14 ms·
NIST's answer to “Do you need a blockchain?”
- berbec 8y agoCould have been simplified to "no"
- BenjiWiebe 8y agoThat's actually what I was expecting.
- pythonaut_16 8y agoExcept this is an actually helpful diagram that points you towards other solutions depending on what benefits you think a blockchain might give you, instead of an (unhelpful) outright dismissal.
- SilasX 8y agoNot really, this seems like an actionable heuristic that gives actual alternatives and a concrete, realistic case where a blockchain might help.
- mkirklions 8y agoIf you are trying to build a currency or have a timestamp system, the answer is yes. This is why the phrase Bitcoin not Blockchain has been floating around.
- zellyn 8y agoYou can do merkle-tree-signing and other clever things with cryptography to provide auditability without needing any kind of distributed consensus via proof of work/stake/etc. so I think the flowchart could have a couple more "No" branches.
- pythonaut_16 8y agoDoesn't that somewhat depend on how you define a blockchain? Blockchain doesn't inherently require proof of work/stake/etc, just a chain where each block contains a hash of the previous block(s). Proof of work/stake just happens to be a popular implementation detail because of cryptocurrencies.
- beaconstudios 8y agowhat you're describing is a Merkle tree. Blockchains are essentially Merkle trees with a distributed consensus algorithm. Take away the consensus algorithm and you're back to Merkle trees.
- zellyn 8y agohttps://twitter.com/whitequark/status/946886702932557824 https://twitter.com/whitequark/status/946886702932557824 https://twitter.com/hikari_no_yume/status/933791331146784768 https://twitter.com/hikari_no_yume/status/933791331146784768 More seriously, some people apparently consider git a blockchain: https://medium.com/@shemnon/is-a-git-repository-a-blockchain-35cb1cd2c491 https://medium.com/@shemnon/is-a-git-repository-a-blockchain...
- deleted 8y ago[deleted]
- pdpi 8y agoGit histories absolutely are something in the blockchain family of data structures, yes, but they’re not a blockchain proper: the defining chacteristic of such data structures is that they use hashes instead of pointers as references to elements. Merkle trees and blockchains are analogous to trees and singly linked lists, respectively, while git histories are DAGs. Where things got murky was that the cryptocurrency crowd started to talk about the blockchain that backs Bitcoin in terms where the consensus layer was left implicit (our own Linux vs GNU/Linux story if you want to see it that way), then people less knowledgeable about cryptography started pouring in, they learned a bunch of new terminology, and along the way missed the nuance about the consensus layer being left implicit, so in their minds (and the world at large, eventually) blockchain means the combined data structure and consensus layer — It’s fairly obvious that git doesn’t meet the requirements for this definition of “blockchain”.
- greggyb 8y agoGit has a great proof-of-work and consensus mechanism in its original application. Proof-of-work is code that passes tests and consensus is "Linus said 'ok'".
- jey 8y agoHere's one library from Google, used by Certificate Transparency: https://github.com/google/trillian https://github.com/google/trillian
- gnarbarian 8y agoYa this flowchart really presents a false dichotomy between a Bitcoin style block chain and a traditional database. There are many other crypto currency data structures that could be used in different ways to achieve various goals. (Directed acyclic graphs etc) One implemtation I would like to see is a consensus algorithm applied to a multiplayer p2p game to prevent hacking. Another implementation could be for digital assets like textures/skins, 3d models, and animations. This could take something like steam workshop and make it distributed.
- zitterbewegung 8y agoSeems to be very similar to this diagram from the hyperledger edX course. https://www.jsemeraro.com/wp-content/uploads/2017/12/Blockchain-Decision-Path-edX.jpg https://www.jsemeraro.com/wp-content/uploads/2017/12/Blockch...
- elliekelly 8y agoThis[1] is one of the sources provided in the NIST Report[2] appendix of references. [1] http://doyouneedablockchain.com/ http://doyouneedablockchain.com/ [2] https://nvlpubs.nist.gov/nistpubs/ir/2018/NIST.IR.8202.pdf https://nvlpubs.nist.gov/nistpubs/ir/2018/NIST.IR.8202.pdf
- greyhair 8y agoNice to see at least one comment from someone that has actually read the document....
- calibas 8y agoSo if you want a "tamper-proof", auditable, decentralized data store, go with block chain.
- dfox 8y agoNotice that the flow chart does not mention decentralized. The "decentralization" in cryptocurrencies come from whatever mining/proof-of-something mechanism build on top and has nothing to do with blockchain itself.
- calibas 8y agoIt mentions decentralization, but in a rather smart-ass way: "Are the entities with write access having a hard time deciding who should be in control of the data store."
- krastanov 8y agoI do not think I agree. Blockchains are decentralized consensus. If you remove the decentralized consensus algorithm from a block chain, you are left with simply a Merkle tree, a much older concept (used in git for instance where there is no global consensus).
- blattimwind 8y ago> So if you want a "tamper-proof", auditable, decentralized data store, go with git. Yes.
- calibas 8y agoGit isn't decentralized, each data store has an owner.
- dfox 8y agoIn my view the most sane definition of what blockchain is includes Git.
- erikpukinskis 8y ago
- Derek_MK 8y agoDon't forget the first step "Do you not really care about the technology and just want to write a webapp that gets mad investor money?" and an arrow that goes straight to "Yes"
- calibas 8y agoI think the days of "mad investor money" just because you added blockchain to something may be over. The hysteria over blockchain went hand-in-hand with last year's cryptocurrency bubble, I wouldn't be surprised if smart investors are avoiding it now.
- woah 8y agoWouldn’t the dumb investors be avoiding it now? I think the smart investors would ideally form an opinion based on fundamentals instead of which buzzword is hot right now.
- calibas 8y agoI'm no investor, but I assume a whole year of the markets crashing would discourage people.
- starbeast 8y agoThen again, when you look at the rest of the economy it would seem that people only have a two year memory for really bad ideas, at best.
- erikpukinskis 8y agoYes, I used to think stocks were a good investment, but then that one year they all crashed and I realized stocks are all hype.
- calibas 8y agoWho's saying anything like that? My thoughts are, if a markets in a steady decline with no signs of improving, is it a good investment?
- SilasX 8y agoIs there a source document that can be linked instead?
- ucaetano 8y agohttps://csrc.nist.gov/publications/detail/nistir/8202/final https://csrc.nist.gov/publications/detail/nistir/8202/final
- niftich 8y agoPDF page 53 of the document with canonical URI of [1], resolved by the doi.org resolver [2] to a pdf with a NIST URL [3]. [1] doi:10.6028/NIST.IR.8202 [2] https://doi.org/10.6028/NIST.IR.8202 https://doi.org/10.6028/NIST.IR.8202 [3] https://nvlpubs.nist.gov/nistpubs/ir/2018/NIST.IR.8202.pdf https://nvlpubs.nist.gov/nistpubs/ir/2018/NIST.IR.8202.pdf
- seibelj 8y agoI think blockchain is staring us in the face as a solution to the collapse of trust in institutions. For example, if all votes were stored on a permissioned blockchain, audits would be trivial. If we layered it on top of our existing (bad) election technologies and did a post-election comparison of accuracy, I bet it would be far more accurate.
- SilasX 8y agoIf you don't care about keeping a voter's vote secret, the problem becomes a lot easier to begin with, and permits a lot of non-blockchain solutions. Like publishing votes in the newspaper.
- theoh 8y agoWho allocates the credentials that each citizen needs to vote? There's no way around the need for trusted institutions in this case.
- Ensorceled 8y agoOr, stored on paper with a bunch of both independent and representative people counting the paper and ensuring the newspapers reported their riding correctly. My mom was a returning officer for years and I find it horrifying to watch the US gum up their election systems in the name of progress (or, maybe, in the name of election fraud).
- 8y ago
- paraditedc 8y agopdf of the document: https://nvlpubs.nist.gov/nistpubs/ir/2018/NIST.IR.8202.pdf https://nvlpubs.nist.gov/nistpubs/ir/2018/NIST.IR.8202.pdf
- SilasX 8y agoI think the mods should switch the link to this one.
- alanfranzoni 8y agoIt's linked at the bottom of the imgur link. And scrolling down to page 42 is not exactly quick :-)
- nradov 8y agoThe actual NIST report is here. https://csrc.nist.gov/publications/detail/nistir/8202/final https://csrc.nist.gov/publications/detail/nistir/8202/final
- ucaetano 8y agoTL;DR: No.
- erikpukinskis 8y agoTL;DR: Probably not but maybe
- snissn 8y agoThe concept of "You" is sort of interesting. If "You" want to build something that isn't centrally owned by "You" then you should use a blockchain. Satoshi Nakamoto doesn't "own" bitcoin anymore than anyone else does. Same with most other blockchain projects. The problems come when "You" want to have your cake and eat it too.
- mthom 8y agoIt is almost as though, prior to blockchain, nobody had conceived the idea of a distributed spreadsheet.
- elliekelly 8y agoNIST would apparently have you believe that a spreadsheet & email are just as effective.
- zeroxfe 8y agoThe idea definitely existed -- it's just that no one had cracked how to keep it correct and consistent until Bitcoin demonstrated how proof-of-work could be used as a practical consensus algorithm. (Prior implementations of digital currencies always relied on some kind of centralized mechanism to prevent double-spending.)
- ballenf 8y agoIn talking to a few companies who thought they wanted a blockchain, one big misconception is that blockchain will magically solve the interoperability issue where multiple parties have data in disparate formats. Blockchain doesn't inherently do any data translation or normalization. It's interesting to me how resilient this misconception is. I have come to the conclusion that it's just wishful thinking for a magic bullet for an age-old difficult problem.
- jrochkind1 8y ago> one big misconception is that blockchain will magically solve the interoperability issue where multiple parties have data in disparate formats. That reminds me so hard of RDF/"linked data", which was (and is still in some sectors) popular for same motivation I think. Data interoperability is a real problem, with real pain, which is why people get so excited about tech they think will solve it. But no magic technology is going to solve it, it's a human problem. (At least I can see _why_ people (wrongly) thought RDF would; no idea how they arrived at that misconception of blockchain).
- vec 8y ago> (At least I can see _why_ people (wrongly) thought RDF would; no idea how they arrived at that misconception of blockchain) There was briefly the bad idea that "NoSQL means we don't have to care about our schemas anymore" bridging the other two bad ideas.
- bunderbunder 8y agoThinking, "this might solve our interoperability woes", seems to be the classic motivator behind big companies' interest in every tech trend. It was there with Big Data ("Who cares? Just throw it in a data lake!"). It was there with NoSQL ("Who cares? Just throw it in a document store!") It was there with XML ("XML is just one format, right?") It was there with COM/CORBA/AppleScript/etc ("The vendor can make their own data readable!") I wouldn't be surprised if, millennia ago, there were organizations trying to figure out how fluted spear heads might solve their communication woes.
- 8y ago
- kawfey 8y agoOne perfect use case is amateur radio cloud logging. Logbook of the World[0] is the defacto standard, which implements cryptographic signing, but the database is centralized, and it's consistently broken, lagging, and needs frequent updates and downtime, and due to this it probably costs a lot of money to the American Radio Relay League (ARRL) and her members. Blockchain is the perfect solution IMO. [0]: http://www.arrl.org/logbook-of-the-world http://www.arrl.org/logbook-of-the-world
- pslam 8y agoA technology which incentivizes consuming all available resources and favors those with the most sounds like a perfect fit for amateur radio.
- CydeWeys 8y agoYou wouldn't need mining for such a blockchain. It could easily work on proof of stake.
- root_axis 8y agoPoS doesn't actually work. The wastefulness of PoW mining is what keeps the network honest, without the waste there is no incentive to stay on "the main chain" (i.e. prevent an accidental or malicious fork) since it costs nothing to "mine" every possible chain.
- CydeWeys 8y agoIt works for this use case. Radio contact logging is based on the honor system, and a contact is valid if both ends log it. Currently it's a centralized database that anyone can input data into. In this use case you'd simply decentralize the DB. Blockchains are needed in cryptocurrencies to prevent the double spend problem. There's no double spend problem in logging radio contacts. The incentives to attack are much less too, because there's no value to steal.
- known 8y agoNIST nailed it :)
- sklivvz1971 8y agoThe last step should be "You should use git"
- commandlinefan 8y agoI was honestly expecting a picture of the word "No".
- joshschreuder 8y agohttp://doyouneedablockchain.com/ http://doyouneedablockchain.com/
- philip1209 8y agoI'm surprised somebody hasn't yet made an "audit log as a service". The Reddit comment editing is one place that shows why companies cannot be trusted. But, for enterprise security, you also want a log that cannot be tampered with.
- root_axis 8y agoBlockchains are pointless for "enterprise security" because "enterprise" already implies a trusted authority.
- Karunamon 8y agoBeing in an enterprise doesn't mean you have ultimate trust of every single individual with write access. There's a reason many orgs operate under a two-person rule for access to some data, have change controls, and so forth.
- root_axis 8y agoThat's irrelevant. The point is that the enterprise is a centralized authority so it can trivially codify its business rules into a centralized system; nothing is gained by using a blockchain. Tracking, audits, and tamper resistance is already possible without a blockchain.
- Karunamon 8y agoOnly thing I took issue with is the overbroad statement "because "enterprise" already implies a trusted authority" It does not necessarily.
- root_axis 8y agoNo. It necessarily does. The enterprise is the final authority regarding whether or not the system is behaving correctly, not a distributed consensus.
- nwsm 8y agoI don't have a specific use case in mind but it seems that some subset of these, for example [0], would necessitate, or at least be aptly solved with a blockchain. [0]: {Shared and Consistent, More than One Contributor, Distributed Control, Tamperproof Log}
- 3chelon 8y agoI remember trying to explain this to a bank I worked for a few years ago. The trouble is, they're all so hyped up by the buzzwords they don't listen. And before I knew it they'd hired a self-styled "blockchain consultant" at god knows what daily rate. I realised I was fighting a losing battle. Probably should have reinvented myself there and then as a blockchain consultant.
- jacquesm 8y agoCould we please have another one for AI? And while we're at it another for serverless architectures?
- jedberg 8y agoAre you writing all the code? | | Yes No | | Use serverless Use containers
- platz 8y agosometimes you don't really want a blockchain, you actually want a "Distributed Ledger". It's similar in that a DLC also requires consensus. It's different in that a DLC need not be a "chain of blocks". i.e. a linked-list as it's core data structure. The Difference Between Blockchains & Distributed Ledger Technology https://towardsdatascience.com/the-difference-between-blockchains-distributed-ledger-technology-42715a0fa92 https://towardsdatascience.com/the-difference-between-blockc...
- CydeWeys 8y agoSome of these miss the mark, e.g. depending on what you're doing with PII storing hashes or symmetric encryptions would work fine. Similarly, updates can be accomplished by writing new entries, which is how Bitcoin works; you read all blocks ever and steadily build up a (local) database of all the unspent transactions, and update those as new blocks come in. Namecoin works similarly but for DNS entries. It's no different than replaying a transaction log in a standard DB (once) to reconstruct the current state. Where >99% of blockchain proposals fall down, though, is that they don't actually need the "anyone can commit" property. Businesses sure as hell wouldn't allow random strangers to commit to their internal blockchain, so they don't really need one at all. They would only allow some small number of vetted, authenticated external parties to do so, in which case normal account mechanisms work fine.
- sigstoat 8y ago> Some of these miss the mark, e.g. depending on what you're doing with PII storing hashes or symmetric encryptions would work fine. granted that "depending on what you're doing" is a big caveat, but: i feel like there's a difference between encrypting my PII with an ephemeral session key, then sending it in some packets across the internet that are unlikely to be captured, and encrypting my PII with some not-very ephemeral key, then writing it to the disks of thousands or millions of people with a big "this is PII" sign on top of it.
- CydeWeys 8y agoThere wouldn't be a "this is PII" sign on top of it. By its nature you don't know what encrypted data is unless you can decrypt it, and there's many other things that people would be encrypting and putting on the blockchain that aren't PII (probably the vast majority of them wouldn't be). And that's only for the symmetric case anyway; in the hash case it's non-reversible and the majority of the blockchain data is already hashes anyway. Also, your "ephemeral encrypted packets" are probably logged to disk in multiple three-letter agency databases.
- r32a_ 8y agoDefinition of blockchain is fluid because a blockchain is a combination of many technologies.
- M2Ys4U 8y agoDo you want to help ruin the planet by wasting a tremendous amount of power? If yes, consider Blockchain
- jtonz 8y agoYou are thinking of cryptomining, specifically ones that use proof-of-work blockchains.
- simias 8y agoI think the key point that crypto-enthusiasts often miss here is "Are the entities with write access having a hard time deciding who should be in control of the data store". For many purported use-cases for blockchains (things having to do with traceability of goods for instance) the answer to this question is most likely "no". For instance if you want to trace a shipment of pineapples there must be some entity somewhere who's tasked with making sure that the goods are up to code (otherwise anybody could just lie on the blockchain). This entity is clearly "in control of the data store". Of course you may want to be able to publicly audit that entity's records to detect any wrongdoings or suspicious activity, but that doesn't require a blockchain at all, simply having a signed public database/log (that anybody could archive) would do the trick nicely for instance.
- tim333 8y agoI could see a situation where several rival pineapple growers supply several rival pineapple retailers where they are not sure who should control the data store but where there would be an advantage to having an auditable record. If they lie, the recipient of the iffy pineapples could go hassle the supplier. Not sure about the virtues of signed public database/logs vs blockchains.
- m-i-l 8y agoAlso note the "blockchain trilemma": at the moment you can have decentralised and secure systems that don't scale (e.g. Bitcoin), or you can have scalable and secure systems which aren't decentralised (e.g. all the "private permissioned blockchain" solutions which don't actually need to use a blockchain).
- JoshuaDavid 8y agoOr scalable and decentralized systems that aren't secure (e.g. SMTP) :)
- m-i-l 8y agoYes, and as per your example this combination also doesn't need blockchain. The only combination that actually needs blockchain is decentralised and secure.
- jesusthatsgreat 8y agoYou don't need a blockchain until corruption and lack of transparency forces a need for one in order to re-build trust.
- sekai 8y agoWouldn't it make sense have some sort of solution before it happens? Like Venezuela.
- garysahota93 8y agoThe blockchain "revolution" is very similar to AI, bots, IoT, Web 2.0, etc etc. These were all mainstream "fads" that died down over time. As I've said before, many of these technologies are revolutionary and extremely useful - but only in their respective domain. Calling any of them, blockchain included, the end-all-be-all is foolish. There are some legitimate use cases for which this will apply greatly. But it's only a matter of time before another technology goes viral only for folks to realize it's intended use cases and then simmer down to a focuses, purpose-driven tech.
- lwansbrough 8y agoIt seems to me that a better solution for auditing in situations where you don’t need a distributed ledger is using event sourcing. Blockchains are just a data structure after all. You wouldn’t say “just use a b-tree.” Event sourcing databases solve most of the problems blockchain companies seem to think they have. (And the other problems they have probably won’t be solved with Blockchain anyway.)
- greyhair 8y agoFunny how almost everyone seems to be discussing the diagram and not actually reading the NIST paper first hand. And then nitpicking over the very definition of what block chain is. But then saying 'bitcoin' 'ethereum' 'git' and 'merkle tree' over and over and over. Given the title of the thread, and the availability of the actual text, I suggest everyone take a quick read first, then come on back. It is only 50 pages. https://nvlpubs.nist.gov/nistpubs/ir/2018/NIST.IR.8202.pdf https://nvlpubs.nist.gov/nistpubs/ir/2018/NIST.IR.8202.pdf