4 ms·

But storing things off-chain kinda kills the entire concept, doesn't it? If I hack into DigitalOcean I can mess everybody's NFTs by tampering with one database.

by soco 5y ago

askmike 5y ago
If the whole world uses DigitalOcean for NFTs sure, but maybe we end up in a world where there are many providers. And not one that controls everything (by which point it's not centralized). Similar to right now many crypto is stored in exchanges but not one exchange holds all.
- soco 5y ago
  I can hack into those providers as well, right? My worry was that the chain of trust is broken by definition - as soon as you store things outside the chain. I really don't understand why one would dilute the value proposition of the blockchain like that. If I have a Ferrari I shouldn't put monster truck wheels on it only because it can't drive over speed bumps - it kills the "ferrari-ness".
  - askmike 5y ago
    > My worry was that the chain of trust is broken by definition - as soon as you store things outside the chain. From the chain perspective they never really leave the chain. They are either locked (most L2 solutions such as Bitcoin Lightning) or they are held by someone else (most centralized custodians, including exchanges). So the worst that can happen is that the locked/held coins get "stolen".
  - josephg 5y ago
    > My worry was that the chain of trust is broken by definition As I understand it, the idea is you put the data itself off chain but keep hashes on chain. Anyone who downloads the data can verify it by checking that the hash matches what is stored on chain.
    - soco 5y ago
      Uh, no, you store nothing of sorts. Which is the problem. According to ERC-721 (NFT standard) you store exactly three things: the name, a cute pic and the URI to its definition file somewhere else (not even that definition has a hash, not that it would help anything).
pa7x1 5y ago
> But storing things off-chain kinda kills the entire concept, doesn't it? If I hack into DigitalOcean I can mess everybody's NFTs by tampering with one database. It's not about storing off-chain, you compute off-chain and post to the network a cryptographic proof of the computation. Rollups provide something akin to lossless compression proofs of computation. You execute the computation off-chain with high throughput and post a proof to the Ethereum network, this proof contains everything necessary to verify the correct execution of the computation. Sounds mind-blowing but we can thank smart mathematicians for figuring out the cryptography that makes it possible. This means that we can scale off-chain while enjoying the security guarantees of the blockchain. These techniques allow scaling the network throughput towards the 1000-4000 transactions per second range. Which together with data-availability sharding will push the throughput towards the 100K transactions per second range. To be noted that this is not anymore a theoretical construction, these things are live running today on Ethereum. You can check the different solutions as well as detailed explanations of their trade-offs, limitations, etc... Here: https://l2beat.com https://l2beat.com
- soco 5y ago
  NFT definition is stored off-chain. Which means the security you defined on the chain protects only the URI to a random file or some database - which can be modified any time DigitalOcean or the hacker decides to modify. So you're right, we can create quickly and safely keys to the metal front door, while the back door is propped with a stick.
  - proto-n 5y ago
    What you are saying is that an certificate of authenticity is useless because you can burn the artwork with a torch. Those two things are mostly unrelated.
    - soco 5y ago
      I say the certificate of authenticity can be easily forged or destroyed with no way to know what it once contained. And because the entire reason to exist of an NFT is based on this certificate of authenticity (unlike a real world artwork which can be touched and estimated by a specialist), I see a problem right there. Of course this is a problem only if the NFT has an artistic value, which is an entire discussion per se.

But storing things off-chain kinda kills the entire concept, doesn't it? If I hack into DigitalOcean I can mess everybody's NFTs by tampering with one database.

by soco 5y ago

But storing things off-chain kinda kills the entire concept, doesn't it? If I hack into DigitalOcean I can mess everybody's NFTs by tampering with one database.

askmike 5y ago

If the whole world uses DigitalOcean for NFTs sure, but maybe we end up in a world where there are many providers. And not one that controls everything (by which point it's not centralized). Similar to right now many crypto is stored in exchanges but not one exchange holds all.

soco 5y ago
I can hack into those providers as well, right? My worry was that the chain of trust is broken by definition - as soon as you store things outside the chain. I really don't understand why one would dilute the value proposition of the blockchain like that. If I have a Ferrari I shouldn't put monster truck wheels on it only because it can't drive over speed bumps - it kills the "ferrari-ness".
- askmike 5y ago
  > My worry was that the chain of trust is broken by definition - as soon as you store things outside the chain. From the chain perspective they never really leave the chain. They are either locked (most L2 solutions such as Bitcoin Lightning) or they are held by someone else (most centralized custodians, including exchanges). So the worst that can happen is that the locked/held coins get "stolen".
- josephg 5y ago
  > My worry was that the chain of trust is broken by definition As I understand it, the idea is you put the data itself off chain but keep hashes on chain. Anyone who downloads the data can verify it by checking that the hash matches what is stored on chain.
  - soco 5y ago
    Uh, no, you store nothing of sorts. Which is the problem. According to ERC-721 (NFT standard) you store exactly three things: the name, a cute pic and the URI to its definition file somewhere else (not even that definition has a hash, not that it would help anything).

pa7x1 5y ago

> But storing things off-chain kinda kills the entire concept, doesn't it? If I hack into DigitalOcean I can mess everybody's NFTs by tampering with one database. It's not about storing off-chain, you compute off-chain and post to the network a cryptographic proof of the computation. Rollups provide something akin to lossless compression proofs of computation. You execute the computation off-chain with high throughput and post a proof to the Ethereum network, this proof contains everything necessary to verify the correct execution of the computation. Sounds mind-blowing but we can thank smart mathematicians for figuring out the cryptography that makes it possible. This means that we can scale off-chain while enjoying the security guarantees of the blockchain. These techniques allow scaling the network throughput towards the 1000-4000 transactions per second range. Which together with data-availability sharding will push the throughput towards the 100K transactions per second range. To be noted that this is not anymore a theoretical construction, these things are live running today on Ethereum. You can check the different solutions as well as detailed explanations of their trade-offs, limitations, etc... Here: https://l2beat.com https://l2beat.com

soco 5y ago
NFT definition is stored off-chain. Which means the security you defined on the chain protects only the URI to a random file or some database - which can be modified any time DigitalOcean or the hacker decides to modify. So you're right, we can create quickly and safely keys to the metal front door, while the back door is propped with a stick.
- proto-n 5y ago
  What you are saying is that an certificate of authenticity is useless because you can burn the artwork with a torch. Those two things are mostly unrelated.
  - soco 5y ago
    I say the certificate of authenticity can be easily forged or destroyed with no way to know what it once contained. And because the entire reason to exist of an NFT is based on this certificate of authenticity (unlike a real world artwork which can be touched and estimated by a specialist), I see a problem right there. Of course this is a problem only if the NFT has an artistic value, which is an entire discussion per se.