6 ms·

I've worked on private blockchain solutions for financial firms (in supply chain and commodity trade finance). The reason companies are doing these projects is

I've worked on private blockchain solutions for financial firms (in supply chain and commodity trade finance). The reason companies are doing these projects is because in a lot of scenarios no one trusts each other. Even if they do, there are not allowed to for legal and compliance reasons. As such huge parts of the industry are paper based. Because if there was a simple MySQL solution from a company they would have gone with that 2 decades ago. The article talks about reasons for wanting a private blockchain. But I have never heard any of these reasons come up in any of my projects. I'm not sure what projects the author is talking about, but definitely not anything related to what most private blockchain projects companies are doing. That said there is a lot of hype in the space (not denying that). You can make an argument that bitcoin in the whitepaper was defined as an open access system, and as such any closed access system is not a blockchain. Sure, but the developers on these projects (like me) are calling them blockchains nonetheless because most the of the tech is the same (except for things like consensus forming, you probably would never use PoW in a private blockchain). ---- Companies are looking into private blockchains because they allow for systems where not one party is in charge of all the data and the network. But they require more than an append only log.

lifeisstillgood 8y ago
Can you point at any examples / elaborations on the subtleties here - almost a "how / why to write your own private blockchain"? I am interested in esp not using PoW in consensus - what makes consensus??
- askmike 8y ago
  I'm only involved with proof of concepts, as such I usually work with pre made blockchain solutions with smart contracts slapped on top. Consensus is arguably the hardest part of a blockchain (if you need distributed data storage just use something like IPFS). An example is Quorum (JP morgan fork of Ethereum), this is their take on consensus algorithms: https://github.com/jpmorganchase/quorum/wiki/Quorum-Consensus https://github.com/jpmorganchase/quorum/wiki/Quorum-Consensu...
  - lifeisstillgood 8y ago
    Thank you
cm2187 8y ago
They might not trust each others but if they know each others, why can’t they simply use a public private key solution? For a transaction to be valid it needs to have been signed by both parties.
- askmike 8y ago
  For compliance and privacy reasons. For example I deal with a lot of Swiss banks and Swiss law is very strict about what kind of data is allowed to leave Switzerland (not very much).
  - cm2187 8y ago
    Is it privacy as in no one must be aware that this particular party signed a contract? Otherwise the public/private key could also be used for the encryption of the contract. Then you have an encrypted blob signed by both parties, and any of these two parties can decrypt it. What I am not sure I get is why you need a block chain when the parties know each others. If they exchange public keys (and financial institutions have to go through a lengthy KYC process anyway), do you need a proof of work mechanism given that a transaction could be validated simply by both parties signing it.
    - thinkloop 8y ago
      You probably need chronological ordering as well, and to broadcast transactions to all stakeholders, and tools to interact with and verify the structure, and to not roll your own crypto - all of which are provided by following the "blockchain" standard.
    - jkepler 8y ago
      I'm not sure that @askmike uses PoW in his project(s). It sounds like if the companies know each other and can form consensus, they don't need PoW to form consensus.
      - berkes 8y ago
        They indeed don't need that. Nor PoS. What is more, when there is a "consortium of companies that do no trust eachother using a private blockchain" they imply three things: * They have a permissioned system: not everyone can participate. This means there is a mechanism to punish adversaries right there: just remove their permissions! A large part of what "a blockchain" is all about, is dealing with sybil attacks stemming from the requirement of it being permissionless. * They know eachother. Hence there won't be a sybil attack possible. * They have established communication channels (otherwise it is impossible to grant access to the private blockchain). Hence the Byzantine problem is non-existing or not an actual problem. Maybe, very maybe, there is a case for a private blockchain in which there are many participants and a system to fully anonymize all these participants once they "are inside the firewall". I really cannot comprehend this, though. But that would make a case for a private blockchain, becayse sybil attacks are then again possible and need to be dealt with.
hef19898 8y ago
If you don't mind asking, what kind of actual use cases do you see in the supply chain environment for blockchain? I would assume the financa part would be more suitable, but up to now I didn't find a use case where I personally see the benefit. As I assume I might miss something it would be great to hear your opinion on it.
- askmike 8y ago
  Hard to say for me, because the obstacles and problems in these projects are always legal and business. I'm just an engineer ;) > use case where I personally see the benefit This is just infrastructure (as it should be), right now the middlemen are very expensive because of all the paper documents going between companies, and all the people hired to go over all of them. The usual arguments for these projects are: - Cheaper - Quicker decision making & communication - Less fraud & errors For us consumers that would probably result in cheaper apples in the the grocery store I guess.
  - hef19898 8y ago
    Thanks for the quick answer! So it would be fair to say to get rid of the paper work by making it digital and using blockchain to reduce the fraud risk? Anyway, I'm really curious to see what people come up with! And yes, being faster and cheaper is summing up logisitcs pretty well! ;-)
    - askmike 8y ago
      > So it would be fair to say to get rid of the paper work by making it digital and using blockchain to reduce the fraud risk? I'm no expert on fraud, but I think most of it comes when data enters a system. With a blockchain (or any digital system really) you can easily check that your data stays consistent (when it needs to be between different documents and contracts). But if the guy entering how many tons of apple are in this container is lying about it a blockchain won't really help you.
- Silixon 8y ago
  As an example, food safety in the developing world. Food firms claim food is fresh and came from places where it did not come from. If you introduce an agricultural and food tagging system that logs food item IDs into a blockchain-based system, you can know when and where food was made and grown. Note that this ignores the huge expense of measuring and storing all of this data, but I've seen some interest in these use cases in Asia, especially for staple crops like rice.
wslh 8y ago
There are a lot of issues with your thinking. I will just start with a few ones. One is that in a trustless blockchain like Bitcoin your source of truth is the blockchain, no external force (based on some security assumptions) can change that. In a private blockchain the source of truth is the law, if the organizations signed their transactions, published it in a typical SQL database but they were not recognized by the other parties you can sue other parties legally. This is not possible with public blockchains. Another is the number of security point of failures you have. If you use your blockchain for supply chain but the input to the supply chain depends on devices, since all these devices can be hacked or impersonated you cannot trust them. > Because if there was a simple MySQL solution from a company they would have gone with that 2 decades ago. No, this is an organizational problem where different organizations cannot agree on different protocols. It is difficult to agree on a common API, workflow, etc if you have 100 organizations.
- askmike 8y ago
  > Another is the number of security point of failures you have. If you use your blockchain for supply chain but the input to the supply chain depends on devices, since all these devices can be hacked or impersonated you cannot trust them. I don't know any private blockchains that have apps running on smartphones that connect directly to them. Companies have IT systems (what your app talks to) running in private clouds protected by cameras, people with guns and layers of firewalls. And those systems interface with a private blockchain. Authenticating over a number of factors (eg. 2FA) is obviously done, but that's unrelated from the blockchain. > In a private blockchain the source of truth is the law Definitely not true (in any jurisdiction I have worked in, mostly EU), and if it was lawsuits are very expensive and drag out over long periods of time. > No, this is an organizational problem where different organizations cannot agree on different protocols. It is difficult to agree on a common API, workflow, etc if you have 100 organizations. You're right that it's hard, but that's definitely not the problem in any of the projects I have worked in. The problem is trust.
  - wslh 8y ago
    > I don't know any private blockchains that have apps running on smartphones In the example you mentioned: supply chain, you have an external device (outside the blockchain) pushing transactions to the blockchain. You can see this example repeated over a billion of times, it is the typical private blockchain use case. I am not inventing anything new here, just exposing the claim vs. the reality. > Definitely not true (in any jurisdiction I have worked in, mostly EU), and if it was lawsuits are very expensive and drag out over long periods of time. The law is the last resource I cannot imagine NASDAQ and financial institutions having security issues because the financial institution doesn't recognize a message signed by NASDAQ. This is clearly ridiculous. This can be handled in many ways If the message was signed because of fraud or a security breach.

lifeisstillgood 8y ago

Can you point at any examples / elaborations on the subtleties here - almost a "how / why to write your own private blockchain"? I am interested in esp not using PoW in consensus - what makes consensus??

askmike 8y ago
I'm only involved with proof of concepts, as such I usually work with pre made blockchain solutions with smart contracts slapped on top. Consensus is arguably the hardest part of a blockchain (if you need distributed data storage just use something like IPFS). An example is Quorum (JP morgan fork of Ethereum), this is their take on consensus algorithms: https://github.com/jpmorganchase/quorum/wiki/Quorum-Consensus https://github.com/jpmorganchase/quorum/wiki/Quorum-Consensu...
- lifeisstillgood 8y ago
  Thank you

cm2187 8y ago

They might not trust each others but if they know each others, why can’t they simply use a public private key solution? For a transaction to be valid it needs to have been signed by both parties.

askmike 8y ago
For compliance and privacy reasons. For example I deal with a lot of Swiss banks and Swiss law is very strict about what kind of data is allowed to leave Switzerland (not very much).
- cm2187 8y ago
  Is it privacy as in no one must be aware that this particular party signed a contract? Otherwise the public/private key could also be used for the encryption of the contract. Then you have an encrypted blob signed by both parties, and any of these two parties can decrypt it. What I am not sure I get is why you need a block chain when the parties know each others. If they exchange public keys (and financial institutions have to go through a lengthy KYC process anyway), do you need a proof of work mechanism given that a transaction could be validated simply by both parties signing it.
  - thinkloop 8y ago
    You probably need chronological ordering as well, and to broadcast transactions to all stakeholders, and tools to interact with and verify the structure, and to not roll your own crypto - all of which are provided by following the "blockchain" standard.
  - jkepler 8y ago
    I'm not sure that @askmike uses PoW in his project(s). It sounds like if the companies know each other and can form consensus, they don't need PoW to form consensus.
    - berkes 8y ago
      They indeed don't need that. Nor PoS. What is more, when there is a "consortium of companies that do no trust eachother using a private blockchain" they imply three things: * They have a permissioned system: not everyone can participate. This means there is a mechanism to punish adversaries right there: just remove their permissions! A large part of what "a blockchain" is all about, is dealing with sybil attacks stemming from the requirement of it being permissionless. * They know eachother. Hence there won't be a sybil attack possible. * They have established communication channels (otherwise it is impossible to grant access to the private blockchain). Hence the Byzantine problem is non-existing or not an actual problem. Maybe, very maybe, there is a case for a private blockchain in which there are many participants and a system to fully anonymize all these participants once they "are inside the firewall". I really cannot comprehend this, though. But that would make a case for a private blockchain, becayse sybil attacks are then again possible and need to be dealt with.

hef19898 8y ago

If you don't mind asking, what kind of actual use cases do you see in the supply chain environment for blockchain? I would assume the financa part would be more suitable, but up to now I didn't find a use case where I personally see the benefit. As I assume I might miss something it would be great to hear your opinion on it.

askmike 8y ago
Hard to say for me, because the obstacles and problems in these projects are always legal and business. I'm just an engineer ;) > use case where I personally see the benefit This is just infrastructure (as it should be), right now the middlemen are very expensive because of all the paper documents going between companies, and all the people hired to go over all of them. The usual arguments for these projects are: - Cheaper - Quicker decision making & communication - Less fraud & errors For us consumers that would probably result in cheaper apples in the the grocery store I guess.
- hef19898 8y ago
  Thanks for the quick answer! So it would be fair to say to get rid of the paper work by making it digital and using blockchain to reduce the fraud risk? Anyway, I'm really curious to see what people come up with! And yes, being faster and cheaper is summing up logisitcs pretty well! ;-)
  - askmike 8y ago
    > So it would be fair to say to get rid of the paper work by making it digital and using blockchain to reduce the fraud risk? I'm no expert on fraud, but I think most of it comes when data enters a system. With a blockchain (or any digital system really) you can easily check that your data stays consistent (when it needs to be between different documents and contracts). But if the guy entering how many tons of apple are in this container is lying about it a blockchain won't really help you.
Silixon 8y ago
As an example, food safety in the developing world. Food firms claim food is fresh and came from places where it did not come from. If you introduce an agricultural and food tagging system that logs food item IDs into a blockchain-based system, you can know when and where food was made and grown. Note that this ignores the huge expense of measuring and storing all of this data, but I've seen some interest in these use cases in Asia, especially for staple crops like rice.

wslh 8y ago

There are a lot of issues with your thinking. I will just start with a few ones. One is that in a trustless blockchain like Bitcoin your source of truth is the blockchain, no external force (based on some security assumptions) can change that. In a private blockchain the source of truth is the law, if the organizations signed their transactions, published it in a typical SQL database but they were not recognized by the other parties you can sue other parties legally. This is not possible with public blockchains. Another is the number of security point of failures you have. If you use your blockchain for supply chain but the input to the supply chain depends on devices, since all these devices can be hacked or impersonated you cannot trust them. > Because if there was a simple MySQL solution from a company they would have gone with that 2 decades ago. No, this is an organizational problem where different organizations cannot agree on different protocols. It is difficult to agree on a common API, workflow, etc if you have 100 organizations.

askmike 8y ago
> Another is the number of security point of failures you have. If you use your blockchain for supply chain but the input to the supply chain depends on devices, since all these devices can be hacked or impersonated you cannot trust them. I don't know any private blockchains that have apps running on smartphones that connect directly to them. Companies have IT systems (what your app talks to) running in private clouds protected by cameras, people with guns and layers of firewalls. And those systems interface with a private blockchain. Authenticating over a number of factors (eg. 2FA) is obviously done, but that's unrelated from the blockchain. > In a private blockchain the source of truth is the law Definitely not true (in any jurisdiction I have worked in, mostly EU), and if it was lawsuits are very expensive and drag out over long periods of time. > No, this is an organizational problem where different organizations cannot agree on different protocols. It is difficult to agree on a common API, workflow, etc if you have 100 organizations. You're right that it's hard, but that's definitely not the problem in any of the projects I have worked in. The problem is trust.
- wslh 8y ago
  > I don't know any private blockchains that have apps running on smartphones In the example you mentioned: supply chain, you have an external device (outside the blockchain) pushing transactions to the blockchain. You can see this example repeated over a billion of times, it is the typical private blockchain use case. I am not inventing anything new here, just exposing the claim vs. the reality. > Definitely not true (in any jurisdiction I have worked in, mostly EU), and if it was lawsuits are very expensive and drag out over long periods of time. The law is the last resource I cannot imagine NASDAQ and financial institutions having security issues because the financial institution doesn't recognize a message signed by NASDAQ. This is clearly ridiculous. This can be handled in many ways If the message was signed because of fraud or a security breach.