22 ms·

Coco: Framework for enterprise blockchain networks

177 points by mbgaxyz 9y ago

aerovistae 9y ago
Are we running out of words, or combinations of letters that are pronounceable? I swear to god this is like the third time I've seen someone release a new framework that had the same name as a different, already popular framework. Sure, Apple's API is called Cocoa, but verbally is there really any difference?
jrs95 9y ago
Really? Couldn't come up with a name that wasn't effectively already in use?
- 2_listerine_pls 9y ago
  It's Microsoft, their names are supposed to be confusing.
  - greggyb 9y ago
    Their parallelized data warehousing solution: Azure Data Warehouse. Their document store database: Azure DocumentDB. Their large scale structured+unstructured data storage and analysis (frequently referred to as a data lake): Azure Data Lake Storage... AND Azure Data Lake Analytics. Let's talk about the precise differences and co-dependencies between these two. Their offering to expose functions as an API: Azure Functions. Their RDBMS, a product that runs as a server and is queried with the language, SQL (what might, in another world, be called a SQL server): SQL Server. Their cloud version of the same: Azure SQL DB. Their only well named product, you ask? Their cloud platform named Azure, which is the color of a blue sky. Well played, Microsoft. tl;dr I agree with you.
    - statictype 9y ago
      All those names are actually pretty clear and not confusing at all. Boring and uninspired - yes - but certainly not confusing. No different from MapKit and WebKit and ARKit and HomeKit and HealthKit
      - greggyb 9y ago
        ADLS and ADLA do definitely inspire confusion, but your point is well-taken.
- napsterbr 9y ago
  And for the record, it literally translates to "shit" in Portuguese :)
sboselli 9y ago
I wonder what are the best use cases for an enterprise blockchain? EDIT: Great suggestions. How about some non-banking applications?
- firefoxNX11 9y ago
  Think about any business transactions between enterprises like shown in the demo. Using enterprise application integration both enterprises can work with each other but what if an auditor comes in and now has to get audit reports from two systems. Instead of that block-chain or hyper-ledger [1] can be used to keep single source of truth. [1] https://www.hyperledger.org/projects/sawtooth https://www.hyperledger.org/projects/sawtooth
- koolba 9y ago
  Best use case I've seen is selling air to gullible enterprises.
  - mdns33 9y ago
    haha. true that.
  - Naomarik 9y ago
    Yes. Sprinkle a bit of blockchain pixie dust on your servers and now all of the sudden you can secure your data and go paperless. It wasn't possible before this. Software was useless before blockchain. Blockchain invented computers.
  - ringaroundthetx 9y ago
    Ways to make money in 'blockchain' from worst to best: - employment at an enterprise company with a blockchain research division - employment at a blockchain startup - contracting at a blockchain startup - contracting at an enterprise company with a blockchain application - contracting at an enterprise company exploring a blockchain application - forming a contracting company to sell blockchain ideas to enterprise companies - trading cryptocurrencies - selling services for cryptocurrency traders - launching an ICO
- 9y ago
custos 9y ago
Because removing an A makes it a completely different framework from Cocoa Framework...
- mtgx 9y ago
  It's not a clon.
  - michaelcullina 9y ago
    Nice. They could have named it "Chanel" and by the fifth version it would smell great.
smaili 9y ago
Is this Microsoft's subtle way of saying they do not ackknowledge iOS's Cocoa and Cocos2d frameworks? Or were they hoping dropping the 'a' wouldn't cause for confusion/overlap.
- ad404b8a372f2b9 9y ago
  Different words, different contexts. I don't see the problem.
- pyroinferno 9y ago
  Was Apple naming their mobile OS iOS a diss towards Cisco?
  - captn3m0 9y ago
    They got a license from Cisco: https://blogs.cisco.com/news/cisco_and_apple_agreement_on_ios_trademark https://blogs.cisco.com/news/cisco_and_apple_agreement_on_io...
m0sa 9y ago
Coco? Jamboo! https://www.youtube.com/watch?v=m_-Qtz70_z4 https://www.youtube.com/watch?v=m_-Qtz70_z4
victor106 9y ago
MSFT needs a name doctor
Gormisdomai 9y ago
Watching the demo video [1] has me a little confused. He makes it sound like all your interaction with Ethereum goes through the Coco framework (so permissions are implemented by Coco deciding which contracts you're allowed to see). Is that right? If so what's the point of using Ethereum at all? - Who is doing the computation for a smart contract if it's private and only you can see it? - Is the permissioning managed by a trusted Coco server somewhere? If so, why not also trust that server with storing the information about your supply chain? [1] http://aka.ms/cocodemo http://aka.ms/cocodemo
- PretzelPirate 9y ago
  I think the idea is that, since the blockchain nodes are running in a TEE, that any participant in the network can get an attestation to be sure that no one has tampered with the rules of the network. You don't need to personally validate each transaction as long as you are sure that the network is running the correct code. It seems that permissions are set in each contract with identities tied to Azure AD members. I might be wrong about that. The white paper is pretty long and I only had time to skim it.
  - mtgx 9y ago
    TEE is a joke. I don't even trust the newer SGX [1], which some blockchain companies like Corda [2] are adopting now, let alone TEE, with its myriad of security issues [3]. [1] - https://www.theregister.co.uk/2016/02/01/sgx_secure_until_you_look_at_the_detail/ https://www.theregister.co.uk/2016/02/01/sgx_secure_until_yo... [2] - https://www.corda.net/2017/06/corda-sgx-privacy-update/ https://www.corda.net/2017/06/corda-sgx-privacy-update/ [3] - https://invisiblethingslab.com/resources/bh09dc/Attacking%20Intel%20TXT%20-%20paper.pdf https://invisiblethingslab.com/resources/bh09dc/Attacking%20...
  - MatthewKernerMS 9y ago
    You captured the basic idea of the TEEs well. One way of thinking about this is that proof of work and proof of stake consensus protocols establish trust on a per-block basis. By leveraging TEEs, we have hoisted that trust establishment out of the per-block workflow and instead have the option to pay the cost once, at the time the network is established. One tradeoff of this design is that a TEE compromise would have major impact on the ledger. The whitepaper (https://aka.ms/cocopaper https://aka.ms/cocopaper) contains a section on mitigating TEE compromise. Additionally, our intent is to support multiple consensus models, including models that require per-block trust validation. Ledgers and consortiums are free to make choices about what they want to support depending on their threat model and the assets being protected - with the ability to trade off scalability and latency against security as they see fit. What we demo'ed is one design that we think is interesting for many use cases we've heard about from customers. Permissions are not tied to AAD members per se - we rely on a set of X.509 certs that correspond to the identities of the actors on the network for network-level authentication. These certs are referenced in the network constitution. Ledger- and app-level authentication can be done however developers would like to do it. It can be, but need not be, AAD. See my comment above or the whitepaper for more details on the confidentiality design.
jbob2000 9y ago
I don't understand 'enterprise blockchain'. Doesn't a blockchain depend on thousands of computers, each independently verifying the data? How does this hold if the blockchain is just running on 1 server (or a few, but that's not the point)? Then it's just a server, not a block chain...
- randomerr 9y ago
  You need someone to at least partially direct traffic. Someone is still putting out new BitCoins.
- riskable 9y ago
  You're right: It's not practical to run a blockchain on a single server or even just a collection of servers. For it to work properly it needs to be constructed as a P2P system. So each system that wants to use the blockchain has to participate in its construction. What this framework appears to do is enable your endpoints to participate in a one-way fashion. So they will get just enough information to facilitate a transaction but nothing beyond that. It seems like a bit of cloak & dagger tomfoolery where the blockchain is just being implemented behind-the-scenes on a specified collection of servers but I haven't looked very deep yet. I can see the benefit to Microsoft from having a setup like that--they can allow customers to participate in a blockchain-utilizing system without giving them full access to the blockchain but to me that seems like defeating the purpose and unnecessarily trusting a 3rd party to handle all your transactions with no independent way of verifying said transactions. In other words, it's no different than just standard server-client architecture except instead of handling transactions through a database (the traditional way) they utilize a blockchain in the background. When you want to verify a transaction you're really just making a request to their central server and asking it to do the job for you--and trusting whatever it tells you. Not exactly a proper blockchain if you ask me.
  - floatrock 9y ago
    > It seems like a bit of cloak & dagger tomfoolery where the blockchain is just being implemented behind-the-scenes on a specified collection of servers The key is who is running that "specified collection of servers". If they're all yours, then yeah, there's no advantage to just running your own sql-ish cluster. However, what if now your p2p miner pool includes a few machines run by your regulator? Yes, your business logic endpoint nodes are participating in a one-way fashion, but their transactions are now being automatically logged by the regulator (regulator doesn't need to know what the underlying business logic is, just that the reportable transaction results are being logged in the blockchain they're part of). Something like a third of financial firms' business is around reporting requirements. Or consider a large supply chain... again the miners aren't just one company, it's everyone in the supply web or the consortium. Allows for coordination without necessarily being open to the public.
johnnyringohP 9y ago
Because removing an A makes it a completely different framework from Cocoa Framework...
- kin 9y ago
  I was just going to say, verbally Coco = Cocoa. Not that it matters all too much since they're in different spaces, but they could have come up with a different name, especially when you don't even have to use a real word.
randomerr 9y ago
I was hoping it would be a new Tandy Color Computer. I guess the news on the new Amiga clone got my hopes up.
slickyslick 9y ago
I was hoping it would be a new Tandy Color Computer. I guess the news on the new Amiga clone got my hopes up.
gwbas1c 9y ago
"My framework runs on anything and works with anything..." should translate to, "it's very fragile and only works with what we tested it with."
reEenact12321 9y ago
Is this Microsoft's subtle way of saying they don't acknowledge iOS's Cocoa and Cocos2d frameworks? Or were they hopping to drop the 'a' wouldn't cause for confusion/overlap.
ksteigerwald 9y ago
Wheres the ICO!
- MatthewKernerMS 9y ago
  We were talking about this yesterday. We should call them Cokens :)

177 points by mbgaxyz 9y ago

Are we running out of words, or combinations of letters that are pronounceable? I swear to god this is like the third time I've seen someone release a new framework that had the same name as a different, already popular framework. Sure, Apple's API is called Cocoa, but verbally is there really any difference?

jrs95 9y ago

Really? Couldn't come up with a name that wasn't effectively already in use?

2_listerine_pls 9y ago
It's Microsoft, their names are supposed to be confusing.
- greggyb 9y ago
  Their parallelized data warehousing solution: Azure Data Warehouse. Their document store database: Azure DocumentDB. Their large scale structured+unstructured data storage and analysis (frequently referred to as a data lake): Azure Data Lake Storage... AND Azure Data Lake Analytics. Let's talk about the precise differences and co-dependencies between these two. Their offering to expose functions as an API: Azure Functions. Their RDBMS, a product that runs as a server and is queried with the language, SQL (what might, in another world, be called a SQL server): SQL Server. Their cloud version of the same: Azure SQL DB. Their only well named product, you ask? Their cloud platform named Azure, which is the color of a blue sky. Well played, Microsoft. tl;dr I agree with you.
  - statictype 9y ago
    All those names are actually pretty clear and not confusing at all. Boring and uninspired - yes - but certainly not confusing. No different from MapKit and WebKit and ARKit and HomeKit and HealthKit
    - greggyb 9y ago
      ADLS and ADLA do definitely inspire confusion, but your point is well-taken.
napsterbr 9y ago
And for the record, it literally translates to "shit" in Portuguese :)

sboselli 9y ago

I wonder what are the best use cases for an enterprise blockchain? EDIT: Great suggestions. How about some non-banking applications?

firefoxNX11 9y ago
Think about any business transactions between enterprises like shown in the demo. Using enterprise application integration both enterprises can work with each other but what if an auditor comes in and now has to get audit reports from two systems. Instead of that block-chain or hyper-ledger [1] can be used to keep single source of truth. [1] https://www.hyperledger.org/projects/sawtooth https://www.hyperledger.org/projects/sawtooth
koolba 9y ago
Best use case I've seen is selling air to gullible enterprises.
- mdns33 9y ago
  haha. true that.
- Naomarik 9y ago
  Yes. Sprinkle a bit of blockchain pixie dust on your servers and now all of the sudden you can secure your data and go paperless. It wasn't possible before this. Software was useless before blockchain. Blockchain invented computers.
- ringaroundthetx 9y ago
  Ways to make money in 'blockchain' from worst to best: - employment at an enterprise company with a blockchain research division - employment at a blockchain startup - contracting at a blockchain startup - contracting at an enterprise company with a blockchain application - contracting at an enterprise company exploring a blockchain application - forming a contracting company to sell blockchain ideas to enterprise companies - trading cryptocurrencies - selling services for cryptocurrency traders - launching an ICO
9y ago

custos 9y ago

Because removing an A makes it a completely different framework from Cocoa Framework...

mtgx 9y ago
It's not a clon.
- michaelcullina 9y ago
  Nice. They could have named it "Chanel" and by the fifth version it would smell great.

smaili 9y ago

Is this Microsoft's subtle way of saying they do not ackknowledge iOS's Cocoa and Cocos2d frameworks? Or were they hoping dropping the 'a' wouldn't cause for confusion/overlap.

ad404b8a372f2b9 9y ago
Different words, different contexts. I don't see the problem.
pyroinferno 9y ago
Was Apple naming their mobile OS iOS a diss towards Cisco?
- captn3m0 9y ago
  They got a license from Cisco: https://blogs.cisco.com/news/cisco_and_apple_agreement_on_ios_trademark https://blogs.cisco.com/news/cisco_and_apple_agreement_on_io...

m0sa 9y ago

Coco? Jamboo! https://www.youtube.com/watch?v=m_-Qtz70_z4 https://www.youtube.com/watch?v=m_-Qtz70_z4

victor106 9y ago

MSFT needs a name doctor

Gormisdomai 9y ago

Watching the demo video [1] has me a little confused. He makes it sound like all your interaction with Ethereum goes through the Coco framework (so permissions are implemented by Coco deciding which contracts you're allowed to see). Is that right? If so what's the point of using Ethereum at all? - Who is doing the computation for a smart contract if it's private and only you can see it? - Is the permissioning managed by a trusted Coco server somewhere? If so, why not also trust that server with storing the information about your supply chain? [1] http://aka.ms/cocodemo http://aka.ms/cocodemo

PretzelPirate 9y ago
I think the idea is that, since the blockchain nodes are running in a TEE, that any participant in the network can get an attestation to be sure that no one has tampered with the rules of the network. You don't need to personally validate each transaction as long as you are sure that the network is running the correct code. It seems that permissions are set in each contract with identities tied to Azure AD members. I might be wrong about that. The white paper is pretty long and I only had time to skim it.
- mtgx 9y ago
  TEE is a joke. I don't even trust the newer SGX [1], which some blockchain companies like Corda [2] are adopting now, let alone TEE, with its myriad of security issues [3]. [1] - https://www.theregister.co.uk/2016/02/01/sgx_secure_until_you_look_at_the_detail/ https://www.theregister.co.uk/2016/02/01/sgx_secure_until_yo... [2] - https://www.corda.net/2017/06/corda-sgx-privacy-update/ https://www.corda.net/2017/06/corda-sgx-privacy-update/ [3] - https://invisiblethingslab.com/resources/bh09dc/Attacking%20Intel%20TXT%20-%20paper.pdf https://invisiblethingslab.com/resources/bh09dc/Attacking%20...
- MatthewKernerMS 9y ago
  You captured the basic idea of the TEEs well. One way of thinking about this is that proof of work and proof of stake consensus protocols establish trust on a per-block basis. By leveraging TEEs, we have hoisted that trust establishment out of the per-block workflow and instead have the option to pay the cost once, at the time the network is established. One tradeoff of this design is that a TEE compromise would have major impact on the ledger. The whitepaper (https://aka.ms/cocopaper https://aka.ms/cocopaper) contains a section on mitigating TEE compromise. Additionally, our intent is to support multiple consensus models, including models that require per-block trust validation. Ledgers and consortiums are free to make choices about what they want to support depending on their threat model and the assets being protected - with the ability to trade off scalability and latency against security as they see fit. What we demo'ed is one design that we think is interesting for many use cases we've heard about from customers. Permissions are not tied to AAD members per se - we rely on a set of X.509 certs that correspond to the identities of the actors on the network for network-level authentication. These certs are referenced in the network constitution. Ledger- and app-level authentication can be done however developers would like to do it. It can be, but need not be, AAD. See my comment above or the whitepaper for more details on the confidentiality design.

jbob2000 9y ago

I don't understand 'enterprise blockchain'. Doesn't a blockchain depend on thousands of computers, each independently verifying the data? How does this hold if the blockchain is just running on 1 server (or a few, but that's not the point)? Then it's just a server, not a block chain...

randomerr 9y ago
You need someone to at least partially direct traffic. Someone is still putting out new BitCoins.
riskable 9y ago
You're right: It's not practical to run a blockchain on a single server or even just a collection of servers. For it to work properly it needs to be constructed as a P2P system. So each system that wants to use the blockchain has to participate in its construction. What this framework appears to do is enable your endpoints to participate in a one-way fashion. So they will get just enough information to facilitate a transaction but nothing beyond that. It seems like a bit of cloak & dagger tomfoolery where the blockchain is just being implemented behind-the-scenes on a specified collection of servers but I haven't looked very deep yet. I can see the benefit to Microsoft from having a setup like that--they can allow customers to participate in a blockchain-utilizing system without giving them full access to the blockchain but to me that seems like defeating the purpose and unnecessarily trusting a 3rd party to handle all your transactions with no independent way of verifying said transactions. In other words, it's no different than just standard server-client architecture except instead of handling transactions through a database (the traditional way) they utilize a blockchain in the background. When you want to verify a transaction you're really just making a request to their central server and asking it to do the job for you--and trusting whatever it tells you. Not exactly a proper blockchain if you ask me.
- floatrock 9y ago
  > It seems like a bit of cloak & dagger tomfoolery where the blockchain is just being implemented behind-the-scenes on a specified collection of servers The key is who is running that "specified collection of servers". If they're all yours, then yeah, there's no advantage to just running your own sql-ish cluster. However, what if now your p2p miner pool includes a few machines run by your regulator? Yes, your business logic endpoint nodes are participating in a one-way fashion, but their transactions are now being automatically logged by the regulator (regulator doesn't need to know what the underlying business logic is, just that the reportable transaction results are being logged in the blockchain they're part of). Something like a third of financial firms' business is around reporting requirements. Or consider a large supply chain... again the miners aren't just one company, it's everyone in the supply web or the consortium. Allows for coordination without necessarily being open to the public.

johnnyringohP 9y ago

Because removing an A makes it a completely different framework from Cocoa Framework...

kin 9y ago
I was just going to say, verbally Coco = Cocoa. Not that it matters all too much since they're in different spaces, but they could have come up with a different name, especially when you don't even have to use a real word.

randomerr 9y ago

I was hoping it would be a new Tandy Color Computer. I guess the news on the new Amiga clone got my hopes up.

slickyslick 9y ago

I was hoping it would be a new Tandy Color Computer. I guess the news on the new Amiga clone got my hopes up.

gwbas1c 9y ago

"My framework runs on anything and works with anything..." should translate to, "it's very fragile and only works with what we tested it with."

reEenact12321 9y ago

Is this Microsoft's subtle way of saying they don't acknowledge iOS's Cocoa and Cocos2d frameworks? Or were they hopping to drop the 'a' wouldn't cause for confusion/overlap.

ksteigerwald 9y ago

Wheres the ICO!

MatthewKernerMS 9y ago
We were talking about this yesterday. We should call them Cokens :)