ETHKL#5 - Part4: Panel discussion

[Music] so before we start the proper panel and start again so I always like this with all our guests because this together it's a story from you of how you joined so unless you've been around for a long time you need a textile of speech especially in Singapore in Toronto Convention physics graduate and pattern from the academic side so you all have very different stories lower different backgrounds so how did you first join this space and when and any interesting anecdotes from there yes so I do I started working with book chains in 2013 in 2013 we created a company and we deployed actually Asia's first Bitcoin ATM in 2014 February in Singapore a very sad story we had a great huge event for for this deployment we we we had 40 B crews at like 50 reporters on site to to see the the Bitcoin ATM 2014 again and when we everybody arrived we realized that we don't actually have internet for the idea so so what I did I set up the ATM to and I shared the internet from my phone in my in my pocket and I set up the machine very quickly to use use the Wi-Fi from my phone so for the rest of the evening which was like three hours I could not leave more than three meters from the marshal because then it would have lost the internet connection but we made it so everything worked and and then was successful yeah as hardest mentioned I I did physics for my undergrad and how I got into this space was really an interest in the potential for social applications of a theorem and I've gotten to work on a few really cool projects thanks to an Josh for instance on power grids rights management and I've really gotten to see how a theorem is being used in the real world and how I joined the foundation was quite a different story so there's this guy in Singapore caught for don't Griffin yes remember the name hydrogel and he basically just came to my school and then he he put on an ad and this ad was like greeting students from a serum foundation we're looking for people pipe glue it intelligence I quote like naturally yeah that's me no but yeah and got along with the foundation I like that ethos and I like their vibe so yeah I'm glad to be here building the community in Singapore and kale and beyond so I actually got sent to the blockchain space quite by the month I would say so I've always been interested in security I was having on automating security analysis for any you know different applications and I I think the first time I got into it was actually right after the telepathy because then just the news vote and then you can see you know how much money people lost and I well that's such a great opportunity for so I quickly put together basically a team of four or five people from the lab to work on this we release the first system and then it was amazing that was really tremendous in two aspects people started emailing us it was a loss system like early 2017 and people say if you check things like a my poly but for days well contact that from the logo that wasn't like in the very early days and then we said we realize wow there's really really demand for this period we should really do something about it and yeah so we then we incorporate chain security we put together a team and we just continue to working hard on all the things I mentioned you know with new products and working more with clients with a team foundation with the Webster foundations and other people in the space to so basically raise the level of security to - to the next level that's basically what happens thanks guys for the hs6 stories and this is a topic a panel with two different topics internal balance between you to scaling and speedy audits and so please bear with me if it becomes a bit hard to follow but first question is for Peter and possibly for unrest as well at DEFCON one of the speakers fulfilled I'm talking about a sweetie and one of the things that he said was like most secretly audience now are done on ICO contracts it's it's all like done once and walk away get all the money you know disappear or you know not necessarily think about next steps and this is not a technical question but on a community site so how do we incentivize the people in the community to think about ongoing security processes for the entire lifecycle of their projects and products yeah I think this has already happens I mean we see in internally the training is definitely we're working more with products have already there are building platforms and I mean we had firm any recurrence clients including a fiber network for example which and both ICO they're doing big complicated platforms and I think that's also the so we definitely see this big trend of much bigger much more complicated audits where if you try to do something manually it really doesn't work because it is so complex you don't want to look line by line it will take you forever yeah so I think I think that has already happened we already see huge demand for more advanced solutions like that that's the reason I get the monitor in the tribute was completely the one favor because all these little platforms they don't really there's this lack of transparency of how users use the contract sake or their you know some kind of weird exceptions they would begin forget it didn't get this insight to debug their platforms and yeah I think we're definitely working with big products nowadays absolutely necessary and we actually see apparently not ICO contracts between what one of the biggest challenges right now a lot of very bright IT people coming into the space who has no idea what they are doing so just recently we have been demoed a concept product where they collect their system with multi-chain why I will tell you and they were using it a new public network public transactions to transfer the the clients private keys and just looking at it and see so we have we have the ether scam where is it awesome thank you very much for your service by the way so we are looking at eaters can we can so this is the privacy of the user right right are you sure this is what you want to do and it wasn't that they were videos by one means they just simply came they take what they consider the eternal puppet that workers and I as an API and it's not that they they are they are there they simply just don't know the tools here so one of the things that we need to do we need to educate the people to actually understand what they are dealing with and the other thing is we need to have more formal ways of of helping the security during the development even like formal verification or even if it's possible a language that is a slightly better than PHP instead of what we have now that actually promotes contracts that are secure so there is a lot of work what we need to do to get things okay so next sessions on our scaling and so we have an obvious question and it is a bit controversial to push your buttons as well there are a lot of things out there they say that you know they are better at scheming than here and it's always talked about a skill of you know decentralization speed so from your experiences in the industry have you seen and we've got things that actually exhibit this and what are your thoughts on that scale of decentralization and please feel free to shove the camera so without mentioning names we don't mention that name yes there are many systems that that seem to be trying to rush into the market using using solutions that are technically shortcuts between own problems and they doing it because they want to be claiming that they have a scalable solution sooner and faster the material but most of the time they they do it by by by using techniques and technologies that the problems it's easy to scale I can scale with my bicycle server much faster than the material but that doesn't mean that it's actually going to be as bad for them I guess that being said sometimes it's not so clear-cut the trade-offs between scaling and decentralization you look at something like 50 M or Bitcoin I mean that's what we hope to be like the standard for decentralization but we see that big mining pools for instance have emerged that the market is it's really in the control of not so many players as one might think and when we move to proof of stake that's gonna depend on a system where basically people I mean it makes sense people who have estate people who own ether get to each site get to validate what goes on in a blockchain but we also have to think about what that means for decentralization and so yeah I think in short we can never be complacent we can never be we can never take it for granted that will always have decentralization yeah I we need to be vigilant it's a process maybe I can pull up with a question to the foundation people so because I mean in a sense it's kind of expected that's the smaller projects they have not much about it to risk it's kind of like you know young stars versus you know big company so of course due to the risk you know they're more like it takes experimenting to be faster in a sense so and there are also of course goods you know solid really cool you can any producer looking at this form so are you also looking actively at these solutions because is there such collaboration when I was at Def Con I attended like a talkback polka-dot really one of the up-and-coming projects that are exciting and polka-dot themselves is doing an implementation on serenity or if they're 2.0 or Jasper whichever of those names you know it fine and they said they talked that but we are committed to if they have 2.0 and yeah it's not a zero-sum game in this space is about working together there was another right after the punkin dog there was another presentation from I mean any good Shearer who actually brought in a seemingly brand-new consensus protocol that we actually haven't heard before and he he claims that to be significantly better done than anything else in existence if anybody else would say that I would be very doubtful but he is a guy who is usually knows what he's talking about so the main point is not many some of you are old enough to remember the early days of the Internet we had like the mosaic browser and the Vista was the king of the other search engines we are there right now with with built-in technology so Google does me not actually exist yet so we are not at the end of the end of the library and it means we just need to we just need to look out and discover the new projects as of now there is no other gaming term but I tell you but it doesn't mean that is going to stay this way so funny that you mentioned that is usually one for questions about us you guys did you have any heard more about this whole avalanche and the whole family of four calls I mentioned and the whole idea of gossip protocol you can share with others yes the problem is that many of these are not proven yet so I would like to see is protocols out in the wide for a longer period of time being used and hampered by by attackers and users and after that we will know much more about them absolutely there are lots of hopefuls but we need to see them perform cool so an expression on the studio audience so you mean around since big more than a year now the whole team security and understand to fit as well do you see what changes have you seen in the entire industry of setting standards on security audits a long time ago it was only like Zeppelin that did this sort of standard contracts how have you seen that grown and has there been a community that's being built around security audit sauce these processes and how to build the entire community of people who are looking at how we can improve them yeah definitely I mean there's pretty good community we all do the security space in a way there's I mean the community is very helpful we're actually in touch with also the top of people that are in a sense competitors to us but people are very open sharing their experience trying to come up with common ways to describe the vulnerabilities that they find coming up with common well said but benchmarks for the tools of their building so there's definitely community of people that are working in this space and we we have you know we weekly just weekly sinks and so on so yeah there's a huge improvement in that space one year ago it was really really disconnected where everyone is doing their own thing there was no no standards of what some of it means I think this is still changing a lot audits are still now they were mostly about like finding bugs whereas things would move shift more towards like certifying what you have to be so you know should have to check to work which is they're actually twisting things so things are still moving slowly I think while these discussions in the community so when you see a check for underlying logic as well as just bugs in the contracts right what would the main differences between checking for that and was checking for bugs in yeah so if you actually open many other audits today they mostly talk about what issues have been found in the concert which is if I'm a user of this contract it's not very interesting for me you know I supposedly this has been fixed by the developer what I would like to read it I would like to read exactly the properties that have been the scope of the audits what properties have been verified to hold on the contract exactly these things like you know what is either an actual capacity enforced by the contract cooking towards with with the tokens so these are the kind of things that will be more more more malleable Sadie tell you what's actually the contract does which is I think the whole point of doing the knowledge and the process how is it different to check for that versus yeah so people are definitely more aware of the possibilities the consummation some parts of the community are a bit through resistance they don't see how this can work in a way I mean forward to make sure it's not possible so some part will always be menu so understanding what the Contra be supposed to do you know writing down the the specification the contrabass will always remain menu but the checks would be done automatically and that would give much more reliability towards the users because you have machine rather than have people and make many of the goods people in the space are aware of these possibilities they are doing solutions that could do this you know basically bringing techniques that have been known to exist very well in other domains they verify chip designs and all these domains where you have critical small components these are its it's not somehow it's a new domain but it's not a new problem and people are now bridging this gap just exactly what we're also trying to do so back to scaling and domain and as you guys have talked a lot about technical skill of the protocol itself but one big point of stealing is also the social side of the various people in the space and other stuff that you do outside of this technical what are the thoughts on that coming from that part I I just do an example so I understand everywhere had this launch of blockchains LLC who so you might find an interesting story it was a surreal experience and I say I just so happened that the me developer for Bitcoin cash was actually there it was very interesting to a per curiam say to us that he didn't realize the ETM space was so big and so dynamic and so that it is very interesting you see it's not just the program is that it is in the human species also everyone else you have any thoughts on the social side of getting politicians that in design in history you know I use this for here what I've seen I I be to DEFCON 2 in Shanghai at Honda DEFCON 4 and the difference was enormous it difficult for we had like three and a half thousand people very actively involved and engaged and we had a lot of other people from the social side one of the main speaker was on stage Cory Doctorow with who's a writer and human rights activist and a lot of other people tried coming into the space that are not strictly technical anymore so I see a lot of improvements and add-on I think UI UX is a big part of this social scaling and at Def Con I attended a few really interesting workshops on for example guestlist onboarding so basically now to do anything on a theorem you have to own ether because our transactions cost gas plus a lot tenants to keep track of it for you whereas gaseous onboarding basically it makes it possible for users to not own ether themselves but for for them to use an app that will then pay a proxy contract to send transactions for the users so for normal people who don't already have an economy theorem this could be a great way to onboard them solutions like universal logins are on a similar debt and I even have some fun it's working on this solution that assigned to an ATM account based on like your gmail email address and I think the ATM name service for example is also something that makes makes it they're more usable so instead of reading like a long hex hexadecimal text you have a human readable string so yeah I think all these are really promising UI UX improvements that will help if you scale socially many of you people from other domains are jumping to come up with to take decisions for this yesterday we had an event at Singapore themselves we tell people were working with law legal people you know thinking coming up with that domain specific languages to to pray specific kind of contracts or people naturally jumping and trying to see what to do also in academic space and and just to add to it one of the side effect of using cycling's or plasma is that again you can on board people using it without them having to actually have either to to send and receive transactions since you are going to run your own cycling application-specific site in plasma you can set the rules and you can make it so that people don't have to own internal any other token to receive transactions and there are also other kind of socials coming out I don't want to promote my own business but I'm going to promote like very simple cars that let you put some ether on them and hand it over to somebody who doesn't have any knowledge of the system can be done this is a little card and so these people are getting these in order to give either tokens or other things to others who doesn't don't actually know much about and then are always shielding him as well as you have so a common so for exchanges so do you mind elaborating a bit more on that yeah so one of them one of the demands that they think why we did it is that many of the things the requirement you would have been at home a smart contract you cannot enforce them always in the source code this is often because you want to for example allow some additional functionality if something happens either to follow the contracts or to you know issue additional topics or maybe to manipulate at office abusers and if you want to have this functionality it's kind of skeleton in a conflict with other things and they should be used only in very exceptional cases and this is actually very common this many contracts catalyst and this is it's impossible to certify this behavior the only way you can provide guarantee to investors including users people exchange that are using the you using the tokens is to monitor what's happening and notifying people well this is Stephanie so it's basically all the other things that cannot be done at the audit fate but all body part would have to be monitored and we sell a lot of demand for this which is why we also feel this this kind of solution the other demand was more from the technical side that people were just you know CTO they're just curious you know what's what's happening to my contracts is something failing can I look at this transaction so that's what's more like debugging you basically different so it's getting say there are other solutions other than the ones mentioned like efficient New York on very few foundation there are for example our customers is doing either me 2.0 there's also some people have talked about doing side chain on Toa and using die as their current token or currency to transact you have us heard more about these ideas or any other ideas that haven't been presented earlier and you're allowed to share I think clarification here the layer one is being worked by most foundational content but layer do has nothing to do with their information they are two is all being implemented by by different groups and different categories so those are basically figure so before I can point to the Q&A with the audience and are giving it gets a bit more time to ask and I know we read a bit over time it's the last question for you for me for you guys what can people in these especially the key ultimately what can we do to help with scale what can we do to help with providing daily security for smart contacts well run your own application specific citing learn how to do it plasma is not an actual implementation plasma is more like a set of rules a set of guidelines so based on that you can actually find an intranet your own version and that would be I think that would be the most important thing to get familiar with that they are to scaling solutions I working with Josh I'm with Nathan Foundation officially but I work to punish a lot as well at a combat and I think our most interesting clients actually often come from outside the block chains so for me one of the most exciting things in communities it's just to see the variety of use cases and the variety of projects that people are working on so yeah I feel like if you guys have projects are cool just like give us a shout out and reach out to us or like as I just said build your own stuff there's very active online forum called eat research yeah I see a few people nodding yeah so yeah post there I'm posed I'm ready etc yeah just yeah communities nice from the security part I think dinner it's good to be a word they're actually a lot colleges that are also open available online there are channels you know where you can join so just if you guys use these it use these freely available tools so when you you know when you when you work on your you know contracts and join the channels to give us feedback absolutely super valuable and I think it would help both sides you know for us to improve the technology and for for you to write better that's a smart contracts one last thing which is very important to be could also show how we on this is whole communities like prismatic labs who right now is implementing charvak like one of the core component of the system they they just appeared and say hey guys can we do it we can do this and they and they actually did it so almost technically anybody who has the ability and and the skills to help out can take on extremely significant part of the community thanks guys this is an honorable boss so it's time for you guys to ask questions I'm going to be a big undemocratic here and I know kill the very question actually right as Peter mentioned our feedback for since three I believe Caleb have a question just on that for developers I trying to use the security fire kinda hard to figure it out can we get a mic for the audience [Music] I thanks for the time first off I appreciate you guys coming down to Kyoto basically attendees me actually it's not so much of a secret I borrowed oh I'm taking more from community perspective so for example I've seen cases where unity students they produce smart contracts or small groups of young so they release one contracts body but quite have the financial capability to have contracts audited so in this case on is there anything you could recommend which we could do something like this or something like that yeah there is I think one platform of Google to see what it is who are you codes for some specific cases do these things also if you reach out to the community you know we could provide help for such projects if they're you know this can be done especially with the tools so this is let me know what the product is I didn't know that as okay as they came up they don't serve if you have your community project they will consider doing an audit for you [Music] you know physical moduli statement was ah sorry so I mixed question [Music] I am Jeremy maybe my main problem with this Sun SPOT contract ordinance if you guys think back I think a month or so back there's a project called oyster now that project had its smart contract auditor and screaming but the founder killed exit scan and they did a form right so who governs these audit companies right they do they follow a set batch I mean this is only recommended by industry people or is there I mean are you guys coming up and lines for example I mean I mean real audit world accounts or do you have the big four big five that that sets the benchmark right so where are you guys in on this yeah so correctly there's not know anything there's no kind of property it's more reputation based and there is definitely a community of companies that are very trusted and if you ask you know bit about it changes they would be refer you to one of those and these are basically and so but they cannot expose the reputation based in the census we would never you know our main job is to secure the investors of the contracts and we have also in the company had many cases where there's actually really bad codes and we would have a bad report and they would not want to publish it and they will say well could you actually remove these things and would say no because that's that's how it goodness you know we want to protect the users so I think yeah it's clearly reputation base at this point maybe you think a reputation based token crashing on the back thank you for this great panel my question is about the 40 LT like hash graph I know the ambassador's here scalability versus security because both are very important so far we didn't find any HP CEO high performance computing okay this is a subjective and personal opinion okay it's not my company's opinion in in many ways in many ways it is important for the community to be able to to see and verify the the proposed systems there are there are systems that are coming into the market with with larger and more established companies inside and they are promoting closed source systems with with patents around them this is very different problem from the rest of the community is not necessarily better but it but is different and is targeting larger and more established players but because of its mostly closed source it is very difficult to tell how good it is and that that is the that is that is the for the first part of the question and for the second part is blockchains purely public blog things will never be speed demos they have a role to play their role is to provide accountability their rule is not to become became per from 1 million transactions per second we have we have the systems for that we have perfectly well operating Basra sequel databases that can do that so it is important to see also that blockchain is not a silver bullet not good for every single use case they are there to provide accountability a very important part of the of the whole design but they are not going to replace centralized systems hopefully ever you have another question ah ok the question at the back hi I'm actually quite with you here this is my first time attending this Clarence met you before from PwC so yes the gentleman there Jeremy you were just mentioned before so I probably just step onto that so we do a lot of and the price IT security audit as well as supposed to function on it so two questions there to be a handful for the techno one is that obviously on the security audit front while I'm seeing the solutions that you have actually some somewhat very similar to you know this enterprise IT we do when we do web applications we do source code review config reviews all and so forth but security breaches it's always locked just at the source code level but also the considerations the design we're talking about security by design right and also the processes around it so I think while keeping that we sort of like to also sort of Arkansas the plan is that when it comes to building a block change solutions to what extend actually the community right now it's sort of thinking about the trust element - see by design elements as well as security by design elements in the past the failure was that for many of the applications developers the first thing that comes to their mind is always to rush deadlines to actually build their applications up and to dish it up to the markets we certainly do not wanna me everyone is very confident that blockchain is gonna be the future right we certainly do not want these to be some of the event that you know currently what many of the organizations right even down to the course Intel chips processors many of them actually have security force that was because 20 years ago 30 years ago people don't actually think about you know security active whole level when they they actually build it so how much is it being done and channeled for blockchain specific area I mean how much time and effort have been channeled into the security space and the second question is that obviously this one's also a lot of discussions about not change replacing the financial auditors jobs many of my counterparts in my firm they are very afraid that blockchain will replace the a job so I'd like to hear from from the panel smell better do you see all details actually being part of the community at the end of the day okay time I am actually very new to be stopping assault myself yeah the first question so I think you're absolutely right that there it's a big pipeline of where things can go wrong including processes you know and so on and these are we're not focusing on these things exactly because there are things that have existence and we have we know what to check and how to do them so we're focusing on the new aspect that are challenging with other smart contracts and definitely all these other pieces are super relevant and have to be part of the auditing process for whatever products you have in mind so that's yeah and I think the term audit is very important we have talked to most of the you know the big four and we also had difficulty on the you know matching the terminology so it's just terminology problem there I mean for the question of being a finance particles being replaced by boxing absolutely you know what what when when you have a system when you when you mandate the total transaction will have to go through a blockchain of course let's not get into the the privacy and the privacy parts of this of this scenario yet in that case the blockchain will operate as as its own audit record and the audit trail follows the transactions by one block time so from this point of view lot of the mechanical work work of an auditor will be replaced by by by the inability to somebody to hide or to misrepresent a transaction of course the whole the whole job will never be replaced because this is way more deep and complex than following through transactions but the following two transactions part will be and can be automated [Music] yes but again I cannot highlight it enough that it's only true if it's a public trail because if you are running a privately you can keep everybody accountable except yourself so that's why it is important that we need to find solutions to put these things on to a public chain because we can mathematically prove that a public key can be can be falsified by nobody and this is this is basically the most important part of the technology that a public key chain can provide accountability and if you remove all the hype order all the big claims of the technology one thing that remains is accountability but it's only true if we are talking about the public shame I think your time for because and we work closely with two of PwC global offices so I happened in same we're doing was IBM in five countries so we're not thinking that the option will replace technology please make if you say I so I think if this will be the last question no it's a little bit to answer it one of the most important things is that the blockchain is an information system this on its own right people put stuff in from outside and you have to outside so if I would give you the example - hello vault right we can we can put up a block take all of the transactions that take place with the gods but we still have to prove somehow we've got the gold we do that I mean yeah we do that in as many ways as we can because we want people to trust us but one of the most obvious ones is we have audits taking place Yeah right another company we still need everything else [Music] yeah absolutely that's true if you don't have any questions and on times there's enough time for people to talk and you know before we have to get picked up from our office so please argue the speakers a round of applause so just a couple of things to know can I get a raise of hands who is going to block show in Singapore so Sandra I have one of our community members has actually got a telegram group up for people to just like find find each other and go to after parties and meetups she's also organizing the mic the wallet after party so if you'd like to join our group I think well I know I'm sure I can hand you guys it and see a couple more hiding things please help to clean up on any glasses or any food that you have please please don't miss this opportunity to check with our speakers from Switzerland from Singapore for example I know some people here from exchanges Peter has this solution for exchanges so don't forget to talk to him about that and before we end yesterday our so thank you didn't marry me on Thursday next week there is a introductory session than by lip it's a mere two organizes women who code K L so if producible you want to know the sort more introduction level not basic with you then is good for you to join yeah so lastly is the we to take photos with our speakers so Arceus like sort of say on the front