10 ms·

> Data stored in immudb is cryptographically coherent and verifiable, just like blockchains, but without all the complexity. Unlike blockchains, immudb can hand

> Data stored in immudb is cryptographically coherent and verifiable, just like blockchains, but without all the complexity. Unlike blockchains, immudb can handle millions of transactions per second, and can be used both as a lightweight service or embedded in your application as a library. > Companies use immudb to protect credit card transactions and to secure processes by storing digital certificates and checksums. This explanation is available on their github repo [1]. It has been a common refrain on Hacker News that you don't need a blockchain and instead can just use a database, but this product may actually fill the gap where tamper resistance is desired. [1] https://github.com/codenotary/immudb https://github.com/codenotary/immudb

simtel20 5y ago
Yeah, this interests me because I'm thinking about how to use grafeas - it's role is critical for reliable software development going forward - but storing it's data in a backend like this would add one more layer of trust and verifiability to a software supply chain. There are some interesting possibilities with making e.g. public software repos' metadata clonable verifiable and queryable via local immutable copies.
- decodebytes 5y ago
  Maybe take a look at rekor, part of the sigstore project, it's built specifically for software supply chain transparency (disclaimer I am one of the community): https://github.com/sigstore/rekor https://github.com/sigstore/rekor
codetrotter 5y ago
> this product may actually fill the gap where tamper resistance is desired I think in the future, all enterprise storage solutions will be append-only by default. To protect against cryptolocker malware. But also with isolated functionality for actually deleting data, for example because of GDPR requests or because of malware that tries to fill all writable storage with garbage. So that data can still be deleted, but not from any of the regular servers that are reading and appending data to the system. Instead from separate servers that are isolated and for data storage management only.
capableweb 5y ago
I don't quite understand how something you run yourself on your own hardware can be tamper-proof (digitally, not physically). If you're running the software you can modify it, so no matter how many processes there are in place for resisting mutability, you'll always be able to find some way to mutate it. Compared to blockchain which is running on X number of nodes that you'd have to have access to in order to modify something, immudb doesn't actually seem to replace the use case when you need something actually tamper-proof.
- jeroiraz 5y ago
  the entire state of the database gets captured by a hash value. By having light-weight clients (or auditors) keeping track of it is how tampering is detected in despite of where the database server is running
  - capableweb 5y ago
    I see. It's a blockchain without calling it a blockchain, so people who hate blockchain can use it without having to realize they use a blockchain.
    - f38zf5vdt 5y ago
      And with git being the most superior blockchain of them all.
      - ric2b 5y ago
        Except it has no way to achieve consensus automatically. That's left as an exercise to the reader.
    - jacquesm 5y ago
      Blockchain is just a special case of Merkle trees, there isn't anything original about them other than that Bitcoin served as a marketing engine for the term blockchain because some people made a ton of money with it. https://en.wikipedia.org/wiki/Merkle_tree https://en.wikipedia.org/wiki/Merkle_tree
ampdepolymerase 5y ago
How does this compare feature wise to https://aws.amazon.com/qldb/ https://aws.amazon.com/qldb/
- jeroiraz 5y ago
  there are many differences (as immudb contributor): - immudb can be used embedded or client-server database while qldb is a aws service - immudb behaves as a key-value store but also provides SQL support while qldb provides a document-like data model with PartiQL language - immudb provides time travel features - immudb it's faster, built-in with a mode of operation designed for fast writes which works with eventual indexing. Finally but super important, immudb can be deployed anywhere and it's open source!
  - giaour 5y ago
    QLDB provides time travel features, too (if by "time travel" you mean being able to query the state of a record at an arbitrary point in the past): https://docs.aws.amazon.com/qldb/latest/developerguide/working.history.html https://docs.aws.amazon.com/qldb/latest/developerguide/worki...
    - jeroiraz 5y ago
      immudb already included history support for key-value entries in previous releases. But since v1.0.0, immudb provides query resolution at a given point, using the current data on that specific moment but also being able to combine data at different points in time on the same query. Is not clear to me if it's something that can be achieved with “SELECT * FROM history”, it requires up most one result per different entry (the most recent one)
      - giaour 5y ago
        QLDB is a document DB, so you are limited to a single point or range per query. Also keep in mind `history` in QLDB is a function, not just a store of previous values; given a table "foo" and a key "bar", getting its immutable state from last Tuesday at 4 PM EDT would be: SELECT * FROM history('foo', `2021-05-18T20:00:00`, `2021-05-18T20:00:00`) as t WHERE t.metadata.id = 'bar';
c01n 5y ago
Does immudb offer mechanisms for distributed consensus, because that is one of the top features in blockchains, they do this while remaining P2P.
- jeroiraz 5y ago
  the order of changes is not subject to consensus, but clients have the tools to ensure no history rewrite happened
  - c01n 5y ago
    Can Immudb work in a decentralized network while remaining secure from attacks in such networks or is Immudb meant for centralized systems if so I think you cannot compare it to Blockchains. Maybe a better comparison is Git.
    - jeroiraz 5y ago
      immudb is not meant for public decentralized networks, although it might be possible to use embedded immudb to build a public blockchain... but that's a different story. immudb server is tailored to provide a database where any tampering will be subject to detection by any single client application consuming its data.
  - judge2020 5y ago
    sounds like git :)
    - stingraycharles 5y ago
      I think both blockchains and git are based on the concept of merkle trees, so that sounds about right. https://en.m.wikipedia.org/wiki/Merkle_tree https://en.m.wikipedia.org/wiki/Merkle_tree
      - dmacvicar 5y ago
        immudb has a website where you can visualize the Merkle tree in real time as you insert data: https://play.codenotary.com/ https://play.codenotary.com/
cryptonector 5y ago
It sounds a lot like ZFS. What I really want is a way to get a hash of a root node / snapshot.
decodebytes 5y ago
Maybe take a look at rekor, part of the sigstore project, it's built specifically for software supply chain transparency (disclaimer I am one of the community). Being a transparency log, you get much better guarantees around inclusion proof (it uses a merkle tree): https://github.com/sigstore/rekor https://github.com/sigstore/rekor
deleted 5y ago
[deleted]
simias 5y ago
Was there a gap in the first place? We could design temper-proof data storage since way before the blockchain. All you need is checksums, public key cryptography and a way to publish your signed checksums. I'm not saying that this isn't a good project but it's a bit strange to frame it as if it was a major technical breakthrough. If anything what catches my eye in this announcement is the "time travel" feature as well as the wire protocol compatibility with Postgres, that's pretty cool.
- XorNot 5y ago
  Getting it all for free in the product is kind of a huge win though. It's always been possible with other systems, but you still have to implement it.
- nuclearnice1 5y ago
  > All you need is checksums, public key cryptography and a way to publish your signed checksums. I agree that’s sufficient. One non technical addition I see in Bitcoin is the incentive to verify the checksums.

simtel20 5y ago

Yeah, this interests me because I'm thinking about how to use grafeas - it's role is critical for reliable software development going forward - but storing it's data in a backend like this would add one more layer of trust and verifiability to a software supply chain. There are some interesting possibilities with making e.g. public software repos' metadata clonable verifiable and queryable via local immutable copies.

decodebytes 5y ago
Maybe take a look at rekor, part of the sigstore project, it's built specifically for software supply chain transparency (disclaimer I am one of the community): https://github.com/sigstore/rekor https://github.com/sigstore/rekor

codetrotter 5y ago

> this product may actually fill the gap where tamper resistance is desired I think in the future, all enterprise storage solutions will be append-only by default. To protect against cryptolocker malware. But also with isolated functionality for actually deleting data, for example because of GDPR requests or because of malware that tries to fill all writable storage with garbage. So that data can still be deleted, but not from any of the regular servers that are reading and appending data to the system. Instead from separate servers that are isolated and for data storage management only.

capableweb 5y ago

I don't quite understand how something you run yourself on your own hardware can be tamper-proof (digitally, not physically). If you're running the software you can modify it, so no matter how many processes there are in place for resisting mutability, you'll always be able to find some way to mutate it. Compared to blockchain which is running on X number of nodes that you'd have to have access to in order to modify something, immudb doesn't actually seem to replace the use case when you need something actually tamper-proof.

jeroiraz 5y ago
the entire state of the database gets captured by a hash value. By having light-weight clients (or auditors) keeping track of it is how tampering is detected in despite of where the database server is running
- capableweb 5y ago
  I see. It's a blockchain without calling it a blockchain, so people who hate blockchain can use it without having to realize they use a blockchain.
  - f38zf5vdt 5y ago
    And with git being the most superior blockchain of them all.
    - ric2b 5y ago
      Except it has no way to achieve consensus automatically. That's left as an exercise to the reader.
  - jacquesm 5y ago
    Blockchain is just a special case of Merkle trees, there isn't anything original about them other than that Bitcoin served as a marketing engine for the term blockchain because some people made a ton of money with it. https://en.wikipedia.org/wiki/Merkle_tree https://en.wikipedia.org/wiki/Merkle_tree

ampdepolymerase 5y ago

How does this compare feature wise to https://aws.amazon.com/qldb/ https://aws.amazon.com/qldb/

jeroiraz 5y ago
there are many differences (as immudb contributor): - immudb can be used embedded or client-server database while qldb is a aws service - immudb behaves as a key-value store but also provides SQL support while qldb provides a document-like data model with PartiQL language - immudb provides time travel features - immudb it's faster, built-in with a mode of operation designed for fast writes which works with eventual indexing. Finally but super important, immudb can be deployed anywhere and it's open source!
- giaour 5y ago
  QLDB provides time travel features, too (if by "time travel" you mean being able to query the state of a record at an arbitrary point in the past): https://docs.aws.amazon.com/qldb/latest/developerguide/working.history.html https://docs.aws.amazon.com/qldb/latest/developerguide/worki...
  - jeroiraz 5y ago
    immudb already included history support for key-value entries in previous releases. But since v1.0.0, immudb provides query resolution at a given point, using the current data on that specific moment but also being able to combine data at different points in time on the same query. Is not clear to me if it's something that can be achieved with “SELECT * FROM history”, it requires up most one result per different entry (the most recent one)
    - giaour 5y ago
      QLDB is a document DB, so you are limited to a single point or range per query. Also keep in mind `history` in QLDB is a function, not just a store of previous values; given a table "foo" and a key "bar", getting its immutable state from last Tuesday at 4 PM EDT would be: SELECT * FROM history('foo', `2021-05-18T20:00:00`, `2021-05-18T20:00:00`) as t WHERE t.metadata.id = 'bar';

c01n 5y ago

Does immudb offer mechanisms for distributed consensus, because that is one of the top features in blockchains, they do this while remaining P2P.

jeroiraz 5y ago
the order of changes is not subject to consensus, but clients have the tools to ensure no history rewrite happened
- c01n 5y ago
  Can Immudb work in a decentralized network while remaining secure from attacks in such networks or is Immudb meant for centralized systems if so I think you cannot compare it to Blockchains. Maybe a better comparison is Git.
  - jeroiraz 5y ago
    immudb is not meant for public decentralized networks, although it might be possible to use embedded immudb to build a public blockchain... but that's a different story. immudb server is tailored to provide a database where any tampering will be subject to detection by any single client application consuming its data.
- judge2020 5y ago
  sounds like git :)
  - stingraycharles 5y ago
    I think both blockchains and git are based on the concept of merkle trees, so that sounds about right. https://en.m.wikipedia.org/wiki/Merkle_tree https://en.m.wikipedia.org/wiki/Merkle_tree
    - dmacvicar 5y ago
      immudb has a website where you can visualize the Merkle tree in real time as you insert data: https://play.codenotary.com/ https://play.codenotary.com/

cryptonector 5y ago

It sounds a lot like ZFS. What I really want is a way to get a hash of a root node / snapshot.

decodebytes 5y ago

Maybe take a look at rekor, part of the sigstore project, it's built specifically for software supply chain transparency (disclaimer I am one of the community). Being a transparency log, you get much better guarantees around inclusion proof (it uses a merkle tree): https://github.com/sigstore/rekor https://github.com/sigstore/rekor

deleted 5y ago

[deleted]

simias 5y ago

Was there a gap in the first place? We could design temper-proof data storage since way before the blockchain. All you need is checksums, public key cryptography and a way to publish your signed checksums. I'm not saying that this isn't a good project but it's a bit strange to frame it as if it was a major technical breakthrough. If anything what catches my eye in this announcement is the "time travel" feature as well as the wire protocol compatibility with Postgres, that's pretty cool.

XorNot 5y ago
Getting it all for free in the product is kind of a huge win though. It's always been possible with other systems, but you still have to implement it.
nuclearnice1 5y ago
> All you need is checksums, public key cryptography and a way to publish your signed checksums. I agree that’s sufficient. One non technical addition I see in Bitcoin is the incentive to verify the checksums.