1 00:00:00,000 --> 00:00:08,680 Okay, so Ricardo asked me to give this talk, and he's like, yeah, come to this blockchain 2 00:00:08,680 --> 00:00:13,520 panel, and I was like, I don't know about that, and he's like, no, it's beyond the hype. 3 00:00:13,520 --> 00:00:14,520 It's beyond the hype. 4 00:00:14,520 --> 00:00:15,520 It's blockchain beyond the hype. 5 00:00:15,520 --> 00:00:18,200 And I was like, oh, okay, that sounds fun, I think I can do that. 6 00:00:18,200 --> 00:00:22,600 So I'm going to talk about this problem and why it's so much harder here, and the subtitle 7 00:00:22,600 --> 00:00:26,640 here, I'm going to read it to you, is Honest Reporting in Peer-to-Peer Networks When Everyone 8 00:00:26,640 --> 00:00:30,760 Has an Incentive to Lie, and You Don't Even Know How Many People There Really Are. 9 00:00:30,760 --> 00:00:35,000 So it's a really hard problem to solve, and it's a really important problem. 10 00:00:35,000 --> 00:00:40,520 But what I thought I would do to go beyond the hype is try to contrast how easy this 11 00:00:40,520 --> 00:00:43,080 problem would be if you just didn't have to use a blockchain. 12 00:00:43,080 --> 00:00:45,120 It would be very easy. 13 00:00:45,120 --> 00:00:48,600 But instead, we have something that's really, really hard. 14 00:00:48,600 --> 00:00:54,400 And so the goal is really to draw the contrast as clearly as possible, and I have this little 15 00:00:54,400 --> 00:01:00,160 paper airplane ship thing going because I'm going to try to talk about maybe aerospace 16 00:01:00,160 --> 00:01:05,160 engineering in some sense, and maybe people will be able to follow it, maybe they won't. 17 00:01:05,160 --> 00:01:09,520 But the point is just to draw as much of a contrast as possible between the two modes 18 00:01:09,520 --> 00:01:14,920 so that it's really clear how different blockchain is from other things, because it's very, very, 19 00:01:14,920 --> 00:01:17,640 very different in my point of view. 20 00:01:17,640 --> 00:01:22,640 And so the overview here is that I'm going to try and give you the thesis straight off, 21 00:01:22,640 --> 00:01:26,520 then I'm going to introduce what this problem is in some detail, and then I'm going to talk 22 00:01:26,520 --> 00:01:30,240 about kind of the history of trying to solve this problem and how people have failed in 23 00:01:30,240 --> 00:01:34,840 very complicated ways that did not involve a lot of computer science, and that instead 24 00:01:34,840 --> 00:01:38,480 involved things like economics. 25 00:01:38,480 --> 00:01:42,200 So here are kind of the takeaways that I'm hoping that people will get, which is that 26 00:01:42,200 --> 00:01:46,600 blockchain means that you, it doesn't mean that there is less trust, but the security 27 00:01:46,600 --> 00:01:50,440 model in blockchain is that everyone is a threat and you cannot trust anyone, which 28 00:01:50,440 --> 00:01:52,920 is like a high bar. 29 00:01:52,920 --> 00:01:57,280 So that means everything is way more difficult here than it would normally be. 30 00:01:57,280 --> 00:02:01,240 And the second thing is something that I really liked, Peter Todd emphasized it in his talk, 31 00:02:01,240 --> 00:02:07,120 and even I think Elaine and a couple other people mentioned it, which is that there's 32 00:02:07,120 --> 00:02:11,920 a developer or someone who wants to write software for people, usually wants to enable 33 00:02:11,920 --> 00:02:14,480 the user to do more things. 34 00:02:14,480 --> 00:02:18,560 And Peter Todd gave the example of Photoshop, and he's like, you add new layers or colors 35 00:02:18,560 --> 00:02:21,560 or something and that's a new thing you want your user to be able to do. 36 00:02:21,560 --> 00:02:26,280 But contracts are about allowing people to like opt into a contract and then the contract 37 00:02:26,280 --> 00:02:28,000 constrains them so they can do less. 38 00:02:28,000 --> 00:02:31,520 So if you sign a contract with your employer, instead of being able to do whatever he wants 39 00:02:31,520 --> 00:02:35,880 with his money, he has to give some of it to you every month or every hour or whatever. 40 00:02:35,880 --> 00:02:41,320 And so contracts are about making things impossible, which is very opposite and quite different. 41 00:02:41,320 --> 00:02:44,200 And in particular, the Oracle is going to, I'm going to point out these examples where 42 00:02:44,200 --> 00:02:51,320 the Oracle fails for things that the user, actions that the user are allowed to take. 43 00:02:51,320 --> 00:02:56,280 And I'm going to say that in the blockchain world, code is built on a foundation of incentives. 44 00:02:56,280 --> 00:02:59,760 But before we can talk about that, we have to talk about what this problem is. 45 00:02:59,760 --> 00:03:02,480 And it has nothing to do with the Oracle Corporation. 46 00:03:02,480 --> 00:03:08,560 It is this issue of the blockchain not inherently knowing any information about the real world. 47 00:03:08,560 --> 00:03:13,280 It only knows what people bring to it and submit in to the blockchain system. 48 00:03:13,360 --> 00:03:18,400 So I have an unhappy Bitcoin there and it's thinking about what it's own exchange rate is. 49 00:03:18,400 --> 00:03:21,400 But it doesn't know anything about that because it doesn't inherently know anything about 50 00:03:21,400 --> 00:03:25,320 US dollars or in this case, British pounds. 51 00:03:25,320 --> 00:03:30,160 And we know that it's around 1,000 British pounds for Bitcoin today, but there's no way 52 00:03:30,160 --> 00:03:33,120 that the blockchain itself can know this problem. 53 00:03:33,120 --> 00:03:39,160 And because in general, the more abstract something is in this space, the more dishonest 54 00:03:39,160 --> 00:03:44,520 its contributors tend to be, I'm going to try to make this very concrete and not abstract 55 00:03:44,520 --> 00:03:45,520 at all. 56 00:03:45,520 --> 00:03:48,560 And I'm going to say that we're going to use this one example almost the entire time, which 57 00:03:48,560 --> 00:03:53,480 is that two people are going to bet or at least some number of people are going to be 58 00:03:53,480 --> 00:03:54,840 betting on Brexit. 59 00:03:54,840 --> 00:03:59,200 And much earlier in the past, before Brexit happens, we're going to have Arthur and Beatrix 60 00:03:59,200 --> 00:04:04,560 who disagree over what will happen in the future. 61 00:04:04,560 --> 00:04:10,160 And Arthur says that Britain is going to remain and Beatrix says leave and Arthur offers 62 00:04:10,160 --> 00:04:14,360 to bet 500 and Beatrix says fine. 63 00:04:14,360 --> 00:04:18,160 And so in the real world, they would just kind of maybe settle up in human or something 64 00:04:18,160 --> 00:04:21,920 like they would just, they know each other personally and their reputation would suffer 65 00:04:21,920 --> 00:04:22,920 or something like that. 66 00:04:22,920 --> 00:04:26,880 But the issue here is that we want to automate this process with a computer and replace it 67 00:04:26,880 --> 00:04:31,320 and make it so that it doesn't depend on individual people knowing each other and people can just 68 00:04:31,320 --> 00:04:33,680 meet on the internet and do this. 69 00:04:33,680 --> 00:04:38,440 So now, later on in the present, we know that the outcome was leave. 70 00:04:38,440 --> 00:04:41,840 And in order to automate this process, we're going to have them put some money in a box 71 00:04:41,840 --> 00:04:43,720 and then that box is going to have to open. 72 00:04:43,720 --> 00:04:48,200 To be very, very, very concrete about this, the Oracle problem is that we want to be able 73 00:04:48,200 --> 00:04:55,000 to guarantee that the box is worth whatever under condition A and whatever other thing, 74 00:04:55,000 --> 00:04:57,800 so Y, X and Y, under different conditions. 75 00:04:57,800 --> 00:05:03,320 So given conditions A has to be worth X, given conditions B has to be worth Y and the crucial 76 00:05:03,360 --> 00:05:08,480 thing is we want to make that guarantee at all times but particularly when they're putting 77 00:05:08,480 --> 00:05:09,880 the money in. 78 00:05:09,880 --> 00:05:15,320 So we don't want to like, you know, the guarantee has to be something that they can rely on 79 00:05:15,320 --> 00:05:16,600 when they're putting the money in the box. 80 00:05:16,600 --> 00:05:20,440 So we need some kind of magical box that only opens and gives the money to Arthur in one 81 00:05:20,440 --> 00:05:24,480 case and only opens and gives the money to Beatrix in a different case and doesn't do 82 00:05:24,480 --> 00:05:27,720 anything else and we can't expect to do anything else. 83 00:05:27,720 --> 00:05:31,160 So I'm going to talk a little, one slide about why we should solve this problem and this 84 00:05:31,160 --> 00:05:35,080 is a screenshot from Gavin Andreessen who when he wrote this blog post was the chief 85 00:05:35,080 --> 00:05:42,080 scientist of the Bitcoin Foundation and he is talking about something kind of complicated 86 00:05:42,080 --> 00:05:45,080 but I'm just going to read to you this highlighted part which is that he says, all the really 87 00:05:45,080 --> 00:05:50,280 interesting complex contracts I can think of require data from outside the blockchain 88 00:05:50,280 --> 00:05:54,920 like the Bitcoin US dollar exchange rate on some future date for blockchain enforced futures 89 00:05:54,920 --> 00:06:00,040 contracts and that data from outside, that is the Oracle problem that I'm referring to 90 00:06:00,040 --> 00:06:05,280 and I want to be totally clear about exactly what this problem is so you get a better idea 91 00:06:05,280 --> 00:06:09,040 of kind of what we're talking about here. 92 00:06:09,040 --> 00:06:15,200 And as was mentioned, we don't want to like bother courts or any kind of humans with this. 93 00:06:15,200 --> 00:06:19,000 We want to the extent that humans are involved at all, we want to be able to expect them 94 00:06:19,000 --> 00:06:24,120 to be as lazy and selfish and anonymous as possible and so ideally, they wouldn't be 95 00:06:24,120 --> 00:06:28,120 involved one bit but they're going to have to be involved a little bit. 96 00:06:28,240 --> 00:06:29,400 But why solve this problem? 97 00:06:29,400 --> 00:06:34,400 I mean, we're talking like lots of applications in finance, insurance, even Internet of Things, 98 00:06:34,400 --> 00:06:37,800 you want to like, if a car is supposed to pick you up, the blockchain needs to know 99 00:06:37,800 --> 00:06:42,080 somehow if the car actually did come or if anything actually did happen. 100 00:06:42,080 --> 00:06:44,880 So this world of information is very important. 101 00:06:44,880 --> 00:06:47,900 And in the non-blockchain world, it would be very, very, very easy because you would 102 00:06:47,900 --> 00:06:51,680 just dial out to some place and ask them. 103 00:06:51,680 --> 00:06:55,140 And this is some random thing I found on Google Images but apparently, this is some free service 104 00:06:55,220 --> 00:07:01,420 that OCRs images and gives you JSON of whatever the text is in those images. 105 00:07:01,420 --> 00:07:05,660 And that's not really relevant, you know, just in an abstract sense, you could dial 106 00:07:05,660 --> 00:07:10,620 out to Google and ask them about the result for Brexit or you could compare search results 107 00:07:10,620 --> 00:07:16,780 or something like that and you could ask someone, you could compare Twitter amounts or any kind 108 00:07:16,780 --> 00:07:21,260 of metric that you could use by just dialing out to someone else. 109 00:07:21,260 --> 00:07:23,940 But we're not going to be able to do that in the blockchain world and I'm going to explain 110 00:07:23,940 --> 00:07:29,620 why, which is that the blockchain has features that prevent that from happening. 111 00:07:29,620 --> 00:07:33,020 So the good thing about the blockchain is that it's very automatic and it's immune to 112 00:07:33,020 --> 00:07:36,640 tampering and it's very resistant to censorship. 113 00:07:36,640 --> 00:07:42,340 It's the miners who control which messages get in usually don't have any context about 114 00:07:42,340 --> 00:07:44,040 those messages at all. 115 00:07:44,040 --> 00:07:47,820 They only know the fee that they're getting paid and like the kilobytes of the message 116 00:07:47,820 --> 00:07:51,580 so they have a very clear incentive to just include whatever. 117 00:07:51,580 --> 00:07:57,420 They only remove messages that are spam basically. 118 00:07:57,420 --> 00:08:02,780 And that's very good for our guarantee because it's so simple and ironclad that it's easy 119 00:08:02,780 --> 00:08:06,420 to, this is the only system in which you could even make such a guarantee. 120 00:08:06,420 --> 00:08:09,700 But the bad news is that there are no inherent identities on the blockchain, there's certainly 121 00:08:09,700 --> 00:08:12,740 none that are programmed in from the beginning. 122 00:08:12,740 --> 00:08:17,340 And every user must be able to validate the entire history, it's like an engineering requirement, 123 00:08:17,340 --> 00:08:19,020 it's just difficult. 124 00:08:19,020 --> 00:08:23,100 And everyone participating needs to be able to have some way of coming to total consensus 125 00:08:23,100 --> 00:08:26,060 and a unique valid history down to the very last byte. 126 00:08:26,060 --> 00:08:32,900 It has to be exactly the same, they have to get identical hash function results. 127 00:08:32,900 --> 00:08:40,620 So the reason we cannot just dial out to someone else is that it's possible for you to dial 128 00:08:40,620 --> 00:08:44,380 out today and understand what's happening today but it's not possible for you to do 129 00:08:44,380 --> 00:08:45,740 that yesterday. 130 00:08:45,740 --> 00:08:50,020 So I'm going to go into a little bit of detail on this point, which is that this is from 131 00:08:50,020 --> 00:08:54,220 Satoshi's white paper and I'm just going to read some parts, which are that the longest 132 00:08:54,220 --> 00:08:58,140 chain not only serves as proof of the sequence of events witnessed. 133 00:08:58,140 --> 00:09:02,660 So what the blockchain is doing is proving a sequence of events that have been witnessed. 134 00:09:02,660 --> 00:09:07,620 And if you're going to download the blockchain for yourself, you are going to need to re-download 135 00:09:07,620 --> 00:09:13,300 everything and yourself verify that you have the same sequence of events as everyone else. 136 00:09:13,300 --> 00:09:19,620 But not only do you need the same sequence as everyone else, there can't be any messages 137 00:09:19,620 --> 00:09:22,940 in the sequence that break the rules. 138 00:09:22,940 --> 00:09:27,460 And I'm going to go into that in like two minutes but let me read this next part, which 139 00:09:27,460 --> 00:09:32,020 is that the longest proof of work chain has proof of what happened while they were gone. 140 00:09:32,020 --> 00:09:34,740 So people are going to be leaving and joining this network, they're not going to be totally 141 00:09:34,740 --> 00:09:35,980 synchronized. 142 00:09:35,980 --> 00:09:39,420 They may need to leave their computer for some reason or their computer could catch 143 00:09:39,420 --> 00:09:42,460 on fire or something and they need to redo some of this. 144 00:09:42,460 --> 00:09:48,260 It won't be very synchronized and we're going to need to have proof of everything that happened. 145 00:09:48,260 --> 00:09:50,180 And I think I explained this a little bit better on this other slide. 146 00:09:50,180 --> 00:09:54,780 So you need to have the, you need to be able to verify the entire history at all times. 147 00:09:54,780 --> 00:09:57,420 So not just when the history is being written. 148 00:09:57,420 --> 00:10:00,620 So you can prove what Google said today. 149 00:10:00,620 --> 00:10:06,380 You just Google it yourself today and you check that what you got matches whatever someone 150 00:10:06,380 --> 00:10:08,100 else says that the answer is. 151 00:10:08,100 --> 00:10:10,620 And so then you can verify that that is the case. 152 00:10:10,620 --> 00:10:14,420 But what you can't do is prove what Google said yesterday because you'd have to time 153 00:10:14,420 --> 00:10:18,660 travel to yesterday in order to Google it then and verify it back then. 154 00:10:18,660 --> 00:10:25,660 So if we're talking something that is like going to be operating for many, a long time 155 00:10:25,660 --> 00:10:31,060 in the future, people will join the network in the future and they will need to verify 156 00:10:31,060 --> 00:10:36,220 everything that's been happening over the time since the network began, since they joined 157 00:10:36,220 --> 00:10:40,100 it and they can't do any of those things. 158 00:10:40,100 --> 00:10:43,060 And there are some other issues with just kind of trusting Google for this which are 159 00:10:43,060 --> 00:10:46,940 that some people, depending on where they are located in the world or what time of day 160 00:10:46,940 --> 00:10:52,660 or if they're signed in or something, they may not get exactly the same results which 161 00:10:52,660 --> 00:10:54,780 we have to get down to the exact byte. 162 00:10:54,780 --> 00:10:57,660 They have to be exactly the same. 163 00:10:57,660 --> 00:11:02,780 And I have kind of asked yous up here the, I'm going to, I think so on this next slide 164 00:11:02,780 --> 00:11:09,580 I'm going to point out that Satoshi planned the Bitcoin network to be unalterable for 165 00:11:09,580 --> 00:11:10,820 like a hundred years. 166 00:11:10,820 --> 00:11:15,340 So I have this quote from Satoshi which didn't fit so I broke it into two but I'm going to 167 00:11:15,340 --> 00:11:18,940 read just the first sentence of it to you which is that, the nature of Bitcoin is such 168 00:11:18,940 --> 00:11:23,580 that once version 0.1 was released, the core design was set in stone for the rest of its 169 00:11:23,580 --> 00:11:25,260 lifetime. 170 00:11:25,260 --> 00:11:29,100 And on the right I have when he actually announced version 0.1, so I have exactly what he was 171 00:11:29,100 --> 00:11:30,100 talking about. 172 00:11:30,100 --> 00:11:34,500 So on the right is the thing that he's talking about that cannot be changed and is set in 173 00:11:34,500 --> 00:11:36,540 stone for the rest of its lifetime. 174 00:11:36,540 --> 00:11:39,900 And he announces a number of things there but one of the things he announces in particular 175 00:11:39,900 --> 00:11:44,340 is the circulation of the coins which will be distributed to network nodes when they 176 00:11:44,340 --> 00:11:49,460 make blocks with the amount cut in half every four years and the final year of this plan 177 00:11:49,460 --> 00:11:51,800 is the year 2140. 178 00:11:51,800 --> 00:11:57,780 So this post does explain how Bitcoin can be extended and improved over time and indeed 179 00:11:57,780 --> 00:12:02,980 it has been upgraded a lot since June 17th, 2010. 180 00:12:02,980 --> 00:12:09,140 But the core design is set in stone and this is a big contrast to something like anything. 181 00:12:09,140 --> 00:12:14,540 I mean like we're talking like Corda, Hyperledger or even modern day things that are relatively 182 00:12:14,540 --> 00:12:20,380 blockchain like such as Ethereum which hard for and even Monero, Ricardo who introduced 183 00:12:20,380 --> 00:12:26,740 me his project, they will, they plan to reset the network every six months like manually 184 00:12:26,860 --> 00:12:28,180 but that's not what Satoshi did. 185 00:12:28,180 --> 00:12:35,820 He turned it, when he turned it on January 1st, excuse me, January 9th, 2009, it actually 186 00:12:35,820 --> 00:12:38,180 has not been substantially changed since then. 187 00:12:38,180 --> 00:12:43,020 There has been one change that was snuck through as the, it's a quirk but that was snuck through 188 00:12:43,020 --> 00:12:45,900 a long time ago and it's not very relevant at all. 189 00:12:45,900 --> 00:12:50,280 In fact, you don't actually need to upgrade for that change to protect you. 190 00:12:50,280 --> 00:12:56,840 But the point is that this network is very, it's designed to be resistant so that you 191 00:12:56,840 --> 00:13:01,080 can make guarantees of this kind with the box because we want people to be maybe betting 192 00:13:01,080 --> 00:13:05,080 on something that might happen a long time in the future and if the network is going 193 00:13:05,080 --> 00:13:11,040 to be changed sometime between now and then, there's no principle on which to base an assertion 194 00:13:11,040 --> 00:13:15,520 that we won't change what opens the box when we change everything else. 195 00:13:15,520 --> 00:13:18,040 So the only good change is no change. 196 00:13:18,040 --> 00:13:21,000 And so that's the Oracle problem which is that you want to guarantee that this box opens 197 00:13:21,000 --> 00:13:24,360 the right way, pays out the money to the right people. 198 00:13:24,360 --> 00:13:30,040 And that's what I'm going to try to limit this to for maximum clarity and minimal abstraction. 199 00:13:30,040 --> 00:13:33,600 And now I'm going to talk about people who tried to solve this problem and really didn't 200 00:13:33,600 --> 00:13:35,200 succeed at all. 201 00:13:35,200 --> 00:13:41,680 So as I hinted at before, the entire network history of all the messages received or sent 202 00:13:41,680 --> 00:13:47,880 by anyone that was going to be in this consensus set, it must be totally self-contained. 203 00:13:48,720 --> 00:13:51,480 So you can't dial out to someone else that's kind of cheating or just kind of punting the 204 00:13:51,480 --> 00:13:52,640 problem away. 205 00:13:52,640 --> 00:13:56,600 But in addition to being, it's kind of a cheating thing, there's no way for people to verify 206 00:13:56,600 --> 00:13:58,960 that you did it the right way themselves. 207 00:13:58,960 --> 00:14:02,820 So everything has to be self-contained and we'll need people to report in on how they 208 00:14:02,820 --> 00:14:04,600 did this. 209 00:14:04,600 --> 00:14:08,960 And people have tried or they conjectured a number of different ways of kind of doing 210 00:14:08,960 --> 00:14:10,800 this. 211 00:14:10,800 --> 00:14:14,960 And the first way is that there's something called multi-signature where you have one 212 00:14:14,960 --> 00:14:19,760 third party who can be like a, sort of like a lawyer or do like a kind of an escrow arrangement 213 00:14:19,760 --> 00:14:25,400 where you and your counterparty will, like Arthur and Beatrix will meet with someone 214 00:14:25,400 --> 00:14:29,600 and they'll say, okay, we're going to settle this up ourselves. 215 00:14:29,600 --> 00:14:32,760 And if you have any two people agreeing, then it's fine. 216 00:14:32,760 --> 00:14:38,640 So if Arthur decides that he lost or he won, I don't even remember how I set the example 217 00:14:38,640 --> 00:14:43,840 up but it doesn't matter if they, Alex and Arthur and Beatrix decide that they won, they 218 00:14:43,840 --> 00:14:46,080 can each sign and that's two of the required three. 219 00:14:46,080 --> 00:14:49,080 But if they get into some kind of dispute and the winner says I won and the loser says 220 00:14:49,080 --> 00:14:53,760 no you didn't win, they can go to a third person and the third person will be the tie-breaking 221 00:14:53,760 --> 00:14:54,760 vote. 222 00:14:54,760 --> 00:14:56,600 And I'll talk about that in the next slide. 223 00:14:56,600 --> 00:15:00,560 But people then, that kind of wasn't working at all, no one was using that for anything 224 00:15:00,560 --> 00:15:01,560 interesting. 225 00:15:01,560 --> 00:15:06,300 And so they moved on to this idea of competing reporters and I'm going to talk about that. 226 00:15:06,300 --> 00:15:10,120 And that also didn't really work and I kind of foresaw that it wouldn't work. 227 00:15:10,120 --> 00:15:16,800 And at around the same time, I proposed something which is my project, the Bitcoin Hivemind, 228 00:15:16,800 --> 00:15:21,920 which is sort of like this much more complicated version but it's basically a pseudo-corporation 229 00:15:21,920 --> 00:15:24,920 that slowly resolves these outcomes. 230 00:15:24,920 --> 00:15:32,120 But I also inspired a kind of Ethereum-based version of this which doesn't work for reasons 231 00:15:32,120 --> 00:15:33,120 that are very complicated. 232 00:15:33,120 --> 00:15:37,800 So I'm going to try to get through those reasons because I think they really speak to the nature 233 00:15:37,800 --> 00:15:41,080 of failure in blockchain which is supposed to be all about. 234 00:15:41,080 --> 00:15:43,540 Which is exactly what I'm going to be talking about in this half of the talk. 235 00:15:43,540 --> 00:15:48,880 So as I explained on the previous slide, this first example is this multi-signature idea 236 00:15:48,880 --> 00:15:53,680 where there's, you need two or three keys to open this lock and Charles will break the 237 00:15:53,680 --> 00:15:55,400 tie. 238 00:15:55,400 --> 00:16:00,920 And there's like all kinds of unspoken stuff about like Charles will always resolve correctly 239 00:16:00,920 --> 00:16:04,640 therefore we won't, there won't be any disputes and we'll never need to borrow Charles and 240 00:16:04,640 --> 00:16:06,880 therefore this will scale a lot and stuff like that. 241 00:16:06,960 --> 00:16:10,120 So there's all kinds of unspoken stuff that goes with all of these claims that people 242 00:16:10,120 --> 00:16:12,480 have made in the past. 243 00:16:12,480 --> 00:16:17,000 And right off the bat there's a severe problem which is that we don't actually know, Charles 244 00:16:17,000 --> 00:16:22,480 really can't prove a negative that he is not actually Arthur in disguise and then this 245 00:16:22,480 --> 00:16:26,400 whole scheme is foolish because as soon as two people put money into this box, Arthur 246 00:16:26,400 --> 00:16:29,440 will just sign twice to take the money out. 247 00:16:29,440 --> 00:16:36,860 But the real problem is economic which is that Arthur can actually offer Charles a bribe 248 00:16:36,860 --> 00:16:43,280 of not only 500 but up to 1,000 because he's losing 500. 249 00:16:43,280 --> 00:16:51,720 As the outcome is reported honestly, Arthur loses his 500 and it goes to Beatrix. 250 00:16:51,720 --> 00:16:56,560 Beatrix not only gets her 500 back but she wins Arthur's 500. 251 00:16:56,560 --> 00:17:00,560 So the, so Arthur's down a net 1,000. 252 00:17:00,560 --> 00:17:07,040 He can bid up to 1,000 if he bids 999 for this bribe to Charles then Charles will throw 253 00:17:07,040 --> 00:17:13,680 it in his favor and then he'll get 1,000 out of this box and he's still up one from against 254 00:17:13,680 --> 00:17:16,960 where he would have been if he had lost honestly. 255 00:17:16,960 --> 00:17:20,920 And this is like really dark because this foreshadows the entire sequence of problems 256 00:17:20,920 --> 00:17:25,200 that the Oracle thing experiences. 257 00:17:25,840 --> 00:17:31,440 In particular, the critical issue is that Charles, he right now he's getting nothing. 258 00:17:31,440 --> 00:17:35,400 So any bribe at all is higher than what he's getting which is like he's charitably kind 259 00:17:35,400 --> 00:17:37,180 of agreed to do this. 260 00:17:37,180 --> 00:17:38,340 Right now his payoff is zero. 261 00:17:38,340 --> 00:17:44,440 So any bribe he should take because his bribe would cause him to get a higher payoff. 262 00:17:44,440 --> 00:17:49,680 And a really annoying thing is that the only thing Beatrix can do is counter bribe and 263 00:17:49,680 --> 00:17:54,200 this is really unfair because she won the bet fair and square. 264 00:17:54,720 --> 00:17:59,600 Her like maximum bribe is really 500 if we're being serious because she could have just 265 00:17:59,600 --> 00:18:04,320 not put any money into this box at all, she would have been stuck at zero. 266 00:18:04,320 --> 00:18:10,320 So in order for this to be worth it for the person who wins, they actually have a less 267 00:18:10,320 --> 00:18:12,320 recourse than the person who loses. 268 00:18:12,320 --> 00:18:17,680 And this is sort of like a general problem which is that Charles, the decision to steal 269 00:18:17,680 --> 00:18:20,180 is worth 1,000 in this case. 270 00:18:20,620 --> 00:18:25,540 It doesn't always have to be 1,000 but there is always going to be some cost that is inherent 271 00:18:25,540 --> 00:18:29,340 to the oracle problem which I'm going to call the opportunity cost of theft. 272 00:18:29,340 --> 00:18:33,580 And it's going to be equal at least to the amount of money controlled by the oracle because 273 00:18:33,580 --> 00:18:42,820 whoever this oracle is, in this case, Charlie, he can throw the thing in some other way and 274 00:18:42,820 --> 00:18:46,500 make himself a party to that transfer. 275 00:18:46,500 --> 00:18:49,980 And so this is very dire situation right here. 276 00:18:49,980 --> 00:18:54,060 And the multi-signature solution in this case to reinterpret it through this lens is 277 00:18:54,060 --> 00:18:57,500 to just transfer that burden from Arthur where it originates. 278 00:18:57,500 --> 00:19:00,340 And it originates with Arthur because he lost the bet. 279 00:19:00,340 --> 00:19:06,260 So he loses the 500 and so there's an inherent cost of honesty that he must honestly lose 280 00:19:06,260 --> 00:19:08,380 his 500. 281 00:19:08,380 --> 00:19:13,140 And the solution here in quotes is to transfer that burden from Arthur to Charlie and simply 282 00:19:13,140 --> 00:19:15,760 hope that they cannot coordinate. 283 00:19:15,760 --> 00:19:18,620 But that's not very clever because they can easily coordinate. 284 00:19:19,620 --> 00:19:28,460 So this got more sophisticated in 2014 particularly with Counterparty but with a number of other 285 00:19:28,460 --> 00:19:33,380 people especially I think including BitShares and some other projects that were kind of 286 00:19:33,380 --> 00:19:34,980 had a weird take on this. 287 00:19:34,980 --> 00:19:39,300 But they said, okay, we're going to give up on identity which is smart because it's a 288 00:19:39,300 --> 00:19:40,300 lost cause. 289 00:19:40,300 --> 00:19:43,300 And they say, well, abstract the identities into roles, right? 290 00:19:43,300 --> 00:19:47,180 And we'll say there's users who are would be the people who are Arthur and Beatrix and 291 00:19:47,180 --> 00:19:48,820 they'll be reporters. 292 00:19:48,820 --> 00:19:53,140 And we don't care if they are the same people potentially or we don't know who they are 293 00:19:53,140 --> 00:19:54,740 and we're just going to forget about that. 294 00:19:54,740 --> 00:19:58,480 So already we've like given up on a lot of concrete things. 295 00:19:58,480 --> 00:20:01,660 And then it's pretty simple kind of business type model where the reporters are going to 296 00:20:01,660 --> 00:20:03,260 collect fees on an ongoing basis. 297 00:20:03,260 --> 00:20:08,660 It might be per report, it might be per minute, it might be per whatever. 298 00:20:08,660 --> 00:20:13,580 But whatever it is, since the users can choose their reporter when they make the, when they 299 00:20:13,580 --> 00:20:18,980 put the money in the box so to speak or when they want to initiate a bet of some kind in 300 00:20:18,980 --> 00:20:26,580 this very concrete example, there is an incentive for the reporters to get and keep a good reputation 301 00:20:26,580 --> 00:20:30,460 which is that if you have a bad reputation, you won't be chosen and you will lose this 302 00:20:30,460 --> 00:20:33,460 stream of ongoing fees. 303 00:20:33,460 --> 00:20:37,660 But no one really use this either because it has a lot of problems. 304 00:20:37,660 --> 00:20:43,380 So I'm going to walk you through this slide which is basically the decision calculus of 305 00:20:43,380 --> 00:20:47,660 this guy, the reporters over here, these judges so to speak. 306 00:20:47,660 --> 00:20:51,940 And there's three factors that go into their decision at least and this is like a basic 307 00:20:51,940 --> 00:20:57,100 finance NPV calculation of like net present value for those of you who are familiar with 308 00:20:57,100 --> 00:20:58,100 this. 309 00:20:58,100 --> 00:21:04,360 But the attack payoff is how much money they can get by just stealing from everyone. 310 00:21:04,360 --> 00:21:13,360 So, circumstances might be such that there ends up being like 50 million pounds more 311 00:21:13,360 --> 00:21:19,800 or let's say 50 million pounds that Brexit will happen and that Brexit equals yes and 312 00:21:19,800 --> 00:21:25,600 maybe 40 million pounds that Brexit equals no and so there's this extra 10 million there. 313 00:21:25,600 --> 00:21:31,040 The attack is that the reporter will himself become a user or a trader. 314 00:21:31,040 --> 00:21:35,240 Get against this outstanding 10 million pounds and then throw it, the switch the wrong way 315 00:21:35,240 --> 00:21:37,240 and extract the 10 million pounds. 316 00:21:37,240 --> 00:21:41,280 So this attack is all the money that they can get which is this opportunity cost of 317 00:21:41,280 --> 00:21:44,560 theft and that's offset by these payoffs that are in the future. 318 00:21:44,560 --> 00:21:49,920 So this table here, the horizontal axis represents time and you're going today, one day, two 319 00:21:49,920 --> 00:21:54,120 day, three days into the future and they have all this stuff, these payoffs in the future 320 00:21:54,120 --> 00:21:59,000 and then this third factor is a mapping that allows you to compare payments in the future 321 00:21:59,000 --> 00:22:02,520 to payments today and so it's basically how much they care about the future. 322 00:22:02,520 --> 00:22:06,080 And the assumption in order to make our guarantee which is our goal, our design goal is to make 323 00:22:06,080 --> 00:22:14,080 this guarantee that the box will work which we absolutely cannot do in this case but in 324 00:22:14,080 --> 00:22:17,920 order to make the guarantee, it has to be the case that it's always true that the payoffs 325 00:22:17,920 --> 00:22:21,840 in the future outweigh the attack payoff today and I think it should be pretty obvious why 326 00:22:21,840 --> 00:22:26,600 that's not the case but I'm going to explain some of it anyway which in there, there's 327 00:22:26,600 --> 00:22:32,600 a triple uncertainty, each of the three factors can wander into a dangerous zone where it 328 00:22:32,600 --> 00:22:38,960 guarantees the failure of the scheme and if any of the three factors fail, the entire 329 00:22:38,960 --> 00:22:44,940 scheme fails and there's no, more importantly, there's no way to guarantee ahead of time 330 00:22:44,940 --> 00:22:47,000 that it won't enter any of those zones. 331 00:22:47,000 --> 00:22:49,880 So this is like a giant disaster but I'm going to walk through some of it. 332 00:22:49,880 --> 00:22:54,400 The attack payoff today which we want to be low because we want the scales to tilt to 333 00:22:54,400 --> 00:22:59,880 the right, there's nothing preventing that from skyrocketing if the market becomes unexpectedly 334 00:22:59,880 --> 00:23:00,880 popular. 335 00:23:00,880 --> 00:23:06,360 So you could have like something that just, some reason everyone wants to bet on something 336 00:23:06,360 --> 00:23:13,000 with some reporter, there's no clear way to limit the popularity of like, you know, like 337 00:23:13,000 --> 00:23:16,640 it's sort of like a little bit what David was saying where he was saying that sometimes 338 00:23:16,640 --> 00:23:21,240 the service becomes too popular and the network has to like kind of rebalance slowly but in 339 00:23:21,240 --> 00:23:24,240 this case, there is no rebalancing, it's too late. 340 00:23:24,280 --> 00:23:25,680 So this thing can skyrocket. 341 00:23:25,680 --> 00:23:32,120 The red payments that we want to be high, they can decrease for any number of reasons. 342 00:23:32,120 --> 00:23:36,040 One is just that the reporter industry might become more competitive or there could just, 343 00:23:36,040 --> 00:23:38,480 not only could there be news of that, it doesn't actually need to happen. 344 00:23:38,480 --> 00:23:41,320 It could be a rumor, it could be false. 345 00:23:41,320 --> 00:23:44,040 So this is very dire. 346 00:23:44,040 --> 00:23:47,600 More people might join the industry or they might have different offerings in this case 347 00:23:47,600 --> 00:23:53,460 so they would not be able to, they'd say, okay, I'm going to lose this stream of payments 348 00:23:53,460 --> 00:23:56,340 but I'm going to lose it anyway so, of course, I'll just attack everything and steal the 349 00:23:56,340 --> 00:23:57,740 money today. 350 00:23:57,740 --> 00:24:01,020 The reporter's concern for the future, we want it to be high but there's nothing preventing 351 00:24:01,020 --> 00:24:02,680 it from decreasing. 352 00:24:02,680 --> 00:24:06,020 The person might decide there's enough money in here for them to retire, they don't care 353 00:24:06,020 --> 00:24:09,640 about their future at all or they might get some terminal illness or they could pretend 354 00:24:09,640 --> 00:24:13,900 to be hacked or they could really be hacked and then the hacker would not similarly care 355 00:24:13,900 --> 00:24:16,100 about their reputation. 356 00:24:16,100 --> 00:24:19,700 So this is totally doomed but I'm going to walk it back through the framework of before. 357 00:24:19,700 --> 00:24:23,780 This is this opportunity cost of theft that's still here, it's equal to the amount of the 358 00:24:23,780 --> 00:24:29,820 losing bet and that amount and it's potentially large if there are many users which in the 359 00:24:29,820 --> 00:24:32,780 number of users can skyrocket unexpectedly. 360 00:24:32,780 --> 00:24:37,340 And this fee that we can extract here is to offset that and it's based on the utility 361 00:24:37,340 --> 00:24:38,340 of the service. 362 00:24:38,340 --> 00:24:39,340 So this is much better. 363 00:24:39,340 --> 00:24:43,480 This is an improvement over the terrible multisig world where we are compensated for honesty 364 00:24:43,480 --> 00:24:44,860 this time. 365 00:24:44,860 --> 00:24:48,420 And this is some new psychological parameter that's specific to this solution attempt and 366 00:24:48,420 --> 00:24:49,420 it's unreliable. 367 00:24:49,420 --> 00:24:54,220 But the overall result is that this is a small improvement but it's still nowhere near good 368 00:24:54,220 --> 00:24:58,220 enough which is why people really did not use this service to do anything interesting 369 00:24:58,220 --> 00:24:58,940 like the... 370 00:24:59,181 --> 00:25:26,181 blockchain enforced futures contracts that Gavin mentioned. People really are not doing that. It's got to be really good to be useful for that and so I'm going to try to just walk you through a little bit of this and again this is sort of like the plane versus boat thing where I'm not going to be able to explain the plane in detail but just try to draw the contrasts as much as possible which is that this is part of kind of my thinking on the issue which is one thing 371 00:25:26,181 --> 00:25:30,021 improvement that I made is that I'm going to make a reputation itself a 372 00:25:30,021 --> 00:25:35,541 tradable resource in this finite and tradable resource in this system and so 373 00:25:35,541 --> 00:25:38,381 there's some pseudo corporation that's kind of not really a corporation of 374 00:25:38,381 --> 00:25:43,661 course but in an abstract sense it is behaves kind of with the it's a nexus of 375 00:25:43,661 --> 00:25:48,301 stakeholders that have ownership so it exists to prove its consistency within 376 00:25:48,301 --> 00:25:52,061 and across time and collects money to power the mechanism so it provides this 377 00:25:52,061 --> 00:25:56,781 service here the reason that making reputation itself tradable is important 378 00:25:56,781 --> 00:26:01,781 is because it's a basic of finance that the stream of payments coming in which 379 00:26:01,781 --> 00:26:05,421 is this red thing before we'll go back to it the stream of payments coming in 380 00:26:05,421 --> 00:26:09,781 should actually be equal to the current market capitalization of the shares of 381 00:26:09,781 --> 00:26:15,661 the corporation so if you want to buy up the this corporation your attack is so 382 00:26:15,661 --> 00:26:19,141 your attack is not to be a reporter and then decide to do something wrong your 383 00:26:19,861 --> 00:26:25,621 your attack is to buy up 51% or 75% or whatever it is of this corporation and 384 00:26:25,621 --> 00:26:31,141 then force the entire group to make everything go haywire but the reason 385 00:26:31,141 --> 00:26:34,461 that it's important to make reputation itself tradable is that it deletes that 386 00:26:34,461 --> 00:26:39,741 third factor of time from the equation because theoretically the current market 387 00:26:39,741 --> 00:26:44,661 capitalization of the company should be equal to the present value of all the 388 00:26:44,781 --> 00:26:49,381 money coming in so similarly if the market becomes unexpectedly popular if 389 00:26:49,381 --> 00:26:52,901 any market it was in this corporation or the entire system becomes unexpectedly 390 00:26:52,901 --> 00:26:57,861 popular the it should the expected future fees should be going up or indeed 391 00:26:57,861 --> 00:27:01,741 the present ones because the sort of dividends that are paid are a function 392 00:27:01,741 --> 00:27:06,381 of the trades that are being made they happen later so they the money that's 393 00:27:06,381 --> 00:27:09,301 coming in as the service gets more popular should directly translate to a 394 00:27:09,301 --> 00:27:14,221 higher market capitalization immediately today so there's some stuff that's 395 00:27:14,381 --> 00:27:19,581 offsetting this here and I do some other things as well which I don't really want 396 00:27:19,581 --> 00:27:24,101 to explain this slide is from a different talk that I'm reusing but one 397 00:27:24,101 --> 00:27:30,581 thing I do is I have everyone in the corporation submits a report on every 398 00:27:30,581 --> 00:27:34,141 single thing that is resolved and I cross-reference those things against 399 00:27:34,141 --> 00:27:39,181 each other for consistency but also to produce some information about who is 400 00:27:39,181 --> 00:27:43,381 lying and what and there's sort of a kind of it's not really a cluster 401 00:27:43,421 --> 00:27:46,901 analysis it's actually something else but more or less you can tell if some 402 00:27:46,901 --> 00:27:50,661 people are being some people innocently got something wrong or some people are 403 00:27:50,661 --> 00:27:54,581 just like out to reverse everything and steal all the money and it kind of very 404 00:27:54,581 --> 00:27:59,341 makes it much more obvious like what people are kind of doing and one thing I 405 00:27:59,341 --> 00:28:02,861 do want to emphasize the strategic use of time which is that it's easy in the 406 00:28:02,861 --> 00:28:06,141 blockchain to lock money this is something that David was talking about a 407 00:28:06,141 --> 00:28:11,181 little bit as well in his talk it's easy to lock money for a period of time but 408 00:28:11,181 --> 00:28:16,501 as time goes on the kind of it's more easier to find truth and more easy to 409 00:28:16,501 --> 00:28:20,181 kind of figure things out which is kind of one of the reasons why a court move 410 00:28:20,181 --> 00:28:25,421 slowly slowly and that's not a bad thing so the net effect is that time 411 00:28:25,421 --> 00:28:28,701 penalizes attackers only and so you have this money locked in it's locked in the 412 00:28:28,701 --> 00:28:32,901 box that's not leaving but the box is gonna take a really long time to open 413 00:28:32,901 --> 00:28:36,901 and the future contracts don't actually need to settle up again for a reason 414 00:28:36,901 --> 00:28:39,901 that's totally financial and has nothing to do with computer science whatsoever 415 00:28:39,901 --> 00:28:46,701 the futures price of this box the what the box is worth should track whatever 416 00:28:46,701 --> 00:28:50,741 the whatever a real futures contract would be worth because if one is worth 417 00:28:50,741 --> 00:28:54,621 different from the other you buy the cheaper one you short the higher one and 418 00:28:54,621 --> 00:29:00,221 you extract money for free and since that would be if anyone who does that 419 00:29:00,221 --> 00:29:04,261 will reharmonize and equalize those prices so I don't really want to explain 420 00:29:04,261 --> 00:29:08,061 a lot of this but what I do want to explain is how this can break because it 421 00:29:08,061 --> 00:29:11,581 is itself fragile so it's gonna break in a way that's totally itself bizarre 422 00:29:11,581 --> 00:29:18,701 and yet is relies on a lot of simplicity so this slide there's two slides for 423 00:29:18,701 --> 00:29:23,061 this the second one is where everything breaks but this is just a setup of some 424 00:29:23,061 --> 00:29:27,781 very very simple things simple premises that you have to get admitted and one is 425 00:29:27,781 --> 00:29:32,461 that this stuff is happening in a very specific order so first there are must 426 00:29:32,461 --> 00:29:36,661 be multiple oracles because there's no way to stop people from you know copying 427 00:29:36,661 --> 00:29:43,501 the service and creating it again and once someone chooses an oracle then you 428 00:29:43,501 --> 00:29:49,301 have to wait for in order to evaluate so you choose first and then later on you 429 00:29:49,301 --> 00:29:53,581 want to evaluate if that oracle was actually honest or not so in this case 430 00:29:53,581 --> 00:29:58,381 you've chosen the blue oracle it's a thicker arrow there and then the blue 431 00:29:58,381 --> 00:30:03,501 oracle is paired with some event in this case is this moon half crescent moon 432 00:30:03,501 --> 00:30:07,981 event and then they have a report where they're gonna tell you this thing and 433 00:30:07,981 --> 00:30:11,221 that's gonna this thing is gonna go into the blockchain and then stuff will 434 00:30:11,221 --> 00:30:15,021 happen with it it will be referenced as a thing that everyone knows but it's 435 00:30:15,021 --> 00:30:18,181 only after that phase two happens that you can actually check and see if 436 00:30:18,181 --> 00:30:21,221 whether or not the oracle actually reported correctly because you need the 437 00:30:21,221 --> 00:30:25,221 report and the event the report before the event happens maybe they could get 438 00:30:25,221 --> 00:30:28,541 lucky or something but you need you need both in order to actually check to see 439 00:30:28,541 --> 00:30:31,741 if they did it right and so since there's this degree of freedom here that 440 00:30:31,741 --> 00:30:35,941 is not removable it must be possible it must be the case that they vary in 441 00:30:35,941 --> 00:30:41,701 quality the oracles from 100% honest and the lower bound is actually 50% because 442 00:30:41,701 --> 00:30:45,581 if they were a 0% honest that you would just flip everything and they would be 443 00:30:45,581 --> 00:30:49,261 honest again but the point is a very simple one that if there are multiple 444 00:30:49,261 --> 00:30:52,781 oracles they must have the freedom to vary in quality and it turns out that 445 00:30:52,781 --> 00:30:59,421 simple premise destroys just about everything which is that the there's so 446 00:30:59,421 --> 00:31:04,341 some are more honest than others and they must charge this fee to offset all 447 00:31:04,341 --> 00:31:08,141 of their costs and so if they can't do that then they're just out of business 448 00:31:08,141 --> 00:31:12,741 and they won't exist it's unsustainable of course but one of the one of their 449 00:31:12,741 --> 00:31:16,981 costs is this quality premium which is a really important point to emphasize 450 00:31:16,981 --> 00:31:23,581 because I'm having the top here honesty is costly to the oracle everything every 451 00:31:23,581 --> 00:31:28,301 time they're honest they are foregoing some opportunity to steal the money and 452 00:31:28,301 --> 00:31:33,061 so every so in order to compensate them for that we they have to charge this is 453 00:31:33,061 --> 00:31:36,461 a cost it's not like a profit or anything like that they need even though 454 00:31:36,461 --> 00:31:41,541 it's an inherently abstract concept theoretical kind of concepts it they 455 00:31:41,541 --> 00:31:46,021 must charge more for being higher quality than they would charge if they 456 00:31:46,021 --> 00:31:50,941 were going to be low quality and this is in addition to other costs that they may 457 00:31:50,941 --> 00:31:54,141 or may not have such as the labor of like you know the 30 seconds it would 458 00:31:54,141 --> 00:31:57,621 spend to Google something they didn't already know and maybe something about 459 00:31:57,621 --> 00:32:02,221 that setup so the problem here is that as I say in the title of this slide you 460 00:32:02,221 --> 00:32:05,821 need something that's sort of like a pseudo copyright and it took a long time 461 00:32:05,821 --> 00:32:09,661 to figure out for me to figure out exactly how this would be done and I'm 462 00:32:09,661 --> 00:32:12,421 not gonna explain how it's done here but I'm just gonna say if you don't have it 463 00:32:12,421 --> 00:32:16,381 why everything breaks so you by you don't mean like a literal copyright or 464 00:32:16,381 --> 00:32:19,221 any kind of legal enforcement of anything like that but you do need 465 00:32:19,221 --> 00:32:24,501 something that will censor someone who steals the information in order to 466 00:32:24,501 --> 00:32:28,221 purchase quality if you can't do this and you can't purchase quality and all 467 00:32:28,221 --> 00:32:31,581 the reporters will be low quality and there'll be this kind of collapse of 468 00:32:31,581 --> 00:32:37,301 unraveling markets which is the term so this red guy he's making it kind of an 469 00:32:37,301 --> 00:32:41,461 evil statement that he's gonna copy the blue guy what when he reports and he can 470 00:32:41,461 --> 00:32:45,261 do that in any number of ways one is by just watching the blockchain to wait for 471 00:32:45,261 --> 00:32:48,981 one of those two people to get paid and say if they get paid that triggers this 472 00:32:48,981 --> 00:32:52,941 thing or they could program them to just simulate blue or just look it up or 473 00:32:52,941 --> 00:32:57,541 anything there's any number of very easy ways of doing this now the thing is 474 00:32:57,541 --> 00:33:02,421 once this guy's coded up he's always going to be cheaper it's unavoidable 475 00:33:02,421 --> 00:33:06,741 that he will be he will be able to charge less for this exact same service 476 00:33:06,741 --> 00:33:12,061 to the users but he will always be exactly as reliable I'm gonna walk 477 00:33:12,061 --> 00:33:16,181 through that which is that blues report is on the blockchain and now it's a 478 00:33:16,181 --> 00:33:20,781 public non-excludable resource that anyone can verify and we've kind of 479 00:33:20,781 --> 00:33:23,701 flipped the tables on that which is that anyone can validate and verify this 480 00:33:23,701 --> 00:33:28,101 that blue actually did report that and that's exactly what red is gonna 481 00:33:28,101 --> 00:33:34,181 exploit red is going to take blues contract here and he's just gonna copy 482 00:33:34,181 --> 00:33:39,141 it and he's not gonna do any effort on his own and the issue is not that he the 483 00:33:39,141 --> 00:33:44,301 issue is not that he is saving on labor the issue is that he is always exactly 484 00:33:44,301 --> 00:33:49,701 as reliable but he will has no reason to charge the quality premium and so since 485 00:33:49,701 --> 00:33:53,501 he's always exactly as reliable and always cheaper there's really no logical 486 00:33:53,501 --> 00:33:59,661 basis for any users to pick blue over red because they're the same they're 487 00:33:59,661 --> 00:34:05,781 exactly the same things if one's cheaper so in short but even since everyone may 488 00:34:05,781 --> 00:34:08,661 be foreseeing that or at least not willing not being willing to wait to 489 00:34:08,661 --> 00:34:12,461 kind of investigate if this is worth it this kind of entire scheme will never 490 00:34:12,461 --> 00:34:18,221 pick up momentum because it will just constantly be in a state of uncertainty 491 00:34:18,221 --> 00:34:23,661 but long story short since the red guy is always as cheap or cheaper than the 492 00:34:23,661 --> 00:34:27,341 blue guy so we all excuse me it's always cheaper the blue guy and always exactly 493 00:34:27,341 --> 00:34:31,101 the same service the blue guy goes out of business and this scheme doesn't work 494 00:34:31,101 --> 00:34:37,061 and the idea behind the corporation pseudo corporation idea is that you 495 00:34:37,061 --> 00:34:41,221 successfully spread the opportunity cost of theft widely over many people and 496 00:34:41,221 --> 00:34:45,421 over a long time period very infrequent reporting and you've minimized the total 497 00:34:45,421 --> 00:34:49,341 amount of information that someone needs to assess when they're looking at 498 00:34:49,341 --> 00:34:56,181 whether or not this thing is honest or broken but the problem in this case very 499 00:34:56,181 --> 00:35:00,901 bizarre failure is that the maximum reward these people could get for their 500 00:35:00,901 --> 00:35:05,461 efforts is zero and so in turn the shares by that same finance kind of 501 00:35:05,461 --> 00:35:10,221 theory I was mentioning before the shares of the honest corporation will be 502 00:35:10,221 --> 00:35:14,061 worth the net present value of a stream of zeros which will be zero which will 503 00:35:14,061 --> 00:35:17,221 mean that it would be trivial to purchase the shares and attack which 504 00:35:17,221 --> 00:35:21,541 means that no one has any reason to trust that the system will operate the 505 00:35:21,541 --> 00:35:25,701 way it was designed and that's basically it so I'm just going to repeat the 506 00:35:25,701 --> 00:35:29,101 takeaways which is that with blockchain there's less trust everything is harder 507 00:35:29,101 --> 00:35:32,781 it would have been a lot easier to just have Google do this or have Google 508 00:35:32,781 --> 00:35:36,301 publish some keys or something but in the blockchain threat model everyone is 509 00:35:36,301 --> 00:35:42,221 a threat and so we're doomed and there is a difference between programmers and 510 00:35:42,221 --> 00:35:45,821 contract authors specifically smart contract authors and so in particular 511 00:35:45,821 --> 00:35:49,981 number one there well that was with a it was too easy for the user to assume two 512 00:35:49,981 --> 00:35:54,901 identities or make some bribe and with two it was too easy for the service to 513 00:35:54,901 --> 00:36:00,301 be too popular it was a victim of its own popularity and then in the third 514 00:36:00,301 --> 00:36:05,581 one it was too easy for rivals to enter and steal the service and in my opinion 515 00:36:05,581 --> 00:36:12,101 in the blockchain world code is built on a foundation of incentives so what I 516 00:36:12,101 --> 00:36:16,301 hope I what I was hoping to do is just draw a severe contrast as possible 517 00:36:16,301 --> 00:36:20,581 between the way this would normally be done by anyone writing normal software 518 00:36:20,581 --> 00:36:24,181 which is that they would just there'd be some reliable database for this that 519 00:36:24,181 --> 00:36:28,941 you would just dial out to and the blockchain world and so I hope that 520 00:36:28,941 --> 00:36:31,701 you've learned a little about the peer-to-peer Oracle why it's such a 521 00:36:31,701 --> 00:36:35,821 difficult problem and in particular why it's much harder than just asking 522 00:36:35,821 --> 00:36:40,021 someone else for the answer and then in turn you've learned more about 523 00:36:40,021 --> 00:36:44,661 blockchain and so thank you very much for your attention 524 00:36:47,221 --> 00:36:51,461 thank you Paul thanks we have time for a couple of questions if there's anyone 525 00:36:51,461 --> 00:36:54,861 that wants to ask something or if there's anyone that understood most of 526 00:36:54,861 --> 00:37:02,581 that talk it was it was in depth thank you any questions at the end of the day 527 00:37:02,581 --> 00:37:09,421 oh hey Elaine does Olga have active markets going it doesn't matter to what 528 00:37:09,421 --> 00:37:19,781 I was presenting here because it won't they don't work in equilibrium so it 529 00:37:19,781 --> 00:37:26,941 still exists but it yeah but it would want though I mean it doesn't it hasn't 530 00:37:26,941 --> 00:37:29,981 even launched in some sense depends on who you ask you ask them they say they 531 00:37:29,981 --> 00:37:35,541 haven't launched yet so so I guess I would say no I don't know but they have 532 00:37:35,541 --> 00:37:40,781 you know markets on you can look at but you know they're not they exist in the 533 00:37:40,781 --> 00:37:47,621 sense that everything it's like only in like a testing kind of phase I guess I 534 00:37:47,621 --> 00:38:01,181 would say well you know but I mean a lot of things that are literally test 535 00:38:01,181 --> 00:38:05,501 nets have tokens that are traded on coin market cap you could trade Zcash 536 00:38:05,501 --> 00:38:12,461 before launch on BitMEX yeah being having having a token traded on coin 537 00:38:12,461 --> 00:38:15,861 market cap is actually a contra indicator of value I think it's like the 538 00:38:15,861 --> 00:38:19,861 more valuable the coin is on coin market cap the less valuable the project 539 00:38:19,861 --> 00:38:24,021 will ultimately be I think yeah they're going to be in the sole 540 00:38:24,021 --> 00:38:31,141 exception the exception that proves the rule cool anything else it's you could 541 00:38:31,141 --> 00:38:35,061 comment on that that oh did you have a question 542 00:38:45,861 --> 00:39:07,861 I agree with you I'm not sure so that is one thing that so there's a separate 543 00:39:07,861 --> 00:39:10,301 issue with that I think yeah so I think you're completely right if we had 544 00:39:10,301 --> 00:39:13,541 something like where someone published a website and they said I'm gonna offer 545 00:39:13,541 --> 00:39:19,021 this service and I will sign whatever the British pound to Bitcoin exchange 546 00:39:19,021 --> 00:39:23,341 rate is and I will only do that once every you know a couple months and then 547 00:39:23,341 --> 00:39:26,301 you can set up a bunch of stuff based on that and we'll reference that and they 548 00:39:26,301 --> 00:39:29,221 their signature will go into the blockchain the problem with that is that 549 00:39:29,221 --> 00:39:35,381 all of the money there is is reliant on that one person so even if they are 550 00:39:35,381 --> 00:39:39,221 honest they could be like maybe hacked or something so it's like the Bitcoin 551 00:39:39,221 --> 00:39:42,261 exchanges so I don't know if you're familiar everyone here is but every 552 00:39:42,261 --> 00:39:45,981 Bitcoin exchange has basically been hacked at one point or another and 553 00:39:45,981 --> 00:39:49,101 emptied of all of its money and there's like really no way to tell if it's like 554 00:39:49,101 --> 00:39:55,341 an inside job or there's a legitimate security problem or if the founders just 555 00:39:55,341 --> 00:39:58,661 absconded with the money and embezzled it or something to their friends or 556 00:39:58,661 --> 00:40:04,381 there's like it's really really hard to tell so the the the kind of the ethos of 557 00:40:04,381 --> 00:40:09,541 Bitcoin is that you control your own money and by putting it in the hands of 558 00:40:09,541 --> 00:40:14,381 someone else you kind of are not operating in that world anymore hence 559 00:40:14,381 --> 00:40:19,021 the focus on this box that you have this guarantee for you know this bearer token 560 00:40:19,021 --> 00:40:25,221 that is worth some other amount of money but you you're right that that could 561 00:40:25,221 --> 00:40:28,101 work it probably won't work at scale though because if something is worth 562 00:40:28,101 --> 00:40:31,781 like 20 million dollars or 20 million pounds or something then that's a big 563 00:40:31,781 --> 00:40:35,541 incentive to throw the switch the wrong way and even if you don't do it other 564 00:40:35,541 --> 00:40:40,941 people will try to hack you for it and I'm not sure that that will scale I 565 00:40:40,941 --> 00:40:51,901 don't think it will scale in monetary sense cool anything else yes 566 00:40:51,901 --> 00:40:54,901 it was 567 00:40:55,901 --> 00:41:06,541 new sources or I guess correct well it did it did work for a while but then it 568 00:41:06,541 --> 00:41:11,701 didn't work you know and then it yeah then it had to comply with some laws and 569 00:41:11,701 --> 00:41:16,861 the also the founder hiked Mount Everest and died and then some people it was 570 00:41:16,861 --> 00:41:19,901 ambiguous like MF global situation where some people were like stealing money 571 00:41:19,901 --> 00:41:24,101 from it or something they were using the money to make safe investments and they 572 00:41:24,101 --> 00:41:29,301 were not allowed to do but yeah in trade is great it is not an example of 573 00:41:29,301 --> 00:41:33,501 something where there's a guarantee because so that's the world of non 574 00:41:33,501 --> 00:41:36,661 blockchain of like the legal world where it's not automated and you have 575 00:41:36,661 --> 00:41:40,181 contracts with a person that has a brand and they have a mailing address and they 576 00:41:40,181 --> 00:41:45,301 have something like that and you as a consequence it's a normal business and 577 00:41:45,301 --> 00:41:49,661 not in the blockchain world it's not automated in trade had a number of 578 00:41:49,661 --> 00:41:54,021 problems that I could maybe lists but they're not important because you could 579 00:41:54,021 --> 00:41:59,061 if you ran into it a different way you would be able to fix those problems but 580 00:41:59,061 --> 00:42:02,661 one thing that you couldn't fix is that it would not be this automated computer 581 00:42:02,661 --> 00:42:07,381 system that would maybe be able to operate without any forms of censorship 582 00:42:07,381 --> 00:42:12,341 or control and they would give this these financial tools to everyone in the 583 00:42:12,341 --> 00:42:17,101 world and that is something that would not be the case for in trade you had in 584 00:42:17,101 --> 00:42:21,381 order to like wire money to in trade it was expensive and cumbersome and slow 585 00:42:21,381 --> 00:42:26,381 and that was a result purely of artificial regulatory and legal 586 00:42:26,381 --> 00:42:31,261 requirements and it ended up not working for a lot of reasons but basically that 587 00:42:31,261 --> 00:42:38,101 company went bankrupt and had some problems that we could list cool does 588 00:42:38,101 --> 00:42:46,901 that answer your question cool all right any more questions 589 00:42:46,901 --> 00:42:54,101 it's beer o'clock thank you very much for attending guys