News for hackers. Stuff that matters.
Re:Web3 Is Not Decentralization by nostrademons on Wednesday December 08, 2021 @09:35PM (#29493151)
I thought this would be about a bigger and more obvious problem with web3, namely that by default all traffic going through MetaMask runs through Infura and hence through Consensys's servers. If you think you're getting privacy or resilience because you're interacting with a DApp, think again. All your transactions are going through a single organization, which might have logs linking the IP, your ETH address, the smart contract address, and timestamp, and if it goes down web3 won't work for a significant number of users. [It is possible to configure MetaMask to use a different gateway, but how many users fiddle with the defaults or even know what a web3 gateway is?]

Ethereum as a whole and the raw smart contracts of most DApps actually are decentralized, but there are SPOFs in the UI, name service, and transaction gateway. If you aren't willing to run your own geth instance and understand Solidity/EVM, it's not really decentralized for you.

Re:Web3 Is Not Decentralization by rauljordan2020 on Thursday December 09, 2021 @12:13AM (#29494064)
Disclaimer: I work on Ethereum core development. One of the coolest things happening that will be available to everyone over the coming year is something called a light client, which is essentially a very light, validating node that tracks the head of the chain with certainty, and can be used as an alternative to services such as Unfura. In the future, Metamask will probably be a light client that actually tracks the head of the chain and can validate proofs of user account state. Source: https://github.com/ethereum/consensus-specs/blob/dev/specs/a...
Re:Web3 Is Not Decentralization by littlestymaar on Thursday December 09, 2021 @02:27AM (#29494787)
> light client, which is essentially a very light, validating node that tracks the head of the chain with certainty

How does that work?

Re:Web3 Is Not Decentralization by kamray23 on Thursday December 09, 2021 @03:47AM (#29495221)
Skip over verifying everything and only verify a subset of all things you care about. Use alternative root nodes you trust instead of verifying. Stuff like that. They have a spec: https://eth.wiki/concepts/light-client-protocol
Re:Web3 Is Not Decentralization by keymone on Thursday December 09, 2021 @01:21PM (#29500965)
It works by surrendering any pretense of eth being a decentralized cryptocurrency and turning every node into a glorified and bloated transport/identity layer.

If you’re not validating transactions - you’re trusting a third party. There are no light clients that avoid this problem. It remains to be seen if they are even possible.

Re:Web3 Is Not Decentralization by rauljordan2020 on Sunday December 12, 2021 @08:56PM (#29535698)
Sorry it took me ages to clarify this. It's actually a pretty cool mechanism! What I mean by "tracking the head of the chain with certainty" means that you don't have any trust assumptions on the head block. If you track the latest head block, that means you can verify Merkle proofs of the chain state (as the state root is a field embedded in a block). This is neat because a light client, using low resource requirements, can tell verify a proof of some state data you present it.

The way it works is that there is a committee of validators in the consensus protocol that is required to sign the head of the chain. We use cryptography known as BLS signatures to perform signature aggregation, meaning you can verify a single signature to ensure that whole committee is correct. The state of the chain can be represented as a Merkle trie, and we can obtain the actual committee as a branch of this tree which can be used during the verification process.

https://medium.com/chainsafe-systems/lodestar-releases-light...

It's really neat and there are working prototypes out there today.

Re:Web3 Is Not Decentralization by thr0wawayf00 on Wednesday December 08, 2021 @09:51PM (#29493239)
> If you aren't willing to run your own geth instance and understand Solidity/EVM, it's not really decentralized for you.

This is how I feel about the exchanges generally, which wield an incredible amount of influence in the crypto markets, for better or worse. It's a complete tangent, but reading about Tether's shifting story around its capital reserves terrifies me.

I have yet to see a blockchain implementation that's easy enough to use on its own that it could achieve widespread adoption without a strong market desire to have someone else manage the complexity of it for you. People talk about decentralization all day long while completely ignoring the fact that we've just shifted the centralized authority from one entity to another.

Re:Web3 Is Not Decentralization by agumonkey on Wednesday December 08, 2021 @11:04PM (#29493696)
That summarizes a lot.

The system is not simple at all.

The benefits are only potentially here (eth fees are wild).

The solution involves the opposite of religious principles the mob believes in.

Re:Web3 Is Not Decentralization by fragmede on Thursday December 09, 2021 @05:02AM (#29495627)
It's more than the mob believes it to be an ecumenical matter and you want it to be otherwise. If you want to participate, but aren't willing to trust someone else (which no one would blame you for), then your move is to run your own node. Like, that's the entire premise of blockchain technology - no one trusts each other - but no one has to!
Re:Web3 Is Not Decentralization by thr0wawayf00 on Thursday December 09, 2021 @08:07AM (#29496918)
> no one trusts each other - but no one has to!

Isn’t the whole point of a market that we trust each other enough to have a shared understanding of what value is? How can a market function when you trust no one else in it? Cash is a perfect example of this: it’s only worth something because we all agree that it’s worth something, we can’t eat it or do anything else with it other than to exchange it for goods. Crypto isn’t any different.

It will be interesting how this holds up if Tether is actually just “printing” money as they go. If the rumors are true and they go bust or are shut down, one could easily see that event catalyzing a crypto market meltdown similar to what we saw in 2008 where speculation was out of control. Will the energy remain in the crypto space if the crypto markets fall victim to the very thing they were created to prevent?

Re:Web3 Is Not Decentralization by couchand on Thursday December 09, 2021 @09:49AM (#29497911)
> Will the energy remain in the crypto space if the crypto markets fall victim to the very thing they were created to prevent?

Yes, because the energy in the cryptocurrency space is based not on rational analysis but religious fervor. The inconvenient objective facts will be explained away rather than addressed.

Re:Web3 Is Not Decentralization by agumonkey on Thursday December 09, 2021 @12:04PM (#29499945)
There are some philosophical question. Even trust need trustlessness at first. Things don't couple blindly. But ultimately I believe a good system is where trust is high.
Re:Web3 Is Not Decentralization by cblconfederate on Thursday December 09, 2021 @12:41PM (#29500456)
> that we trust each other enough to have a shared understanding of what value is

No, hence why we need the state to print the money, regulate the markets, and put the bad guys in jail.

Re:Web3 Is Not Decentralization by kaczordon on Wednesday December 08, 2021 @11:12PM (#29493746)
This is how I feel about the exchanges generally, which wield an incredible amount of influence in the crypto markets, for better or worse.

This isn’t really true as there’s a bunch of decentralized AMM’s(automated market maker) now: uniswap, sushiswap, pancakeswap

Re:Web3 Is Not Decentralization by verdverm on Thursday December 09, 2021 @12:42AM (#29494225)
Word had it uniswap is prepping for KYC requirements. Sounds like there is still a centralized decision making element to the smart contracts that are what uniswap is at the core.
Re:Web3 Is Not Decentralization by kobasa on Thursday December 09, 2021 @02:06AM (#29494687)
Re:Web3 Is Not Decentralization by cinquemb on Thursday December 09, 2021 @01:42AM (#29494545)
uniswap labs != open source uniswap (v1/v2) smart contracts and open source ui, both of which have been forked many times
Re:Web3 Is Not Decentralization by pjc50 on Thursday December 09, 2021 @05:22AM (#29495777)
How do you do an onchain swap for real money in a real bank?
Re:Web3 Is Not Decentralization by gruez on Thursday December 09, 2021 @09:17AM (#29497563)
>I have yet to see a blockchain implementation that's easy enough to use on its own

Bitcoin core is pretty easy to run yourself, no technical skills required.

Re:Web3 Is Not Decentralization by cblconfederate on Thursday December 09, 2021 @12:40PM (#29500435)
you d have to define 'pretty easy' and 'technical skills'
Re:Web3 Is Not Decentralization by vmception on Wednesday December 08, 2021 @11:27PM (#29493833)
2017 called

Now there are lots of rpc providers and it is much easier to spin up your own node

Check out erigon client it is an archive node with much lower resource requirements than geth archival nodes, about 1/10th the requirements and that gulf will likely expand

pruned geth is still much lower than that though, but at least erigon gets rid of some of the state-storage centralization arguments (and lets inquisitive people browse prior chain states and simulate environments)

anybody that wants their own privacy has much better ways to get it

But Tails + TorBrowser + Metamask extension is also good enough if you want to hide info from Infura, analytics packages etc

Re:Web3 Is Not Decentralization by Animats on Thursday December 09, 2021 @04:15AM (#29495351)
How do you know the RPC provider's node isn't logging your transactions or even executing a man-in-the-middle attack?
Re:Web3 Is Not Decentralization by vmception on Thursday December 09, 2021 @08:20AM (#29497003)
Regarding logging, you don’t know but the node doesn’t know that it was the first node to receive a transaction.

If you are communicating directly to the node.

Infura, on the other hand, uses a load balancer so it receives transactions before they hit their nodes, which means that server can assume it was the first to receive.

If you are operating on clearnet then you need your own node for privacy.

A TorOS lets you do this on darknet just fine though, its some random onion or exit node IP.

Re:Web3 Is Not Decentralization by lgrapenthin on Thursday December 09, 2021 @04:43AM (#29495505)
They can't do a man in the middle attack because the transaction is already signed with your private key and they don't have that.
Re:Web3 Is Not Decentralization by davidmurdoch on Wednesday December 08, 2021 @09:56PM (#29493263)
Eehhhhhhhh, maybe true 2-3 years ago, but things are getting more decentralized as time goes on. There are many competitors to Infura and MetaMask coming into the space now! There are even hardware companies creating nodes that work right off the shelf (I only know if a handful of devs in the space that have one though, as they're still a bit pricey).
Re:Web3 Is Not Decentralization by littlestymaar on Thursday December 09, 2021 @02:17AM (#29494732)
> maybe true 2-3 years ago, but things are getting more decentralized as time goes on

That's a good indication that it is not decentralized ;).

Re:Web3 Is Not Decentralization by PragmaticPulp on Wednesday December 08, 2021 @10:38PM (#29493540)
Can you name any of these alternative companies? I’d like to at least look into them.

One of the weirdest trends I’ve seen in Web3 discussions is the insistence that better alternatives exist, but for some reason nobody is using them, talking about them, or even naming them in discussions.

Re:Web3 Is Not Decentralization by lhl on Wednesday December 08, 2021 @11:19PM (#29493781)
For Metamask alternatives, Rabby https://rabby.io/ (MIT-licensed) (it routes all queries through its own RPCs atm) and Frame https://frame.sh/ (GPLv3) are the best desktop alternatives I've tried. The latter is my preferred client and IMO is a strict upgrade from Metamask. It's also getting a $7/$1 match on Gitcoin Grants GR12 right now if anyone wants to contribute in the next week: https://gitcoin.co/grants/1143/frame

There are many, many WalletConnect https://walletconnect.com/ compatible wallets that can be used with most dapps as well. There are close to 100 of these: https://walletconnect.com/registry/wallets

As for RPCs, here's a list for you: https://github.com/arddluma/awesome-list-rpc-nodes-providers

If you want to run you're own RPC node, it's not so hard as there are docker and docker-compose images that will let you get geth (or nethermind, or erigon) that will let you spin up an RPC pretty trivially.

The more important thing for decentralization IMO, is that you can reasonably switch, even if most people don't. Think about how this plays out in the browser or email markets and compare it to how much of a difference that is to completely locked in services like Facebook.

Re:Web3 Is Not Decentralization by NetOpWibby on Thursday December 09, 2021 @02:25AM (#29494778)
Wow, Rabby looks great! Had no idea Metamask had competitors, this is awesome.
Re:Web3 Is Not Decentralization by diveanon on Thursday December 09, 2021 @01:28AM (#29494471)
Would like to second Rabby, been trialing it for about a month now and I love it.
Re:Web3 Is Not Decentralization by davidmurdoch on Wednesday December 08, 2021 @10:46PM (#29493601)
I work at ConsenSys so I am definitely not claiming the alternatives are better.

https://moralis.io/ and https://www.alchemy.com/ are Infura alternatives

You can Google "metamask alternatives" if you want, there are lots. I won't vouch for any of them.

Re:Web3 Is Not Decentralization by sebmellen on Wednesday December 08, 2021 @11:56PM (#29493967)
https://ava.do is one. Cool founders based in the Swiss “Crypto Valley”.
Re:Web3 Is Not Decentralization by michaelsbradley on Wednesday December 08, 2021 @10:02PM (#29493295)
And there are active efforts to develop ultra-light clients for Ethereum together with the concept of “portal network”:

https://our.status.im/nimbus-fluffly/

Re:Web3 Is Not Decentralization by DennisP on Wednesday December 08, 2021 @10:19PM (#29493412)
The name service is a smart contract. Even if one entity is hosting UI for it, anyone else can do the same. It's probably a good idea to build direct support for it into clients.
Re:Web3 Is Not Decentralization by toddh on Thursday December 09, 2021 @01:17PM (#29500925)
And whomever owns the interpreter owns everything.
Re:Web3 Is Not Decentralization by miracle2k on Wednesday December 08, 2021 @10:23PM (#29493441)
> If you aren't willing to run your own geth instance and understand Solidity/EVM, it's not really decentralized for you.

That's just overly reductive. You certainly benefit from all kinds of vectors of decentralisation regardless of you using MetaMask, or possibly having connectively problems if a popular nodes goes down.

You can test this very simply, because regardless of the common node you are using, are still exposed to all the downsides and responsibilities that decentralisation brings, such as the possibility of losing your private key and being unable to recover your funds. So the decentralisation is still clearly there.