• 0 Posts
  • 30 Comments
Joined 2 years ago
cake
Cake day: June 30th, 2023

help-circle









  • I’m big into privacy and its not so much about an entity knowing stuff about me personally, but rather the entity knows stuff about everyone and weaponizes it against me.

    Political efforts to get citizens to vote against their own self interests or suppressing votes of those who don’t fall in line.

    Fueling hate machines to distract citizens with infighting so they don’t focus on those hoarding wealth and power.

    Controlling access to content that those in power see as “harmful” (to them).


  • While I haven’t seen data to back this up, another Lemmy user called out that Intel chips may have support for running secure code the user cannot modify. The results are signed by an encryption key on the motherboard/CPU that cannot be extracted to fake the signature.

    So let’s say Chrome asks this hardware module to hash the executable code and some state for itself currently in RAM and sign it with Intel’s private key on the motherboard/CPU. The “some state” portion ensures the hash is always unique. Maybe it is just a timestamp. Regardless, this helps the attestation server know Chrome has not been modified because the hash is unique and cannot simply be captured in flight once and then replayed/faked over and over like a user-agent string.



  • Totally agree you do not need a blockchain. Its just one class of implementations. There are others like Apache Zookeeper, or even just roll your own.

    Also really appreciate you engaging with me on the topic. I’m currently working on a federated product (business to business). Blockchains have come up (private chain), so I’m trying to convince myself it brings something to the table as a framework by arguing from the other side.

    Verifying who said what is the major concern we are trying to solve. Everyone having a copy of the data is also preferred so each business pays for their own read usage.

    Verifying who is who is pretty much solved using traditional PKI with certificates. The what is said is less of a concern so long as we know who said it. The whats in our use case are not digital assets.

    We are looking at it like pub/sub kafka-like framework with complete history intact that is immutable without needing to dedicate resources to rolling our own. Co-operators have something to gain by working together (long term) but can also gain by screwing each other over (short term).

    Tendermint/Cosmos has been looking pretty attractive as a private chain with ~1s commits (no mining). 67% of the nodes must agree on who signed a message and the order the messages were seen to commit it to the next block. So far its seeming pretty convenient for what we are looking for.


  • Tamper proof federated distribution. That’s it now that I’ve had a couple days to think on it. Why use Lemmy when Reddit or even old school forums exist? We (as a generalization) are here because we see value in accessing many forums under one UX and we do not trust Reddiit as a centralized distributer.

    If some user here started posting they were a famous person, we wouldn’t trust that without some additional verification. Same with blockchain accounts/wallets.

    Blockchains provide one possible mechanism that prevents any Lemmy instance from falsely distributing ActivityPub messages from a user that did not author them. False messages can be checked they didn’t come from that user since they were not signed with their private key. The rest of the federated distributors would detect the forgery and drop the message.

    Sure we could all sign our messages with a PGP key. Blockchains just bake this feature into the distribution.

    The last feature, which may or may not be desirable, is that these tamper proof federated distribution channels have a full audit log.



  • There could be a “validator” you choose that has to sign off on the blockchain the seller’s claims are true as a condition to finalize the sale. Similar to buyers (in the US at least) selecting and paying for a home inspector when buying a property.

    The point is, nobody can change their answer later with lots of independently operated data redundancy. The data is meant to be tamper proof. Its up to you to authenticate identities, delegate authentication, or blind trust the seller before trusting that data.

    It’s not a one size fits all solution. A better example is if all the transport authorities in the world wanted to share one database. Who would all those transport authorities trust to operate it globally? Probably no organization would have the trust of all of them. With a blockchain, transferring that ownership from being managed by one authority to another would then go through that validation flow where the seller and receiver transport authorities sign off that they authenticated the other out-of-band and that they authorize this transaction as a matter of public record.

    The NFT use case is dumb for digital art with the intent they hold value as if the resource is scarce.

    The Matter DCL on the other hand I think is a great use case. Apple, Amazon, Google, and many more companies want to share a common database for certified IoT devices. They don’t trust each other enough to agree to one company operating this database. They can agree to a certifier, but its not the certifier’s role to certify devices and host the infrastructure to automate a device is certified during adoption by a customer. So the big companies built that infrastructure using a blockchain and made it easy for the certifier (account authenticated out-of-band when created) to post certification results. 67% of the companies verify the certifier’s identity on the chain matches who they previously authenticated every time a result is posted (automated using public key cryptography). Only then are the results authorized to be published. Since the data is tamper proof, everyone trust those published results.


  • You are trusting the transport authority in this instance to always report the truth.

    My understanding with NFTs is that the previous owner only needs to say it once as part of the sale. Now only you can transfer ownership. No central body needs to be trusted.

    Maybe… pretty sure I’ve seen some articles of NFT chain creators having the ability to revert transactions (e.g., owner was phished). In that case yeah… just use a database.