🎤 Decentralized Trust as a web3 Primitive

[Applause] [Music] so up next uh we have another awesome talk uh by another amazing thinker in the space so we have a talk called decentralized trust as a web 3 primitive danny from the ceramic team is going to be leading this chat and danny you have a little bit more time which is nice so if you want to go a little bit long you've got the space for it um but we would love to have you join me up on stage share your video and uh otherwise take it away i would love to hear more about how you're thinking about trust data identity data to sovereignty all those topics i'm sure are overlapping here absolutely thank you jacob can you hear me okay before i dive straight in yeah you're coming through awesome cool let me share my screen sounds good all right cool um well thanks again jacob excited to be here hack of s is always one of my favorite hackathons of the year we always see some incredible projects so very excited to um get into the meat of it and see what people start building and um excited to be part of the opening series here um so as jacob previewed i'm going to be talking today about trust as a primitive for web 3 um and a really core building block to start to bring some of the use cases around web 3 and more sophisticated applications to life on par with you know financial legos and data legos i think trust is a really important aspect that we don't dive into quite enough um in the right way so that's what we'll be talking about today um before we dive in just quickly about me very very quickly danny zuckerman i am one of the founders of three box labs have been working on issues around decentralized data identity reputation all of which touched trust for uh four and a half years now um steward of ceramic network which is the protocol that we've been building at three box labs for decentralized data and i will stop there more about my bio and then on the right hand side some places to come find me and us but that's the least interesting part of what we'll talk about so very big picture um i think the the goal of hack fs and building around web 3 is to start to move us from talking about the stack the web 3 infrastructure stack which can be pictured in a lot of different ways here's one that i really like from the edge of node devrel team and start talking much more about the things that you can do with the stack the applications use cases and users and values being created on top of all this infrastructure and it kind of begs the question why aren't we there yet what are the missing pieces when so much great infrastructure has been built and i don't mean to take away from that the place that we're at today compared to this time last year when hacketfest took off is way more sophisticated and the primitives are way better um and so we are getting much closer but we still don't see a massive amount of um mainstream ready high scale applications and things that are they're even at a point to do that and this talks about one of the reasons why um another piece of the framing and the kind of issue of trust has been a hot topic in crypto twitter and web3 world recently for a lot of reasons among them is the decentralized society paper from puja glenn and vitalik um and uh i just highlighted this one quote in the at the top of their abstract by three ksu today's hyper financialization in favor of a more transformative pluralist future and their paper was really about the need for us to move beyond purely financial applications why we hadn't to date and what was needed to or or one course for what was needed to do that and trust is really at the center of this i think a little bit unfortunately a lot of the conversation that kicked off after that paper became this massive debate between the implementations of how to get that trust in particular soul-bound tokens non-transferable tokens that could be issued on the blockchain as a way to um start to issue signals of of trust and reputation versus dids and credentials which is the stack that many in the identity world um in the off chain data world have been working on for quite a while um and so if you've been poking around the space or if you've been part of this um debate you've seen um a little bit of a flame war between these two implementations that's not what i want to talk about today unless we go really fast and have some extra time at the end um what i want to talk about instead at least the first is the importance of reputation as a mechanism for trust um it's a very quick story here and one of my favorite fun facts about the founding of the united states and the founding fathers is that ben franklin wrote a gossip column um amongst the many other things that he did and this seems like very strange and at odds with some of the reputation around ben franklin um but he knew that his town needed some trust to be able to work together and start to mature the things that they could do as a newly burgeoning society they didn't know each other that well it was a lot of people who had recently migrated or were migrating between different towns on the east coast and there weren't a lot of norms established in this brand new society and among the many things that he did was write a gossip column in the local paper and gossip has this very negative connotation today but one thing that gossip does is it's a way to create reputations about people it's a way for third parties to trade information including negative information about others and it's a really important way that we have developed as societies to basically put reputation at stake and when reputation is at stake for individuals it really helps reinforce the norms and values of that society that they're a part of and this can be for a society like the united states or it can be for an application and the users of that application or the constituents in a tokenized network but reputation being on the line through in different ways is a really important mechanism to get people to work together it's not the only one and we'll talk a little bit later about how this interplays with tokens and financial incentives but it's always been a critical one um this was the case on web 2 as well if we look at some of the biggest segments and success stories from the last major wave of internet companies reputation played a huge part and they could not have exceeded without reputation trust was not an extra feature it was a key enabler ebay the first really massive ecommerce success succeeded in huge part because they were able to build trust around between sellers and buyers in a way that no one really believed was going to be possible early on um you're going onto this website you're paying money to a random person somewhere in the world who you didn't know had no way of knowing and ebay was a startup at the time and you just had to trust that the seller was actually going to sell you the item and that it was going to be what they said it was especially some of these used goods that they would be not broken that there was actually original um condition that was new in box and there was not a it was a huge pain to be able to actually like if you got an item that wasn't what you were promised to actually track that down and and get resolution was fairly painful um and so scoring and ratings and reputation was the primary mechanism that actually enforced good behavior made ebay a massive hit same thing with amazon later when they opened up to third-party sellers um so reputation as a way to build trust amongst parties was critical to doing any commerce online um any social platform had to build trust um in facebook it was friends linkedin it was connections twitter's followers but they all put front and center the followers that you have in common with someone else so not every piece of reputation needs to be quantified some of it is very contextual and so showing the connections you share in common with someone is a way to very quickly build some trust understanding and familiarity on these social platforms um airbnb is a quote from the ceo of airbnb the trust of our community is our top priority um again similar to ebay probably even more so nobody believed that airbnb could succeed in getting people comfortable staying in strangers houses or comfortable with strangers staying in their own home but it was by creating a really sophisticated and trustworthy itself reputation system that they were able to build this massive company but also this this really new way of having economies different sharing economies um and so what all these had right when they're trying to build what you can think of as these little digital societies on each of these platforms is that um i think what if i did in this quote from jonathan haye uh the most important principle for designing an ethical society is to make sure that everyone's reputation is on the line all the time um that sounds very punitive um and in some ways it is and and we'll come back to vitalik has been talking recently about negative reputation which again makes it sound punitive but if you're trying to get people to behave in a way that is in the not just their own interest like the capitalism and financial incentives work so well because um in a one-time game people act in their own interest and it balances out and allocates capital but if you're trying to do things that are not one time financial games but rather repeated games where you need to actually build familiarity in context and trust basically any social application or use case you need reputation to be able to convince people that they should play by the rules that they should do what is expected in the norms of that system and there needs to be a way for them to lose reputation if what they do goes against that and so one thing that we learned from this is that reputation is inherently a social thing not an individual thing um so all these web 2 companies did a great job building their reputation systems the problem is they're built in silos and jeff bezos said a brand is a company's reputation um and so as all of us users are using these platforms and building reputation the social capital that's built the trust that's being built goes a little bit to each of us as individuals but mostly it's accruing to the companies who built these reputation systems in these walled gardens and they're trapped within those gardens or within the silos and so you have no agency or portability or composability um to use that trust elsewhere um and this is uh really great for some of these big web 2 platforms um but it took them a long time to build it up and we don't really have and you see tons of crypto companies trying to kind of bootstrap off of the trust that's been built up on twitter which is why we are constantly verifying our twitter handle for different um for different services on web3 to try to build off of that but we don't want to replicate this same issue in web 3 of having to rebuild trust over and over again because that's going to dramatically slow down how quickly we can build up trust on web3 as a whole and therefore how quickly we can build up applications and use cases that are meaningful beyond financial ones and so the question is if we're not doing reputation on these platforms in these silos where are we doing it and we kind of need a new organizing principle and that organizing principle for trust as a primitive in web 3 is to organize it around users and users individually kind of put users at the center an agency of their own reputations and the data that makes it up but also give users kind of control over and and a sharing kind of a collective way to manage reputation and data and so i'll talk about what that means abstractly but first i want to give a few examples of projects that are doing this really well already today because we're starting to see the emergence of trust as a primitive in web 3 in some very cool ways just in the last few months first example in kind of the commerce and finance world was a partnership between cyber connect so social graph protocol and rock phi to basically look at on-chain data and a bunch of other information about a user and create a credit score and then to link that credit score to a user's profile and their social graph and also incorporate their social graph on cyber connect into um their their reputation and their credit score and so what this does is it creates um a way so cyberconnect is this social graph protocol built on ceramic which is a public data network and it creates this open shared way to start to aggregate information like a credit score in a way that anybody can compose on and use and interoperate with instead of it being locked into one place and so once it's done once for one lending platform now it's accessible and extendable by anybody a second example is orbis which is a decentralized social application and it looks a little bit like a twitter but with more of a community bent to it lots of conversation happening there every day go check it out orbis.club um but like with any social media platform um there's problems with content moderation and ranking of content and creating a feed and so they've included like many social platforms comments and upvotes but also down votes and the down votes are actually a way for people to signal about the value of not just content but implicitly the author of any given piece of content and so an author that is creating lots of content that's getting down voted is implicitly building a reputation um that can be looked at to say this this person is creating low value or spam content and that can uh that can be used by orbis to change their application but also if another social app joins because this is happening on a public network they can also look at that same data that same reputation and say okay this author has already built up a reputation as distrustworthy i'm not going to let them in a third example uh git coin uh recently released before the last grants round bitcoin passport and git coin had been aggregating lots of different signals of proof of humanity so proof of humanity itself and bright id and linking to your google account your twitter account all these give some insight into a user is um just a single user and the reason this is so important for get coin is they run these grants rounds with matching funds and they need to protect against civil attacks and collusion to against people who are trying to get more matching than they deserve and so they need to have some idea of one person um uh is is acting the a person is only acting within the grants round in one way and so to do that they've activated all these scores and created a json document that they sign into a credential and put into the user's profile this bitcoin passport and so they needed it for their own application but because it's linked to the users the id and key now that is available for any other application on web3 to query and use also and so again it's not just a single walled garden implementation of reputation it's this new primitive for trust that others in web3 can build on um so how are they all doing this i've kind of referenced it a little bit but really quickly the anatomy of what these pieces of trust which is really you know it's data that's aggregating to reputation what does this actually look like and how are people building this especially for those of you who will be hacking unrelated things uh this this uh this hackathon um and so there's a few different flows but very generally a user might submit a claim that they are a certain person if they have a certain credit score they'll just bring certain data to bear or they'll just interact with an application and that application can run a service that verifies the claim or just you know it's generating the activity um for example the fact that a user participated in a um a working group for a dao and they create a piece of data and they sign it um if it's a certain format it might be called a verifiable credential which is a spec from w3c for what some of these claims look like but it can be any piece of signed data and they sign that data using the application key d id and they write that claim to the user's stream on a public data network in this case and the one that i work on ceramic and that is now tied to the user's key and associated to them but written by the application and so you have this shared piece of data and it could be written not by an application but by another user more peer-to-peer and so you have this signed data on this network that can be shared and what you're starting to build up is this single public network that maintains all this data and all this latent trust that others can build upon and start to create you know not just reputation but other forms of signal that that lets you do much more powerful applications and ones that are much more than one-time financial apps so yeah what this is starting to build up just implicitly is the shared graph of trusted data trusted because it's being signed by the ids and so it has some properties um that are really good for building trust and reputation in ways that are shareable across contexts um it's both sovereign and social um and we'll talk about in a few minutes the the um soulbound tokens versus credentials they both have limitations they both get used in ways here actually um but sovereign social because things are being signed and and organized around private keys but the data itself is on a public graph and so you have user control but not into it's not purely individual because a lot of data and especially our reputation is shared between users and so you need to be able to make attestations and claims about others to build reputation it's provably authentic because it's being signed it's being verified by nodes and that reputation is at stake because if you've accumulated lots of positive reputation lots of positive claims but then you also start to get some negative ones you're actually damaging yourself and so you know going back to the john hate quote reputation is only super valuable at stake all of the time um it's composable because it's structured data it's being signed with schema and it can be used across chains and i think most importantly it's emerging it doesn't need to be a perfect reputation system right off the bat first these use cases are being built for their own value bitcoin built a passport for their own need for their grants program so the value starts locally but now others in d5 or l1s who also need anti-sybil or proof of individuality can start to use that same passport extend it add new claims to it add new algorithms for how they're calculating to it and so you start off of this one you know trusted context um in in one use case but because it's composable and provably authentic and on a shared network others can start to build on that same thing and extend it similar to how we saw defy legos really extend the use cases of finance and blockchains similarly this trust primitive can very quickly get built upon and extended in powerful ways and so that creates is this kind of composable set of building blocks for reputation in web 3 people's and reputation again is really just an algorithm on top of lots of data so what this really means is composable signed data in web3 of all different times preferences participation endows content that's upvoted lots of followers on certain social networks and you have these composable bits of trust to build new 3 applications that can resist attacks um so i said we weren't gonna make this about the the implementation details um but a little bit about like the way to build up um this these trust primitives and what works well and what doesn't work well um and so a few things that are all important to these systems but on their own not enough so we'll talk about sole bound tokens talk about dids and verified credentials and talk about tokens themselves why does why can't we just use financial incentives for everything so really quickly soulbound tokens can be really powerful there's there's a value in bringing some elements of reputation on chain um in very thoughtful ways to make it interoperable with some of the other things that happen on chain today um especially financial markets um but they're not a good mechanism for every piece of data that we want to build it as a press primitive they're they can be encrypted and you know these continue to change but a public by default um method for publishing data is going to really compromise privacy for users um and make people shy away from using it there's lots of scale issues and you're chain siloing everything that you put on a blockchain as opposed to making it more interoperable um verified credentials and did's in the stack that many in the identity world have been working on for a long time play a huge role in um should play a huge role in building trust for for web 3 applications one of the key elements of that stack is selective disclosure of vcs giving users the power to decide what data to share when which really helps privacy compared to sold bound tokens the issue is you can't have complete selective disclosure over data and actually build powerful reputation systems um imagine a airbnb like application where every where every um review and meeting that you got uh was put into a private data vault that you controlled as a user and then when you went to go use the application again you would get to choose which pieces of data you shared what you did you would only share your 5.0 ratings and every user would have a 5.0 rating um and there wouldn't actually be any trust in the system and so reputation systems are necessarily somewhat public and social and involves some third-party claims and so pure pure sovereign systems don't work for building full reputation systems they also have some challenges around ux and security of key replication and um and credential revocation and rotating keys maybe most importantly is why not just use tokens tokens are great incentive um financial incentives for things and most of the crypto space to date has relied on using tokens as incentives to align networks but there's a huge downside to over financializing everything and as soon as there is a potential to make profit our arbitragers will flood a system and find any profit to make and completely overcrowd any of the more pro-social behaviors um and um an example i heard recently from uh from stephen cloud fund i'll give him credit was um that like how come we all pay our phone bills on time or those of us who do do and it's very rarely because we're actually scared of verizon coming to take us to court and settle our phone bill it's much more because we don't want to have our credit score harmed um reputation is actually a much more powerful day-to-day incentive than financial incentives um in a lot of cases um and so and they don't co-exist well as soon as you introduce financial incentives it crowds out reputation and other types of incentives because all of the financial arbitrage comes in and so as soon as we bring in tokens we're no longer in a social multi-time game we're in a one-time game with arbitraging and the incentive actually gets worse not better um and so one more quote um from adam smith who's most known for as being the inventor of capitalism but he wrote another book called the theory of moral sentiments which is really largely about reputation um and how we're mostly motivated by reputation and things like it rather than by capital a man naturally desires not only to be loved but to be lovely um so to be seen in the eyes of others as good and to live up to that um and so even the founder of capitalism but we you know that the the book that kind of is looked at as the founding of capitalism is about how the invisible hand can make markets be a great way to allocate capital but he didn't believe that was the right way to actually incentivize individuals um that was for that reputation as a much more powerful tool so what to do with this um some ideas that we've been talking about around our team and community that we'd love to see continue to build out the primitives for decentralized trust or to take use of it um comment and rating plug-ins for different applications for smart contracts for tokens um for all sorts of stuff happening in the space reputation doesn't all have to be quantified and so giving people ways to write verifiable information about what they're seeing and for others to use it um can add a lot of context to what's happening in the space um tracking contributions to dao and endorsement on tools and what's happening skills and what's happening um for those who've been around for a while for there was a huge wave of token curated registries a while ago but what about reputation curated registries a way for people to put their reputation at stake behind something which probably means more to them than tokens and can't be attacked in the same way as token curated registries could reputation only sharing economies so networks where you don't earn financial capital for contributing but you do earn social capital which has a softer power aggregating data around users bridging from web 2 to web 3 or creating these personality profiles that can be used as an alternative to centralized ad ids and things like it so lots of different things that are now very achievable with the tools that we have for managing decentralized data and and using the web3 stack to start to do more with trust and more social use cases um i think i'm supposed to wind down so just a couple resources if you want to know kind of how to use data to build some of these things there's a talk from matt davis on monday morning um on building with composable data um there's a blog on how to build with composable trust and how other apps are doing it on blog.ceramic.

network um and also some links here to come chat with others who are thinking about these things building some of these things and some bounties related to this um from the ceramic team at hackafs for the hackathon as well so i think that's it i don't know if we're doing questions in this one but again here's some links to come find me um or our team or some of this tech and would love to see um and hear from some of you on this but also can't wait to see what some of you build in the hackathon the next few weeks amazing thank you so much danny um i mean i do have some small questions i mean i think this is a really fascinating topic in general and like it just seems to be such a missing block from the web 3 uh world versus like web 2. like if you think about it almost like all of our institutions financial lending like all these different things are based on trust reputation and and really enable you to do so many things and um like as as great as kind of defy has been in terms of like allowing anyone market participation that kind of thing like one aspect of that for sure is that like in almost all cases it has to be over collateralized you have to have some sort of like way to get back the money in the end if somebody kind of messes you over or screws you over but in the traditional financial markets it's almost the opposite it's almost always their collateral last um i i guess my question to you would be like i think we both could probably agree on the importance of trust and reputation and stuff but um maybe what what has been so challenging about tackling this project and this problem and i know it's a problem that a lot of people have been thinking about and it is in a lot of ways like a bit of a holy grail um we'd love to hear a little bit more about just sort of the some of the challenges involved in in actually making this a reality yeah here's a few um the first is um so reputation is not the only way to build trust but it's a really good one and so if we focus just on that i think the easiest way to look at what reputation is is it's just a combination of data um in the real world it's a combination of like experiences you have and what you hear about someone in the digital world it's like looking at a bunch of pieces of data and saying what does this aggregate into its reputation and we haven't had a great way to manage that data um to date to just like aggregate it um in a web 3 native way and i think that's changing very rapidly um uh through many of the sponsors and the hosts of this hackathon and a bunch of others um but you need the right foundations to build on um first of all i also think that um you know there's a few different ways to to start to build and bootstrap reputation um but like it's it's much harder to do it in abstract than it is to do it it's like almost one of those problems that's harder in theory than it is in practice because mathematically it's very hard to build decentralized reputation and to kind of bootstrap that and you run into the who watches the watchmen problem and you need trusted seeds but in practice people trust get coin and so when they release the passport uh which they are signing as a company um it's uh it's got trust from the beginning and so when you start to build in these specific use cases and context and you sort of build trust from there then you could start to extend from you know from there and so i think we've been missing those first initial cases with real applications that are building decentralized trusts for themselves and then that can be leveraged you know beyond that and so i think that's what we're starting to see um it's not an easy problem even with that um there will start to be ways to attack it and it's almost harder it's definitely harder than what three than one two because people can um just leave their private key and move to a new one and so you can't limit participation in the same way but i think we'll start to see a lot of a lot of these open systems where positive reputation gets you a lot of benefit and then anyone who's found to be kind of going against the grain will be banished and so there's a lot of cost to actually um a lot of opportunity costs to misbehaving and so that's what we're starting to see um but it's it's taking a little while to get there yeah it makes sense and i guess yeah i mean at some point like if you go far enough down the line you've got to trust somebody right whether that's bitcoin or like some oracle or something like down the line like you've got to trust something it has to be the end um and i guess like you know it depends on maybe the rigor of trust that is required for your application um but i think in a lot of cases you're right like you know um bitcoin putting something out into the world or you know any anybody kind of with uh with enough skin in the game being able to put something on out in the wild and say like you know like we are validating that this is the case like that's probably enough for most applications and then maybe there's like uh you know a much larger set of things but maybe it's also the case where it's like exactly just described like it's like there are so many of these different attestation or type like trusted things that like you have so much positive trust that like even if like they bitcoin side is lying or even like one out of the like 50 different things is that trust you is is sort of like not trusted um i'm using the word trust a lot um it almost doesn't matter at that point right so um yeah definitely yeah good sorry i think that's a really interesting point that like we were at a phase in web 3 where it was so small for a while that like just knowing someone's ens name wasn't that was enough trust because you just like knew who they were what they had done and what they had said so you didn't need a score and if we flash forward a couple of years there'll be so much data and so many different you know verifiers and services and reputation algorithms you know the hard part won't be having trustworthy choosing which one to trust and we're kind of in that middle portion today where we haven't built up some little services but we're past the point where just knowing someone's twitter handle or username or their telegram or discord handle is enough um yeah and everything ends up being composable too which is super interesting so okay cool i mean i could talk about this forever so i'm gonna i'm gonna have to stop because i think we're already over time a little bit um but yeah danny i really appreciate you coming and chatting about this um i agree i think we're in the middle of it and i think there's gonna be some really interesting applications that come out once we uh sort of come out on the other side and and i think the earlier people start building with this is the faster that that accelerates so um amazing well really appreciate your time danny thank you for being here