News for hackers. Stuff that matters.
Re:OpenBazaar 2.0, powered by IPFS by damoonvisuals on Wednesday March 28, 2018 @07:14PM (#16702951)
Hi Sam,

How do you intend to prevent sybil attacks on seller ratings? Since there are no account sign ups and subsequent verifications, it would be theoretically possible to create a large number of accounts with fake reviews.

Re:OpenBazaar 2.0, powered by IPFS by SamPatt on Wednesday March 28, 2018 @07:21PM (#16703001)
The honest answer is that we haven't solved the decentralized reputation problem and reviews can't entirely be trusted.

There are a few factors that still make reviews somewhat useful though. People can choose to attach their name, and if they are reputable then their review matters more than an anon account. Reviews also can only be left when there is a full record of trade having occurred, and funds have moved (verified on the blockchain), so at the very least an attacker is paying cryptocurrency fees for each false rating.

But ultimately there's a lot of work to be done in decentralized reputation. The work of projects like Trust is Risk seems promising (we've supported their efforts):

https://github.com/OrfeasLitos/TrustIsRisk

Re:OpenBazaar 2.0, powered by IPFS by WhitneyLand on Thursday March 29, 2018 @10:17AM (#16707233)
Is anonymity only related to identity, and which parties are involved in a transaction?

Could there be a way to leave identity and parties involved anonymous, yet track count and/or value of transactions without knowing what they were?

If this were possible, some weighting could be assigned to reviews based on count and/or value of transactions, to somewhat combat a review bomber willing to pay for many small transactions. In a sense it would raise the cost of a fake review campaign.

I bet if you gave users the option to have only count and value of their transactions public, in exchange for some sort of “trusted reviewer” status badge, that a significant number would opt in to it, because people like to earn badges and points for reasons more motivating that we intuitively think.

edit: better yet, allow opt in to have your transaction count and value incrementee on a per transaction basis, so you could earn reputation power or not depending on the marketplace or persons dealt with.

side note: I think the “free sub” episode on Seinfeld may have been the first reference to gamification mechanics on television.

Re:OpenBazaar 2.0, powered by IPFS by aomix on Wednesday March 28, 2018 @07:37PM (#16703121)
Why isn't a basic version of proof of work a reasonable approximation of that for the time being? Ex. to provide a review you must also provide a value that when postpended to your review gives a hash containing some properties that scales with the number of reviews. This doesn't solve decentralized reputation at all but does prevent review bombing.
Re:OpenBazaar 2.0, powered by IPFS by SamPatt on Wednesday March 28, 2018 @07:43PM (#16703156)
If the buyer leaves a review after making a purchase, that's effectively a small proof of work in and of itself, and you can only leave one review per purchase.

We haven't seen review bombing attempted yet, but if someone were willing to pay a bunch of fees then I suppose it is possible to do.

Re:OpenBazaar 2.0, powered by IPFS by IncRnd on Wednesday March 28, 2018 @10:58PM (#16704195)
In book publishing an author can purchase copies of their own books in order to increase purchases by others. This effect is actually common in many industries, even in mobile apps :)
Re:OpenBazaar 2.0, powered by IPFS by jcoffland on Thursday March 29, 2018 @04:27AM (#16705445)
So OpenBazaar's no worse than preexisting systems in this respect.
Re:OpenBazaar 2.0, powered by IPFS by hnarn on Thursday March 29, 2018 @05:58AM (#16705795)
It's also borderline an unsolvable problem, because how do you identify "legitimate" customers in an anonymous de-centralized system, when it's even too complicated to achieve in a centralized system?
Re:OpenBazaar 2.0, powered by IPFS by heavenlyblue on Friday March 30, 2018 @06:48AM (#16715086)
Assign a cost of creating a single anonymous identity: you've got to send xx amount of bitcoin to an unspendable address.
Re:OpenBazaar 2.0, powered by IPFS by jononor on Saturday March 31, 2018 @06:37PM (#16725538)
That is somewhat analogous to proof of stake, I guess?
Re:OpenBazaar 2.0, powered by IPFS by nedwin on Thursday March 29, 2018 @01:25AM (#16704688)
And definitely in the record industry
Re:OpenBazaar 2.0, powered by IPFS by tylersmith on Wednesday March 28, 2018 @07:46PM (#16703177)
There is a dichotomy in real cost/benefit ratio for PoW systems as spam control between real users and attackers. Attackers have more to gain from accepting the PoW penalty than users do. There is no difficulty of PoW that would both deter attackers with a financial motive and be reasonable for average users.
Re:OpenBazaar 2.0, powered by IPFS by nosuchthing on Thursday March 29, 2018 @04:58AM (#16705560)
What?

A spammer could easly bypass that with capital/hardware.

Re:OpenBazaar 2.0, powered by IPFS by dmichulke on Thursday March 29, 2018 @05:03AM (#16705575)
Anybody can do anything with enough capital and hardware :-)

The question is always just "Will the cost of fraud exceed the benefits of fraud" and if that is true, no one in his right mind will do it.

Re:OpenBazaar 2.0, powered by IPFS by zaarn on Thursday March 29, 2018 @02:29AM (#16704961)
>gives a hash containing some properties that scales with the number of reviews

That woudl IMO mean that once you have 10k reviews you can scam some customers without worry.

Re:OpenBazaar 2.0, powered by IPFS by ecesena on Wednesday March 28, 2018 @08:23PM (#16703436)
Is there a check that the price in the transaction is (greater or) equal to the price of the product?

Or, can I pay for a product from multiple addresses and leave many reviews?

Edit: typos

Re:OpenBazaar 2.0, powered by IPFS by SamPatt on Wednesday March 28, 2018 @08:30PM (#16703479)
The buyer can only leave one review per purchase, it's not one review per payment.
Re:OpenBazaar 2.0, powered by IPFS by bmelton on Wednesday March 28, 2018 @08:48PM (#16703577)
What is the logical distinction between purchase and payment? How does one know the differences when the transactions are anonymous?
Re:OpenBazaar 2.0, powered by IPFS by SamPatt on Wednesday March 28, 2018 @08:57PM (#16703636)
Each step in the transaction flow appends a new step - digitally signed - into a JSON document that acts as a ledger. So the seller puts out the listing and the buyers signs it and sends the funds. The seller won't proceed with the order until the payment is made in full, so the ledger doesn't get any new information until then. The final step (the review) is the last addition to the ledger.

It's based on the concept of the Ricardian Contract by Ian Grigg, adapted to become a ledger. This allows trade to continue asynchronously.

Re:OpenBazaar 2.0, powered by IPFS by tylersmith on Wednesday March 28, 2018 @08:58PM (#16703639)
Every purchase goes to a unique address. Multiple payments can be made to that address but they constitute a single purchase.