4 ms·

I'm more and more convinced of an old idea that seems to become more relevant over time: to somehow form a network of trust between humans so that I know that y

by icoder 1y ago

I'm more and more convinced of an old idea that seems to become more relevant over time: to somehow form a network of trust between humans so that I know that your account is trusted by a person (you) that is trusted by a person (I don't know) [...] that is trusted by a person (that I do know) that is trusted by me. Lots of issues there to solve, privacy being one (the links don't have to be known to the users, but in a naive approach they are there on the server). Paths of distrust could be added as negative weight, so I can distrust people directly or indirectly (based on the accounts that they trust) and that lowers the trust value of the chain(s) that link me to them. Because it's a network, it can adjust itself to people trying to game the system, but it remains a question to how robust it will be.

XorNot 1y ago
I think technically this is the idea that GPG's web of trust was circling without quite staring at, which is the oddest thing about the protocol: it's used mostly today for machine authentication, which it's quite good at (i.e. deb repos)...but the tooling actually generally is oriented around verifying and trusting people.
- wobfan 1y ago
  Yeah exactly, this was exactly the idea behind that. Unfortunately, while on paper it just sounds like a sound idea, at least IMO, though ineffective, it has proven time and time again that the WOT idea in PGP has no chance against the laziness of humans.
littlestymaar 1y ago
Ultimately, guaranteeing common trust between citizens is a fundamental role of the State. For a mix of ideological reasons and lack of genuine interest for the internet from the legislators, mainly due to the generational factor I'd guess, it hasn't happened yet, but I expect government issued equivalent of IDs and passports for the internet to become mainstream sooner than later.
- eadmund 1y ago
  > Ultimately, guaranteeing common trust between citizens is a fundamental role of the State. I don’t think that really follows. Businesses credit bureaus and Dun & Bradstreet have been privately enabling trust between non-familiar parties for quite a long time. Various networks of merchants did the same in the Middle Ages.
  - littlestymaar 1y ago
    > Businesses credit bureaus and Dun & Bradstreet have been privately enabling trust between non-familiar parties for quite a long time. Under the supervision of the State (they are regulated and rely on the justice and police system to make things work). > Various networks of merchants did the same in the Middle Ages. They did, and because there was no State the amount of trust they could built was fairly limited compared to was has later been made possible by the development of modern states (the industrial revolution appearing in the UK has partly been attributed to the institutional framework that existed there early). Private actors can, and do, and have always done, build their own makeshift trust network, but building a society-wide trust network is a key pillar of what makes modern states “States” (and it directly derives from the “monopoly of violence”).
    - lormayna 1y ago
      Havala (https://it.m.wikipedia.org/wiki/Hawala https://it.m.wikipedia.org/wiki/Hawala) or other similar way to transfer money abroad are working over a net of trust, but without any state trust system.
      - littlestymaar 1y ago
        Compare its use to SWIFT and you'll see the difference.
- icoder 1y ago
  Interestingly, as I've begun to realise the ease by which a State's trust can sway has actually increased my believe that this should come from 'below'. I think a trust network between people (of different countries) can be much more resilient.
drcongo 1y ago
I actually built this once, a long time ago for a very bizarre social network project. I visualised it as a mesh where individuals were the points where the threads met, and as someone's trust level rose, it would pull up the trust levels of those directly connected, and to a lesser degree those connected to them - picture a trawler fishing net and lifting one of the points where the threads meet. Similarly, a user whose trust lowered over time would pull their connections down with them. Sadly I never got to see it at the scale it needed to become useful as the project's funding went sideways.
- icoder 1y ago
  Yeah building something like this is not a weekend project, getting enough traction for it to make sense is another orders of magnitude beyond that. I like the idea of one's trust to leverage that of those around them. This may make it more feasible to ask some 'effort' for the trust gain (as a means to discourage duplicate 'personas' for a single human), as that can ripple outward.
- all2 1y ago
  How would 'trust' manifest? A karma system? How are individuals in the network linked? Just comments on comments? Or something different?
  - drcongo 1y ago
    The system I built it for was invite only so the mesh was self-building, and yeah, there was a karma-like system that affected the trust levels, which in turn then gave users extra privileges such as more invites. Most of this was hidden from the users to make it slightly less exploitable, though if it had ever reached any kind of scale I'd imagine some users would work out ways to game it.
Philpax 1y ago
https://en.wikipedia.org/wiki/Key_signing_party https://en.wikipedia.org/wiki/Key_signing_party
- genewitch 1y ago
  Matrix protocol or at least the clients agree that several emoji is a key - which is fine - and you verify by looking at the keys (on each client) at the same time in person, ideally. I've only ever signed for people in person, and one remote attestation; but we had a separate verified private channel and attested the emoji that way.
- nickdothutton 1y ago
  Do these still happen? They were common (-ish, at least in my circles) in the 90s during the crypto wars, often at the end of conferences and events, but I haven't come across them in recent years.
im3w1l 1y ago
GPG lost, TLS won. Both are actually webs of trust with the same underlying technology. But they have different cultures and so different shapes. GPG culture is to trust your friends and have them trust their friends. With TLS culture you trust one entity (e.g. browser) that trusts a couple dozen entities that (root certificate authorities), that either signs keys directly or can fan out to intermediate authorities that then sign keys. The hierarchical structure has proven much more successful than the decentralized one. Frankly I don't trust my friends of friends of friends not to add thirst trap bots.
- lxgr 1y ago
  The difference is in both culture and topology. TLS (or more accurately, the set of browser-trusted X.509 root CAs) is extremely hierarchical and all-or-nothing. The PGP web of trust is non-hierarchical and decentralized (from an organizational point of view). That unfortunately makes it both more complex and less predictable, which I suppose is why it “lost” (not that it’s actually gone, but I personally have about one or maybe two trusted, non-expired keys left in my keyring).
- deleted 1y ago
  [deleted]
- kevin_thibedeau 1y ago
  The issue is key management. TLS doesn't usually require client keys. GPG requires all receivers to have a key.
- amenghra 1y ago
  Couple dozen => it’s actually 50-ish, with a mix of private and government entities located all over the world. The fact that the Spanish mint can mint (pun!) certificates for any domain is unfortunate. Hopefully, any abuse would be noticed quickly and rights revoked. It would maybe have made more sense for each country’s TLD to have one or more associated CA (with the ability to delegate trust among friendly countries if desired). https://wiki.mozilla.org/CA/Included_Certificates https://wiki.mozilla.org/CA/Included_Certificates
SuperShibe 1y ago
I think this ideas problem might be the people part, specifically the majority type of people that will click absolutely anything for a free iPad
- icoder 1y ago
  Theoretically that should swiftly be reflected in their trust level. But maybe I'm too optimistic. I have nothing intrinsically against people that 'will click absolutely anything for a free iPad' but I wouldn't mind removing them from my online interactions if that also removes bots, trolls, spamners and propaganda.
haswell 1y ago
I’ve also been thinking about this quite a bit lately. I also want something like this for a lightweight social media experience. I’ve been off of the big platforms for years now, but really want a way to share life updates and photos with a group of trusted friends and family. The more hostile the platforms become, the more viable I think something like this will become, because more and more people are frustrated and willing to put in some work to regain some control of their online experience.
- jeremyjh 1y ago
  The key is to completely disconnect all ad revenue. I'm skeptical people are willing to put in some money to regain control; not in the kind of percentages that means I can move most of my social graph. Network effects are a real issue.
- TheOtherHobbes 1y ago
  They're different application types - friends + family relationship reinforcement, social commenting (which itself varies across various dimensions, from highlighting usefulness to unapologetically mindless entertainment), social content sharing and distribution (interest group, not necessarily personal, not specifically for profit), social marketing (buy my stuff), and political influence/opinion management. Meta and X have glommed them all together and made them unworkable with opaque algorithmic control, to the detriment of all of them. And then you have all of them colonised by ad tech, which distorts their operation.
marcusb 1y ago
Isn't this vaguely how the invite system at Lobsters functions? There's a public invite tree, and users risk their reputation (and posting access) when they invite new users.
- withinboredom 1y ago
  I know exactly zero people over there. I am also not about to go brown nose my way into it via IRC (or whatever chat they are using these days). I'd love to join, someday.
- somethingsome 1y ago
  Hey I never actually tried lobsters, do you mind if I ask an invite?
brongondwana 1y ago
Also there's the problem that every human has to have perfect opsec or you get the problem we have now, where there are massive botnets out there of compromised home computers.

by icoder 1y ago

XorNot 1y ago

I think technically this is the idea that GPG's web of trust was circling without quite staring at, which is the oddest thing about the protocol: it's used mostly today for machine authentication, which it's quite good at (i.e. deb repos)...but the tooling actually generally is oriented around verifying and trusting people.

wobfan 1y ago
Yeah exactly, this was exactly the idea behind that. Unfortunately, while on paper it just sounds like a sound idea, at least IMO, though ineffective, it has proven time and time again that the WOT idea in PGP has no chance against the laziness of humans.

littlestymaar 1y ago

Ultimately, guaranteeing common trust between citizens is a fundamental role of the State. For a mix of ideological reasons and lack of genuine interest for the internet from the legislators, mainly due to the generational factor I'd guess, it hasn't happened yet, but I expect government issued equivalent of IDs and passports for the internet to become mainstream sooner than later.

eadmund 1y ago
> Ultimately, guaranteeing common trust between citizens is a fundamental role of the State. I don’t think that really follows. Businesses credit bureaus and Dun & Bradstreet have been privately enabling trust between non-familiar parties for quite a long time. Various networks of merchants did the same in the Middle Ages.
- littlestymaar 1y ago
  > Businesses credit bureaus and Dun & Bradstreet have been privately enabling trust between non-familiar parties for quite a long time. Under the supervision of the State (they are regulated and rely on the justice and police system to make things work). > Various networks of merchants did the same in the Middle Ages. They did, and because there was no State the amount of trust they could built was fairly limited compared to was has later been made possible by the development of modern states (the industrial revolution appearing in the UK has partly been attributed to the institutional framework that existed there early). Private actors can, and do, and have always done, build their own makeshift trust network, but building a society-wide trust network is a key pillar of what makes modern states “States” (and it directly derives from the “monopoly of violence”).
  - lormayna 1y ago
    Havala (https://it.m.wikipedia.org/wiki/Hawala https://it.m.wikipedia.org/wiki/Hawala) or other similar way to transfer money abroad are working over a net of trust, but without any state trust system.
    - littlestymaar 1y ago
      Compare its use to SWIFT and you'll see the difference.
icoder 1y ago
Interestingly, as I've begun to realise the ease by which a State's trust can sway has actually increased my believe that this should come from 'below'. I think a trust network between people (of different countries) can be much more resilient.

drcongo 1y ago

I actually built this once, a long time ago for a very bizarre social network project. I visualised it as a mesh where individuals were the points where the threads met, and as someone's trust level rose, it would pull up the trust levels of those directly connected, and to a lesser degree those connected to them - picture a trawler fishing net and lifting one of the points where the threads meet. Similarly, a user whose trust lowered over time would pull their connections down with them. Sadly I never got to see it at the scale it needed to become useful as the project's funding went sideways.

icoder 1y ago
Yeah building something like this is not a weekend project, getting enough traction for it to make sense is another orders of magnitude beyond that. I like the idea of one's trust to leverage that of those around them. This may make it more feasible to ask some 'effort' for the trust gain (as a means to discourage duplicate 'personas' for a single human), as that can ripple outward.
all2 1y ago
How would 'trust' manifest? A karma system? How are individuals in the network linked? Just comments on comments? Or something different?
- drcongo 1y ago
  The system I built it for was invite only so the mesh was self-building, and yeah, there was a karma-like system that affected the trust levels, which in turn then gave users extra privileges such as more invites. Most of this was hidden from the users to make it slightly less exploitable, though if it had ever reached any kind of scale I'd imagine some users would work out ways to game it.

Philpax 1y ago

https://en.wikipedia.org/wiki/Key_signing_party https://en.wikipedia.org/wiki/Key_signing_party

genewitch 1y ago
Matrix protocol or at least the clients agree that several emoji is a key - which is fine - and you verify by looking at the keys (on each client) at the same time in person, ideally. I've only ever signed for people in person, and one remote attestation; but we had a separate verified private channel and attested the emoji that way.
nickdothutton 1y ago
Do these still happen? They were common (-ish, at least in my circles) in the 90s during the crypto wars, often at the end of conferences and events, but I haven't come across them in recent years.

im3w1l 1y ago

GPG lost, TLS won. Both are actually webs of trust with the same underlying technology. But they have different cultures and so different shapes. GPG culture is to trust your friends and have them trust their friends. With TLS culture you trust one entity (e.g. browser) that trusts a couple dozen entities that (root certificate authorities), that either signs keys directly or can fan out to intermediate authorities that then sign keys. The hierarchical structure has proven much more successful than the decentralized one. Frankly I don't trust my friends of friends of friends not to add thirst trap bots.

lxgr 1y ago
The difference is in both culture and topology. TLS (or more accurately, the set of browser-trusted X.509 root CAs) is extremely hierarchical and all-or-nothing. The PGP web of trust is non-hierarchical and decentralized (from an organizational point of view). That unfortunately makes it both more complex and less predictable, which I suppose is why it “lost” (not that it’s actually gone, but I personally have about one or maybe two trusted, non-expired keys left in my keyring).
deleted 1y ago
[deleted]
kevin_thibedeau 1y ago
The issue is key management. TLS doesn't usually require client keys. GPG requires all receivers to have a key.
amenghra 1y ago
Couple dozen => it’s actually 50-ish, with a mix of private and government entities located all over the world. The fact that the Spanish mint can mint (pun!) certificates for any domain is unfortunate. Hopefully, any abuse would be noticed quickly and rights revoked. It would maybe have made more sense for each country’s TLD to have one or more associated CA (with the ability to delegate trust among friendly countries if desired). https://wiki.mozilla.org/CA/Included_Certificates https://wiki.mozilla.org/CA/Included_Certificates

SuperShibe 1y ago

I think this ideas problem might be the people part, specifically the majority type of people that will click absolutely anything for a free iPad

icoder 1y ago
Theoretically that should swiftly be reflected in their trust level. But maybe I'm too optimistic. I have nothing intrinsically against people that 'will click absolutely anything for a free iPad' but I wouldn't mind removing them from my online interactions if that also removes bots, trolls, spamners and propaganda.

haswell 1y ago

I’ve also been thinking about this quite a bit lately. I also want something like this for a lightweight social media experience. I’ve been off of the big platforms for years now, but really want a way to share life updates and photos with a group of trusted friends and family. The more hostile the platforms become, the more viable I think something like this will become, because more and more people are frustrated and willing to put in some work to regain some control of their online experience.

jeremyjh 1y ago
The key is to completely disconnect all ad revenue. I'm skeptical people are willing to put in some money to regain control; not in the kind of percentages that means I can move most of my social graph. Network effects are a real issue.
TheOtherHobbes 1y ago
They're different application types - friends + family relationship reinforcement, social commenting (which itself varies across various dimensions, from highlighting usefulness to unapologetically mindless entertainment), social content sharing and distribution (interest group, not necessarily personal, not specifically for profit), social marketing (buy my stuff), and political influence/opinion management. Meta and X have glommed them all together and made them unworkable with opaque algorithmic control, to the detriment of all of them. And then you have all of them colonised by ad tech, which distorts their operation.

marcusb 1y ago

Isn't this vaguely how the invite system at Lobsters functions? There's a public invite tree, and users risk their reputation (and posting access) when they invite new users.

withinboredom 1y ago
I know exactly zero people over there. I am also not about to go brown nose my way into it via IRC (or whatever chat they are using these days). I'd love to join, someday.
somethingsome 1y ago
Hey I never actually tried lobsters, do you mind if I ask an invite?

brongondwana 1y ago

Also there's the problem that every human has to have perfect opsec or you get the problem we have now, where there are massive botnets out there of compromised home computers.