Okay, so Ricardo asked me to give this talk, and he's like, yeah, come to this blockchain

panel, and I was like, I don't know about that, and he's like, no, it's beyond the hype.

It's beyond the hype.

It's blockchain beyond the hype.

And I was like, oh, okay, that sounds fun, I think I can do that.

So I'm going to talk about this problem and why it's so much harder here, and the subtitle

here, I'm going to read it to you, is Honest Reporting in Peer-to-Peer Networks When Everyone

Has an Incentive to Lie, and You Don't Even Know How Many People There Really Are.

So it's a really hard problem to solve, and it's a really important problem.

But what I thought I would do to go beyond the hype is try to contrast how easy this

problem would be if you just didn't have to use a blockchain.

It would be very easy.

But instead, we have something that's really, really hard.

And so the goal is really to draw the contrast as clearly as possible, and I have this little

paper airplane ship thing going because I'm going to try to talk about maybe aerospace

engineering in some sense, and maybe people will be able to follow it, maybe they won't.

But the point is just to draw as much of a contrast as possible between the two modes

so that it's really clear how different blockchain is from other things, because it's very, very,

very different in my point of view.

And so the overview here is that I'm going to try and give you the thesis straight off,

then I'm going to introduce what this problem is in some detail, and then I'm going to talk

about kind of the history of trying to solve this problem and how people have failed in

very complicated ways that did not involve a lot of computer science, and that instead

involved things like economics.

So here are kind of the takeaways that I'm hoping that people will get, which is that

blockchain means that you, it doesn't mean that there is less trust, but the security

model in blockchain is that everyone is a threat and you cannot trust anyone, which

is like a high bar.

So that means everything is way more difficult here than it would normally be.

And the second thing is something that I really liked, Peter Todd emphasized it in his talk,

and even I think Elaine and a couple other people mentioned it, which is that there's

a developer or someone who wants to write software for people, usually wants to enable

the user to do more things.

And Peter Todd gave the example of Photoshop, and he's like, you add new layers or colors

or something and that's a new thing you want your user to be able to do.

But contracts are about allowing people to like opt into a contract and then the contract

constrains them so they can do less.

So if you sign a contract with your employer, instead of being able to do whatever he wants

with his money, he has to give some of it to you every month or every hour or whatever.

And so contracts are about making things impossible, which is very opposite and quite different.

And in particular, the Oracle is going to, I'm going to point out these examples where

the Oracle fails for things that the user, actions that the user are allowed to take.

And I'm going to say that in the blockchain world, code is built on a foundation of incentives.

But before we can talk about that, we have to talk about what this problem is.

And it has nothing to do with the Oracle Corporation.

It is this issue of the blockchain not inherently knowing any information about the real world.

It only knows what people bring to it and submit in to the blockchain system.

So I have an unhappy Bitcoin there and it's thinking about what it's own exchange rate is.

But it doesn't know anything about that because it doesn't inherently know anything about

US dollars or in this case, British pounds.

And we know that it's around 1,000 British pounds for Bitcoin today, but there's no way

that the blockchain itself can know this problem.

And because in general, the more abstract something is in this space, the more dishonest

its contributors tend to be, I'm going to try to make this very concrete and not abstract

at all.

And I'm going to say that we're going to use this one example almost the entire time, which

is that two people are going to bet or at least some number of people are going to be

betting on Brexit.

And much earlier in the past, before Brexit happens, we're going to have Arthur and Beatrix

who disagree over what will happen in the future.

And Arthur says that Britain is going to remain and Beatrix says leave and Arthur offers

to bet 500 and Beatrix says fine.

And so in the real world, they would just kind of maybe settle up in human or something

like they would just, they know each other personally and their reputation would suffer

or something like that.

But the issue here is that we want to automate this process with a computer and replace it

and make it so that it doesn't depend on individual people knowing each other and people can just

meet on the internet and do this.

So now, later on in the present, we know that the outcome was leave.

And in order to automate this process, we're going to have them put some money in a box

and then that box is going to have to open.

To be very, very, very concrete about this, the Oracle problem is that we want to be able

to guarantee that the box is worth whatever under condition A and whatever other thing,

so Y, X and Y, under different conditions.

So given conditions A has to be worth X, given conditions B has to be worth Y and the crucial

thing is we want to make that guarantee at all times but particularly when they're putting

the money in.

So we don't want to like, you know, the guarantee has to be something that they can rely on

when they're putting the money in the box.

So we need some kind of magical box that only opens and gives the money to Arthur in one

case and only opens and gives the money to Beatrix in a different case and doesn't do

anything else and we can't expect to do anything else.

So I'm going to talk a little, one slide about why we should solve this problem and this

is a screenshot from Gavin Andreessen who when he wrote this blog post was the chief

scientist of the Bitcoin Foundation and he is talking about something kind of complicated

but I'm just going to read to you this highlighted part which is that he says, all the really

interesting complex contracts I can think of require data from outside the blockchain

like the Bitcoin US dollar exchange rate on some future date for blockchain enforced futures

contracts and that data from outside, that is the Oracle problem that I'm referring to

and I want to be totally clear about exactly what this problem is so you get a better idea

of kind of what we're talking about here.

And as was mentioned, we don't want to like bother courts or any kind of humans with this.

We want to the extent that humans are involved at all, we want to be able to expect them

to be as lazy and selfish and anonymous as possible and so ideally, they wouldn't be

involved one bit but they're going to have to be involved a little bit.

But why solve this problem?

I mean, we're talking like lots of applications in finance, insurance, even Internet of Things,

you want to like, if a car is supposed to pick you up, the blockchain needs to know

somehow if the car actually did come or if anything actually did happen.

So this world of information is very important.

And in the non-blockchain world, it would be very, very, very easy because you would

just dial out to some place and ask them.

And this is some random thing I found on Google Images but apparently, this is some free service

that OCRs images and gives you JSON of whatever the text is in those images.

And that's not really relevant, you know, just in an abstract sense, you could dial

out to Google and ask them about the result for Brexit or you could compare search results

or something like that and you could ask someone, you could compare Twitter amounts or any kind

of metric that you could use by just dialing out to someone else.

But we're not going to be able to do that in the blockchain world and I'm going to explain

why, which is that the blockchain has features that prevent that from happening.

So the good thing about the blockchain is that it's very automatic and it's immune to

tampering and it's very resistant to censorship.

It's the miners who control which messages get in usually don't have any context about

those messages at all.

They only know the fee that they're getting paid and like the kilobytes of the message

so they have a very clear incentive to just include whatever.

They only remove messages that are spam basically.

And that's very good for our guarantee because it's so simple and ironclad that it's easy

to, this is the only system in which you could even make such a guarantee.

But the bad news is that there are no inherent identities on the blockchain, there's certainly

none that are programmed in from the beginning.

And every user must be able to validate the entire history, it's like an engineering requirement,

it's just difficult.

And everyone participating needs to be able to have some way of coming to total consensus

and a unique valid history down to the very last byte.

It has to be exactly the same, they have to get identical hash function results.

So the reason we cannot just dial out to someone else is that it's possible for you to dial

out today and understand what's happening today but it's not possible for you to do

that yesterday.

So I'm going to go into a little bit of detail on this point, which is that this is from

Satoshi's white paper and I'm just going to read some parts, which are that the longest

chain not only serves as proof of the sequence of events witnessed.

So what the blockchain is doing is proving a sequence of events that have been witnessed.

And if you're going to download the blockchain for yourself, you are going to need to re-download

everything and yourself verify that you have the same sequence of events as everyone else.

But not only do you need the same sequence as everyone else, there can't be any messages

in the sequence that break the rules.

And I'm going to go into that in like two minutes but let me read this next part, which

is that the longest proof of work chain has proof of what happened while they were gone.

So people are going to be leaving and joining this network, they're not going to be totally

synchronized.

They may need to leave their computer for some reason or their computer could catch

on fire or something and they need to redo some of this.

It won't be very synchronized and we're going to need to have proof of everything that happened.

And I think I explained this a little bit better on this other slide.

So you need to have the, you need to be able to verify the entire history at all times.

So not just when the history is being written.

So you can prove what Google said today.

You just Google it yourself today and you check that what you got matches whatever someone

else says that the answer is.

And so then you can verify that that is the case.

But what you can't do is prove what Google said yesterday because you'd have to time

travel to yesterday in order to Google it then and verify it back then.

So if we're talking something that is like going to be operating for many, a long time

in the future, people will join the network in the future and they will need to verify

everything that's been happening over the time since the network began, since they joined

it and they can't do any of those things.

And there are some other issues with just kind of trusting Google for this which are

that some people, depending on where they are located in the world or what time of day

or if they're signed in or something, they may not get exactly the same results which

we have to get down to the exact byte.

They have to be exactly the same.

And I have kind of asked yous up here the, I'm going to, I think so on this next slide

I'm going to point out that Satoshi planned the Bitcoin network to be unalterable for

like a hundred years.

So I have this quote from Satoshi which didn't fit so I broke it into two but I'm going to

read just the first sentence of it to you which is that, the nature of Bitcoin is such

that once version 0.1 was released, the core design was set in stone for the rest of its

lifetime.

And on the right I have when he actually announced version 0.1, so I have exactly what he was

talking about.

So on the right is the thing that he's talking about that cannot be changed and is set in

stone for the rest of its lifetime.

And he announces a number of things there but one of the things he announces in particular

is the circulation of the coins which will be distributed to network nodes when they

make blocks with the amount cut in half every four years and the final year of this plan

is the year 2140.

So this post does explain how Bitcoin can be extended and improved over time and indeed

it has been upgraded a lot since June 17th, 2010.

But the core design is set in stone and this is a big contrast to something like anything.

I mean like we're talking like Corda, Hyperledger or even modern day things that are relatively

blockchain like such as Ethereum which hard for and even Monero, Ricardo who introduced

me his project, they will, they plan to reset the network every six months like manually

but that's not what Satoshi did.

He turned it, when he turned it on January 1st, excuse me, January 9th, 2009, it actually

has not been substantially changed since then.

There has been one change that was snuck through as the, it's a quirk but that was snuck through

a long time ago and it's not very relevant at all.

In fact, you don't actually need to upgrade for that change to protect you.

But the point is that this network is very, it's designed to be resistant so that you

can make guarantees of this kind with the box because we want people to be maybe betting

on something that might happen a long time in the future and if the network is going

to be changed sometime between now and then, there's no principle on which to base an assertion

that we won't change what opens the box when we change everything else.

So the only good change is no change.

And so that's the Oracle problem which is that you want to guarantee that this box opens

the right way, pays out the money to the right people.

And that's what I'm going to try to limit this to for maximum clarity and minimal abstraction.

And now I'm going to talk about people who tried to solve this problem and really didn't

succeed at all.

So as I hinted at before, the entire network history of all the messages received or sent

by anyone that was going to be in this consensus set, it must be totally self-contained.

So you can't dial out to someone else that's kind of cheating or just kind of punting the

problem away.

But in addition to being, it's kind of a cheating thing, there's no way for people to verify

that you did it the right way themselves.

So everything has to be self-contained and we'll need people to report in on how they

did this.

And people have tried or they conjectured a number of different ways of kind of doing

this.

And the first way is that there's something called multi-signature where you have one

third party who can be like a, sort of like a lawyer or do like a kind of an escrow arrangement

where you and your counterparty will, like Arthur and Beatrix will meet with someone

and they'll say, okay, we're going to settle this up ourselves.

And if you have any two people agreeing, then it's fine.

So if Arthur decides that he lost or he won, I don't even remember how I set the example

up but it doesn't matter if they, Alex and Arthur and Beatrix decide that they won, they

can each sign and that's two of the required three.

But if they get into some kind of dispute and the winner says I won and the loser says

no you didn't win, they can go to a third person and the third person will be the tie-breaking

vote.

And I'll talk about that in the next slide.

But people then, that kind of wasn't working at all, no one was using that for anything

interesting.

And so they moved on to this idea of competing reporters and I'm going to talk about that.

And that also didn't really work and I kind of foresaw that it wouldn't work.

And at around the same time, I proposed something which is my project, the Bitcoin Hivemind,

which is sort of like this much more complicated version but it's basically a pseudo-corporation

that slowly resolves these outcomes.

But I also inspired a kind of Ethereum-based version of this which doesn't work for reasons

that are very complicated.

So I'm going to try to get through those reasons because I think they really speak to the nature

of failure in blockchain which is supposed to be all about.

Which is exactly what I'm going to be talking about in this half of the talk.

So as I explained on the previous slide, this first example is this multi-signature idea

where there's, you need two or three keys to open this lock and Charles will break the

tie.

And there's like all kinds of unspoken stuff about like Charles will always resolve correctly

therefore we won't, there won't be any disputes and we'll never need to borrow Charles and

therefore this will scale a lot and stuff like that.

So there's all kinds of unspoken stuff that goes with all of these claims that people

have made in the past.

And right off the bat there's a severe problem which is that we don't actually know, Charles

really can't prove a negative that he is not actually Arthur in disguise and then this

whole scheme is foolish because as soon as two people put money into this box, Arthur

will just sign twice to take the money out.

But the real problem is economic which is that Arthur can actually offer Charles a bribe

of not only 500 but up to 1,000 because he's losing 500.

As the outcome is reported honestly, Arthur loses his 500 and it goes to Beatrix.

Beatrix not only gets her 500 back but she wins Arthur's 500.

So the, so Arthur's down a net 1,000.

He can bid up to 1,000 if he bids 999 for this bribe to Charles then Charles will throw

it in his favor and then he'll get 1,000 out of this box and he's still up one from against

where he would have been if he had lost honestly.

And this is like really dark because this foreshadows the entire sequence of problems

that the Oracle thing experiences.

In particular, the critical issue is that Charles, he right now he's getting nothing.

So any bribe at all is higher than what he's getting which is like he's charitably kind

of agreed to do this.

Right now his payoff is zero.

So any bribe he should take because his bribe would cause him to get a higher payoff.

And a really annoying thing is that the only thing Beatrix can do is counter bribe and

this is really unfair because she won the bet fair and square.

Her like maximum bribe is really 500 if we're being serious because she could have just

not put any money into this box at all, she would have been stuck at zero.

So in order for this to be worth it for the person who wins, they actually have a less

recourse than the person who loses.

And this is sort of like a general problem which is that Charles, the decision to steal

is worth 1,000 in this case.

It doesn't always have to be 1,000 but there is always going to be some cost that is inherent

to the oracle problem which I'm going to call the opportunity cost of theft.

And it's going to be equal at least to the amount of money controlled by the oracle because

whoever this oracle is, in this case, Charlie, he can throw the thing in some other way and

make himself a party to that transfer.

And so this is very dire situation right here.

And the multi-signature solution in this case to reinterpret it through this lens is

to just transfer that burden from Arthur where it originates.

And it originates with Arthur because he lost the bet.

So he loses the 500 and so there's an inherent cost of honesty that he must honestly lose

his 500.

And the solution here in quotes is to transfer that burden from Arthur to Charlie and simply

hope that they cannot coordinate.

But that's not very clever because they can easily coordinate.

So this got more sophisticated in 2014 particularly with Counterparty but with a number of other

people especially I think including BitShares and some other projects that were kind of

had a weird take on this.

But they said, okay, we're going to give up on identity which is smart because it's a

lost cause.

And they say, well, abstract the identities into roles, right?

And we'll say there's users who are would be the people who are Arthur and Beatrix and

they'll be reporters.

And we don't care if they are the same people potentially or we don't know who they are

and we're just going to forget about that.

So already we've like given up on a lot of concrete things.

And then it's pretty simple kind of business type model where the reporters are going to

collect fees on an ongoing basis.

It might be per report, it might be per minute, it might be per whatever.

But whatever it is, since the users can choose their reporter when they make the, when they

put the money in the box so to speak or when they want to initiate a bet of some kind in

this very concrete example, there is an incentive for the reporters to get and keep a good reputation

which is that if you have a bad reputation, you won't be chosen and you will lose this

stream of ongoing fees.

But no one really use this either because it has a lot of problems.

So I'm going to walk you through this slide which is basically the decision calculus of

this guy, the reporters over here, these judges so to speak.

And there's three factors that go into their decision at least and this is like a basic

finance NPV calculation of like net present value for those of you who are familiar with

this.

But the attack payoff is how much money they can get by just stealing from everyone.

So, circumstances might be such that there ends up being like 50 million pounds more

or let's say 50 million pounds that Brexit will happen and that Brexit equals yes and

maybe 40 million pounds that Brexit equals no and so there's this extra 10 million there.

The attack is that the reporter will himself become a user or a trader.

Get against this outstanding 10 million pounds and then throw it, the switch the wrong way

and extract the 10 million pounds.

So this attack is all the money that they can get which is this opportunity cost of

theft and that's offset by these payoffs that are in the future.

So this table here, the horizontal axis represents time and you're going today, one day, two

day, three days into the future and they have all this stuff, these payoffs in the future

and then this third factor is a mapping that allows you to compare payments in the future

to payments today and so it's basically how much they care about the future.

And the assumption in order to make our guarantee which is our goal, our design goal is to make

this guarantee that the box will work which we absolutely cannot do in this case but in

order to make the guarantee, it has to be the case that it's always true that the payoffs

in the future outweigh the attack payoff today and I think it should be pretty obvious why

that's not the case but I'm going to explain some of it anyway which in there, there's

a triple uncertainty, each of the three factors can wander into a dangerous zone where it

guarantees the failure of the scheme and if any of the three factors fail, the entire

scheme fails and there's no, more importantly, there's no way to guarantee ahead of time

that it won't enter any of those zones.

So this is like a giant disaster but I'm going to walk through some of it.

The attack payoff today which we want to be low because we want the scales to tilt to

the right, there's nothing preventing that from skyrocketing if the market becomes unexpectedly

popular.

So you could have like something that just, some reason everyone wants to bet on something

with some reporter, there's no clear way to limit the popularity of like, you know, like

it's sort of like a little bit what David was saying where he was saying that sometimes

the service becomes too popular and the network has to like kind of rebalance slowly but in

this case, there is no rebalancing, it's too late.

So this thing can skyrocket.

The red payments that we want to be high, they can decrease for any number of reasons.

One is just that the reporter industry might become more competitive or there could just,

not only could there be news of that, it doesn't actually need to happen.

It could be a rumor, it could be false.

So this is very dire.

More people might join the industry or they might have different offerings in this case

so they would not be able to, they'd say, okay, I'm going to lose this stream of payments

but I'm going to lose it anyway so, of course, I'll just attack everything and steal the

money today.

The reporter's concern for the future, we want it to be high but there's nothing preventing

it from decreasing.

The person might decide there's enough money in here for them to retire, they don't care

about their future at all or they might get some terminal illness or they could pretend

to be hacked or they could really be hacked and then the hacker would not similarly care

about their reputation.

So this is totally doomed but I'm going to walk it back through the framework of before.

This is this opportunity cost of theft that's still here, it's equal to the amount of the

losing bet and that amount and it's potentially large if there are many users which in the

number of users can skyrocket unexpectedly.

And this fee that we can extract here is to offset that and it's based on the utility

of the service.

So this is much better.

This is an improvement over the terrible multisig world where we are compensated for honesty

this time.

And this is some new psychological parameter that's specific to this solution attempt and

it's unreliable.

But the overall result is that this is a small improvement but it's still nowhere near good

enough which is why people really did not use this service to do anything interesting

like the...

blockchain enforced futures contracts that Gavin mentioned. People really are not doing that. It's got to be really good to be useful for that and so I'm going to try to just walk you through a little bit of this and again this is sort of like the plane versus boat thing where I'm not going to be able to explain the plane in detail but just try to draw the contrasts as much as possible which is that this is part of kind of my thinking on the issue which is one thing

improvement that I made is that I'm going to make a reputation itself a

tradable resource in this finite and tradable resource in this system and so

there's some pseudo corporation that's kind of not really a corporation of

course but in an abstract sense it is behaves kind of with the it's a nexus of

stakeholders that have ownership so it exists to prove its consistency within

and across time and collects money to power the mechanism so it provides this

service here the reason that making reputation itself tradable is important

is because it's a basic of finance that the stream of payments coming in which

is this red thing before we'll go back to it the stream of payments coming in

should actually be equal to the current market capitalization of the shares of

the corporation so if you want to buy up the this corporation your attack is so

your attack is not to be a reporter and then decide to do something wrong your

your attack is to buy up 51% or 75% or whatever it is of this corporation and

then force the entire group to make everything go haywire but the reason

that it's important to make reputation itself tradable is that it deletes that

third factor of time from the equation because theoretically the current market

capitalization of the company should be equal to the present value of all the

money coming in so similarly if the market becomes unexpectedly popular if

any market it was in this corporation or the entire system becomes unexpectedly

popular the it should the expected future fees should be going up or indeed

the present ones because the sort of dividends that are paid are a function

of the trades that are being made they happen later so they the money that's

coming in as the service gets more popular should directly translate to a

higher market capitalization immediately today so there's some stuff that's

offsetting this here and I do some other things as well which I don't really want

to explain this slide is from a different talk that I'm reusing but one

thing I do is I have everyone in the corporation submits a report on every

single thing that is resolved and I cross-reference those things against

each other for consistency but also to produce some information about who is

lying and what and there's sort of a kind of it's not really a cluster

analysis it's actually something else but more or less you can tell if some

people are being some people innocently got something wrong or some people are

just like out to reverse everything and steal all the money and it kind of very

makes it much more obvious like what people are kind of doing and one thing I

do want to emphasize the strategic use of time which is that it's easy in the

blockchain to lock money this is something that David was talking about a

little bit as well in his talk it's easy to lock money for a period of time but

as time goes on the kind of it's more easier to find truth and more easy to

kind of figure things out which is kind of one of the reasons why a court move

slowly slowly and that's not a bad thing so the net effect is that time

penalizes attackers only and so you have this money locked in it's locked in the

box that's not leaving but the box is gonna take a really long time to open

and the future contracts don't actually need to settle up again for a reason

that's totally financial and has nothing to do with computer science whatsoever

the futures price of this box the what the box is worth should track whatever

the whatever a real futures contract would be worth because if one is worth

different from the other you buy the cheaper one you short the higher one and

you extract money for free and since that would be if anyone who does that

will reharmonize and equalize those prices so I don't really want to explain

a lot of this but what I do want to explain is how this can break because it

is itself fragile so it's gonna break in a way that's totally itself bizarre

and yet is relies on a lot of simplicity so this slide there's two slides for

this the second one is where everything breaks but this is just a setup of some

very very simple things simple premises that you have to get admitted and one is

that this stuff is happening in a very specific order so first there are must

be multiple oracles because there's no way to stop people from you know copying

the service and creating it again and once someone chooses an oracle then you

have to wait for in order to evaluate so you choose first and then later on you

want to evaluate if that oracle was actually honest or not so in this case

you've chosen the blue oracle it's a thicker arrow there and then the blue

oracle is paired with some event in this case is this moon half crescent moon

event and then they have a report where they're gonna tell you this thing and

that's gonna this thing is gonna go into the blockchain and then stuff will

happen with it it will be referenced as a thing that everyone knows but it's

only after that phase two happens that you can actually check and see if

whether or not the oracle actually reported correctly because you need the

report and the event the report before the event happens maybe they could get

lucky or something but you need you need both in order to actually check to see

if they did it right and so since there's this degree of freedom here that

is not removable it must be possible it must be the case that they vary in

quality the oracles from 100% honest and the lower bound is actually 50% because

if they were a 0% honest that you would just flip everything and they would be

honest again but the point is a very simple one that if there are multiple

oracles they must have the freedom to vary in quality and it turns out that

simple premise destroys just about everything which is that the there's so

some are more honest than others and they must charge this fee to offset all

of their costs and so if they can't do that then they're just out of business

and they won't exist it's unsustainable of course but one of the one of their

costs is this quality premium which is a really important point to emphasize

because I'm having the top here honesty is costly to the oracle everything every

time they're honest they are foregoing some opportunity to steal the money and

so every so in order to compensate them for that we they have to charge this is

a cost it's not like a profit or anything like that they need even though

it's an inherently abstract concept theoretical kind of concepts it they

must charge more for being higher quality than they would charge if they

were going to be low quality and this is in addition to other costs that they may

or may not have such as the labor of like you know the 30 seconds it would

spend to Google something they didn't already know and maybe something about

that setup so the problem here is that as I say in the title of this slide you

need something that's sort of like a pseudo copyright and it took a long time

to figure out for me to figure out exactly how this would be done and I'm

not gonna explain how it's done here but I'm just gonna say if you don't have it

why everything breaks so you by you don't mean like a literal copyright or

any kind of legal enforcement of anything like that but you do need

something that will censor someone who steals the information in order to

purchase quality if you can't do this and you can't purchase quality and all

the reporters will be low quality and there'll be this kind of collapse of

unraveling markets which is the term so this red guy he's making it kind of an

evil statement that he's gonna copy the blue guy what when he reports and he can

do that in any number of ways one is by just watching the blockchain to wait for

one of those two people to get paid and say if they get paid that triggers this

thing or they could program them to just simulate blue or just look it up or

anything there's any number of very easy ways of doing this now the thing is

once this guy's coded up he's always going to be cheaper it's unavoidable

that he will be he will be able to charge less for this exact same service

to the users but he will always be exactly as reliable I'm gonna walk

through that which is that blues report is on the blockchain and now it's a

public non-excludable resource that anyone can verify and we've kind of

flipped the tables on that which is that anyone can validate and verify this

that blue actually did report that and that's exactly what red is gonna

exploit red is going to take blues contract here and he's just gonna copy

it and he's not gonna do any effort on his own and the issue is not that he the

issue is not that he is saving on labor the issue is that he is always exactly

as reliable but he will has no reason to charge the quality premium and so since

he's always exactly as reliable and always cheaper there's really no logical

basis for any users to pick blue over red because they're the same they're

exactly the same things if one's cheaper so in short but even since everyone may

be foreseeing that or at least not willing not being willing to wait to

kind of investigate if this is worth it this kind of entire scheme will never

pick up momentum because it will just constantly be in a state of uncertainty

but long story short since the red guy is always as cheap or cheaper than the

blue guy so we all excuse me it's always cheaper the blue guy and always exactly

the same service the blue guy goes out of business and this scheme doesn't work

and the idea behind the corporation pseudo corporation idea is that you

successfully spread the opportunity cost of theft widely over many people and

over a long time period very infrequent reporting and you've minimized the total

amount of information that someone needs to assess when they're looking at

whether or not this thing is honest or broken but the problem in this case very

bizarre failure is that the maximum reward these people could get for their

efforts is zero and so in turn the shares by that same finance kind of

theory I was mentioning before the shares of the honest corporation will be

worth the net present value of a stream of zeros which will be zero which will

mean that it would be trivial to purchase the shares and attack which

means that no one has any reason to trust that the system will operate the

way it was designed and that's basically it so I'm just going to repeat the

takeaways which is that with blockchain there's less trust everything is harder

it would have been a lot easier to just have Google do this or have Google

publish some keys or something but in the blockchain threat model everyone is

a threat and so we're doomed and there is a difference between programmers and

contract authors specifically smart contract authors and so in particular

number one there well that was with a it was too easy for the user to assume two

identities or make some bribe and with two it was too easy for the service to

be too popular it was a victim of its own popularity and then in the third

one it was too easy for rivals to enter and steal the service and in my opinion

in the blockchain world code is built on a foundation of incentives so what I

hope I what I was hoping to do is just draw a severe contrast as possible

between the way this would normally be done by anyone writing normal software

which is that they would just there'd be some reliable database for this that

you would just dial out to and the blockchain world and so I hope that

you've learned a little about the peer-to-peer Oracle why it's such a

difficult problem and in particular why it's much harder than just asking

someone else for the answer and then in turn you've learned more about

blockchain and so thank you very much for your attention

thank you Paul thanks we have time for a couple of questions if there's anyone

that wants to ask something or if there's anyone that understood most of

that talk it was it was in depth thank you any questions at the end of the day

oh hey Elaine does Olga have active markets going it doesn't matter to what

I was presenting here because it won't they don't work in equilibrium so it

still exists but it yeah but it would want though I mean it doesn't it hasn't

even launched in some sense depends on who you ask you ask them they say they

haven't launched yet so so I guess I would say no I don't know but they have

you know markets on you can look at but you know they're not they exist in the

sense that everything it's like only in like a testing kind of phase I guess I

would say well you know but I mean a lot of things that are literally test

nets have tokens that are traded on coin market cap you could trade Zcash

before launch on BitMEX yeah being having having a token traded on coin

market cap is actually a contra indicator of value I think it's like the

more valuable the coin is on coin market cap the less valuable the project

will ultimately be I think yeah they're going to be in the sole

exception the exception that proves the rule cool anything else it's you could

comment on that that oh did you have a question

I agree with you I'm not sure so that is one thing that so there's a separate

issue with that I think yeah so I think you're completely right if we had

something like where someone published a website and they said I'm gonna offer

this service and I will sign whatever the British pound to Bitcoin exchange

rate is and I will only do that once every you know a couple months and then

you can set up a bunch of stuff based on that and we'll reference that and they

their signature will go into the blockchain the problem with that is that

all of the money there is is reliant on that one person so even if they are

honest they could be like maybe hacked or something so it's like the Bitcoin

exchanges so I don't know if you're familiar everyone here is but every

Bitcoin exchange has basically been hacked at one point or another and

emptied of all of its money and there's like really no way to tell if it's like

an inside job or there's a legitimate security problem or if the founders just

absconded with the money and embezzled it or something to their friends or

there's like it's really really hard to tell so the the the kind of the ethos of

Bitcoin is that you control your own money and by putting it in the hands of

someone else you kind of are not operating in that world anymore hence

the focus on this box that you have this guarantee for you know this bearer token

that is worth some other amount of money but you you're right that that could

work it probably won't work at scale though because if something is worth

like 20 million dollars or 20 million pounds or something then that's a big

incentive to throw the switch the wrong way and even if you don't do it other

people will try to hack you for it and I'm not sure that that will scale I

don't think it will scale in monetary sense cool anything else yes

it was

new sources or I guess correct well it did it did work for a while but then it

didn't work you know and then it yeah then it had to comply with some laws and

the also the founder hiked Mount Everest and died and then some people it was

ambiguous like MF global situation where some people were like stealing money

from it or something they were using the money to make safe investments and they

were not allowed to do but yeah in trade is great it is not an example of

something where there's a guarantee because so that's the world of non

blockchain of like the legal world where it's not automated and you have

contracts with a person that has a brand and they have a mailing address and they

have something like that and you as a consequence it's a normal business and

not in the blockchain world it's not automated in trade had a number of

problems that I could maybe lists but they're not important because you could

if you ran into it a different way you would be able to fix those problems but

one thing that you couldn't fix is that it would not be this automated computer

system that would maybe be able to operate without any forms of censorship

or control and they would give this these financial tools to everyone in the

world and that is something that would not be the case for in trade you had in

order to like wire money to in trade it was expensive and cumbersome and slow

and that was a result purely of artificial regulatory and legal

requirements and it ended up not working for a lot of reasons but basically that

company went bankrupt and had some problems that we could list cool does

that answer your question cool all right any more questions

it's beer o'clock thank you very much for attending guys