Single Player-Ready Dapps by Wayne Chang

cetera and even notion you'll notice that you create your own content for these Services basically you're the Creator and it's your data for a lot of these services and I think these categories of consumer facing applications we're all looking for those use cases for you know consumer applications and web3 I think these are actually the ripest categories for you to take more control over your data single player Uber is not fun because you just get into your car and drive somewhere right you need you actually need more players for Uber to be fun right so basically this category of applications though there's no reason why you can't just have your own instance and Federate outwards and we're going to be talking about a lot of the technicals on how this is possible today with sign in with ethereum and some of the exciting decentralized identity technology coming out of the ecosystem so most of the essential services are built like this the only thing that is user owned is kind of the hardware right your phone or your laptop or something and then you log into you know the services using logins that you don't control right because you use probably an identity provider or something else and uh basically um you have the login the backend server you know hosted on the company's AWS or whatever you have the database RDS postgres MySQL whatever and then you have the domain too the cert is kind of all controlled uh you know by that company or Ayanna depending on you know how much you care about correctness and that but uh basically we have a lot of similar things in web 3 that could kind of be Tit for Tat in each of these right so even domains like we've seen ens and with the ltu scalability you can start chipping away at those DNS use cases although DNS is still great um databases we'll get into how we can do that login we have sign in with ethereum and even the servers will have these Data Vault servers like servers are kind of replaced by dapps in web3 today but we'll see how they're connected and dapps today as you probably know as dap Builders they kind of look like this again the user owned is the hardware and the keys right so you get the keys too and what's cool about the back ends for blockchains is how the apps can be built today not all of them are is that they can be static code single page apps that you can just load and use right and then the blockchain itself is immutable and stuff can get written there so we have this idea at Spruce about unbuttling the login where instead of basically one or two login providers controlling the end-to-end user experience users Define their end to an experience and they can pull in the right resources that they want for their session whether it's you know places to persist data whether it's data volts to get delegate access to data Etc there's an emerging ecosystem of all these unbundling the login areas and basically this will give users new degrees of freedom in terms of what they can do with their keys not just create transactions to ethereum but a whole Suite of other things that can be complementary to that or just totally independent and uh signing with ethereum gives us this passwordless login which basically allows us to recognize a message as the login request right so um this is probably going to come out in future versions of wallets being able to see this interface and know that you're logging in you're not getting man in the middle attack Etc and then you're able to do your stuff right but that's just regular login right can we go further can we do more and I think the answer is yes we can do things with more keys why do we sign things in the first place we want to do an action such as authenticate authorize but we want to execute that action with guarantees about integrity of the message and authenticity that you know someone who signed it and the more we sign things the more opportunity we have for user control that's digital empowerment because today you can sign things in the physical world when we're in the digital world it's not clear that you can do that you might have to you know designate a service to do that for you so the more that you sign stuff digitally the more empowered you are to do stuff especially if there are more systems recognizing your signing right today it's ethereum maybe it's pass keys with certain websites but more and more you can get more control that way add key recovery multi-six that's a whole other rabbit hole but the problem today with web3 wallets in doing this is that every time let's say we wanted to do like decentralized Dropbox right and every time you needed to like rename a file or drag it around you had to like get this prompt up and it's stuff that you don't understand right the ux is pretty bad and uh just going through a normal interaction is terrible so um that is not acceptable for you know web 2 competitive ux to get there we want to delegate some Authority not all of it but some authority to another key kept in a more convenient place more convenient place but less secure so we narrow the scope of what that key can do right and then that key can be used to take actions without all these confirmation dialogues but if it gets compromised the scope of damage is limited it's not like compromising your master seed phrase so we think that this is going to result in huge ux recruitments and a bunch of dimensionality in terms of what your keys can ultimately do so you can execute with this many actions just one signing to delegate the key in as many as you want right so long as the key is within the validity period whereas the key live because you really attenuate the permissions you can even keep it in the Dom right because that's kind of where cookies live more or less and this is effectively replacing the Cookie by your signing delegate signing so basically um the actual implementation of this uses something called cacaos which is a chain agnostic capability objects that are just a summary of assigning with a theory message seabor encoded I think um and it's just super compact so you're able to basically delegate to a session key like a new did key or did pkh or something and then that key can be empowered to do things and there are other protocols that we work on like Recaps that allow you to that specify what those permissions are so other great things you can do with keys now that you you know figured out how to spawn them or maybe the wallet has native support you can basically issue content credentials and this is how we unlock decentralized social media because you can sign a statement saying that you tweeted this or you follow someone and within that credential you issue you can point to a revocation list somewhere you control that you can use to unfollow someone and when someone tries to present the proof of your follow it's no longer valid right so that control stays with you and your keys because that's the issuer so as a user we need to get used to thinking about ourselves as issuers instead of just these authorities that have traditionally been doing issuance like platforms right so I think that's going to usher in decentralized social media a lot of these use cases Etc these peer-to-peer attestations so reviews are interesting too and I'll get to that that's our example later today and another thing you can do with keys is you can send messages end-to-end encrypted right you can basically encrypt to someone's ethereum address or a key that they designate as their encryption key and um that that is secure message Integrity communication that you can send something like a credential Maybe and another interesting idea to consider are data licenses basically being able to issue the right for someone to use your data for a certain period and then revoke that right if you want to right if you can cryptographically sign something then and there's a framework to interpret those data then you can make data licenses all the same so Keys equals empowerment right so I think that the grand scheme of this is instead of this front-end back-end server you know database model what we're able to do is we are able to actually get adapt and you can go from the DAP with session keys and other things to a variety of services that all respect your keys not just blockchains that expect you to make transactions and that can produce these hybrid applications that just have phenomenal ux as good as web2 right or better too because you have the finality of the blockchain behind you for the transactions you care about right so I think this is extremely exciting I'll go through some of these technologies that will make it possible and the other thing is that um if you can choose your indexer service right and other things like that you actually don't have to rely on like for example the back end that the DAP company hosts to do the indexing right you can pick your own indexer you get a lot more freedom that way and the DAP really just becomes static like if you host it on an ens name for example and that code is like hash referenced like nothing else changed pages that is as uh you know static app as you can get right you can carve that code into stone and like read it again and it would still work there's no Dynamic aspects of it so it's trustless so how do we actually like get to personal data vaults where you can store stuff like reviews and credentials uh there's quite a bit of technology to work on in these Stacks uh but I think that it all starts with key based direct authentication as we saw with uh signing in with ethereum and unbundling login now um it's kind of like in Finding Nemo like you know Fisher friends well keys are friends so long as they are cryptographically secure and they can do things and the user can custody them relatively well then keys are friends right like why do we you know don't discriminate against different curves and hashing algorithms if they're okay um you know maybe we will when we move to post Quantum but we're not there yet so um and then also we can delegate using these Keys capabilities you're able to make permission slips with keys and sign them off as if you were the teacher in a middle school right isn't that awesome and then like those rights can be taken by an agent maybe accessing your Data Vault or the high school bathroom or whatever and they can demonstrate that to the resource and be designated access right that's a new security model that is possible when people have keys the only thing I found close to that was in like I think the early 2000s Matt Blaze who teaches cryptography at JHU he uh he had a system called keynote not the Apple software but like it was like an RFC at ITF go look it up right and he had this like predicate system that you would sign off on very similar but it expected pki to be prevalent and we didn't have that then now we have this thriving community of people with keys in their wallets and also Builders who want to like enable these use cases right that's kind of the difference that I see between like designing with ethereum community and like the web authen Community there are so many like dap Builders using sign in with ethereum and doing cool stuff and wanting to do more how many web authen verifier Builders are there there's like eight you know like it's like basically the folks who built the libraries and then everyone uses those libraries and that's kind of it so it's like okay great there's a like a massive scale but how agile is the software how much agility is there right and then I think transitioning to provenance models Based on interoperable data models is going to be really groundbreaking as well today the root of trust is in like a cluster of postgres databases right and uh what if we transition to cryptographically signed messages as the root of trust right instead of in a database there is no Integrity in that mode in most databases uh you know that are SQL mongodb whatever they may be web scale but you know they don't necessarily have cryptographic attestation every step along the way right so switching to these models where the provenance is signed off for issued you know and the data are certificates or credentials that's a really interesting model to me previously there was an implicit trust that it came from a trusted domain as a de facto issuer right so if you think about this model where actually it's like a little data container that's signed off with its own bill of lading right and we get to the data supply chain and you know where the data came from and everything that is actually a really compelling route of trust because it's interoperable especially if you extend things with linked data and the like right in ipld I think it's an exciting Direction because again this is how we get to the decentralized social media future where you can make a tweet and that data packet you sign off on that's authoritative not the entry in the database of the Tweet host website right but the thing that you cryptographically signed off on and also the revocation list that you control somewhere maybe an L2 smart contract and you can revoke it there maybe it's in your Data Vault you know as is low recursive but we'll you know you'll see um and then data Federation Protocols are super exciting too A lot of the groundwork has been done by ipfs Lupita P bit swap those kinds of algorithms but you know we had tip two the old school stuff to activity Pub BitTorrent SCP I always thought that torrent was funny compared to blockchain because in um basically in blockchain you're fitting a lot of different transactions into a block but in BitTorrent you're fitting a lot of blocks into like one transaction right so yes no okay well that joke um sometimes works uh so nsep is awesome too so let's go into a little example um you know inspired by Snow Crash I think that we should just in the decentralized community use snow crash pizza delivery as probably the rude example of things but anyway let's talk about decentralized Yelp if you you know work with me I've probably been talking your ear off about this idea so I'm grateful to do it in a broader basis and you know get it out so basically um why does like uh you know Yelp like if you're writing reviews that are private for your Yelp account why do those have to like be with the online service you don't control right that back to the first slide like you know that's like one of those services that maybe you should sign off on and then you can control how the data are shared further Etc right and um I think that's exactly how it should work you know you get your own planet um and uh you're able to commit your Pizza reviews or whatever to there or you know this is exactly how Mastodon can work today right it's a very similar architecturally but we describe some specific technologies that can help us get there and then you can Federate out you can issue data licenses to share with other people's planets right and like build your constellation and you and your friends can share reviews and Federate it outwards this is what I mean by single player ready right because you can write like the most scathing awful reviews you want to and get it out there in your own personal space or drafts or whatever you know think about for medical histories and other directions like it's not just reviews it's a lot of things that should be single player friendly or ready right and then from there you can even have like you know recursive data licenses that allow this network to even share it further right maybe like you belong to I don't know a Dao and you all Federated your reviews so the Dow has like its pizza places that it likes and then that Dow works with a few other Dows and now we have Dow coverage across the world for the Pisa places are actually good and then one Dao makes like bad decisions and they think that Chicago deep dish is good and they get like ejected from the network you know from like the meta Dow right like that that's the architecture that's possible if you're able to use the end-to-end protocols that we talk about so that's a little bit about single player ready dapps and you know how I know it's the last session of the day here so I really appreciate it everyone hanging through this hopefully you found it interesting in some of the technologies that we're working on at Spruce really try to cover this and I think that uh last slide that I want to talk about is um if you care about data ownership right and like just being able to control stuff that is in your digital life if you grew up like you know after like the late 80s or something you probably spent a lot of your time on the internet as a kid so that means that a lot of your identity is actually like affected digitally because that's where you spend your time right so like when when you get a data incursion you didn't expect that you're probably like very emotionally affected like that was the total you know that wasn't okay whereas like you know other Generations maybe like their relationship with the internet uh you know on the average might be using Facebook or something right so you might have a different view on it anyway so digress about like and I'm sure there are lots of other Democrat cross-demographic things I won't get into because that's not the point of this talk but you might have found yourself interested in these self-hosted like things right like why am I you know uploading all my pictures to iCloud even though it is the most convenient and great thing I don't know there's something interesting about not like that's like a different company or something right what degree of control do you feel over that the reviews you write you know stuff you back up all the things in your life so you might have gone the rabbit hole and like oh what if I were to run my own server right and then I was host things on it and you might have found that it's like a lot of steps and also a lot of things that can go wrong like you didn't upgrade TLS and then harp lead came out and now you're nuked and all this other right so basically a lot of these are like systemic challenges that you as even someone who want to run your own planet and you know datavault you have to run this over and over again the PHP version is matching up with the software that needs maintaining Etc and the implementer for these apps they have big challenges too every single time you get one of these like photo storage like apps written in PHP from the early 2000s they had to implement authentication themselves and if you like scale across 100 applications I guarantee you someone did that wrong right so basically the replication of it okay okay we got it running on one server your Nas or something right how do you like replicate it can you just like download a zip of it and that's it or can we do like a nice crdt replication across multiple instances well no one self-hosted project you know can have the engineering power necessarily to do that so I think that these are all and like even sharing it out right generating a share link and making sure it's secure it expires on time these are like cross-cutting horizontal functionality that protocols can solve really well so when someone gets an idea to build one of these self-hosting apps right or single player ready apps they can build on this basis of open protocols already that bring them almost there to the security side and a bunch of other things and then they can really focus on making the ux beautiful for the user and really usable or making sure the app experience isn't like garbage because 10 when you have to build all this stuff on the back end how much time can you actually spend making the app nice if that's how people use it right so I think if we can work as an ecosystem and solve a lot of these problems at the protocol level and use a lot of open Source we might make self-hosting cool again and fun right and I think that's the future that I would really like to live in so thanks for listening to my talk everyone and uh feel free to chat with me after foreign