Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sign Everything

avc.com

Post reply on HN
Print view View original

81–90 of 90 posts

Re: Sign Everything

#81

Post by infotogivenm »

legutierr wrote: post #79
infotogivenm wrote: post #70

Earlier quoted context omitted.

No blockchain in the world could store the hash of every post ever in a “retrievable way”. Even Elon understands this. The valid ideas that apply here are global labeling and account subkey ordering. I have never seen a solution for either that is end-to-end without a client syncing gigs of data, so various intermediaries are always trusted. In practice a federated (“permissioned” I suppose) audit log is better, chea…

> No blockchain in the world could store the hash of every post ever in a “retrievable way”. Ethereum processes about 1MM transactions per day right now; other blockchains have higher throughput. It currently manages about 100MM accounts. Sure, I suppose that might not be enough to hash and sign all blog posts ever (has anyone ever counted?) but you could timestamp a lot of them. > In practice a federated (“permissio…

This is not my understanding at all. Blockchains (speaking broadly) are based on an incentive economy which often historically struggles to support itself via its own transaction volume.

What happens when a coin is no longer profitably mined, e.g. if no one wants to buy them? What happens if, one day, there is no node that feels like serving your request? The data is gone. All gone. There is no system that guarantees redundancy, just upload and pray that the economy sustains itself.

I can appreciate this is much less of a problem for the more popular chains, but in any case, there are wayyy more than 1M tweets a day.

Re: Sign Everything

#82

Post by acdha »

legutierr wrote: post #80
acdha wrote: post #71

Earlier quoted context omitted.

So would basic PKI or a Merkle tree, but those would be orders of magnitude less expensive to operate and more robust. For example, how many posts a day does Reddit have? It’s far from the biggest social network but would swamp any public blockchain, and none of that is necessary since you’re really just looking for a third-party to say “we verified signature X at time Y” (they’re not vouching for the content). Feder…

> So would basic PKI or a Merkle tree, but those would be orders of magnitude less expensive to operate and more robust. Almost every argument I have on HN with blockchain skeptics boils down to the skeptic pointing out that if you unbundle blockchain component X, Y or Z to use it independently from the rest of the blockchain system, it would save money. Yes, if you extract the PKI and Merkle tree out of the blockcha…

It comes back to how well you understand the system design. The major public blockchains impose massive penalties on the people using them because they’re trying to avoid things like trusted third parties. That’s an interesting problem from a CS perspective but it’s not a problem most people have or one which blockchains solve in scenarios where not everything is on the blockchain.

That matters because the costs of transactions are much higher, overall system performance is much lower, and reliability is lower. You can no longer operate offline, maintaining your own nodes becomes expensive, and that extra infrastructure isn’t buying you things which most applications need.

Going back to the AWS question, if I need immutability I can use QLDB to log my transactions. It’s cheaper, scales really well, has excellent support, and I’ll never have a business operation fail because some grifter is minting a bunch of NFTs and temporarily overloaded the network (Solana) or made it unaffordable (Ethereum). There are very few businesses where it’s not a better deal to go with a more predictable system based on your existing legal relationships, especially when it’s also the cheaper and safer option.

Re: Sign Everything

#83

Post by legutierr »

infotogivenm wrote: post #81
legutierr wrote: post #79

Earlier quoted context omitted.

> No blockchain in the world could store the hash of every post ever in a “retrievable way”. Ethereum processes about 1MM transactions per day right now; other blockchains have higher throughput. It currently manages about 100MM accounts. Sure, I suppose that might not be enough to hash and sign all blog posts ever (has anyone ever counted?) but you could timestamp a lot of them. > In practice a federated (“permissio…

This is not my understanding at all. Blockchains (speaking broadly) are based on an incentive economy which often historically struggles to support itself via its own transaction volume. What happens when a coin is no longer profitably mined, e.g. if no one wants to buy them? What happens if, one day, there is no node that feels like serving your request? The data is gone. All gone. There is no system that guarantees…

> What happens if, one day, there is no node that feels like serving your request? The data is gone. All gone.

One stated objective of the Ethereum project is to ensure that a whole blockchain node can run on a consumer PC. This does limit how much data can be stored, but it also means that if you yourself are interested in keeping a copy of the data, you can run a node yourself.

As it currently stands, there are tens of thousands of identical copies of the Ethereum blockchain that are distributed around the world. It seems very unlikely that the data will disappear within our lifetimes.

> There is no system that guarantees redundancy, just upload and pray that the economy sustains itself.

I don't know if there are any guarantees in life, but the ongoing availability of Bitcoin and Ethereum blockchain data seem to be as close to it as you can get, given how many copies are already out there, and the ongoing incentive that exists to keep them up-to-date.

Do you really trust, say, Google Cloud (or any Google product) to last as long, given their history of shutting things down arbitrarily?

Even AWS's services are subject to prioritization decisions made inside Amazon. How can you really know whether or not the service you depend on is profitable enough to ensure that it won't be discontinued? Or that some corporate VP whose bonus depends on the success of a competing product won't make it his mission to shut your service down?

> I can appreciate this is much less of a problem for the more popular chains, but in any case, there are wayyy more than 1M tweets a day.

You can't run a service like Twitter on Ethereum, but you can timestamp more valuable content that is generated at a lower volume. A specialized Layer 2 application chain that runs on top of Ethereum could conceivably be built to handle larger volumes at lower cost, however.

Re: Sign Everything

#84

Post by [deleted] »

acdha wrote: post #82
legutierr wrote: post #80

Earlier quoted context omitted.

> So would basic PKI or a Merkle tree, but those would be orders of magnitude less expensive to operate and more robust. Almost every argument I have on HN with blockchain skeptics boils down to the skeptic pointing out that if you unbundle blockchain component X, Y or Z to use it independently from the rest of the blockchain system, it would save money. Yes, if you extract the PKI and Merkle tree out of the blockcha…

It comes back to how well you understand the system design. The major public blockchains impose massive penalties on the people using them because they’re trying to avoid things like trusted third parties. That’s an interesting problem from a CS perspective but it’s not a problem most people have or one which blockchains solve in scenarios where not everything is on the blockchain. That matters because the costs of t…

[deleted]

Re: Sign Everything

#85

Post by alkonaut »

acdha wrote: post #73
alkonaut wrote: post #49

Earlier quoted context omitted.

> Machines will simply start pretending to be human and sign everything themselves The signature has to be trusted though. Just signing it with a signature that has no meaning to me doesn't change anything apart from perhaps proving it has the same origin as something else. The key function is the humanness or repotuation/trust score of the signature. If I read something signed by my uncle with a key we recently exch…

> > nothing prevents a person from taking a ChatGPT output and putting their own, human, signature on it. > That would make me lower my trust of that author. I think this is the key: the signatures don't provide much value until we have a good reputation database, perhaps systems of trust networks where my uncles' neighbor is automatically slightly more trusted because I trust my uncle. That would be a useful system.…

Yes, I mean the trust of a friend-of-a-friend will never be as high as your trust in an immediate friend. So the trust networks I think will be small and brittle. Basically: you'll read content from a few people in a very carefully gardened group (Although it can contain things like media outlets etc), and as soon as you try to step outside that, you'll be knee deep in spam and generated nonsense.

Re: Sign Everything

#86

Post by alkonaut »

phoe-krk wrote: post #51
alkonaut wrote: post #49

Earlier quoted context omitted.

> Machines will simply start pretending to be human and sign everything themselves The signature has to be trusted though. Just signing it with a signature that has no meaning to me doesn't change anything apart from perhaps proving it has the same origin as something else. The key function is the humanness or repotuation/trust score of the signature. If I read something signed by my uncle with a key we recently exch…

> That would make me lower my trust of that author. Would it? How would you tell? How can you prove that a piece of text was not written by an artificial intelligence? > (likely because the author is human) I think that's the real problem we're facing right now - humans are no longer the only plausibly intelligent beings on the planet, to the point where the meme-ish line between artificial intelligence and natural s…

> Would it? How would you tell? How can you prove that a piece of text was not written by an artificial intelligence?

You either read enough of them and attribute enough quality that you don't care that it was. This isn't a system to prove whether strangers are human or not. It's a system to keep track of whether their output is human enough for you to bother reading it. If they write 100 things you think feel human, then you can have some certainty that the 101st thing will feel human. That's all. Won't say anything about whether strangers are human. The key here is "likely" and "whether you'll bother". A Turing-like proof of humannes will be possible for the foreseeable future but the caveat is of course a) you don't have time to do that and b) you don't have access to authors even if you did.

The social friends-and-their-friends trust networks have a vert quick dropoff too. If you trust your uncle to be human and exchange keys in person (and you'd be good at noticing whether his keys were compromised or he started signing off spam as human for $5), you'll likely never trust his neighbor that you never met as much. But perhaps the total "initial score" of an anonymous signature can be significantly higher if they are in a network you trust. This is directly analogous to normal "trust" where you might rather trust your uncles neighbor to babysit than a total stranger, even though you never met them.

Re: Sign Everything

#87

Post by zubairq »

RF_Savage wrote: post #23
zubairq wrote: post #18

I think signing things will become a lot more commonplace. At my workplace we sign code using Metamask to prove that someone made a commit. Allows us to build something like a decentralised Git

Isn't git distributed to begin with? The state is stored on every dev's machine. How does additional signing in addition to what git does deal with storage and keeping a main repository in a known state?

Git is decentralised in the way that you can link together separate git instances, but the git repository itself is stored in a single file structure on your file system. What I am working on is where the repository itself is decentralised and stored on something called IPFS, which is a decentralised storage system

Re: Sign Everything

#89

Post by radicalbyte »

legutierr wrote: post #80
acdha wrote: post #71

Earlier quoted context omitted.

So would basic PKI or a Merkle tree, but those would be orders of magnitude less expensive to operate and more robust. For example, how many posts a day does Reddit have? It’s far from the biggest social network but would swamp any public blockchain, and none of that is necessary since you’re really just looking for a third-party to say “we verified signature X at time Y” (they’re not vouching for the content). Feder…

> So would basic PKI or a Merkle tree, but those would be orders of magnitude less expensive to operate and more robust. Almost every argument I have on HN with blockchain skeptics boils down to the skeptic pointing out that if you unbundle blockchain component X, Y or Z to use it independently from the rest of the blockchain system, it would save money. Yes, if you extract the PKI and Merkle tree out of the blockcha…

I see it the other way around: blockchain people are desperately looking for a problem for their solution. If you ignore how the real world (and thus Governance) works and squint a bit then yes, you have a "killer app" for blockchain which isn't scamming people.

The thing is when you compare your problem to a range of solutions you almost always discover that blockchain isn't even close to usable.

Re: Sign Everything

#90

Post by yencabulator »

legutierr wrote: post #44
radicalbyte wrote: post #34

Earlier quoted context omitted.

There is absolutely 0 need to use a blockchain to sign something :facepalm:

Sure, you don't need a blockchain to sign something, but using a blockchain means that the signature is timestamped in an incontestable way, massively replicated and made globally retrievable. It also helps mitigate the possibility that the content will be deleted or suppressed.

You don't need a blockchain for getting a signature timestamped. https://blog.cloudflare.com/roughtime/

Massive replication is cheaper and easier without a blockchain.

Post reply on HN