malicious code is such a bizarre scenario to plan for and is better solved by simply enforcing protocol integrity and through non-technical (i.e. legal) means.

BFT is still useful in that scenario as part of a defense-in-depth against compromise of some of the validators/nodes, yes even ones run by Mastercard or A16Z.

It’s certainly more difficult for that to happen in these settings, but given the state of the world with nation states rampantly hacking each other in any way they can of varying levels of sophistication, from social engineering to stealing user databases to stuxnet, having an extra layer defenses against that in a global currency is not superflous.

And that’s what Libra is, a global currency, not a mere payment system.

Re: Facebook Libra Is Architecturally Unsound

#296

Earlier quoted context omitted.

Given a system with irreversible transactions you can always add structure on top to support escrow, chargebacks, or whatever other protection mechanisms you deem prudent. It doesn't work so well the other way around.

Protection from scams requires that a malicious actor with full technical control of some account is still unable to make irreversible transactions by opting out of whatever structure supports escrow, chargebacks, etc; so either those mechanisms (conditional reversibility, with technical controls defining a reasonable regime of when reversals will be possible and when not) are built in the core system and aren't opti…

You're asking way too much. It's not as if the current system actively prevents you from opting out of all the safety measures and, say, irreversibly handing cash (or something else of value) directly to a scammer; nor should it. Reversible transactions come with costs, especially when the other side of the transaction is not reversible. Chargeback fraud, for example, is a big problem for merchants, and can only occur in a system with reversible transactions. Contracting parties should be free to negotiate both the form of payment and the degree of risk each side is willing to take.

The main problem is simply the novelty of it all. Once reasonable and customary structures to handle disputes are in common use asking people to bypass those structures without a very good reason will be just as much of a red flag as it is under the current system.

Facebook is not a party to a transaction between any other two Libra users and should have no liability in the event of a dispute over payments beyond maintaining accurate records and providing a fair and above all neutral platform to conduct business.

Re: Facebook Libra Is Architecturally Unsound

#297

Earlier quoted context omitted.

> Give me a justification for why you think money should be worth more later My justification is freedom of choice. Or, in other words, the reason is "because I want it to, and I am justified in making my own free decisions". I believe it is people's right to choose which money system that they want, and you should not have the right to prevent other people's voluntary choice to use a different money system. I am jus…

> My justification is freedom of choice. Or, in other words, the reason is "because I want it to, and I am justified in making my own free decisions". You're intentionally not answering my question which is: explain to me what benefit to society could potentially arise from money being worth more over time? I'm not saying you can't do it I'm asking you why . It seems you and everyone else can't point to anything othe…

The benefit is that people are allowed to use money of their own choosing.

Freedom is something that many people care about and value.

The benefit is also that different people want different things in their own money system, and a diversity of things and monetary systems is good, merely because of the money systems being different.

There is value in having differing money systems with different properties (merely because they are different!), and letting the market decide which one is best.

So a direct answer to your question is "because it is different from what we have now", and more diversity in monetary properties is a good thing.

Re: Facebook Libra Is Architecturally Unsound

#298

Earlier quoted context omitted.

I think it's weird how family gets invoked to change the moral gravity of an issue. It suggests orphaned children, for instance, should care less about humanity.

It's not about the moral gravity but about an illustrative example of a particular category of people who have access to devices where buying stuff is possible - children. Our marketplace has at least some customers that clearly are unable to protect themselves and need protection, e.g. these children. This places some contraints on the properties that this marketplace must have - e.g. reversals must be possible with…

It's a good point, about children and reversing transactions.

Even when everyone's an adult, consumer protections can be very important -- e.g. to prevent things like lending crises.

Invoking family to make an ethical point is something I see often, in many different circumstances.

Re: Facebook Libra Is Architecturally Unsound

#299

I am always amazed at the concept that blockchain is private at any level. The architecture is built specifically to share transactional data. It is useful for creating a digital entity that is unique and can be treated as currency, but the shared transactional nature is a huge, huge privacy flaw, as far as I understand blockchain (at least Bitcoin). Please correct me if I am wrong about the public nature of transact…

> Well, for a while Whole Foods was accepting payment by Bitcoin. That means if you know Whole Foods' Bitcoin account number...

They wouldn't have just one "account number". Standard practice is to use a different address for each transaction, both for privacy and for increased security. (An attacker only has the public key hash to work from for any unspent transactions, not the full public key.) Now, these funds would probably be consolidated into a smaller number of holding accounts, and you might be able to deduce some other likely payments to Whole Foods by looking at which inputs were combined together in later transactions, but obtaining their complete ledger is nowhere near as simple as looking at one payment to Whole Foods and finding all the other transactions involving the same address.

Re: Facebook Libra Is Architecturally Unsound

#300

Earlier quoted context omitted.

Protection from scams requires that a malicious actor with full technical control of some account is still unable to make irreversible transactions by opting out of whatever structure supports escrow, chargebacks, etc; so either those mechanisms (conditional reversibility, with technical controls defining a reasonable regime of when reversals will be possible and when not) are built in the core system and aren't opti…

You're asking way too much. It's not as if the current system actively prevents you from opting out of all the safety measures and, say, irreversibly handing cash (or something else of value) directly to a scammer; nor should it. Reversible transactions come with costs, especially when the other side of the transaction is not reversible. Chargeback fraud, for example, is a big problem for merchants, and can only occu…

There's a bunch of "should" in this argument. I won't debate whether it should have liability, but I'll point out that no matter how it ought to be, according the law of the land at least in EU any payment service provider inavoidably has liability in certain cases e.g. when your account has been hacked; if they are unable to reverse a transaction that wasn't authorised by me but by someone else, well, that's their problem, they still have to compensate the consumer above a self-risk of 50 Eur.

The original article mentions UK Consumer Credit Act which IMHO is not appropriate (its scope is limited to credit relations, and the protections of that act generally exclude both debit cards and most e-money systems including Libra), so the scope for potential payment service provider involvement in disputes between buyer and seller is narrower than that - and probably closer to your "should" statement than the arguments of the original article.

However, it can't be a fully neutral platform distancing itself from all liability. It is illegal to "simply" offer payment services without incurring any liability for misuse of them, breaching AML/KYC regulations, etc. Facebook has not yet (as far as I know) stated what exact legal structure they'll use for compliance with the legal requirements, so I can't comment on that, but they did make statements that Libracoin will comply with the EU regulations so I presume that some legal entity regarding Libracoin (possibly co-owned by the consortium members, or possibly multiple entities) will (have to) be a licensed payment service provider in EU, and similarly (it's usually done with separate legal entities) in other major jurisdictions.

Technical structures that "just happen" such as Bitcoin can ignore regulations but any person or organization that wants to offer services using these technical structures is fully liable for meeting all the legal requirements - and if the technical structure makes impossible to do something, they're still fully responsible for any consequences of not achieving the impossible thing; if they don't want the liability, they're free to not use that technical structure and not use/offer/advertise anything with it.

Post reply on HN