Community Meetup October 2020: Web3 PKI - Security through Decentralization with Diode

so before we start some announcements for this month there is the if online hackathon and summit that is happening starting tomorrow uh all the way until the end of the month um since the whole kobe thing is happening there's no def con this year and this is probably the closest thing we'll get um so it's actually a benefit to a lot of people who wouldn't necessarily have been able to um travel all the way to defcon they can participate online and there's a hackathon which i believe is still has a window open i might be mistaken so if you want to participate whether you are a technical person or not you can uh feel free to do that and they will actually match you up with other team members who can complement the skills that you have um other than that there's also lots of summits i believe uh every week there's a different team to the to the talks you can check it out at their website and yeah just register and then you'll get updated as to all the talks and events that's happening as part of the entire month then we have we have a quick roundup of stuff that's been happening this month um the very first one as mentioned slightly earlier is uh everybody should be familiar with this by now uh anyone who had ever used uni swap even if they made a failed transaction would have gotten at least 400 uni which at the time of launch was worth a thousand two hundred dollars each um so please check your uni swap um any wallets that has used uni swap before just in case uh you are able to claim uh and if not well that's unfortunate uh slightly interesting story is that uh earlier this year i remember running a ekl meetup where we just tried out different um decentralized apps including uni-swap and things like loopring and tornado cache and so i created a wallet and i spent some some amount of of ether to pay for gas which at the time um people were um fairly kind of sad that that i was spending that much in fees but fortunately for me because i created a new wallet i got an entire 400 uni uh just from doing that educational meetup so it was a probably like a multiple of 10x reward for for doing the education stuff next we have um escaping the dark forest so this is a blog post written by sam zun i hope i'm pronouncing his name right a very sort of popular security researcher in the ethereum space so you should read the entire uh blog post itself because it's essentially like a like a whole um hollywood movie uh but i uh but essentially it was uh there were about almost 10 million dollars worth of ethereum stuck in um in an address which could have been uh drained uh by anyone so a bunch of white hat hackers um went and saved it uh to be returned back to the original sort of owners but learning from another recent attempt which the first attempt actually failed because they were front run by bots so these guys did a very elaborate scheme to get around the front running bots so that they could uh transfer that uh 10 million dollars safely and yeah i involve a lot of people all over the world um at weird times of days for uh for a bunch of them uh third one is uh emn so this just happened like couple days ago i hope uh no one here uh dumped uh too much money into uh emn and hopefully not at all uh so as the story goes um andrei kronzie the founder of yearn uh has been building this uh decentralized nft game and he is popular for testing and production so he created this contract a bunch of people found it and got very excited so they started depositing a lot of money uh 15 million dollars worth of crypto into this unfinished unaudited contract and at some point um attacker exploited a vulnerability and essentially drained all 15 million dollars from their contract address and um afterwards he or she very kindly returned 8 million back to the address which has led to all kinds of theories about why it's been done but yeah so the lesson here is please don't be greedy and put money into contracts that may potentially uh lose all your funds uh and if you do want to be greedy then just make sure you don't put in any amount that you're not willing to to lose uh moving on to some local news um this is kind of uh frequent stuff that we see nowadays but it came up last month that um there were about a hundred thousand ringgit uh that's about roughly 25k usd uh that has been um that has been uh stolen uh from sort of electricity from from other people uh and this is in sarawak uh and it's been going on for a few months and they were finally caught um recently yeah so that's just uh something that's happened we also have uh two stories actually of um sort of big publicly listed uh companies in malaysia uh who are dabbling in crypto so for those of you who remember the horse currency from i think a couple years ago uh so country heights um they are founder and i believe chairman has stepped down uh to focus purely on this blockchain venture uh the country heights itself wanted to do this but they were essentially blocked by regulators and the founder has essentially sort of stepped down so that he can run an independent subsidiary that can work entirely on this project and as i understand it they plan to be the first publicly listed malaysian company to accept bitcoin and ethereum for their services and another related one is xox berhad which is a mobile telco have announced that they are creating this end chain powered blockchain to do traceability as a service essentially uh using internet of things devices to track um um sort of movement uh of of items and putting it on the blockchain um we have dominique here today so maybe he can expand a bit more on the sort of how much of that is um something that blockchain can add value to um for someone like me i've always been very curious as to how um any of this is um how much of this is real value and how much of it is uh based on the whole uh hyped buzzwords of iot and blockchains um but yeah so that's pretty much a monthly roundup for this month uh we're at just before 8 15. so next i'm just going to introduce uh dominic from diode uh dominic's the cto of diode and um i guess i'll just let dominique introduce himself next yeah hey thanks harris for that um that was really interesting i'm curious about that telco is doing there with with blockchain um i can share my screen in a bit and then i can talk a bit about what i've been doing [Music] let me see i try to share my screen here just tell me if you can see that awesome yeah so i'm i'm dominic i've uh i'm co-founder and cto of diet.io so we are a blockchain startup and before that i was working in an iot company in taiwan and before that i was working in at nokia and also doing uh iot like the the old mobile phone maker so i um i got around quite a bit there and um just a little bit more about us so we have this um we work based on ethereum and we have an ethereum fork that we're using to implement block quick and this is really we started out with a iot background so and we wanted to see like hey how can we actually take like a light bulb and connect it to the blockchain how do you how do you actually do that and then we found by trying out that if you try to use geth or you try to use iota like you need to have a lot of capacity on these very small devices and so the top right here for example in the fingers that's like an esp32 it's a very popular chinese chip but it only has two megabytes of ram right so it's very very small but so if you want to sync like with any like uh other client like iota or gas you just blow it up and so this is where we went in and because of that created block quick so we can connect to the ethereum uh network uh this is what we launched is what we built on you can download the client um today and uh i want to talk though a bit about um what we what we think of the iot space right so this is some of the demos we did we have some video streaming over the blockchain network of end-to-end encryption we have a secure time consensus app so actually having a device get the time from the network we have built a vpn client demo to make like an anonymous a blockchain based vpn network and we also built a developer tool you see that in the bottom left uh ngrok on blockchains that allows developers to make decentralized websites and publish them out to anyone on the planet who wants to see them in a in a decentralized fashion like from the computer on the under your table basically and of course there's a network explorer that is mostly what has ethereum but plus like iot uh uh additions like a map view of the network and then different concepts that we introduced but let's go back to iot and blockchain i think the first reaction if somebody tells you iot and blockchain is like you should take a step back and say like what like why why should i care about like this thing called blockchain and why should i care about this thing web3 and especially from a business perspective often the reaction we see is like um they care about about making revenue right so like what is the thing that helps me to to improve my revenue here and so this is a chart i really like um where we look at like this if you think of a company right it has certain wants and things that wants to achieve and it has needs that things that need to do in pains like existing open problems and a business is always interest in like solving one of these problems which all are focused on the business but it's really hard for a business to say like hey there's this new thing from blockchain and you can send money from a to b and they say like but we don't need to send money from atb you know we have a light bulb and it needs to like turn on and turn off so we need to fit into this triangle here for companies and so i've put your left and right some of the use cases that we know from the blockchain space and some of the use cases from the iot space and on the blockchain side i think it's pretty clear we have seen digital identity of course like everybody here probably i guess everybody here probably used metamask at some point or some other tool like just to interact with uni swap so they definitely dig digital identities there and something we can use and there's supply chain voting fundraising nurturing food safety and of course defy banking on the blockchain that is a big use case and on the other hand iot has like quite a couple of different ones and we need to find the overlap between them now my and i want to say that's my personal opinion there's certain um there's a couple of attempts to take like blockchain use cases for example like some of the banking some of the actually sending money and moving that to iot and and often often cases that that's actually not a need that iot has right so if you look at your drones for example your drones do not necessarily need to send or receive money often it's like the user of the drone who's doing that but we believe that there's another use case that is here in the middle right we have the blockchain strengths we have challenges of the businesses um and we have the business needs and we need to find this overlap like where's blockchain really good and businesses really want to have it we believe fast the answer is security webs3 security blockchain security security aspects that the blockchain can bring and i want to talk about that because um this goes back a bit to like incidents that we are seeing in the like every every other week so this one for example i don't know how many have seen that in in the community but this was a couple of weeks ago when twitter was was taken over and all these twitter accounts suddenly started to tweet out these really silly uh crypto scams like hey i'm joe biden and i'm giving out uh bitcoin to the community just send some to me and i send you back right and what that what he happened the security incident is actually pretty pretty interesting and i want to talk about that for a second what happens here is that twitter and like any other company on the planet so what they have is they have some support staff right there are some people on the phone and you can call them and you tell them hey i forgot my password can you please reset my password i'm really elon musk can you please reset my password and if you if you convince them that you are elon musk they will have the power to reset you and you have that in every company on the world it's called the principal agent problem so these support guys they are not elon musk but the support guys they have the power to basically take elon musk's twitter account right and do with it whatever they want and the same is true in any other services really in facebook for example there's facebook support people who have the power to do everything with their with your account that they want right just because they are on the admin side of it they're somewhere in this data center they're sitting there they're able to make these modifications they have some direct access usually to do good like to help you reset your password but effectively they have the full access and this creates a problem that you just trust them right you're the principal you're the customer of twitter or facebook of any other service in the web and you trust that the there's some agent like in the support and they will not act out of soft self-interest they will only do what is good for you and they will never reim take your identity and do something great with that and we believe that this principal agent problem is actually a perfect fit for blockchain because we can solve it with blockchain technology we can actually replace the agent in many many cases just with a smart contract we don't need a support person to reset your password if you can have like social recovery for example where you have a multi-sig wallet and that multisig wallet you can use to ask like three of your friends can you confirm i lost my password and and reset it and so this automation can actually apply to many many cases and in the future we don't need the support stuff to be able um to to be able to reset elon musk's password in fact it's so silly i think if you if i think about that at least you should have a system where you said like if there's a support person who can reset passwords accounts there should be like two or three people needing to also approve it you know like in a multi-stick especially if it's an important like if this is a president or the vice president's twitter account you should have multiple levels right and of course with a smart contract this is super easy to do and you can actually prove that really nobody else can just do it you always have to go through the steps if it's multisig and so we're going to take we're going to take this and we actually believe that this is applicable through like a lot of industries in iot um but also even in like the normal web and so one of these cases here is the principal agent problem in pki so this is just your daily internet connection you go to https.facebook.com and then facebook tries to open uh encrypted connection to you and so what's happening here is actually if you ever click in your browser and this top left icon there's like a little lock icon and look at that and it will show you a certificate and it will show you that the certificate has been signed not by facebook but by somebody else it's called an intermediate certificate authority so usually it's let's encrypt or digi cert they're quite big but there's actually many of them and there's many of them that are just like um small individual companies but we trust all of them because as long as they sign the certificate your browser will accept it in fact your browser does accept roughly 3000 of these different intermediate companies so this is some of them you can you can actually publicly query that i have a link here it's not clickable as you can see it now but maybe i can put that in the chat i can do that in a minute but you can check that out so there's some companies you know like let's encrypt and digit but there's also companies that you don't know like basically in every country on the planet there's such a company and they have the ability to create a valid ssl certificate for everything like for every domain on the planet and so you you not only have to trust one of them you're effectively trusting all of them right and not surprisingly i was just curious about that on the right hand side you can see like the distribution most of them are in the western world like tons of them actually in the western world but there's um i think just because of the history of the internet but there's it's growing all over the place and um this is what happens when somebody actually creates a certificate who is not the one you should you think me so this was actually half a year ago in kazakhstan when the kazakhstan government decided that they actually want to read all internet traffic from the customer from the from the citizens um what they did is they created fake certificates so this on the on the left hand side we see the correct certificate from facebook at the time so we see it's the names facebook and it has been down here it says cn which means certificate uh authority and it's digital and the country of digital is yes and then on the right hand side we see the certificate that was delivered if you lived in kazakhstan um you would see a cn like a certificate authority called the security certificate so they just made that name up and the country of origin was kazan so they created this certificate but every browser would say like this is valid because it's signed by one of the intermediates that your brother trusts already so this is a typical principal agent problem and this is not it's not bad intention by anybody it's just like the technology when it was created before we had blockchain there was no way to make a central database right there was no way to make a central database that everybody can access and that is always online so the only way they could really do at that point in time is create these hierarchies of of trust but today we have blockchain and so we we're actually suggesting and we're using decentralized pki in our product and dpki means we're putting the certificates into the blockchain and the dns names also into the blockchain so they're living both there and now if the user browses to facebook.

com or would in this world browse to facebook.com they would only contact the blockchain to check hey i want to know who owns the facebook.com domain and you get back like an ethereum key like an ens and then you can check like and what is the correct certificate for this also from the blockchain and then there's no third party involved nobody who can like inject anything else and you don't need to rely on the trust anymore so the man and the middle attacks become possible this is the second item we show here like we talked about twitter and the support people and the support people were an agent now we're talking about pki and we see that we have these intermediaries and they're an agent and we can also remove them and the business case if you do this in general is actually pretty clear like of course it becomes more secure because you remove flick some of these intermediaries but it's actually also easier to be compliant because now in europe for example we have this gdpr which is a data privacy act so companies have to show that all their data and everything they do is trusted and within country limits right like i want to ensure that the data of my customers cannot leave the eu for example and it becomes actually in the systems we have often really difficult because there are so many intermediaries but if you remove them it becomes easier to prove who's involved and who's not and then very important for businesses reduced costs right if there's less agents involved there's less people you have to pay it's very easy um this is pretty technical here but i wanted to show that on like the typical way like an iot device and this might be the light bulb or this might be maybe a robot you have or like a smart watch what what they usually do and and looking at that how it is today with pki and how we believe it it should be in the future and this is like uh it's it's code from like the c language from the c language i don't know how technical people are here but there's basically a couple of steps that you always need to do the first thing you need to do is like you need to get the time as an as a small iot device and surprisingly that is actually not not very easy to get for human it's quite easy to understand the current time because you just walk up to the next clock and you ask three other people and then probably you're gonna get the real time that it is right now but for a machine getting the time trustworthy like knowing that the one who's just delivering you the time is actually the one he says and it's the correct time can be very very complicated it's effectively unsafe when you try to make a um look up of like i want to connect to my hometown like so we had for example this puppet um that would be able to be a baby controller so it's like a baby phone and you can put it in the baby's room and it acts like a microphone so it needs to connect to some server and you want to ensure it actually connects to the right server but today they as we discussed they're using these certificates and they're often using unencrypted dns and so also that lookup is not safe and then finally they're checking the certificate we just talked about that and it's also unsafe and then on the right hand side here we have how it could look blockchain based and like this time problem we solved because if you know if you know the peak of the blockchain like the most recent block it actually has a timestamp so we we know the time if you know like the an ens address you can look up in in the blockchain and with the merkle proof you can prove like this is correct and so you can get the certificate and you can connect and the whole pass we can actually make entry in secure so it's something completely new to to the web that's why i like the term web 3 actually because i think there is potential for that as like web 3. um and just be with me one more second here on the technical parts i just want to give like a little side grant here on infura and a lot of people who use in in in fura which is they're doing a great service and it's awesome that they offer like infurra for free for everybody um to make your little web stream experiments but they're becoming an agent as well like everybody is trusting in fura when they use like web applications like even metamask is actually trusting in fura they don't because the user is not doing their own validation right the validation is not running in your browser the validation runs on the infura say and so everybody is trusting in full it's great and it's cool for adoption but it's an agent right so just just be aware of that and so where we wanted to go to is like getting rid of that right getting rid of the https and getting rid of the agents and so that's what we did real quick on the right hand side here so i would like to go a bit through like some and it's always the same pattern here it's some of the attack vectors that we have so we always have this agent problem and in many many cases this is what we're talking about here so this is a typical company that does some iot product we call it the enterprise they have some admin staff uh they have some servers they have some connectivity down down there on the right hand side like the router and then there's some device with our little yellow robot that hopefully is doing what we wanted to do to do and then on the left hand side we have the core internet infrastructure that has routing certificate authorities dns servers ntp and all of these are attackable and they're like from least like the easiest to attack too harder and harder to attack so one dollar sign means really easy and cheap to attack like the cheapest to attack is the call we just talked about like hey i forgot my password can you please reset it and then it gets more expensive like you can attack a server try to like give it make a denial of service attack you can do men and middle attacks and so on and you can try hacking actually devices directly but for that you have to find like the intrusion points and then you can like go on the left-hand side from bottom up upwards like ntp you can try to change time with men in the middle attacks dns servers take over certificate authorities to bgp routing and so we want to show you just that actually all of these problems that are happening like weekly really these attacks are solvable with blockchain so twitter actually after this incident they they confirmed hey we detected uh the issue and we found it was actually social engineering so it was in fact some of the support people either they were blackmailed or they were called we don't know but somehow they got in through the uh some of the support people into into twitter and could take that over so very clear if you replace that with smart contracts like this problem is just gone right this is you can actually as an industry you can just remove this problem then we had um after shortly after twitter i don't know who saw that like garmin was down like all of garmin was down and they had a ransomware attack um they're up again i think right now um but they couldn't recover all the data but they actually had all the servers down and what happened in to garmin is um they got ransomware so it's like you open an email and there's a like little binary in it and that will encrypt your whole hard disk and then for some reason it was able to go from there to their servers and they did never explain like how that did happen but somebody in their office installed the virus and then the virus spread into their servers also this like if you if you have a central server that's always the issue right because for the central server somebody has access to it you have an ip admin he has access and you have like this whole operating system like linux or windows running around this and if windows gets infected with a virus like your program will not be able to run anymore like they can shut you down they can do whatever you do but if your program runs on the blockchain in a smart contract you have to try to infect the blockchain with a virus right and this is much harder so the attack vector like nearly dies out i want to be fair to everybody so it's like like there's still like in theory you can do a 51 attack of course right on blockchain you can always do the 51 but it's much much harder than sending a virus email to some random dude right now you probably you suddenly have to like hack the whole network before you have like heck one guy's computer in the whole company and then we talk about man in the middle so there's actually so many of these ransomware attacks today right i just wanted that this is um i took the snapshot just from last year um this is actually exploding this year i was just didn't have the time to make um a good uh summary of that for now but especially in the u.s what they're doing these hackers are that they found that sending an email as a virus works pretty well um they're doing that on all kind of different governments so local governments local local city governments are sending the local cities some virus and then they ask like you only get your data back if you give us this money via bitcoin and so they're all having this problem and it's just like because hackers make money and if you make money with a business you can you realize that your business idea is good and you invest more and so you attack more and this is right now going crazy like cities are being attacked like like not never before and probably we have to sell it as crypto i hope we can be the solution with web3 but for now we're also part of the problem because bitcoin is like the way all the hackers get the money yeah right so we think we can solve that we think also we can solve most of the men in the middle attacks where people are intercepting traffic it's still happening like everywhere in iot that devices are communicating without encryption you get the data you access it you send wrong like you send a virus you send some wrong data this is not necessary like with ethereum private keys you can actually not only do um sending transactions but you can establish secure connections from one end to another end so if i use my ens name and it looks up to the ethereum address and my let's say harris is using his i know his ethereum address as well then we can establish on a technical level like an end-to-end encrypted communication channel just based on ethereum technology and so this is what we do as well with nobody in between and then of course at the end network uh control so right now if you use like the standard internet there's a lot of open ports there's a lot of communication that can be hacked and cracked and if you change that those through web three interface where everything is authenticated because everyone on webs like everyone on the ethereum network who's interacting has an identity right so you basically have no autonomous um access anymore you can like uh harris is shaking his head like anonymous in the in like in the personal term of course you have that right you don't know names but you always have an id right you always have an id and so it's very easy for iot devices to say like i want this device my puppet to be controlled by this and this this id and everything else no and you can do that on a network level and i want to fly about this because i don't want to like um take too much time here but we talked a little bit about time that this is actually a problem i just want to show this like you can check this also in your browser actually if you click on the lock there's always like this view certificate and you can look into that like every certificate that exists um and that protects your internet browsing has like a starting time and an end time like this one for example this is actually this from our call just before i entered or call i checked like the certificate from zoom and so it's using a certificate that's valid after um may 2020 and until like two years from now and that's great and so for us as humans it's very easy to see that well this is valid because right now we have uh october 1st of october and so this is within that time frame for a machine it's not that easy because it first needs to know the time right so especially if you imagine the first connection it is a stick in a neck problem i need to get the time from a time server of course this is what you do but how do i know that the time server is truly the time server i want to talk to you right the times i was going to send you a certificate and saying like i'm the time server and in that certificate it says not well before and after and you're like yeah but i i don't know the time right and so there is a chicken and neck problem that hasn't been solved without blockchain and with blockchain because we can get the time from the most recent block we can solve this check in the next problem actually this has caused so much trouble on real deployments already for example the oculus ar headsets that you can use really cool devices they had this problem that they would not auto update anymore because the certificates would expire and then nobody could use them anymore you have to replug them to your computer and reset them so we can solve that we can solve dns with blockchain name servers like with ens or other variants of that um this isn't just another example just i want to show here examples of like everything that we think we can we fix is being attacked in like the normal web 2 world today so this for example is a hack that happened two years ago on customers of a bank so they took over the dns name then they put themselves in between the customer of the bank the customer thought he's talking to his bank but he wasn't and then he clicked like make this transfer i want to do a bank transfer but actually they were sending the money somewhere else and this happens through dns because of the way that how dns is being used to validate correctness so you can use let's encrypt if you have control on dns to get a valid third and then you can use that to intermediate people and the way they got in between is actually an iot attack because they got on the customers routers in their homes so we can we can fix that ens is actually working on that as well uh smart contracts of course we we can replace the weak factors there and then there's like this last item that is really hard to track it's like the lowest level of the internet infrastructure right now it's a bgp routing so if you send like a package from here uh to another location on the other side of the planet there's like an automatic decision making on how the packet is actually arriving at its destination and it's malleable right now so you can actually impact that and we know that this is being impacted this is like an oracle report um there was it's a report from december 2015 it was like one of the first times they detected it and they tried to send packets from los angeles to washington right like data packets tcp just make a normal connect open a connection and what they realized is that for some reason these data packets from los angeles to washington dc did not go through the us they left the us they went to to asia made a hop in asia and came back there and that was actually a routing attack so these routers um in uh in shanghai they announced well i have the shortest route to washington he has sent the packets to me i have the shortest route okay like i'm the cheapest flight come to me and and so the packets because it's a totally automatic system bgp went over there and then went back again and so this is something um that we are still uh working on but our belief is that because we have end-to-end encryption even though you can reroute it like a big player like that you can still not read it and so i'm coming to the end here this is why we believe actually the number one use case for iot and blockchain is increased security like is making security simpler is um making systems simpler and making also systems sometimes cheaper and removing this principal agent problem in so many companies and it's not only applicable to iots as i said like it's um facebook twitter all the social medias you can they can actually make their businesses cheaper and more secure this way if you think about that so we looked at this in the beginning so i wanted to look at that at the end again once like lower cost every company wants to have lower cost um they have needs security of obviously and our pains um i want to raise that because this is actually something that we see when we talk to companies they are ultimately afraid of tokenomics like companies when they hear blockchain they hear that and like maybe this sounds all great but if i do this maybe i get regulated by the fed right so they're really afraid of this and this is something um that we as an as an as an economy and a community we have to work on to also take take the fear from the companies and show them the ways this can work um this is some of our nap steps it's very technical so i'm gonna skip this if you're curious um you can go to our website and check out there's some of that if there's only two things um to take away from this like if you can remember two things from this remember we are the guys who did block quick it's like the first nano client for ethereum networks and we we as a community as a as an ecosystem we have to decentralize the admin we have to get rid of these i.

t admins of these support people that have all the power because it doesn't make sense and it's a super big um security issue for everybody it's a human factor and like who can impersonate the president who can impersonate elon musk who can impersonate you right and it's also a problem if you work with centralized exchanges right you don't know who else actually has access to your funds or could do something weird with that so we have to solve that for everybody in inside and outside of crypto and and that's it really like um i'm happy to answer any questions you can actually like what i presented you can download our software right now it's pretty technical piece of software from diode io there's a slash downloads and it's a cli is a command line tool for iot devices you can download it and play around with that if you have a raspberry pi that's like super easy to do and just have fun and let us know cool thanks thanks dominique um so yeah we're opening um the floor for any questions you can either type it in the chat or just unmute yourself and verbally ask in the meantime i had one right at the very end there on vlog quick to be honest i'm not entirely familiar with um block quick as a light client so i know it's a bit off topic but uh could you elaborate more about um like what what uh what lockpick does or did and especially now with ethereum getting more and more bloated how um how does block creek with that yeah sure block quick is actually a pretty simple idea so the problem with a lot of like clients or like other clients is that if you want to validate the whole blockchain usually it's it's a lot of effort and it's a lot of traffic right so i don't know how many of you try to run a ethereum node but you know like that getting over the sinking is like the major pain right and if you try that on a desktop it's a major pain if you now imagine if this tiny tiny device it's like nearly impossible and so there is a couple of these um approaches there's actually another algorithm called flycline and flyclient and blockclick we looked at how we can get these very small devices to somehow leapfrog that validation and so what we're doing in in block quick is we're using actually the ratio of all the miners as a way to jump uh the validation so if you go to etherscan for example um you can see that there's a distribution of miners actually i'm not sure i don't think i have this as a slide but there's a district like a pie chart of miners and you can see like thirty percent is this guy and thirty percent is this guy and and so on right so and these people are basically you can see like how many of them you need to know like this is 51 approved and so this is what we do in essence the client is checking whether there's 51 of these people present who approve that this is the valid block the most recent valid block and then based on that we we take a snapshot of this pie chart and we have an algorithm to extend that right so incrementally say like because they're not always staying miners sometimes the ratios change right we can update it over time in a secure manner but that is the um essential idea of block quick right given you know this pie chart you can check well this most recent block has it been approved by this and this and this and this guy um the uh the the way we do that is in in blocks you always have like the miner today like you have the coinbase who is actually the miner today though in an ethereum like in the default ethereum client that is not a signature not signed with a public key signature but it's just put there so anybody like you can put like somebody else's coinbase there and then it looks like you have created the block in our case um we ensure that it is a signature so nobody can like impersonate some some big miner and then the existence of these miners tells us well that we are still on the valid chain right just to make it very plastic like imagine you're on a fake chain so somebody wants to give you a fork like um like the light bulb the light bulb is a poor small device it's living in your home and it only has connectivity through your router now you you go to your router and you tell you show the light bulb basically a different internet where it can only see your fork like your personal fork the problem with your fork is it is like following ethereum quite some time but then suddenly from some point in time every and created block is created by you right by one identity which is you and now the light bulb looks with block quick at this and says well i see more blocks but none of these blocks are from the 51 of people who were actually creating blocks before right something is wrong here i'm not going to believe this i'm not going to believe that all the blocks were created by this pool of many many people and now suddenly it's only one person creating blocks and this is where the block quake realizes this is not the real chain this is a this is a fake chain and this protects you like from like it actually also protects you from all kind of um 51 attacks that we have seen right because what mine what often is happening there is that there is a single entity like one company or one evil guy creating 15 blocks right out of nothing before he was never active and now he creates 15 or 20 or 100 blocks so the exchange believes him but with this kind of system with block quick that's also not possible because they all would see well it's all the same guy who created these blocks it's not it's not the real chain so let's see a sense of block quick it's actually pretty simple if you're thinking about that okay cool um there's a question here um i guess kind of the obvious question is um with all the sort of um decentralizing the principal agent relationship um would governments be okay with um what diode is doing as a solution and i i think so yeah i think so i i think actually it i i hope that this can be is actually gonna be a happy blast for for governments i think that governments are often like protective right and so they want to protect their their uh their users or their citizens and i think one problem that we're also seeing like right now in the u.s between tick tock and the u.s government is like of course you could like i think it's mostly a positive from what they are realizing is that a different another government has access to our residence people right and this is what they're saying and this is a problem for them now if diode comes in or some other decentralized solution you can always prove actually no no no other government has access to it nobody has access to it right so it's like it's peaceful neutral data you can prove that nobody has access to it and if nobody has access to it then there's also no reason um for the story and i i believe actually that this is one of the biggest drivers in europe for example the new data privacy acts in brazil we have new data privacy acts in the yes we have the new policy but they're always starting because they realize a different country has power over their own residence and i think this is actually where blockchain can can help us save the internet really i i think this is this is all about saving the internet because i'm afraid that in 20 years from now i'm going to tell my children you know like when i was young we had the thing called the internet and you could browse from one side of the world to the other side and you could read news from another country but you today you can't anymore because what i'm seeing is that the internet is fragmenting right into so many national bubbles you have the chinese internet you have the russian internet and maybe in a couple of years you have the european internet and the us internet right um and even like like every country is starting to to do that because they see they lose they lose this control to other countries and i think that's the danger but if you can bring make blockchain the platform then and we can show that nobody owns it we can really go back to some of the previous thoughts of the internet like this is an is its platform and nobody owns it and then i think most most governments are much happier to work with them and let their residents have them as well so this is my i hope that yeah good uh to kind of um um uh on a slightly different note um and this is more general kind of uh question because i guess it doesn't doesn't just apply to diode or iot um devices or solutions but so when you talk about how you want to have like multiple parties to provide identification if if people lose access uh to have some sort of multi-sig um sort of structure um have you thought about explored more on like how to make uh the process easier if suddenly like multiple nodes or multiple wallets in the multisig uh go offline or like in the real life terms like if people pass away how do you ensure that it can still continue to function smoothly yeah i think um we are focused actually somewhere on the business cases and so in the businesses i think there's often like the the multiple nodes would actually be other companies often right so um for a lot of these iot companies um we believe that they it makes sense to have like this kind of backup way right to say like if i lose my password if i lose my attack my my data or even worse if i'm being attacked and somebody is stealing my private keys or something like that happens i need this backup method but it could be then that the company is choosing those three or four or five um other companies that they trust you might be a bank you know like if it's company they might be trusting their bank because they're also trusting their bank with a bank account and putting it there and so you get like this risk of the bus factor right of the deaths like um you can reduce it that way but also like the way you can reduce it you can because it's smart contract right you can deploy whatever smart contract you want you can reduce the risk just by saying it's not two out of three but maybe it um it is um three out of five or four out of five right you can like increase play around with these numbers increase them or decrease them really depending on you personally or your business case it's i mean it's a total freedom and there's nothing predefined by us right it's just like you define a smart contract yeah so i guess somewhat related is um if if especially in the earlier stages of um of rolling out um these kinds of solutions do you see like um there can be edge cases where just something that hasn't really happened before and um you you kind of have to like step in manually to to curate uh something um do you see that happening yeah i i think that um just what you said like the i think that users are not sensitive send twice to like managing private keys today right this is clearly something that we see so if you if you set up a meta mask account and metamask is trying to tell you like you need to keep my backup of this but we see that people like not from the blockchain space do not fully understand that they think that yeah i see this always right but at the end of the day i can still use email recovery and people don't understand that they cannot do email recovery like if your private key is gone there's a problem um so this is i think this is the biggest problem we're seeing um our solution to that has been to tell like uh get get a hardware wallet get a ledger wallet um if you like if you feel like the customer cannot like he doesn't they're not technical enough just get a ledger wallet it's it's solving that as the biggest problem because it makes it much more like a physical key and then they also understand like they cannot lose this and they will keep it secure and at the same time it keeps your solution secure okay it just the the problem with that is though if i can say that like the user interfaces become more complex right and the user experience becomes more complex of course yeah it's always that balance between ux and security uh just uh uh checking in if anyone has any questions and if you know you too shy to ask them feel free to uh dm me and i can ask for you uh um yeah so anyone uh feel free to to raise any questions i think we can take a couple more questions before we move on to uh the next section um one question i had was so you mentioned uh earlier in the presentation of um i'm not sure if i'm pronouncing it right uh and rock or n rock yeah where it's for decentralized websites uh would you be able to compare that maybe with ips ipfs which i guess some of us would be more familiar with yeah sure um it has it is really two different systems in ipfs the idea is you put some um you put some data out right like some static data it could be some a website or it could be some like even some files from from the past but it's always some data you publish um what we are doing with with the decentralized website is actually like in interaction so ima it could be an auction site you know for example you have an ebay auction site so you're not only consuming data and reading it but you're actually writing it something like an action you say like i want to buy you know like or you may you make a post um something um that actually interacts in both directions and so this is when you really use it's much more like standard web technology so anything that is web technology today you can publish there um with developers very popular for example is also ssh access right which is just to remote access to a machine so you have your light bulb or you have your iot device like on the other side of the planet and it doesn't have like a public dns name so you can use the diode actually to give it that it gets this um public name on the ether on the chain and then you can connect to it with ssh and that's something you cannot do with ipfs right because it's ipf has like a file protocol but diode is a direct connection protocol for bi-directional communication between two sites also like a video chat for example a video stream you can you can also do that with diet like anything that is bi-directional and real-time okay uh okay and i guess back more on topic there's a question here on um basically so so and i think this is quite common as well uh kind of question that people would have is um if it's if there's an iot device uh and uh if the the device itself uh gets hacked how how does the system sort of detect it and um block it or prevent it yeah this is a this is a good question right so um there's probably a couple of answers to that like one is that we actually have seen a lot of devices being impersonated and often the problem is that like devices don't talk encrypted and often is that the platform of the device is being attacked right so at least that like the platform of the device we can protect because we're not using these public protocols we're using ntn encrypted channels but if it still happens right you still have some bugs and somebody's still able to hack the device then the device is going to impersonate um in the worst case have access to the private key of this single device right so in our model like every device has like its own private key and they all belong to a device fleet that's what we call and so we identify them that they belong to this to this device fleet which is a smart contract now if one of the devices being hacked and starts acting strangely you can just kick it out of the of the smart contract of the fleet device and then it's if once it's being kicked out it loses access to everything like oh in that moment because in the consensus in the blockchain everybody sees like this device doesn't belong anymore to our fleet it's gone and can't talk to anybody else anymore okay thanks uh dominic so that wraps up dominic's presentation thank you for uh sharing your knowledge we will be going to the next section here of uh a discussion on decentralized social networks uh and i think um dominique even mentioned uh some some of that in as part of this presentation and i'm sure everyone has a lot of opinions on the current social networks and the problems with them and how potentially a decentralized version can and provide solutions for it so i'm just putting in a link to a google doc here in the chat so everyone please feel free to come in there and add notes to it and if you want to suggest any uh different subtopics to discuss feel free to do that as well i was just thinking as a general template just to sort of start with what it is or what people understand the topic is and what are some pros and cons of the current version uh versus any suggested solution um so yeah if anyone wants to um kind of given your opinion of of what a social network is as it stands and how a decentralized version of it can can work um please please feel free to bring it up otherwise i'll come up with my own understanding and experience of it first so yeah so social networks as it stands are um websites like facebook and twitter um obviously uh we can use it to communicate with people around the world but the problem comes in where it can be co-opted people can can put in fake news and because humans are inclined to believe um there's this thing called confirmation bias where we're inclined to believe something that um agrees with our beliefs um so people stick to their own versions of our truths and end up in this worrying situation with each other all the time and there's also an element of sharing sort of information that is not safe maybe morally ethically or even just from a national security point of view so those are some of the problems with uh such social media as it stands um a decentralized uh a decentralized social network theoretically can sort of get over any censorship that happens and with the example of steam you can be even incentivized to to add input so that you know you drive uh people to add more uh opinions um on these networks um there are probably a couple people here who know a bit more on what happened with steam uh so if you know uh feel free to to add ray do you want to elaborate a bit more on what happened to steam to my understanding uh it was uh i mean first of all there's a question of uh if you simply incentivize using just money um how far that can go uh because uh money alone uh without elements of like uh reputation uh doesn't uh go very far and uh with a blockchain that eventually uh can be bought over and be owned by a centralized third party then um it defeats the point of being a decentralized social network so as a generalization you could even say that um even if it wasn't steep if it was any other decentralized social network but if somehow it gets a 51 attack then it can be corrupted and we've seen with real uh chains whether social networks or not that a lot of times people don't necessarily care and the value can even hold up even as it's been attacked multiple times so yeah does anyone at uh i want to add any uh thoughts on on social networks um an introduction to current social networks and to decentralize the social networks uh yeah paul go ahead you should be able to unmute yourself yep i think i just did can you hear me good um yeah so i want to introduce another topic about uh about decentralized social networks and well we we as with everything in in in blockchain we sort of we sort of have this part of where there's the logic and the the data storage right and and i think that something very interesting in in social networks as they work right now is um that you actually go to somebody's house to somebody's server do let's say facebook um and you knock at their door and you say hey can can i have my own data that that you're hosting for me and they might or might not decide to give you access to this data um depending on whether they decide that you're a bot or that you are actually the person that you're saying that you are because you introduced the password um and and they might let somebody else that actually has this password access this um this data that's that's um that's that's yours etc and um but but not only this but also they are in control of who else can see your data and who else's data you can see and i think i mean that's that's just how it works and it shouldn't be surprising at all um but it is important that we consider data storage part when you think about the centralized um the centralized social networks because it becomes really powerful to be able to be you who is able to give control to your own data to somebody else to and to revoke the access to this data um okay i'm i'm just not going to say dab node but don't know um but no no sorry there's so a social network built on top of swarm or ipfs um could be something that allows uh that that that would allow you to share um your encrypted data into the centralized way um with whoever you want to share your data so whenever you um so imagine that you that you basically have the skeleton and that's the that's the social network it's like a wireframe and you fill it with your own data and then you're actually asking in the background to other people's servers or to other people's other people's swarms or ipfs's um you can say or other people's smart contracts saying like hey where can i find the ipfs um hash of your latest data your latest update and then you feel it whether well you feel it if they actually give you access to this sort of thing and that's something that i've been thinking about um lately on on the data storage part because a lot of well i mean that's that's the part of i've not been um seeing or hearing so much i think one issue with ipfs uh as a sort of infrastructure for this is at least in my experience uh it's very difficult to find um relevant um links or or items um maybe there's just a ux thing that can be solved for but as it is right now it's it's a mess to find these things absolutely true um yes it is it is a it is a bit of a mess and maybe it's not there yet in terms of uh usability um but some something similar i know the the storm team um the b team is doing a great job towards that direction it's something that they have in mind and they're working with a data fund as well for for uh sort of like fair drop and uh and another solutions for for sharing data um and give permissions and withdraw permissions to other people to share your own data um of course everything becomes a lot easier if you if you're hosting your own notes but there's ways of of doing that um and spreading like putting putting um sort of like where to find this information um in in a smart contract so to speak and then whoever has access to that smart contract or whoever or maybe the smart contract is public but then you you go to that address and you can only decrypt this data if you have a specific ethereum key or or if you're a specific person dave did you want to say something yeah yeah yeah um i mean okay i mean we we saw people which basically offered twitter like stuff but did not uh but it's still struggling insanely um but i was actually what had had some other things to mention um let's let's make myself visible hey i can see um okay so the other uh yeah the thing the things that i was thinking about is that i mean there are definitely pros and cons to um making some making a social network decent decentralized one of the problems that we that we don't like about facebook is that people can game the system right um the problem is any kind of incentive you try and put in place um is equally gameable uh so you know we all have an idea of what we deem acceptable and not acceptable on a social network and they're all different right um now you mentioned two things earlier on really which is like financial incentives and reputational um i mean i i know i knew a guy who you know he would go to a restaurant and he would just park on the double yellow line outside because he didn't actually care if they find him the amount of the fine didn't mean enough to him any situation you know if you look at like the things cambridge analytica did um i don't believe that you could put a financial incentive in place that would make it not worth them doing what they did because i believe dave i think you're we're losing you uh if you need to admit yourself okay i am unmuted okay so i think that's your you know that um it's very difficult for uh financial incentives because um you you have to figure out yeah i mean like the things that would stop a small player from from doing bad things big player if they can see enough alternative advantages from messing with the system the same thing applies to reputation really i mean we've got a couple of people in in the in the space i mean craig wright certainly seems to be one of them uh justin's son also appears to be one of them who basically just didn't give a damn yo uh dave we lost you good me too and yourself again you're good [Music] yeah anyway so i mean i think uh hard to put the incentives in place the only thing i could have been community curated uh content list if you have a decentralized platform because i mean like yeah everybody wants something to be permissionless to be um uncensorable and whether you're whether you're talking about child pornography or pirated stuff or whatever yeah there's something that you know there are things that like you know at least 99 percent all people would not want on their social platform um so it gets quite complicated and so i mean like yeah okay can you curated lists just like for example on unispot you can now choose your list of coins uh that's one possibility um question would you want to go into a network where your kids could pick up an alternative list and then access stuff you really didn't think they would be accessing at their age so there are lots of challenges that's basically where i'm going with this um you know uh you know decentralization democratization is always a double-edged sword uh yeah and i think uh one very interesting that you mentioned early on was this whole idea of um i don't remember exactly where i said i'm hoping i'm paraphrasing it right but like different people essentially have different values and um the more i see of of uh things in the decentralized world um and and even for example not to touch on this very hot topic but for example politics in the u.s where essentially someone's idea of what's right is another person's idea of what's wrong and people just have completely different values and so there's this phrase good fences make make better neighbors so potentially any decentralized social network may want to kind of have a focus on let's say their network only focuses on um this is these are the values that we subscribe to and these are some other values that we don't have an opinion on um whether it's right or wrong and so to me it feels like without that kind of structure you will eventually run into a situation where um people get very um angry or unhappy at each other not because they are intentionally meaning to be rude but because their idea of what's right and wrong are just diametrically opposite and so the network if it just lets it run free people will kind of clash on those things and try and and get um sort of popularity from other people who share the same opinions or values on this one point um and and get into fiction with another i don't know if that made much sense but like maybe one example uh is um and hopefully people can take this um objectively uh are things such as homosexuality where in certain cultures it's um or certain beliefs it's a big no-no whereas in others uh they believe um it's a it's a human right and without and and i feel like um anyone uh on on either side will will never be happy with the other on this particular point uh and if the sort of network doesn't have any kind of guideline or or or or rule or structure on um how we want to approach this particular topic then it will always be fractious and and and and bad because yeah because people won't be able to agree uh on that on the rightness of that particular point uh then uh another thing that dave mentioned was about uh curation with unisop as an example this is um to me very interesting uh so eta scan also has to curate a lot of stuff uh when it comes to let's say token um tokens to to even uh lots of other details and uh there's always this problem of um like who watches the watchmen like uh if there's any curators then um who decides on on the curator whether they're right or wrong and um for example with the uniso um token list um for those who are not familiar uh unisoft recently kind of like opened it up so that other people can create their own lists so whether it's coingecko or any other project can create their own lists for people to use but essentially instead of then um unisop deciding what list what lists to get added uh it's other people who are deciding uh and then another question will be who decides on these people whether they are legit or not um to create their curated lists and i i honestly don't know whether there is a answer for that because like with one of the questions asked to dominate earlier like there will always be edge cases and especially when it comes to social things where it's not purely logic and there's a lot of subjectivity involved um so who then can you do something where is that where there is no curator at all um and the opposite will be uh if there's executed and um who who decides whether someone qualifies to be a curator or not if anyone has any uh thoughts on any solution for that that we very welcome the only thing i can think of on my end is having that sort of pre-agreed values that um the people in the network um subscribe to and values that they agree can we can have differences on if there's anything else uh from anyone um happy to have you bring it up otherwise we're essentially at the end of our time already and uh yeah if anybody's if anybody has any points you want to bring up um feel free to uh otherwise um i'll end it here um on the discussion on social networks and there's a bunch of links that have been uh added earlier i'll make sure to share it in the telegram group later and yeah otherwise we will um end to this meetup here and um the next meetup will be on the 5th of november where we will have uh that note to present on um what they do and what they're preparing for e2 and hopefully you can also have a discussion on staking in e2 whether people are looking forward to do that any pros and cons of that as well um so yeah thanks everyone for uh tuning in today and thank you a lot dominic for sharing your time