16 ms·

Spore – Decentralized package manager on Ethereum and IPFS

45 points by jamesdwilson 11y ago

nikolay 11y ago
Can somebody ELI5 why we need Ethereum, too?
- jamesdwilson 11y ago
  So you can program your program's program while you program
  - nikolay 11y ago
    I got it. Gx [0] looks simpler and better without the craptocurrency stuff. [0]: https://github.com/whyrusleeping/gx https://github.com/whyrusleeping/gx
    - williamcotton 11y ago
      $ gx import QmR5FHS9TpLbL9oYY8ZDR3A7UWcHTBawU1FJ6pu9SvTcPa vs $ spore install mortal This is a very important distinction that you gloss over when you use loaded terms like "craptocurrency".
      - nikolay 11y ago
        Everything comes at a price. The first one is free and has a lot fewer dependencies to be used and operate - no Chinese miners required!
        williamcotton 11y ago
        Why do you want to go down the rabbit hole of economic externalities? Do you realize the sorts of unnecessary energy that is wasted just to protect the legal and financial infrastructure that even let's a company like npm exist in the first place? You're making it seem like only cryptocurrencies have a downside. The truth of the matter is that there will always be a price to pay for state-making functions and that we can't build npm-like things without these state-making functions. Cryptocurrencies might end up being one of the least wasteful manners in which a group of people can come up with decentralized consensus. Someone should do a study to compare the infrastructure required to support storing and tracking all of the world's real estate property titles versus the infrastructure of all the Chinese miners in the world. I'm willing to bet that in kilowatt hours even the heavy-duty Bitcoin blockchain is much more efficient.
        nikolay 11y ago
        I don't have any interest in anything with a speculative value. Sorry, but Bitcoin didn't make it - "the next big thing", i.e. Ethereum will not make it either as people have zero interest in something that's at the mercy of low-quality speculators. In this case, I really don't want my business to have anything to do with a speculative technology. As I said, the only two requirements are authenticity and immutability and you don't need Ethereum to implement it.
        williamcotton 11y ago
        Don't only think of it as having a speculative value. Think of it also as having the utility of being able to write to an immutable public ledger. Think of "Bitcoin the currency" as a commodity that lets you write to the Bitcoin blockchain like how ink is a commodity that let's you write on paper. You don't need to use much Bitcoin in order to secure a lot of data with a timestamp and signature. This makes it great for synchronizing all sorts of transactional data across service boundaries meaning people can bring their ownership rights from provider to provider. With something like keybase.io you're reliant on them to authorize the link between a name and your public key. You're also reliant on the DNS system. All of this adds unnecessary friction to the concept of individual ownership of digital properties like domain names to say nothing of owning the rights to a named module of published open source code. The speculative value is what drives the mining process. It's a dirty little trick and yes, it encourages a bunch of people near cheap hydro power to buy a bunch of machines that do nothing other than play the SHA-256 lottery. You can still have zero interest in the speculative value of Bitcoin. That's the miners concerns. Your concerns can just be the transactional fees that let you embed your own data in the consensus ledger.
- aakilfernandes 11y ago
  You need ethereum (or some other blockchain) if you're concerned about hackers. You could imagine an attacker getting into npm's servers and replacing package links with malware. You might also like a decentralized repo if you're worried about a single agent having a monopoly. This monopoly could one day charge for access to the repo.
  - nikolay 11y ago
    That's a total overkill for the purpose. We use signatures for authenticity checks. Let's not try to use Ethereum for everything just because we hold some ETH and want its value to grow by using it where it's not even necessary.
    - williamcotton 11y ago
      Decentralized consensus over which private keys own what strings (aka Namecoin) would save us from having to deal with obtuse hashes, would it not?
      - nikolay 11y ago
        Once I install a package, its hashes and other info become part of the project. I just don't want that to change in time without me knowing. Etherum here is an overkill, it's not practical.
        williamcotton 11y ago
        How do you first discover the hash? How are you looking it up?
        nikolay 11y ago
        The recent issue with NPM surfaced the following two major issues: - a package got unpublished - we demand an immutable package manager; - packages got hijacked - we need authenticity as basic as checksums or signatures. Anything that accomplishes the above in an uncomplicated manner will win my business. Any craptocurrency pitching will not.
rkeene2 11y ago
AppFS ( http://appfs.rkeene.org/ http://appfs.rkeene.org/ ) is exactly a decentralized package manager, except it uses HTTP as a transport and does end to end verification (i.e. not like HTTPS where only the transport is verified) of all data using PKI.

45 points by jamesdwilson 11y ago

nikolay 11y ago

Can somebody ELI5 why we need Ethereum, too?

jamesdwilson 11y ago
So you can program your program's program while you program
- nikolay 11y ago
  I got it. Gx [0] looks simpler and better without the craptocurrency stuff. [0]: https://github.com/whyrusleeping/gx https://github.com/whyrusleeping/gx
  - williamcotton 11y ago
    $ gx import QmR5FHS9TpLbL9oYY8ZDR3A7UWcHTBawU1FJ6pu9SvTcPa vs $ spore install mortal This is a very important distinction that you gloss over when you use loaded terms like "craptocurrency".
    - nikolay 11y ago
      Everything comes at a price. The first one is free and has a lot fewer dependencies to be used and operate - no Chinese miners required!
      - williamcotton 11y ago
        Why do you want to go down the rabbit hole of economic externalities? Do you realize the sorts of unnecessary energy that is wasted just to protect the legal and financial infrastructure that even let's a company like npm exist in the first place? You're making it seem like only cryptocurrencies have a downside. The truth of the matter is that there will always be a price to pay for state-making functions and that we can't build npm-like things without these state-making functions. Cryptocurrencies might end up being one of the least wasteful manners in which a group of people can come up with decentralized consensus. Someone should do a study to compare the infrastructure required to support storing and tracking all of the world's real estate property titles versus the infrastructure of all the Chinese miners in the world. I'm willing to bet that in kilowatt hours even the heavy-duty Bitcoin blockchain is much more efficient.
        nikolay 11y ago
        I don't have any interest in anything with a speculative value. Sorry, but Bitcoin didn't make it - "the next big thing", i.e. Ethereum will not make it either as people have zero interest in something that's at the mercy of low-quality speculators. In this case, I really don't want my business to have anything to do with a speculative technology. As I said, the only two requirements are authenticity and immutability and you don't need Ethereum to implement it.
        williamcotton 11y ago
        Don't only think of it as having a speculative value. Think of it also as having the utility of being able to write to an immutable public ledger. Think of "Bitcoin the currency" as a commodity that lets you write to the Bitcoin blockchain like how ink is a commodity that let's you write on paper. You don't need to use much Bitcoin in order to secure a lot of data with a timestamp and signature. This makes it great for synchronizing all sorts of transactional data across service boundaries meaning people can bring their ownership rights from provider to provider. With something like keybase.io you're reliant on them to authorize the link between a name and your public key. You're also reliant on the DNS system. All of this adds unnecessary friction to the concept of individual ownership of digital properties like domain names to say nothing of owning the rights to a named module of published open source code. The speculative value is what drives the mining process. It's a dirty little trick and yes, it encourages a bunch of people near cheap hydro power to buy a bunch of machines that do nothing other than play the SHA-256 lottery. You can still have zero interest in the speculative value of Bitcoin. That's the miners concerns. Your concerns can just be the transactional fees that let you embed your own data in the consensus ledger.
aakilfernandes 11y ago
You need ethereum (or some other blockchain) if you're concerned about hackers. You could imagine an attacker getting into npm's servers and replacing package links with malware. You might also like a decentralized repo if you're worried about a single agent having a monopoly. This monopoly could one day charge for access to the repo.
- nikolay 11y ago
  That's a total overkill for the purpose. We use signatures for authenticity checks. Let's not try to use Ethereum for everything just because we hold some ETH and want its value to grow by using it where it's not even necessary.
  - williamcotton 11y ago
    Decentralized consensus over which private keys own what strings (aka Namecoin) would save us from having to deal with obtuse hashes, would it not?
    - nikolay 11y ago
      Once I install a package, its hashes and other info become part of the project. I just don't want that to change in time without me knowing. Etherum here is an overkill, it's not practical.
      - williamcotton 11y ago
        How do you first discover the hash? How are you looking it up?
        nikolay 11y ago
        The recent issue with NPM surfaced the following two major issues: - a package got unpublished - we demand an immutable package manager; - packages got hijacked - we need authenticity as basic as checksums or signatures. Anything that accomplishes the above in an uncomplicated manner will win my business. Any craptocurrency pitching will not.

rkeene2 11y ago

AppFS ( http://appfs.rkeene.org/ http://appfs.rkeene.org/ ) is exactly a decentralized package manager, except it uses HTTP as a transport and does end to end verification (i.e. not like HTTPS where only the transport is verified) of all data using PKI.