3 ms·

Codius co-creator here, AMA!

silviaotar 8y ago
How do I verify that the host is executing my application correctly? How do I make sure that a host is billing me the right amount of money?
- justmoon2 8y ago
  > How do I verify that the host is executing my application correctly? You can't verify what an individual host does. So you can either upload your application to a single host that you trust to run it (like everyone has been doing happily for decades) or you can write your application to be Byzantine fault-tolerant and upload it to multiple hosts. The key things that Codius provides that make this possible are: - Host provides the hash of the manifest which shows exactly what it's running down to the container image hashes. -> This removes trust from the uploader. So I can upload a BFT application to 10 hosts and you can convince yourself to trust it if you can convince yourself that the code is legit and too many of those hosts won't collude. That's not possible with traditional hosting because the uploader generally gets admin rights at ALL hosts they upload to. - Standardization, so you can upload to many hosts without speaking a dozen different APIs. > How do I make sure that a host is billing me the right amount of money? You pay when you upload and your client is enforcing a certain max rate. The host could turn off your contract before the agreed-upon time so if you're worried about that you could only pay for e.g. two hours at a time using some cron job. In practice, a lot of this will come down to host selection. If a host has been legit, reliable, etc. for years, it's unlikely to suddenly decide to screw you out of $10. That's why we think host trackers like codiushosts.com will play an important role. We're working on building our own host tracker as well. Edit: Fixed typo.
  - silviaotar 8y ago
    > You can't verify what an individual host does. So you can either upload your application to a single host that you trust to run it (like everyone has been doing happily for decades) or you can write your application to by Byzantine fault-tolerant and upload it to multiple hosts. There is a difference between trusting someone and have a contract with someone. If I use EC2, I'm using AWS, and they have policies and laws they have to comply with (data privacy is one of the first one that pops up in my mind). Technically, nothing stops a AWS engineer to put their hands in my application; Legally, they cannot do it, so they are liable if I find it out. I'm not saying that AWS is the best. I'm saying that compared to AWS, Codius gives me less guarantees. > [...] That's not possible with traditional hosting because the uploader generally gets admin rights at ALL hosts they upload to. A Sybil attack seems to be quite cheap on Codius. I can have 10 hosts managed with 10 different identities and make people think the app is legit. > Standardization, so you can upload to many hosts without speaking a dozen different APIs. I don't mind having more tools to achieve that, but Docker/Kubernetes standardized the way devops deploy apps, you can use them on different cloud providers (or on your own machine[s]). > You pay when you upload and your client is enforcing a certain max rate. The host could turn off your contract before the agreed-upon time so if you're worried about that you could only pay for e.g. two hours at a time using some cron job. There is still no proof that the host charged me the correct amount of money. Even if I cap the money I put in the system, a host can still charge me much more than it should be. > In practice, a lot of this will come down to host selection. If a host has been legit, reliable, etc. for years, it's unlikely to suddenly decide to screw you out of $10. That's why we think host trackers like codiushosts.com will play an important role. We're working on building our own host tracker as well. Maybe I'm thinking too much about "blockchain" when I think about Codius, but reading "Decentralized apps" and "Smart contracts/programs" in the homepage doesn't help, I'd remove it.
    - justmoon2 8y ago
      > I'm not saying that AWS is the best. I'm saying that compared to AWS, Codius gives me less guarantees. Codius isn't supposed to give you any guarantees but Codius hosts might. Imagine you're a Codius host. You make money when people upload contracts. If you think you can make more money by legally agreeing not to screw with your users' uploads, you may just do that. IANAL, so I'm not sure exactly how you would do it but I imagine you could have the CLI print a tabulated summary of the hosts' terms and conditions that you could agree to and thereby enter into a binding contract. Whether this is a good idea and whether people will actually do this, I don't know but there are definitely hosting companies who are interested in running Codius hosts. So as an uploader you'll be able to choose to upload to reputable hosting companies or to whoever you want. There are pros and cons to either option. > A Sybil attack seems to be quite cheap on Codius. I can have 10 hosts managed with 10 different identities and make people think the app is legit. Point taken. I remember a few years ago there was a story going around about some botnet you could rent with 400000 hosts. So this isn't anything new. If people abuse Codius, we'll think about ways to make that less attractive. But I think it's not so unprecedented to have distributed networks you can run arbitrary code on that we have to worry about breaking the Internet. I hope. > Maybe I'm thinking too much about "blockchain" when I think about Codius, but reading "Decentralized apps" and "Smart contracts/programs" in the homepage doesn't help, I'd remove it. Totally fair point. I think the main thing is that when we created the website there was a lot less "blockchain fatigue" than there is no, so the next redesign will definitely emphasize more of the pragmatism and less of the blockchain magic.
inputcoffee 8y ago
This looks interesting. Is it basically a hosting site you can pay for with crypto? This makes other things possible: anyone can pay for it using crypto etc? I can imagine some use cases, but since you've been thinking about this a lot longer, can you say a little about: 1. Use cases 2. Long term vision for different paths along which you might see this evolve? Thanks in advance
- justmoon2 8y ago
  > I can imagine some use cases, but since you've been thinking about this a lot longer I don't know the future but I'm happy to give you my prediction in case it's interesting for you now and hilariously entertaining when we look back in ten years. > 1. Use cases We built it for fun but I could see myself using to quickly spin up small little hobby projects, kinda like how you might use Heroku. We've also talked about the idea of "open services". Think "open-source" where the source code is free, "open hardware" where the blueprints are free, so this would be services where both the code and the data are free. You could fork the whole service including data kinda like a blockchain but without having to have the overhead of a decentralized service. You don't need Codius for that but open-services seem to mash more nicely with the anyone-can-pay mentality of Codius than just running on someone's AWS account. Another use case is if somebody wants to create a decentralized application, today they have to run around recruiting hosts. I used to work at Ripple and we'd run around and ask people to please run validators. It required a whole team and a lot of Powerpoint to get to a decent number. Many other projects like BigchainDB went through a similar process. Codius basically makes this a one click affair, you just upload to whatever hosts you want, publish the source code and anyone can verify that the hosts claim to be running the code you say you uploaded. So people have to trust a majority of the hosts (which all distributed consensus systems provably require) but not you as the uploader. Another idea we had was beneficial digital organisms. We already have "viruses", i.e. programs that replicate without permission. But Codius provides a platform where programs can run by paying without having to steal computing resources. So you could imagine programs that earn money and then pay to run longer or on more hosts. > 2. Long term vision for different paths along which you might see this evolve? I just started a company called Coil which is building tech so websites can make money. I think this could come together with Codius to make websites that earn money from users visiting them and then pay for their own hosting. Those websites could in principle survive their creators by centuries. I think that's pretty cool. Obviously, all of these ideas have been talked about by others long before Codius but my pitch for Codius would be that it's a nice and pragmatic, web-y way to do it vs the clunky, blockchain-based approach.

How do I verify that the host is executing my application correctly? How do I make sure that a host is billing me the right amount of money?

justmoon2 8y ago
> How do I verify that the host is executing my application correctly? You can't verify what an individual host does. So you can either upload your application to a single host that you trust to run it (like everyone has been doing happily for decades) or you can write your application to be Byzantine fault-tolerant and upload it to multiple hosts. The key things that Codius provides that make this possible are: - Host provides the hash of the manifest which shows exactly what it's running down to the container image hashes. -> This removes trust from the uploader. So I can upload a BFT application to 10 hosts and you can convince yourself to trust it if you can convince yourself that the code is legit and too many of those hosts won't collude. That's not possible with traditional hosting because the uploader generally gets admin rights at ALL hosts they upload to. - Standardization, so you can upload to many hosts without speaking a dozen different APIs. > How do I make sure that a host is billing me the right amount of money? You pay when you upload and your client is enforcing a certain max rate. The host could turn off your contract before the agreed-upon time so if you're worried about that you could only pay for e.g. two hours at a time using some cron job. In practice, a lot of this will come down to host selection. If a host has been legit, reliable, etc. for years, it's unlikely to suddenly decide to screw you out of $10. That's why we think host trackers like codiushosts.com will play an important role. We're working on building our own host tracker as well. Edit: Fixed typo.
- silviaotar 8y ago
  > You can't verify what an individual host does. So you can either upload your application to a single host that you trust to run it (like everyone has been doing happily for decades) or you can write your application to by Byzantine fault-tolerant and upload it to multiple hosts. There is a difference between trusting someone and have a contract with someone. If I use EC2, I'm using AWS, and they have policies and laws they have to comply with (data privacy is one of the first one that pops up in my mind). Technically, nothing stops a AWS engineer to put their hands in my application; Legally, they cannot do it, so they are liable if I find it out. I'm not saying that AWS is the best. I'm saying that compared to AWS, Codius gives me less guarantees. > [...] That's not possible with traditional hosting because the uploader generally gets admin rights at ALL hosts they upload to. A Sybil attack seems to be quite cheap on Codius. I can have 10 hosts managed with 10 different identities and make people think the app is legit. > Standardization, so you can upload to many hosts without speaking a dozen different APIs. I don't mind having more tools to achieve that, but Docker/Kubernetes standardized the way devops deploy apps, you can use them on different cloud providers (or on your own machine[s]). > You pay when you upload and your client is enforcing a certain max rate. The host could turn off your contract before the agreed-upon time so if you're worried about that you could only pay for e.g. two hours at a time using some cron job. There is still no proof that the host charged me the correct amount of money. Even if I cap the money I put in the system, a host can still charge me much more than it should be. > In practice, a lot of this will come down to host selection. If a host has been legit, reliable, etc. for years, it's unlikely to suddenly decide to screw you out of $10. That's why we think host trackers like codiushosts.com will play an important role. We're working on building our own host tracker as well. Maybe I'm thinking too much about "blockchain" when I think about Codius, but reading "Decentralized apps" and "Smart contracts/programs" in the homepage doesn't help, I'd remove it.
  - justmoon2 8y ago
    > I'm not saying that AWS is the best. I'm saying that compared to AWS, Codius gives me less guarantees. Codius isn't supposed to give you any guarantees but Codius hosts might. Imagine you're a Codius host. You make money when people upload contracts. If you think you can make more money by legally agreeing not to screw with your users' uploads, you may just do that. IANAL, so I'm not sure exactly how you would do it but I imagine you could have the CLI print a tabulated summary of the hosts' terms and conditions that you could agree to and thereby enter into a binding contract. Whether this is a good idea and whether people will actually do this, I don't know but there are definitely hosting companies who are interested in running Codius hosts. So as an uploader you'll be able to choose to upload to reputable hosting companies or to whoever you want. There are pros and cons to either option. > A Sybil attack seems to be quite cheap on Codius. I can have 10 hosts managed with 10 different identities and make people think the app is legit. Point taken. I remember a few years ago there was a story going around about some botnet you could rent with 400000 hosts. So this isn't anything new. If people abuse Codius, we'll think about ways to make that less attractive. But I think it's not so unprecedented to have distributed networks you can run arbitrary code on that we have to worry about breaking the Internet. I hope. > Maybe I'm thinking too much about "blockchain" when I think about Codius, but reading "Decentralized apps" and "Smart contracts/programs" in the homepage doesn't help, I'd remove it. Totally fair point. I think the main thing is that when we created the website there was a lot less "blockchain fatigue" than there is no, so the next redesign will definitely emphasize more of the pragmatism and less of the blockchain magic.

inputcoffee 8y ago

This looks interesting. Is it basically a hosting site you can pay for with crypto? This makes other things possible: anyone can pay for it using crypto etc? I can imagine some use cases, but since you've been thinking about this a lot longer, can you say a little about: 1. Use cases 2. Long term vision for different paths along which you might see this evolve? Thanks in advance

justmoon2 8y ago
> I can imagine some use cases, but since you've been thinking about this a lot longer I don't know the future but I'm happy to give you my prediction in case it's interesting for you now and hilariously entertaining when we look back in ten years. > 1. Use cases We built it for fun but I could see myself using to quickly spin up small little hobby projects, kinda like how you might use Heroku. We've also talked about the idea of "open services". Think "open-source" where the source code is free, "open hardware" where the blueprints are free, so this would be services where both the code and the data are free. You could fork the whole service including data kinda like a blockchain but without having to have the overhead of a decentralized service. You don't need Codius for that but open-services seem to mash more nicely with the anyone-can-pay mentality of Codius than just running on someone's AWS account. Another use case is if somebody wants to create a decentralized application, today they have to run around recruiting hosts. I used to work at Ripple and we'd run around and ask people to please run validators. It required a whole team and a lot of Powerpoint to get to a decent number. Many other projects like BigchainDB went through a similar process. Codius basically makes this a one click affair, you just upload to whatever hosts you want, publish the source code and anyone can verify that the hosts claim to be running the code you say you uploaded. So people have to trust a majority of the hosts (which all distributed consensus systems provably require) but not you as the uploader. Another idea we had was beneficial digital organisms. We already have "viruses", i.e. programs that replicate without permission. But Codius provides a platform where programs can run by paying without having to steal computing resources. So you could imagine programs that earn money and then pay to run longer or on more hosts. > 2. Long term vision for different paths along which you might see this evolve? I just started a company called Coil which is building tech so websites can make money. I think this could come together with Codius to make websites that earn money from users visiting them and then pay for their own hosting. Those websites could in principle survive their creators by centuries. I think that's pretty cool. Obviously, all of these ideas have been talked about by others long before Codius but my pitch for Codius would be that it's a nice and pragmatic, web-y way to do it vs the clunky, blockchain-based approach.