98
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 26 Jul 2023
98 points (94.5% liked)
No Stupid Questions
34331 readers
1255 users here now
No such thing. Ask away!
!nostupidquestions is a community dedicated to being helpful and answering each others' questions on various topics.
The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:
Rules (interactive)
Rule 1- All posts must be legitimate questions. All post titles must include a question.
All posts must be legitimate questions, and all post titles must include a question. Questions that are joke or trolling questions, memes, song lyrics as title, etc. are not allowed here. See Rule 6 for all exceptions.
Rule 2- Your question subject cannot be illegal or NSFW material.
Your question subject cannot be illegal or NSFW material. You will be warned first, banned second.
Rule 3- Do not seek mental, medical and professional help here.
Do not seek mental, medical and professional help here. Breaking this rule will not get you or your post removed, but it will put you at risk, and possibly in danger.
Rule 4- No self promotion or upvote-farming of any kind.
That's it.
Rule 5- No baiting or sealioning or promoting an agenda.
Questions which, instead of being of an innocuous nature, are specifically intended (based on reports and in the opinion of our crack moderation team) to bait users into ideological wars on charged political topics will be removed and the authors warned - or banned - depending on severity.
Rule 6- Regarding META posts and joke questions.
Provided it is about the community itself, you may post non-question posts using the [META] tag on your post title.
On fridays, you are allowed to post meme and troll questions, on the condition that it's in text format only, and conforms with our other rules. These posts MUST include the [NSQ Friday] tag in their title.
If you post a serious question on friday and are looking only for legitimate answers, then please include the [Serious] tag on your post. Irrelevant replies will then be removed by moderators.
Rule 7- You can't intentionally annoy, mock, or harass other members.
If you intentionally annoy, mock, harass, or discriminate against any individual member, you will be removed.
Likewise, if you are a member, sympathiser or a resemblant of a movement that is known to largely hate, mock, discriminate against, and/or want to take lives of a group of people, and you were provably vocal about your hate, then you will be banned on sight.
Rule 8- All comments should try to stay relevant to their parent content.
Rule 9- Reposts from other platforms are not allowed.
Let everyone have their own content.
Rule 10- Majority of bots aren't allowed to participate here.
Credits
Our breathtaking icon was bestowed upon us by @Cevilia!
The greatest banner of all time: by @TheOneWithTheHair!
founded 1 year ago
MODERATORS
The value is in the forward signed, immutable ledger written by neutral consensus. This can take a lot of form and be the backbone of many types of applications (and already is used by large firms), the current market for direct public ledgers is a mess and I don't generally agree with much of the last craze beyond the fundamentals needed to manage transfers, ownership and executions. The applications that will use these kinds of networks haven't really been built yet.
Any sources in large firms using it? I haven’t seen anything other than generic marketing talk.
I can say of the top of my head the JPM and AMEX are running internal ledgers but there are many more, IBM and Accenture co-developed a system called Hyperledger which was given to the Linux Foundation. Its a tool kit for developing and deploying ledger applications primarily targeted at internal corps.
One of the cases these are good for is an easier to manage rights and asset control systems than many products you would pay more for and with less futzing with IAM, LADP or AD.
Hyperledger is a private “blockchain”. I write blockchain in quotes because it’s not really a blockchain. There’s not really a distributed consensus in a private “blockchain”. It’s like taking the concept blockchain, and strips not only down the bad parts but also all the good parts.
Sure, there are multiple actors signing each entry, but who has elected these actors? A central authority of course!
It’s decentralised in the same way a git repo is decentralised. Mostly because Hyperledger is basically a git repo.
Most of the times when a company says they’re using blockchain, they’re either:
A private blockchain is no more than a spicy linked list
I think we are grasping for new words here really, its only been in the last few years orgs have been exploring actual deployments internally.
I do have a very reductive definition of "blockchain" as I believe it is what it says. what is considered "satoshi's vision" includes a blockchain system but it does not define the word.
HL is a blank canvas that allows you to deploy whatever consensus you want including those commonly found in public chains, it is entirely possible to run a hyperledger instance that is compatible with any network you would like, presuming you would want that effort.
These sound more like publicity stunts than anything else. There isn't really much value in running a private Blockchain. At that point it lost all value a Blockchain would provide. Who are you protecting yourself against?
You don't need a distributed untrusted consensus algo for internal ledgers. That's trusted parties only.
for the most part yes, there are interesting regulatory scenarios that are on idea boards, mostly they want the secure write and a form of DiD being provided. these system provide some interesting legal scenarios with regards to accounting for assets in escrow on behalf of clients. In one form they are liabilities, in another, they are technically under the customers control.
But what value does Blockchain bring to the table here that other technologies wouldn't?
I have Excel spreadsheets at home though and you can be assured that they haven't changed if you take a hash of them.
In fact, taking cryptographic hashes and signatures of people is automatic with Adobe signature products, and is how I signed for my house mortgage. You know, things that people really don't want changing or someone doing shenanigans with. Just a click here and a send the .pdf over and... yeah, its not that hard in practice.
Signed, immutable proof of the transaction that nobody can manipulate. It also doesn't require a legion of ASICs hashing numbers until the end of time. Because your "blockchain" is vulnerable to the 51% attack if the hashrate ever declines precipitously.
This is true, the fundamental of a blockchain is simply signed blocks of binary data. We can get into the debates on weather this can work in a public system like many groups are trying now, though I presume that that is not really what the poster is talking about since most public chains fundamentally rely on thier cryptocurrencies to to function, which for some is an argument as to why they can't work.
My cryptographically signed .pdf for my mortgage document requires no cryptocoin or "blockchain" to function.
Its just simple hashing and signatures. You know, standard cryptography. The thing that allows "HTTPS" connections? The thing that signs your credit-card each time you enter it into Amazon? The thing that signs your password as you type it into the password field?
Yeah, that's cryptography. Not "cryptocoins" or "blockchain", its just a cryptographic hash, signature, or encryption.
if you just keep your document on your machine and only use it for personal encryption sure. its a key exchange network, this is for when bob and alice want to talk, not look at something in the safe and put it back. distributed PKI has been a challenge for decades, im not sure about this current incarnation of public systems but I find a lot of promise in many other applications.
I'm not sure if you fully understand what I'm talking about.
https://www.docusign.com/solutions/industries/mortgage
I'm talking about real world business. I'm not getting a $300,000 mortgage leaving a pdf on my personal computer. I'm talking about real world applications here.
Yeahhhh.... no. Its point-and-click these days. Most people don't even realize they're utilizing PKI to handle typical business transactions. It literally "just works", click click boom. It happened, and is legally binding, happens hundreds-of-thousands of times a day across this country and is perfectly functioning cryptography.
so if you are looking at this its a question to trust scopes, at least in public systems. here you are trusting:
the proposal for a decentralized ledger with neutral execution is that the only "trust" needed is that in the contracts function, however this is not entirely true, in reality you are shifting trust to:
some people feel this is a better way of doing things, ive found it interesting to work in the space technically but I dont necessarily agree with the wildwest nature of the public systems and am more an advocate of regulated channels if these are going to be done at all. There is also the idea that a large enough network makes it possible for the network to handle larger loads than any individual processor could handle, this has borne out in some cases though its not perfect since we know P2P network instability tends to ripple through a network.
Finally if an application has been built with web3 practices enshrined its entirely possible to ensure service continuity even in the event of the provider failing financially and being unable to serve the users. Important to note this is RARELY done properly and I have only seen a couple cases where it worked so far.
If we are talking the internal org, like docusign itself, an org like might adopt a ledger based system for the in-built capabilities of some chains, you find quickly that enterprise grade cryptographic tracking of large scales of assets or process gets VERY expensive. Ledgers can be very helpful in these cases though are more a consideration when validating a new system rather than it being an impetus to upgrade in and of itself.
I often refer to it as a specialized app-server stack to clients.
And... where does FTX and Celsius come into the mix? Because in practice, that's where people lose $8 Billion overnight.
Cryptocoin folk pretend they got this "trust" issue figured out, when in actuality, they just technobabble fake words and pretend that I haven't taken a cryptography class in college. Guess what? I know what a hash is, I know how PKI works and I can implement BTC or Monero.
Just because Cryptocoin community is ignorant of very trivial hacks (ex: a hardware wallet using a shitty RNG which would leak the private-key), and is ignorant of how they are unable to trust even the most basic of operations in their house of cards doesn't mean anything. (Are you sure that your hardware wallet generates real, random numbers? And not a pre-made list of ~1-billion, easily hacked wallets?)
Cryptocoin fans can't even solve the hardware wallet trust problem, let alone any other trust issue going on in their little world.
That's a different conversation isn't it? shifting from technical capabilities to what people do with them, we have a number of technologies in society that deal with this issue. Important to note that every form of messaging and storage tech ever conceived has likely or is capable of facilitating large scale fraud.
I understand wanting to point the anger, as someone who sat this tech out until I saw the govt take it seriously, I'd say collectively every government and municipality slept on this, which surprises me, I expected this to get killed long before it capped at 2T in value.
Also important to note that cryptocurrency technology was not central to the failure of these orgs as the vast majority of thier holdings never left the exchange. They bascially setup shop claiming to have the tulips everyone was raging for in full warehouses when they didn't even have seeds. I'm angry at the abject greed as well, however if we apply the current thinking im seeing toward crypto tech as it would logically extend, get ready to throw out all the tech in your house, a surprising amount of it can be used to manipulate and defraud you. Most of FTX's messaging went out over traditional communication channels, controlled by our governments and endorsed by broadcasters.
You're saying a lot of words and not addressing the hardware cryptocoin wallet problem I outlined above.
Lets focus on that. How do you know that a hardware cryptocoin wallet truly emits random numbers that aren't being hacked? The trust problem in this cryptocoin world is horribly, horribly unsolved despite 15+ years.
That's why these scams keep coming up. Because the "oh just trust the cryptocoin" approach doesn't work. You need to think from the perspective of a security researcher.
you are talking to someone whos been doing cryptography since the 90s, the answer hasn't changed since then, you cant. the ONLY was you can be sure is with old school means or controlling your own lithography system.
most people just pick what level of trust/control/effort they are most comfortable with and go with that. the more your life ends up under these keys the more youll want to move to physical storage, multiple cold wallets, etc etc.
This usability nightmare is part of whats hurt crypto's adoption imo.
Why are insecure devices allowed to be sold? I don't know, why do we let comcast sell routers with known firmware vulnerabilities that gets a large chunk of them infected with malware? Why do we only deal with dangerous things after they become dangerous and hurt people, esp when the danger is so damn obvious? I don't know.
Is there a hardware wallet I like that I believe is secure? No
Do i use them? Well of course, insurance companies love them...sigh.
Do I use them for my personal stuff? No, the vast majority of my holdings are stored in physical cold wallets.
So we can't trust hardware wallets then. Isn't that... a problem? Something that needs to be solved?
This is pretty fundamental to the entirety of blockchain. If we can't trust that Alice is truly Alice, then where the hell is everything else built on top of this crap?
Why do you trust that cold wallet? Are you sure they didn't leak the key somehow? We've already established that there's no trust or reason to trust them.
If I were a cryptocoin blackhat, I'd sell a bunch of broken RNGs to the idiotic cold-wallet people and slowly steal money from them over the next 20 years. Its like the easiest steal ever, the entire crytpocoin community is completely blind to how fucking stupid they are.
Are you sure that those people who think they've "forgotten their passphrase" really forgot their passphrase? What if its the cold-wallet that betrayed them?
yup, huge one, something I have sat across the table from the engineers of some of the leading hardware wallet companies and asking them to address. so far what I see are a bunch of companies lining up to say "trust me bro", I look forward to better options though I suspect that no matter how you cut it, due to people wanting convince it will still be you trusting someone, its just a question of how tight your grip on thier throat is. or you go techno-hermit and build your own kit if you really need something digital.
Its a physical set of steel discs with the key encoded on them, locked in a safe with a copy locked in an off-location safe. they leak about as much as one might expect things in your safe might leak. do you control these places? I often think about systems like this looking top provide tiers of control and ownership, you own your accounts legally, physically AND technically. a data breech at a bank using this system drains only the banks accounts, yours are fine (assuming a correct fail-safe desgin)
You should get on that, I'm sure it will work really well, you realize there have been people working on satoshi's cold wallets for over a decade? When this cryptography breaks it will be an advance in quantum tech and we will all be boned.
Wow, a band of rng guessing thieves only targeting wallets that have been lost by those who would reasonably believe they forgot or lost access to thier key, this sounds like a script hollywood will need in its new AI future!
hmac(passphrase, "one") -> seed used to create the private key.
Its so god damn simple man. Passphrase is the key. Standardize the solution so that when Hmac(passphrase, 'one') emits the same private key on two separate devices, we know that their code is legitimate. Run tests on commercial solutions to make sure they emit the standard answer to a set of publicly known private-keys (as well as a few personal tests to ensure it works on your end) and bam, problem solved.
You're telling me that all the best cryptocoin wallet peeps can't come up with a college-textbook answer like that?
As other keys are needed, use hmac(passphrase, "two") and hmac(passphrase, "three"), etc. etc.
No. The answer is that no one is really trying to solve the info-sec issue with regards to cryptocoin. Its just a money game to them. There's elementary / college-level solutions that are in the front of any textbook (or maybe left as an exercise, that you'd find at the back of the book / answer key).
When the level of cryptography knowledge is this primitive, I know that the entire damn community ain't serious about it and I shouldn't waste my time with them.
thats how it works, im not sure what you are getting at?
Oh really, wallet hardware companies are publishing the hmac and algorithm used to go from passphrase to private key?
Care to post one?
there are opensource wallets, the standard is called BIP39
im not sure if any of the hardware providers are doing it though
im still not sure what you are getting at, if you are suggesting I somehow trust hardware cold wallet providers, I dont, does not mean Im not stuck using the tools.
I'm saying there's an obvious solution to anyone who has passed a cryptography 101 course here.
PKI private keys are randomly generated prime numbers and/or ellipitcal curve numbers (depending on algorithm). Either way, that random number generator needs a seed, and that seed can be based off of the passphrase. BIP39 isn't the whole solution, that's just a way to turn long-strings of alpha-numeric characters into binary data.
My overall point is that there's a blatantly obvious, simple solution to the hardware wallet problem. I brought it up because its not a hard crypto-problem to solve. The fact that there's no adequate solution in 15 years is a failure of the cryptocoin community. Not due to a failure of basic cryptography problems.
The cryptocoin community, despite using "cryptography" is a joke. They barely know how to use cryptography even at its most elementary levels. It takes 15 years to come up with crappy, untrusted hardware wallets and they still can't open a basic textbook to come up with a better solution that's already written down.
the issue with the hardware wallet is not a "simple math" problem but a "trust" issue. in reality you simply can't trust any hardware you didn't make yourself, in practical use we usually pick vendors we like and decide to trust them.
for example. many people considered ledger trustworthy until they introduced firmware that indicates a capability to exfiltrate the keys.
I think the problem you are speaking to was some older hardware keys (and maybe some strange off brands) that encode keys at the factory, to my knowledge no major product does anything like that and they take pains to show you are generating the key. the big back and forth there has been with hardware providers using methods that are potentially reversible or other types of vulnerabilities.
Yes pretty much all devices will allow you to import a key you have generated by whatever means you prefer, however once you put it on the device you are signing up for the other issues that come with hardware still.
I don't think you recognize how easy it is to generate trust with the methodology I laid out.
"The Standard-compliant" method is any algorithm that goes from hmac(passphrase) into seed -> generating the random numbers needed to build a wallet. (Prime numbers or whatever). As far as I can tell, this "standard method" doesn't exist, not yet anyway.
Issue has been the workflow for that, everyone wants something that works with thier phone and self-updates. Also have only seen a couple good air-gapped signers. No one likes the offline signer story except finance governance ppl so far.
Explain like I'm five?
sorry, gpt said i could do better
A blockchain is like a special notebook that many people can write in. Once something is written, it cannot be changed, and everyone can check that it was written correctly. This notebook help different people or companies work together by writing down and sharing important information in a safe and secure way.
Some people use these special notebooks to make digital money like Bitcoin. But it's just way to use them. Companies also use these notebooks for other things, like making sure their business runs smoothly and securely.
So, the blockchain is not just about digital money, but also a to help people and businesses work together safely and fairly.
Thank you very much!
https://lemmy.intai.tech/comment/578972
You can also look in my post history, ask away, I'm no fan of where public systems have gone and understand the anger, point is, these techs ARE being used already in corp systems and even if you dont use this crop of chains, you will likely be using a system like this in the future, even if you dont know it.
That's a lot of words to say nothing. Like, you literally aren't saying anything of substance.
All of that is word salad. Blockchain is 100% redundant technology that uses obscene amounts of electricity. Why do I need a network of computers around the globe to make sure a contract and checks get signed? Why does it require a global network of computers constantly refreshing themselves and checking for inconsistencies to implement new business? If the smartest minds on Earth actually can't come up with a use case, then it's trash.
Grifters love it.
Blockchains don't inherently need obscene amount of erlectriciy
Proof of work mechanism does. There's lots of other consensus mechanism that don't.
Forward signed, immutable ledger - a dataset that is written and logged at time of write and validated using cryptographic signatures of the creator of that data and the node of the network responsible for the data. public systems use incentive systems to ensure unbiased writes, private systems work more like your typical app server.
neutral consensus - this is the p2p aspect, this is a bunch of unrelated actors promising to work toward an unrelated goal, in public systems this is done via some form of game theory, in private systems orgs working together have contract law and are more interested in the the controlled writing.
How it can take a lot of forms. Most people are just familiar with what the general public refers to as cryptocurrency. These are ledgers managed on p2p networks with the aforementioned game theory based consensus system. However ledgers are not required to do this, a ledger and even a blockchain can work without fees or even energy wasting miners, in these cases its usually the cryptographic write and channel messaging they want (some of these are a step up from AWS's messaging stack).
Ledgers like this are used in many ways and used in large orgs around the world, what the public is angry at and what the technology is are very different things.
I hope I have "unsaladed things" for you
Blockchains come in many forms, the ones you are thinking of are what are called Proof of Work chains, these uses a kind of cryptographic race to secure thier data and use a TON of waste energy as a result. Def not a fan either.
The growing popularity and interest in chains is around forms of Proof Of Stake, these use other internal protocol mechanisms to secure the network and work to run the cryptographic functions as efficiently as possible. Unsurprisingly the fastest blockchains are proof of stake and power wise are similar to traditional applications in utilization.
You don't need any of these networks if you don't want to use them, fundamentally, they arent even networks, they are cryptographic messaging systems. How the data is sent and processed is incidental, you could work out a bitcoin block on pen and paper if you wanted. This concept has extended to a cryptographic tool called Zero Knowledge Proofs, these will be part of next generation identity verification systems and is a fundamental of the W3C standard around DiD, the whole point is for disconnected attestation.
Maybe this is my “too old for this shit” moment, but this all just sounds like convoluted non-sense that’s never going to go anywhere. We still have SMS and ATMs that run XP.
surprisingly small hardware is needed to sign a message. though I do agree that we are still a bit early for workable end-user use cases. People really dont care what the database or app server is, they just want it to work and raw dogging some public node is just a bit much for people, i dont blame them.
more packaged solutions are under development, these will be more like a proper application with the differences of a chain being abstracted by the provider
things like sms, what if i told you SMS would be fine with this, so would smoke signals
I think the problem I have with it is the online enthusiasm for it is acting like it’s already going to change my life yet it’s been more than a decade and no one has shown tangible and understandable utility, just marketing bs and grifting.
But we're still early lol
Yea I’ve been hearing that for a decade. Aside from missing out on bitcoin at $300, I’m still waiting. 🤷♂️
i think there was a lot of hope among some at the public systems, no clue if it will bear out, the tech however is a viable PKI distro strategy that has been proven to work already in multiple large orgs in different forms. We don't talk about how expensive or difficult it is to control your own PKI. Its one of the key reasons why you have to yield so much data and control to providers.
I could go on a long rant about what the internet was built to be vs what "big tech" has perverted it into, using p2p technologies to do it then saying "i dont see what the point is for people to have versions of this for themselves rather than it being only in the hands of big corps controlled by share holders" but thats about as far as Ill go.
as for private systems, this stuff is already starting to rule your world. distributed PKI systems in enterprise require expensive and technically onerous trust ceremonies for each cross system connection. you also require functioning cert trees from root to tip in order to validate anything in most of these systems (tools like pgp are the exception rather than the rule sadly). These systems are expensive to operate and add another single point of attack to the system. There are already chains doing internal asset management at companies, and its quite likely that any DiD standard that becomes a gov ID will be on a ledger network not that it should matter to end users.
the biggest push with the latest wave of the tech is to stop trying to sell to people, sell to enterprise, the usecases are more solid and don't require strange economic games to function.
You will be using blockchain tech, but if its deployed right. You will never know. Do you know or care what app server or db your provider uses? of course not.
So, if I get it, it's like torrent, except instead of you manually verifying the hash code, each computer your file passes pay automatically checks and says "yup, the file I received and transmitted is the file I was supposed to receive and transmit" ?
pretty much, think of the files like what you would see in your .git folder for a code project. they are all linked together in a history graph. so you are validating the data, its position in history along with its entire history, you also know who changed the data and what systems were responsible for writing those changes. really solid tooling for provenance and chain-of-evidence scenarios.
I see, but if I'm not mistaken, git is anterior to the blockchain. What I'm asking here is what new things the blockchain brings to the table, that preexisting protocols like Git or P2P couldn't do. Or is the blockchain just another application of the same principles (the Merkle chain, as a previous commenter was saying)? If so, what sets it appart ?
I'll refer to one of my earlier responses someone asked about this in context of a process like docusigns'
so if you are looking at this its a question to trust scopes, at least in public systems. here you are trusting:
the proposal for a decentralized ledger with neutral execution is that the only “trust” needed is that in the contracts function, however this is not entirely true, in reality you are shifting trust to:
your ability/resources to asses the contracts function and your counterparties.
some people feel this is a better way of doing things, ive found it interesting to work in the space technically but I dont necessarily agree with the wildwest nature of the public systems and am more an advocate of regulated channels if these are going to be done at all. There is also the idea that a large enough network makes it possible for the network to handle larger loads than any individual processor could handle, this has borne out in some cases though its not perfect since we know P2P network instability tends to ripple through a network.
Finally if an application has been built with web3 practices enshrined its entirely possible to ensure service continuity even in the event of the provider failing financially and being unable to serve the users. Important to note this is RARELY done properly and I have only seen a couple cases where it worked so far. However personally this is one of the most impressive features, I am biased however as I was involved in the recovery of a commons that has turned into a defacto standard. Didn't make anything from it other than consulting feed, just really cool to help a non-profit
If we are talking the internal org, like docusign itself, an org like might adopt a ledger based system for the in-built capabilities of some chains, you find quickly that enterprise grade cryptographic tracking of large scales of assets or process gets VERY expensive. Ledgers can be very helpful in these cases though are more a consideration when validating a new system rather than it being an impetus to upgrade in and of itself.
I often refer to it as a specialized app-server stack to clients.