6 ms·

I thought this would be about a bigger and more obvious problem with web3, namely that by default all traffic going through MetaMask runs through Infura and hen

I thought this would be about a bigger and more obvious problem with web3, namely that by default all traffic going through MetaMask runs through Infura and hence through Consensys's servers. If you think you're getting privacy or resilience because you're interacting with a DApp, think again. All your transactions are going through a single organization, which might have logs linking the IP, your ETH address, the smart contract address, and timestamp, and if it goes down web3 won't work for a significant number of users. [It is possible to configure MetaMask to use a different gateway, but how many users fiddle with the defaults or even know what a web3 gateway is?] Ethereum as a whole and the raw smart contracts of most DApps actually are decentralized, but there are SPOFs in the UI, name service, and transaction gateway. If you aren't willing to run your own geth instance and understand Solidity/EVM, it's not really decentralized for you.

thr0wawayf00 5y ago
> If you aren't willing to run your own geth instance and understand Solidity/EVM, it's not really decentralized for you. This is how I feel about the exchanges generally, which wield an incredible amount of influence in the crypto markets, for better or worse. It's a complete tangent, but reading about Tether's shifting story around its capital reserves terrifies me. I have yet to see a blockchain implementation that's easy enough to use on its own that it could achieve widespread adoption without a strong market desire to have someone else manage the complexity of it for you. People talk about decentralization all day long while completely ignoring the fact that we've just shifted the centralized authority from one entity to another.
- agumonkey 5y ago
  That summarizes a lot. The system is not simple at all. The benefits are only potentially here (eth fees are wild). The solution involves the opposite of religious principles the mob believes in.
  - fragmede 5y ago
    It's more than the mob believes it to be an ecumenical matter and you want it to be otherwise. If you want to participate, but aren't willing to trust someone else (which no one would blame you for), then your move is to run your own node. Like, that's the entire premise of blockchain technology - no one trusts each other - but no one has to!
    - thr0wawayf00 5y ago
      > no one trusts each other - but no one has to! Isn’t the whole point of a market that we trust each other enough to have a shared understanding of what value is? How can a market function when you trust no one else in it? Cash is a perfect example of this: it’s only worth something because we all agree that it’s worth something, we can’t eat it or do anything else with it other than to exchange it for goods. Crypto isn’t any different. It will be interesting how this holds up if Tether is actually just “printing” money as they go. If the rumors are true and they go bust or are shut down, one could easily see that event catalyzing a crypto market meltdown similar to what we saw in 2008 where speculation was out of control. Will the energy remain in the crypto space if the crypto markets fall victim to the very thing they were created to prevent?
      - couchand 5y ago
        > Will the energy remain in the crypto space if the crypto markets fall victim to the very thing they were created to prevent? Yes, because the energy in the cryptocurrency space is based not on rational analysis but religious fervor. The inconvenient objective facts will be explained away rather than addressed.
      - agumonkey 5y ago
        There are some philosophical question. Even trust need trustlessness at first. Things don't couple blindly. But ultimately I believe a good system is where trust is high.
      - cblconfederate 5y ago
        > that we trust each other enough to have a shared understanding of what value is No, hence why we need the state to print the money, regulate the markets, and put the bad guys in jail.
- kaczordon 5y ago
  This is how I feel about the exchanges generally, which wield an incredible amount of influence in the crypto markets, for better or worse. This isn’t really true as there’s a bunch of decentralized AMM’s(automated market maker) now: uniswap, sushiswap, pancakeswap
  - pjc50 5y ago
    How do you do an onchain swap for real money in a real bank?
  - verdverm 5y ago
    Word had it uniswap is prepping for KYC requirements. Sounds like there is still a centralized decision making element to the smart contracts that are what uniswap is at the core.
    - cinquemb 5y ago
      uniswap labs != open source uniswap (v1/v2) smart contracts and open source ui, both of which have been forked many times
    - kobasa 5y ago
      https://newsletter.banklesshq.com/p/unstoppable-liquidity-market-monday-8d6 https://newsletter.banklesshq.com/p/unstoppable-liquidity-ma...
- gruez 5y ago
  >I have yet to see a blockchain implementation that's easy enough to use on its own Bitcoin core is pretty easy to run yourself, no technical skills required.
  - cblconfederate 5y ago
    you d have to define 'pretty easy' and 'technical skills'
davidmurdoch 5y ago
Eehhhhhhhh, maybe true 2-3 years ago, but things are getting more decentralized as time goes on. There are many competitors to Infura and MetaMask coming into the space now! There are even hardware companies creating nodes that work right off the shelf (I only know if a handful of devs in the space that have one though, as they're still a bit pricey).
- littlestymaar 5y ago
  > maybe true 2-3 years ago, but things are getting more decentralized as time goes on That's a good indication that it is not decentralized ;).
- michaelsbradley 5y ago
  And there are active efforts to develop ultra-light clients for Ethereum together with the concept of “portal network”: https://our.status.im/nimbus-fluffly/ https://our.status.im/nimbus-fluffly/
- PragmaticPulp 5y ago
  Can you name any of these alternative companies? I’d like to at least look into them. One of the weirdest trends I’ve seen in Web3 discussions is the insistence that better alternatives exist, but for some reason nobody is using them, talking about them, or even naming them in discussions.
  - sebmellen 5y ago
    https://ava.do https://ava.do is one. Cool founders based in the Swiss “Crypto Valley”.
  - davidmurdoch 5y ago
    I work at ConsenSys so I am definitely not claiming the alternatives are better. https://moralis.io/ https://moralis.io/ and https://www.alchemy.com/ https://www.alchemy.com/ are Infura alternatives You can Google "metamask alternatives" if you want, there are lots. I won't vouch for any of them.
  - 5y ago
DennisP 5y ago
The name service is a smart contract. Even if one entity is hosting UI for it, anyone else can do the same. It's probably a good idea to build direct support for it into clients.
miracle2k 5y ago
> If you aren't willing to run your own geth instance and understand Solidity/EVM, it's not really decentralized for you. That's just overly reductive. You certainly benefit from all kinds of vectors of decentralisation regardless of you using MetaMask, or possibly having connectively problems if a popular nodes goes down. You can test this very simply, because regardless of the common node you are using, are still exposed to all the downsides and responsibilities that decentralisation brings, such as the possibility of losing your private key and being unable to recover your funds. So the decentralisation is still clearly there.
vmception 5y ago
2017 called Now there are lots of rpc providers and it is much easier to spin up your own node Check out erigon client it is an archive node with much lower resource requirements than geth archival nodes, about 1/10th the requirements and that gulf will likely expand pruned geth is still much lower than that though, but at least erigon gets rid of some of the state-storage centralization arguments (and lets inquisitive people browse prior chain states and simulate environments) anybody that wants their own privacy has much better ways to get it But Tails + TorBrowser + Metamask extension is also good enough if you want to hide info from Infura, analytics packages etc
- Animats 5y ago
  How do you know the RPC provider's node isn't logging your transactions or even executing a man-in-the-middle attack?
  - lgrapenthin 5y ago
    They can't do a man in the middle attack because the transaction is already signed with your private key and they don't have that.
  - vmception 5y ago
    Regarding logging, you don’t know but the node doesn’t know that it was the first node to receive a transaction. If you are communicating directly to the node. Infura, on the other hand, uses a load balancer so it receives transactions before they hit their nodes, which means that server can assume it was the first to receive. If you are operating on clearnet then you need your own node for privacy. A TorOS lets you do this on darknet just fine though, its some random onion or exit node IP.
deleted 5y ago
[deleted]
rauljordan2020 5y ago
Disclaimer: I work on Ethereum core development. One of the coolest things happening that will be available to everyone over the coming year is something called a light client, which is essentially a very light, validating node that tracks the head of the chain with certainty, and can be used as an alternative to services such as Unfura. In the future, Metamask will probably be a light client that actually tracks the head of the chain and can validate proofs of user account state. Source: https://github.com/ethereum/consensus-specs/blob/dev/specs/altair/sync-protocol.md https://github.com/ethereum/consensus-specs/blob/dev/specs/a...
- littlestymaar 5y ago
  > light client, which is essentially a very light, validating node that tracks the head of the chain with certainty How does that work?
  - kamray23 5y ago
    Skip over verifying everything and only verify a subset of all things you care about. Use alternative root nodes you trust instead of verifying. Stuff like that. They have a spec: https://eth.wiki/concepts/light-client-protocol https://eth.wiki/concepts/light-client-protocol
  - keymone 5y ago
    It works by surrendering any pretense of eth being a decentralized cryptocurrency and turning every node into a glorified and bloated transport/identity layer. If you’re not validating transactions - you’re trusting a third party. There are no light clients that avoid this problem. It remains to be seen if they are even possible.
  - rauljordan2020 5y ago
    Sorry it took me ages to clarify this. It's actually a pretty cool mechanism! What I mean by "tracking the head of the chain with certainty" means that you don't have any trust assumptions on the head block. If you track the latest head block, that means you can verify Merkle proofs of the chain state (as the state root is a field embedded in a block). This is neat because a light client, using low resource requirements, can tell verify a proof of some state data you present it. The way it works is that there is a committee of validators in the consensus protocol that is required to sign the head of the chain. We use cryptography known as BLS signatures to perform signature aggregation, meaning you can verify a single signature to ensure that whole committee is correct. The state of the chain can be represented as a Merkle trie, and we can obtain the actual committee as a branch of this tree which can be used during the verification process. https://medium.com/chainsafe-systems/lodestar-releases-light-client-prototype-40f300361c65 https://medium.com/chainsafe-systems/lodestar-releases-light... It's really neat and there are working prototypes out there today.
toddh 5y ago
And whomever owns the interpreter owns everything.

thr0wawayf00 5y ago

> If you aren't willing to run your own geth instance and understand Solidity/EVM, it's not really decentralized for you. This is how I feel about the exchanges generally, which wield an incredible amount of influence in the crypto markets, for better or worse. It's a complete tangent, but reading about Tether's shifting story around its capital reserves terrifies me. I have yet to see a blockchain implementation that's easy enough to use on its own that it could achieve widespread adoption without a strong market desire to have someone else manage the complexity of it for you. People talk about decentralization all day long while completely ignoring the fact that we've just shifted the centralized authority from one entity to another.

agumonkey 5y ago
That summarizes a lot. The system is not simple at all. The benefits are only potentially here (eth fees are wild). The solution involves the opposite of religious principles the mob believes in.
- fragmede 5y ago
  It's more than the mob believes it to be an ecumenical matter and you want it to be otherwise. If you want to participate, but aren't willing to trust someone else (which no one would blame you for), then your move is to run your own node. Like, that's the entire premise of blockchain technology - no one trusts each other - but no one has to!
  - thr0wawayf00 5y ago
    > no one trusts each other - but no one has to! Isn’t the whole point of a market that we trust each other enough to have a shared understanding of what value is? How can a market function when you trust no one else in it? Cash is a perfect example of this: it’s only worth something because we all agree that it’s worth something, we can’t eat it or do anything else with it other than to exchange it for goods. Crypto isn’t any different. It will be interesting how this holds up if Tether is actually just “printing” money as they go. If the rumors are true and they go bust or are shut down, one could easily see that event catalyzing a crypto market meltdown similar to what we saw in 2008 where speculation was out of control. Will the energy remain in the crypto space if the crypto markets fall victim to the very thing they were created to prevent?
    - couchand 5y ago
      > Will the energy remain in the crypto space if the crypto markets fall victim to the very thing they were created to prevent? Yes, because the energy in the cryptocurrency space is based not on rational analysis but religious fervor. The inconvenient objective facts will be explained away rather than addressed.
    - agumonkey 5y ago
      There are some philosophical question. Even trust need trustlessness at first. Things don't couple blindly. But ultimately I believe a good system is where trust is high.
    - cblconfederate 5y ago
      > that we trust each other enough to have a shared understanding of what value is No, hence why we need the state to print the money, regulate the markets, and put the bad guys in jail.
kaczordon 5y ago
This is how I feel about the exchanges generally, which wield an incredible amount of influence in the crypto markets, for better or worse. This isn’t really true as there’s a bunch of decentralized AMM’s(automated market maker) now: uniswap, sushiswap, pancakeswap
- pjc50 5y ago
  How do you do an onchain swap for real money in a real bank?
- verdverm 5y ago
  Word had it uniswap is prepping for KYC requirements. Sounds like there is still a centralized decision making element to the smart contracts that are what uniswap is at the core.
  - cinquemb 5y ago
    uniswap labs != open source uniswap (v1/v2) smart contracts and open source ui, both of which have been forked many times
  - kobasa 5y ago
    https://newsletter.banklesshq.com/p/unstoppable-liquidity-market-monday-8d6 https://newsletter.banklesshq.com/p/unstoppable-liquidity-ma...
gruez 5y ago
>I have yet to see a blockchain implementation that's easy enough to use on its own Bitcoin core is pretty easy to run yourself, no technical skills required.
- cblconfederate 5y ago
  you d have to define 'pretty easy' and 'technical skills'

davidmurdoch 5y ago

Eehhhhhhhh, maybe true 2-3 years ago, but things are getting more decentralized as time goes on. There are many competitors to Infura and MetaMask coming into the space now! There are even hardware companies creating nodes that work right off the shelf (I only know if a handful of devs in the space that have one though, as they're still a bit pricey).

littlestymaar 5y ago
> maybe true 2-3 years ago, but things are getting more decentralized as time goes on That's a good indication that it is not decentralized ;).
michaelsbradley 5y ago
And there are active efforts to develop ultra-light clients for Ethereum together with the concept of “portal network”: https://our.status.im/nimbus-fluffly/ https://our.status.im/nimbus-fluffly/
PragmaticPulp 5y ago
Can you name any of these alternative companies? I’d like to at least look into them. One of the weirdest trends I’ve seen in Web3 discussions is the insistence that better alternatives exist, but for some reason nobody is using them, talking about them, or even naming them in discussions.
- sebmellen 5y ago
  https://ava.do https://ava.do is one. Cool founders based in the Swiss “Crypto Valley”.
- davidmurdoch 5y ago
  I work at ConsenSys so I am definitely not claiming the alternatives are better. https://moralis.io/ https://moralis.io/ and https://www.alchemy.com/ https://www.alchemy.com/ are Infura alternatives You can Google "metamask alternatives" if you want, there are lots. I won't vouch for any of them.
- 5y ago

DennisP 5y ago

The name service is a smart contract. Even if one entity is hosting UI for it, anyone else can do the same. It's probably a good idea to build direct support for it into clients.

miracle2k 5y ago

> If you aren't willing to run your own geth instance and understand Solidity/EVM, it's not really decentralized for you. That's just overly reductive. You certainly benefit from all kinds of vectors of decentralisation regardless of you using MetaMask, or possibly having connectively problems if a popular nodes goes down. You can test this very simply, because regardless of the common node you are using, are still exposed to all the downsides and responsibilities that decentralisation brings, such as the possibility of losing your private key and being unable to recover your funds. So the decentralisation is still clearly there.

vmception 5y ago

2017 called Now there are lots of rpc providers and it is much easier to spin up your own node Check out erigon client it is an archive node with much lower resource requirements than geth archival nodes, about 1/10th the requirements and that gulf will likely expand pruned geth is still much lower than that though, but at least erigon gets rid of some of the state-storage centralization arguments (and lets inquisitive people browse prior chain states and simulate environments) anybody that wants their own privacy has much better ways to get it But Tails + TorBrowser + Metamask extension is also good enough if you want to hide info from Infura, analytics packages etc

Animats 5y ago
How do you know the RPC provider's node isn't logging your transactions or even executing a man-in-the-middle attack?
- lgrapenthin 5y ago
  They can't do a man in the middle attack because the transaction is already signed with your private key and they don't have that.
- vmception 5y ago
  Regarding logging, you don’t know but the node doesn’t know that it was the first node to receive a transaction. If you are communicating directly to the node. Infura, on the other hand, uses a load balancer so it receives transactions before they hit their nodes, which means that server can assume it was the first to receive. If you are operating on clearnet then you need your own node for privacy. A TorOS lets you do this on darknet just fine though, its some random onion or exit node IP.

deleted 5y ago

[deleted]

rauljordan2020 5y ago

Disclaimer: I work on Ethereum core development. One of the coolest things happening that will be available to everyone over the coming year is something called a light client, which is essentially a very light, validating node that tracks the head of the chain with certainty, and can be used as an alternative to services such as Unfura. In the future, Metamask will probably be a light client that actually tracks the head of the chain and can validate proofs of user account state. Source: https://github.com/ethereum/consensus-specs/blob/dev/specs/altair/sync-protocol.md https://github.com/ethereum/consensus-specs/blob/dev/specs/a...

littlestymaar 5y ago
> light client, which is essentially a very light, validating node that tracks the head of the chain with certainty How does that work?
- kamray23 5y ago
  Skip over verifying everything and only verify a subset of all things you care about. Use alternative root nodes you trust instead of verifying. Stuff like that. They have a spec: https://eth.wiki/concepts/light-client-protocol https://eth.wiki/concepts/light-client-protocol
- keymone 5y ago
  It works by surrendering any pretense of eth being a decentralized cryptocurrency and turning every node into a glorified and bloated transport/identity layer. If you’re not validating transactions - you’re trusting a third party. There are no light clients that avoid this problem. It remains to be seen if they are even possible.
- rauljordan2020 5y ago
  Sorry it took me ages to clarify this. It's actually a pretty cool mechanism! What I mean by "tracking the head of the chain with certainty" means that you don't have any trust assumptions on the head block. If you track the latest head block, that means you can verify Merkle proofs of the chain state (as the state root is a field embedded in a block). This is neat because a light client, using low resource requirements, can tell verify a proof of some state data you present it. The way it works is that there is a committee of validators in the consensus protocol that is required to sign the head of the chain. We use cryptography known as BLS signatures to perform signature aggregation, meaning you can verify a single signature to ensure that whole committee is correct. The state of the chain can be represented as a Merkle trie, and we can obtain the actual committee as a branch of this tree which can be used during the verification process. https://medium.com/chainsafe-systems/lodestar-releases-light-client-prototype-40f300361c65 https://medium.com/chainsafe-systems/lodestar-releases-light... It's really neat and there are working prototypes out there today.

toddh 5y ago

And whomever owns the interpreter owns everything.