Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sign Everything

avc.com

Post reply on HN
Print view View original

71–80 of 90 posts

Re: Sign Everything

#71

Post by acdha »

legutierr wrote: post #44
radicalbyte wrote: post #34

Earlier quoted context omitted.

There is absolutely 0 need to use a blockchain to sign something :facepalm:

Sure, you don't need a blockchain to sign something, but using a blockchain means that the signature is timestamped in an incontestable way, massively replicated and made globally retrievable. It also helps mitigate the possibility that the content will be deleted or suppressed.

So would basic PKI or a Merkle tree, but those would be orders of magnitude less expensive to operate and more robust.

For example, how many posts a day does Reddit have? It’s far from the biggest social network but would swamp any public blockchain, and none of that is necessary since you’re really just looking for a third-party to say “we verified signature X at time Y” (they’re not vouching for the content). Federation works well for that since you don’t otherwise need a global public namespace.

Re: Sign Everything

#72

Post by mananaysiempre »

radicalbyte wrote: post #62
mananaysiempre wrote: post #57

Earlier quoted context omitted.

Timestamping, so that people can know whether the signature that claims to have been made before revocation actually was, is one reason you might want to. Happily, that idea has been implemented on the Bitcoin mainnet and available as a free service for several years[1,2]. [1] https://opentimestamps.org/ [2] https://petertodd.org/2016/opentimestamps-announcement

Exactly the same thing can and is achieved with a distributed log (append-only database, distributed) controlled by different legal entities. No need for ETH there.

No ETH or smart-contracty stuff is used by OpenTimestamps either, FWIW, they just periodically publish tree (log) hashes in a Bitcoin transaction.

But yes, a Certificate Transparency-style system works too, provided you can get someone to run it. The problem is not even really the compute, which without proof of work should be negligible, but the durability (CT logs intentionally have limited lifetimes) and availability (CT logs are publicly accessible... for now, most of the time[1]). People have even talked about literally piggybacking on top of CT[2].

I’m not saying Bitcoin is an efficient solution here. Keybase had most of the technical side figured out[3], for example, and had it succeeded (or had a business model at all besides the geek appeal) I’d happily used it instead. But it is what we have right now. There are other efforts underway to build a CT-like design[4,5], and one is even running as long as Google is feeling like it[6].

[1] https://utcc.utoronto.ca/~cks/space/blog/tech/TLSCertTransLo...

[2] https://wiki.mozilla.org/Security/Binary_Transparency

[3] https://book.keybase.io/docs/server, see also https://book.keybase.io/docs/server/merkle-root-in-bitcoin-b...

[4] https://transparency.dev/

[5] https://www.sigsum.org/

[6] https://go.dev/blog/module-mirror-launch

Re: Sign Everything

#73

Post by acdha »

alkonaut wrote: post #49
phoe-krk wrote: post #5

>I think AI and Web3 are two sides of the same coin. As machines increasingly do the work that humans used to do, we will need tools to manage our identity and our humanity. Web3 is producing those tools and some of us are already using them to write, tweet/cast, make and collect art, and do a host of other things that machines can also do. Web3 will be the human place to do these things when machines start corruptin…

> Machines will simply start pretending to be human and sign everything themselves The signature has to be trusted though. Just signing it with a signature that has no meaning to me doesn't change anything apart from perhaps proving it has the same origin as something else. The key function is the humanness or repotuation/trust score of the signature. If I read something signed by my uncle with a key we recently exch…

> > nothing prevents a person from taking a ChatGPT output and putting their own, human, signature on it.

> That would make me lower my trust of that author. I think this is the key: the signatures don't provide much value until we have a good reputation database, perhaps systems of trust networks where my uncles' neighbor is automatically slightly more trusted because I trust my uncle. That would be a useful system.

I don’t disagree but I think this kind of thing will be undercut by people responding to different incentives. For example, maybe your uncle’s friend would never intentionally try to scam you but what if they’re really busy and see some cool AI assistant ad? Or broke and get an ad promising $500/week to send letters from what they’re assured is a legitimate business? Or simply that they use some online service which is hacked in a way which lets the attackers use delegated signing credentials?

There are ways to mitigate that kind of thing, of course, but it feels like it’s going to be expensive and unsatisfying.

Re: Sign Everything

#75

Post by bambax »

> When I say sign, I am thinking cryptographically signed, like you sign a transaction in your web3 wallet.

Why would we need web3 to sign something. Public/private keys have existed for decades, the blockchain is completely irrelevant.

Also, signing only proves something originates from you. It doesn't prove the opposite, that some other thing doesn't. And it only matters to people willing to check the signature.

Re: Sign Everything

#76

Post by esbeeb »

gpg -b detached_signature_of_the.mp4.sig needs_signing.mp4

I use this for all the livestream videos I create. I also post an sha256sum of the videos, for good measure. These are mentioned last of all, at the bottom of each webpage for a video.

Re: Sign Everything

#77

Post by dang »

Group_B wrote: post #7
phoe-krk wrote: post #5

>I think AI and Web3 are two sides of the same coin. As machines increasingly do the work that humans used to do, we will need tools to manage our identity and our humanity. Web3 is producing those tools and some of us are already using them to write, tweet/cast, make and collect art, and do a host of other things that machines can also do. Web3 will be the human place to do these things when machines start corruptin…

Some people are so desperate to find any use case for blockchain and other bullshit. It’s like they don’t even think this stuff through.

Maybe so, but please don't post unsubstantive comments or shallow dismissals to HN, and please edit out swipes, as the guidelines ask: https://news.ycombinator.com/newsguidelines.html.

Re: Sign Everything

#78

Post by nonameiguess »

infotogivenm wrote: post #30
infotogivenm wrote: post #25

Earlier quoted context omitted.

Signing everything is not terrible advice. But here the problem Fred is trying to solve is very simple. He is an investor in mirror.xyz and needs to make his money back. This is the only reason someone interested in signing something would also ask you to go through the hassle of using a blockchain.

To add to this a bit - I do think an embedded steganographic-type “signature” of chatgpt output could be enormously valuable - without it we can wave goodbye to the efficacy of things like school assignments. Such a signature is very different than a typical cryptographic one we have today however. But I expect instead of embedding such a signature they will just save hashes of generated content and sell a billion do…

How good is perceptual hashing for text? It seems trivial for a student with any modicum of intellect to delete a sentence and re-word a few others, same as you would do now after bullying a human nerd into writing your essay for you.

Re: Sign Everything

#79

Post by legutierr »

infotogivenm wrote: post #70
legutierr wrote: post #44

Earlier quoted context omitted.

Sure, you don't need a blockchain to sign something, but using a blockchain means that the signature is timestamped in an incontestable way, massively replicated and made globally retrievable. It also helps mitigate the possibility that the content will be deleted or suppressed.

No blockchain in the world could store the hash of every post ever in a “retrievable way”. Even Elon understands this. The valid ideas that apply here are global labeling and account subkey ordering. I have never seen a solution for either that is end-to-end without a client syncing gigs of data, so various intermediaries are always trusted. In practice a federated (“permissioned” I suppose) audit log is better, chea…

> No blockchain in the world could store the hash of every post ever in a “retrievable way”.

Ethereum processes about 1MM transactions per day right now; other blockchains have higher throughput. It currently manages about 100MM accounts.

Sure, I suppose that might not be enough to hash and sign all blog posts ever (has anyone ever counted?) but you could timestamp a lot of them.

> In practice a federated (“permissioned” I suppose) audit log is better, cheaper, and doesn’t require your users spend tokens if you want to go down this path.

Someone has to pay for the servers, etc., right? What's wrong with paying for that using a token?

Blockchains may be expensive, but you get orders of magnitude more redundancy, and you don't need to worry about ever losing access. You get what you pay for.

Re: Sign Everything

#80

Post by legutierr »

acdha wrote: post #71
legutierr wrote: post #44

Earlier quoted context omitted.

Sure, you don't need a blockchain to sign something, but using a blockchain means that the signature is timestamped in an incontestable way, massively replicated and made globally retrievable. It also helps mitigate the possibility that the content will be deleted or suppressed.

So would basic PKI or a Merkle tree, but those would be orders of magnitude less expensive to operate and more robust. For example, how many posts a day does Reddit have? It’s far from the biggest social network but would swamp any public blockchain, and none of that is necessary since you’re really just looking for a third-party to say “we verified signature X at time Y” (they’re not vouching for the content). Feder…

> So would basic PKI or a Merkle tree, but those would be orders of magnitude less expensive to operate and more robust.

Almost every argument I have on HN with blockchain skeptics boils down to the skeptic pointing out that if you unbundle blockchain component X, Y or Z to use it independently from the rest of the blockchain system, it would save money.

Yes, if you extract the PKI and Merkle tree out of the blockchain system, and operate them on your own, it may save you money in terms of infrastructure cost. But then you would have to figure out how to manage the PKI and the Merkle tree. A blockchain gives you both of those things, plus massive replication, high availability and audit-ability built right in, as well as well-defined and decentralized public interfaces that make it easy to interact with the system, and you don't need to manage any of it.

And what's more, the blockchain gives you a built-in way to pay for services rendered by diverse and decentralized set of service providers, without needing to engage with a middleman, or depend on any single service provider.

People complain all the time that AWS is too expensive, and that there are more economical alternatives providing comparable services—but there are still millions of people who are willing to pay Amazon for the convenience. How is that any different than paying a blockchain network for a similar convenience?

Post reply on HN