News for hackers. Stuff that matters.
Re:10 years of whatever this has been by onion2k on Thursday November 18, 2021 @02:52AM (#29263130)
Right, but a signed distributed ledger doesn't inherently provide any trust, so that is where your thinking fails.

A blockchain does provide trust insofar as it's cryptographically impossible to tamper with the previous ledger entries. Obviously that trust only extends as far as trusting the crypto software, the ledger software and that people's entries in to the ledger are authentic at the time of entry, but that's the same as any ledger whether it's signed or not. The advantage of a blockchain is that a third party (eg someone joining the ledger at a later date) can verify the previous transactions and continue the chain with a good level of trust that the previous entries are true.

So, a signed distributed ledger like a blockchain does provide a level of trust that the ledger data hasn't been modified. As that's what a ledger is for (trust in the individual parties or transactions is done outside of the ledger) it does work.

Certificate authorities for signing things like products or documents already exists for many things, blockchain isn't a new solution to that.

A blockchain isn't a new solution. They've been around for decades. It's a different solution to something like a signing authority though. Using a signing authority requires everyone to trust a third party. That can be difficult. A blockchain doesn't require that.

Arguing that there's an alternative to a blockchain is not an indication that blockchain won't work. It's possible, and usually good, to have more than one solution to a problem.

Re:10 years of whatever this has been by Jensson on Thursday November 18, 2021 @03:10AM (#29263250)
> The advantage of a blockchain is that a third party (eg someone joining the ledger at a later date) can verify the previous transactions and continue the chain with a good level of trust that the previous entries are true.

You don't need blockchain for this. I've worked in this space (the non blockchain part of online trust), tamper proof logs is already a service provided by central Certificate Authorities. All you need to do is to continuously sign a log and the CA can keep the chain of signatures, and thus provide proof that you didn't tamper with the log. That way the CA can both validate the identity of the signer and validate that the signer didn't tamper, meaning it is a better service than blockchains.

https://en.wikipedia.org/wiki/Anti-tamper_software

There is great value in software signatures. But that value is already captured and used everywhere, in SSL, software signing, document signing etc, blockchains doesn't add any value at all to that space as far as I've seen.

> Using a signing authority requires everyone to trust a third party. That can be difficult.

Finding a third party both trust more than they trust each other is trivial in almost every transaction. When you buy from Amazon you trust your bank more than you trust Amazon, and Amazon trusts your bank more than they trust you. Your bank is the third party. Can you name any significant usecases where there isn't a third party both participants would trust more than they trust each other?

Re:10 years of whatever this has been by onion2k on Thursday November 18, 2021 @03:44AM (#29263429)
already a service provided by central Certificate Authorities

Yes, and that's great if everyone agrees to trust the CA. Now try to solve the problem if they don't. I guarantee that your solution will look a lot like a blockchain.

Re:10 years of whatever this has been by acdha on Thursday November 18, 2021 @07:54AM (#29264856)
In the case of certificate transparency, the CAs know that the browsers will nuke their business if they’re caught cheating and the design of the system makes tampering evident so they’d primarily only be able to cheat by issuing a certificate without logging it.

I think that’s an important point because it touches on the challenges of a blockchain: if trust can be based entirely on the information in the chain, it can work. If security depends on outside oracles, legal enforcement, or other trust relationships anyway, you don’t need the expense of a blockchain relative to something like a distributed signature system. This is why the supply chain stuff never goes anywhere unless it pivots because the hardest part is trusting your auditors, and the expense / fragility of an always-on networked system isn’t worth it when it can’t solve that problem.