Live data from Hacker News

Response to 'Call for Review: Decentralized Identifiers (DIDs) v1.0'

lists.w3.org

61–66 of 66 posts

Re: Response to 'Call for Review: Decentralized Identifiers (DIDs) v1.0'

#61
post #2

First time I've seen "s12y" (sustainability) and while I'm usually averse to new buzzwords I quite like the association with "i18n" (internationalization) and "a11y" (accessibility). Somehow feels like the trinity of responsible software ("responsible" probably isn't the right word here).

A framework of responsible software isn't complete unless it includes security (s6y?), given the rampant breaches, data theft, and cyber war these days.

Re: Response to 'Call for Review: Decentralized Identifiers (DIDs) v1.0'

#62
post #50
post #46

Earlier quoted context omitted.

1. My point is that you lost me here: > This immediately produces an incentive for both the network to make use of as much computational capacity as possible to keep itself safe, and for any attacker to amass enough computational capacity to mount an attack This seems false to me. Could you elaborate on what incentives you see at play here? On another note, I feel one of the finest design details of Bitcoin is that i…

1. Are we agreed that "securing the network" means "having enough computational power that an attacker cannot out-compute us," and conversely that the security threats that Bitcoin protects against are via attackers out-computing the legitimate network? And that these measurements of computational power are opposed to each other (i.e., if the legitimate participants have more and more computational power, attacks are…

1. I'm not sure we agree on that... Bitcoin doesn't protect against attacks, it provides you with a relatively simple model to measure the cost of attacks.

At equilibrium, any Bitcoin network participant will look for two fundamental things: (a) being able to move their own assets and (b) relative market price stability of their bitcoin. In case of a sustained 50% attack, both properties start to crack, but not completely. But after the attack, they are regained -- (a) immediately, and (b) eventually.

Consider the attacker to be a government, for example, an actor with a relatively high amount of resources, and the Bitcoin participant a dissident citizen of such government. The dissident wouldn't like to have its assets frozen by the government (through strict censorship of the dissident's transactions), so the market value for Bitcoin drops comparatively to how wealthy was the dissident selling its bitcoin savings. But, also, the dissident might avoid selling if they have enough financial capacity to withstand the attack.

In order to carry out such attack, the government needs to increase its energy spending on Bitcoin, up to the point where the attack is successful for a prolonged period of time. Bitcoin production is intrinsically bound to energy generation, thus to its economic realities (variability of demand, climate conditions, political affairs, just to name a few).

It would cost a government X dollars a day, or Y watts a day, every day, minus the price of the coins generated to attack the network. I estimate X to be the total miner rewards: at the time of writing, 38M USD [1]. Y seems to be at around 456 GWh [2]. Is it worth it for your adversary? That number is the dissident's security parameter. As long as their savings are less valuable than the cost of the attack and they can sustain the attack financially, the dissident should be fine (or really scared about an enemy irrationally spending a lot of energy/money with the purpose of just preventing them to access their money temporarily).

In the end both miners and users just want the chain to move forward. If one particular actor or coalition potentially prevents it, users/miners outside the coalition (if they detect it) would raise their investment to continue chugging blocks.

I think there are no "legitimate" vs "attacker" uses of hashing power. It's more about coalitions between miners and how costly/profitable would it be for them to centralize the network, and how hard is it on the other participants to coordinate a decentralized counter-attack (which ends up profiting them). But eventually, the equilibrium between all participants is to spend as little money/energy as possible. And if it's not decentralized it becomes censorable: next, it loses its value: now who's gonna want to mine something worthless?

2. We see it the same way. I'd add that if Bitcoin is staying around (I don't think it can be shut down), one solution is to use Open Timestamps or other hacks that don't require "block real estate", thus in no way compete with transactions, essentially piggybacking the PoW and getting the timestamp for free.

[1] first result I got for "block rewards Bitcoin last 24 hours": https://bitinfocharts.com/bitcoin/

[2] first result for "24 hour bitcoin consumption watts": https://digiconomist.net/bitcoin-energy-consumption

Re: Response to 'Call for Review: Decentralized Identifiers (DIDs) v1.0'

#63
post #2

First time I've seen "s12y" (sustainability) and while I'm usually averse to new buzzwords I quite like the association with "i18n" (internationalization) and "a11y" (accessibility). Somehow feels like the trinity of responsible software ("responsible" probably isn't the right word here).

A framework of responsible software isn't complete unless it includes security (s6y?), given the rampant breaches, data theft, and cyber war these days.

I disagree. Responsible software is something opted into. As engineers, security should be a requirement. It should go without saying.

I agree with you, I just don't think your stance is radical enough :D

Re: Response to 'Call for Review: Decentralized Identifiers (DIDs) v1.0'

#64
post #51

Earlier quoted context omitted.

From https://www.w3.org/TR/did-core/#design-goals Decentralization | Eliminate the requirement for centralized authorities or single point failure in identifier management, including the registration of globally unique identifiers, public verification keys, services, and other information. Control | Give entities, both human and non-human, the power to directly control their digital identifiers without the need to re…

> In short, if the large platforms like Facebook, Google, Apple, Microsoft et al started using DIDs, we could start using logins across platforms instead of creating new accounts for each one. Not a chance really. First, DIDs define a method behind resolving data be it use a website, use bitcoin classic, etc. There are over 100 defined, and only "web" and "key" (inlined data in the URI) have achieved interoperability…

First,which DID methods will be successful is a question of time, additional your wallet app could support multiple of these DID methods. Second, DID and the corresponding keys are supposed to be owned by the user or managed by a platform, any indivdual can make the choice whteher he wants convience of managed keys or full privacy under his own control Third, you can have a seperate DID for every service and they issue you an login credential for that particular service.

Re: Response to 'Call for Review: Decentralized Identifiers (DIDs) v1.0'

#65

It's interesting to me the amount of energy people spend on convincing themselves that a technology (POW) that didn't even exist 12 years ago and ran on home PCs up until 7 years ago is somehow responsible for wildfires in California or deforestation in Brazil. DID has little to do with Bitcoin. I don't even know if it's the best option, but clearly the lack of decentralized identity on the web has been significant i…

I don't really like ENS (or any of the blockchain DNS facsimiles) for decentralized identity. ENS doesn't really have a story for verification of socials or other wallets, and there's no way to look up your ENS domain or eth addr from any of those other identities stored as records on an ENS domain.

Ceramic[0] (a sort of mutability layer on top of IPFS) solves this off-chain by using your crypto wallet to authenticate a DID (their DIDs are known as 3id[1]) which can have a list of socials and crypto wallets associated with them (using their IDX[2] system and the schemas called alsoKnownAs[3] and cryptoAccounts[4], respectively), and the validations are made possible by systems called IdentityLink[5] (verifies similar to Keybase) and Caip10Link[6] (sign a message with your wallet) (respectively). The Caip10Link also allows reverse lookup of a DID from a blockchain address. A reference implementation of these systems in action can be found at https://self.id/ .

Grain of salt: I'm working on a project that makes heavy use of Ceramic.

[0] https://developers.ceramic.network/learn/advanced/overview/ [1] https://github.com/ceramicstudio/js-3id-did-provider [2] https://developers.idx.xyz/learn/overview/ [3] https://github.com/ceramicstudio/datamodels/tree/main/packag... [4] https://github.com/ceramicstudio/datamodels/tree/main/packag... [5] https://developers.ceramic.network/tools/identitylink/overvi... [6] https://developers.ceramic.network/streamtypes/caip-10-link/...

Re: Response to 'Call for Review: Decentralized Identifiers (DIDs) v1.0'

#66
post #29
post #19

Earlier quoted context omitted.

> It's interesting to me the amount of energy people spend on convincing themselves that a technology (POW) that didn't even exist 12 years ago and ran on home PCs up until 7 years ago is somehow responsible for wildfires in California or deforestation in Brazil. I'm not sure why years of time matters. Rapid growth is extremely common in technology. How much time did you need to spend convincing yourself that a micro…

There's a non-sequitour in your depiction of an attack. Gaining 50% of hashing power is not that interesting unless you really want to prevent someone from using their Bitcoin. And you can only prevent them from using it while your attack is sustained. When someone has gained ~50% of the hashing power, they only can do a small number of attacks [1], that are only profitable under external conditions, and even then, e…

Which is why, almost tautologically, it doesn't matter the power expense of blocks or even individual transactions.

If a micro-coin becomes possibly promising, someone will dump 12gW into it a year until the consumption matches it's appreciation. May as well have the work be useful or artificially difficult for good or better reasons.

Post reply on HN