News for hackers. Stuff that matters.
Re:Becoming a blockchain developer by joncrane on Monday February 10, 2020 @07:39AM (#22288556)
I thought with the wave of fraudulent ICOs and zero regulation in the industry that Blockchain-related technologies were like Kryptonite to legitimate developers.

Blockchain in and of itself is separate from Cryptocurrency, though many people use them interchangeably, but what are some of the real-world use cases for a shared trust model? International escrow payments?

Re:Becoming a blockchain developer by RL_Quine on Monday February 10, 2020 @07:45AM (#22288590)
There is literally zero application or real world usage for "blockchain" outside of currency. Anybody claiming otherwise is a deceiving you, or being deceived themselves.

There's this thing where there's swathes of people running around calling themselves "blockchain developers", or people wanting a "blockchain engineer", but basically nobody can describe what this actually entails. What happens in reality is that you make a bunch of handwavey statements about how this can be done better with a block chain, make a proof of concept in whatever the most hipster language that looks sort of interesting, but has nothing at all under the hood, and then move on.

For "blockchain" to be applicable, you have to acknowledge that you've no other solution to trust or maintainability than to use the most expensive key value store in-existence, with huge limitations, probabilistic integrity, and immense developmental and operational cost. When you hear of some large company replacing all of their infrastructure for tracking packages or whatever with "the blockchain", you should interpret this as an admission that they can't run a copy of postgresql safety and are looking for a hyped up brogrammer to make something flashy sounding instead.

Re:Becoming a blockchain developer by mopsi on Monday February 10, 2020 @02:04PM (#22292104)
> There is literally zero application or real world usage for "blockchain" outside of currency.

Blockchain tech is already being used to secure logs of enterprise services. GE Predix platform, with blockchain-based integrity provided by Ericsson, is a notable example: https://www.ericsson.com/en/press-releases/2017/5/ericsson-l...

Re:Becoming a blockchain developer by lawn on Monday February 10, 2020 @07:55AM (#22288657)
I share your detest of the "blockchain", but there are some real world non-currency usage.

Consider a decentralized timestamping service for example. That's useful if you want to anonymously disclose a critical bug, but want the ability to prove you had knowledge beforehand (and thereby proving you were the one who disclosed it).

Re:Becoming a blockchain developer by RL_Quine on Monday February 10, 2020 @08:03AM (#22288714)
Timestamp proofs are interesting but a little hard to find a solid use for in that context. Most people are very happy trusting a post on a mailing list, or even the standard at this point for security researchers is a hash of your disclosure on twitter or IRC. It almost never needs to be cryptographic proof, only social.

They also have a significant issue in that they are non-exclusive. Imagine I timestamp the following messages.

    for i in {1..999999}:
     print "on the 21st of Feb 2022 the Bitcoin price will be exactly $i"
By revealing only a single proof of the possible million, I can prove once and for all that I have complete foresight, and you can't ever prove that I didn't make that prediction. Lots of these things have not entirely obvious issues like that. posting a million hashes on Twitter might raise some eyebrows, posting a million lines on IRC will get me K-lined. I have actually timestamped all of those messages though.
Re:Becoming a blockchain developer by lawn on Monday February 10, 2020 @08:59AM (#22289119)
It's not foolproof of course, and it might be overkill for many, but consider this example:

You've found one of the most catastrophic bugs in Bitcoin ever, and you know that the developers are extremely skeptical of anything. The community is also divided and full of toxic people who will try to discredit anything you do.

Now, will you be satisfied with just posting a hash on IRC or on the mailing list? Are you sure people won't distrust you from posting on "the wrong IRC channel"?

I would assume you'll want as solid a proof as you can construct. Therefore you'll timestamp your message on the blockchain in addition to posting on social media somewhere.

And exactly this is what awemany did when he discovered CVE-2018–17144, one of the most catastrophic bugs in Bitcoin ever:

https://medium.com/@awemany/600-microseconds-b70f87b0b2a6

Re:Becoming a blockchain developer by yori on Monday February 10, 2020 @08:05AM (#22288731)
How about this? Write your bug report. Sign the bug report with your private key. Anonymously publish the bug report, the signature and the public key. Later when required, prove that you wrote the bug report by using your private key to sign a new message or a challenge message sent by any challenger.
Re:Becoming a blockchain developer by lawn on Monday February 10, 2020 @08:42AM (#22288988)
This could work, as long as you trust the ones you file your bug report to. This isn't always the case for white hat hackers who interact with big corporations for example. You also don't always want to disclose the actual vulnerability beforehand to everyone either, to give them time to fix them.

If these things don't hold then you still need to find a trusted way to publish your hash or encrypted message so you can get your timestamp.

Re:Becoming a blockchain developer by RL_Quine on Monday February 10, 2020 @08:07AM (#22288745)
The idea is to replace social proof (that the timestamps are correct wherever it is published) with cryptographic proof, but I commented below on some of the pitfalls of doing so.
Re:Becoming a blockchain developer by yori on Monday February 10, 2020 @08:17AM (#22288814)
I provided a cryptographic proof that does not require blockchain.
Re:Becoming a blockchain developer by RL_Quine on Monday February 10, 2020 @08:47AM (#22289027)
No, yours relies on social proof (the post being public somewhere) as the timestamp. Nothing about what you described is different from just posting a hash of the prediction beforehand.
Re:Becoming a blockchain developer by joosters on Monday February 10, 2020 @08:01AM (#22288707)
Do you even need a blockchain for that? Can't you just encrypt a message detailing your discovery, and publish the result? Then at a later date, you can prove it was you by decrypting the message.
Re:Becoming a blockchain developer by lawn on Monday February 10, 2020 @08:09AM (#22288764)
And how would you prove your encrypted message existed beforehand, and that you didn't just backdate the message after the discovery has been made public?

For that you need to publish your encrypted message that's somehow connected with a timestamp. If you can you might be able to get it included in a journal or a newspaper (which is what Robert Hook did in 1660), or use a trusted third party that verifies your timestamp.

Embedding a hash of your message in the blockchain is another way, which is arguably easier, more secure and trustless.

Re:Becoming a blockchain developer by joosters on Monday February 10, 2020 @08:50AM (#22289045)
As others have said, you could just tweet it (or a hash of it). Or post a video on youtube, or email it to a mailing list, or whatever. There's countless ways to publish information with a timestamp that's very difficult to fake.
Re:Becoming a blockchain developer by leppr on Monday February 10, 2020 @09:46AM (#22289507)
Those are "easily" manipulated if the issue is important enough to someone powerful enough. Sure, you could carpet-bomb and publish your hash on many different platforms under jurisdictions with competing interests, but at this point you've just invented a poor man's blockchains.

Blockchains are the systematization and democratization of that strategy. And those points are what technology is all about.

__

Sure, to write our next shared article we can just have our Word files and call-up each other and exchange paragraphs over WhatsApp. Yet for some reason some people nerd out on unintuitive over-engineered CRDTs. That can't be useful to anyone, can it?

Re:Becoming a blockchain developer by root_axis on Monday February 10, 2020 @12:09PM (#22290955)
> Those are "easily" manipulated if the issue is important enough to someone powerful enough

Perhaps in theory, but in practice it's not really true, especially with regard to the nature of information that is worthwhile to censor; the kind of situation where the powers-that-be would hack twitter to manipulate the timestamp of a hash string are very far-fetched.

Re:Becoming a blockchain developer by lawn on Monday February 10, 2020 @10:05AM (#22289670)
"Very difficult" is context dependent. It might be difficult for you and me to backdate a tweet, but easy for a Twitter employee or a hacker with a 0-day exploit.

You also introduce the risk of your message getting deleted, for whatever reason.

And these ways may also break your anonymity or leak your exploit if you're not careful.

A blockchain backed timestamp is simply better.

Re:Becoming a blockchain developer by throwawayhhakdl on Monday February 10, 2020 @09:09AM (#22289192)
Society has plenty of trust functions. If you can’t rely on them, it’s not unreasonable to think that your blockchain evidence won’t help you either.

Suppose you post your finding generally, then I see it, and post it to the blockchain timestamped as my own. Then you say, “hey, I was first”. The blockchain is bad here because it’s incomplete.

If we mandate that only the blockchain can determine truth, then, if I really want to own that claim, I can hit you with a wrench until I have the private key, and now I am the owner of truth.

Trustless societies suck. We should be trying to increase social trust.

Re:Becoming a blockchain developer by Scarblac on Monday February 10, 2020 @08:53AM (#22289065)
Who would "mine" on that chain, or the equivalent? How could something like that defend against 51% attacks?
Re:Becoming a blockchain developer by lawn on Monday February 10, 2020 @09:12AM (#22289215)
You would embed the hash in another cryptocurrency, like in Bitcoin.

Here's a simple walkthrough of how to do it in the Bitcoin Cash blockchain for instance:

https://whycryptocurrencies.com/timestamping_service.html

Re:Becoming a blockchain developer by Scarblac on Monday February 10, 2020 @10:16AM (#22289774)
So it's an extension of the currency usage, not a blockchain application on its own.
Re:Becoming a blockchain developer by NotASithLord on Monday February 10, 2020 @08:55AM (#22289083)
This may indeed be a valid use case, and Bitcoin fulfills it. You don’t need to build a separate blockchain, you just need to know how to embed a hash into a Bitcoin block and how to point to it which is technically easy.

Also it’s unclear how a separate blockchain with this sole function would work. You need the monetary incentive of bitcoin mining and proof of work to make the security model work so that the time stamp can be trusted. The security of the Bitcoin blockchain is not a computer science problem, it’s an economic one. That’s why the only application it works with is cryptocurrency, with time stamping being a nice byproduct.

Re:Becoming a blockchain developer by mhluongo on Monday February 10, 2020 @07:54AM (#22288643)
It's compelling for DNS and CA replacement tech
Re:Becoming a blockchain developer by RL_Quine on Monday February 10, 2020 @07:59AM (#22288683)
It's not really that applicable there either. NameCoin attempted this in 2010 and ran into some serious engineering issues with non-obvious outcomes. It's not reasonable for every device to store the multi gigabyte UTXO, so delegation to DNS revolvers is necessary on some level. Ideally you'd be able to do something with attestation to prove that the results came from the blockchain itself, but you can not.

Due to the UTXO design in Namecoin, you can attest that a particular record existed, but you can't ever compactly prove it exists. This distinction is important because it means that you as the client have no way of knowing if a returned result is stale and has been changed to something entirely different.

Re:Becoming a blockchain developer by mhluongo on Monday February 10, 2020 @01:56PM (#22292043)
You've missed years of development. Zero-knowledge attestations of name records given a particular blockheight are quite doable.
Re:Becoming a blockchain developer by skitout on Monday February 10, 2020 @09:18AM (#22289262)
You don't necessary need to download a multi gigabyte UTXO anymore :) Blockchain tech is young and a lot of thing are going on - and 2010 was prehistory for blockchain
Re:Becoming a blockchain developer by m82labs on Monday February 10, 2020 @08:04AM (#22288722)
How is it compelling for DNS? (Asking honestly) Any article I have attempted to read is full of non-informations and vague generalizations.
Re:Becoming a blockchain developer by verdverm on Monday February 10, 2020 @08:41AM (#22288986)
handshake.org is a better iteration on BC for DNS

for example... the sale of the .org TLD

Re:Becoming a blockchain developer by skitout on Monday February 10, 2020 @08:53AM (#22289066)
a16z podcasts are cool to understand the applications of blockchain
Re:Becoming a blockchain developer by mopsi on Monday February 10, 2020 @08:23AM (#22288854)
> but what are some of the real-world use cases for a shared trust model?

Document management. Once recorded in the blockchain, documents cannot be altered, removed nor replaced without leaving a trace. This is valuable in any database that deals with historic data that needs to be provably untampered: financial records, contracts, permits & licenses, etc.

Re:Becoming a blockchain developer by verdverm on Monday February 10, 2020 @08:43AM (#22288995)
Supply chain and tamper free history, which is more or less a superset of document management
Re:Becoming a blockchain developer by redact207 on Monday February 10, 2020 @08:00AM (#22288690)
Blockchain can be useful outside of crypto, or even leveraging crypto for anything that needs trust.

Example: you might take a fingerprint of a recorded interview and save that to a block chain. When you distribute the interview the receivers can verify it hasn't been tampered with based on the fingerprint and when it was added to the chain.

This way you don't need to trust the source of the video or the person giving you a fingerprint, as that's stored immutably.

Re:Becoming a blockchain developer by joosters on Monday February 10, 2020 @08:05AM (#22288732)
What does that prove? The person can tamper with the recording before publishing it on the blockchain.

The limiting feature of blockchains is that they cannot integrate with real world (i.e. non-blockchain) data without trusting the data provider. And at that point, the key feature of blockchains (no need to trust anyone) is completely lost.

Re:Becoming a blockchain developer by mopsi on Monday February 10, 2020 @01:34PM (#22291837)
The key feature has always been that the data cannot be retroactively changed, eg log entries removed, inserted (between existing records) or modified. That's what enables cryptocurrencies: nobody can go back and alter account balances without leaving a trace, edits have to go through new transactions or protocol change.

In case of a video, blockchain could be used to tamper-proof security footage. You can always manipulate the incoming data (cover the cameras etc), but once data has been recorded (whatever it may be), there's no going back and overwriting it.

I'm surprised how oblivious the HN crowd is to how huge this is for the enterprise and government sector where data like land registry or citizenship records (see Obama's birth certificate, GWB's military record) have to be kept provably untampered for up to a century.

Re:Becoming a blockchain developer by crispyporkbites on Monday February 10, 2020 @08:47AM (#22289025)
I think there is potential to reduce costs of operating a business with a blockchain by removing a class of middlemen through better automation and standardization. Here's some examples that might work:

- If we run all transactions a business makes through a blockchain with the right tooling the accounting & taxation could be massively automated, submitting P&L reports and other extremely expensive accounting processes could be completely replaced with code

- If all IPOs were run as ICOs, it would take out an entire class of banker, who are currently extracting value that could be captured elsewhere

- Any service that provides one-sided transactions. E.g. donating to charity - you could build a cheaper and more transparent service that allows people to donate to a charity, directly into their accounts (and potentially onward). Imagine going onto justgiving.com and donating directly to a recpient without any middle-men (aside from the blockchain itself)

I'm not sure how much of the blockchain trust model you specifically need for this, but if you think of blockchain technology as an open data structure and global, distributed computer the use cases start to materialize, even if we're not ready for them yet, if ever.