6 ms·

GnuPG/PGP and the web of trust[0]. A lot of things I see blockchain being used for today (e.g. NFTs) seems like it would be better solved using standard OpenPGP

GnuPG/PGP and the web of trust[0]. A lot of things I see blockchain being used for today (e.g. NFTs) seems like it would be better solved using standard OpenPGP signatures with no backing chain. Additionally, as machine-generated content proliferates, I think having services use something like the web of trust concept for membership would be super powerful. The problem is, of course, the terrible UX of cryptographic signatures. But I think there's a lot of opportunity for the group that makes it easy to use. [0]: https://en.wikipedia.org/wiki/Web_of_trust https://en.wikipedia.org/wiki/Web_of_trust

staticBr 3y ago
Well thank you! I think that so often ...
klntsky 3y ago
> seems like it would be better solved using standard OpenPGP signatures with no backing chain. Programmability though
- cvdub 3y ago
  Can you elaborate?
  - klntsky 3y ago
    There would be no automated consensus over results of execution of programs that power the applications
    - 6510 3y ago
      Just curious, which would be most reliable? One entity confirms it who confirmed 1000 previous results, 2 who confirmed 500, 10 who confirmed 100 or 1000 who confirmed 1 previously?
      - DennisP 3y ago
        How about the actual case: many thousands of entities, who confirmed hundreds of thousands of previous results?
        6510 3y ago
        Would many thousands of entities, who confirmed hundreds of thousands of previous results be preferable over hundreds of thousands of entities, who confirmed many thousands of previous results?
        DennisP 3y ago
        I think I'm pretty much ok with either one.
        6510 3y ago
        How few executions (or partial?) could one get away with?
radicalbyte 3y ago
Take a look at KERI.
notpushkin 3y ago
There's a problem though: either you have to ban transferring NFTs (or other tokens), which makes those a lot less useful, or you need something to prevent double spend attacks (something that blockchain solves).
nunez 3y ago
GPG is great. It also makes it really easy to encrypt environment dotfiles that safely reside in your source code repository. This is my favorite way of storing sensitive app configs. You don't even need a PGP private key in your keychain to do it. You can use a passphrase.
- nemoniac 3y ago
  This sounds interesting. Have you got an example of how you do this by any chance?
- mstibbard 3y ago
  I’d really like to hear more about this
ssivark 3y ago
As a follow-up to the web of trust, I was pretty excited about Keybase and the breadth of applications they enabled, with a slick UX for web-of-trust. Pity they didn't quite succeed (got acqired/acquihired by Zoom), but it would be wonderful if something like that got another life.

staticBr 3y ago

Well thank you! I think that so often ...

klntsky 3y ago

> seems like it would be better solved using standard OpenPGP signatures with no backing chain. Programmability though

cvdub 3y ago
Can you elaborate?
- klntsky 3y ago
  There would be no automated consensus over results of execution of programs that power the applications
  - 6510 3y ago
    Just curious, which would be most reliable? One entity confirms it who confirmed 1000 previous results, 2 who confirmed 500, 10 who confirmed 100 or 1000 who confirmed 1 previously?
    - DennisP 3y ago
      How about the actual case: many thousands of entities, who confirmed hundreds of thousands of previous results?
      - 6510 3y ago
        Would many thousands of entities, who confirmed hundreds of thousands of previous results be preferable over hundreds of thousands of entities, who confirmed many thousands of previous results?
        DennisP 3y ago
        I think I'm pretty much ok with either one.
        6510 3y ago
        How few executions (or partial?) could one get away with?

radicalbyte 3y ago

Take a look at KERI.

notpushkin 3y ago

There's a problem though: either you have to ban transferring NFTs (or other tokens), which makes those a lot less useful, or you need something to prevent double spend attacks (something that blockchain solves).

nunez 3y ago

GPG is great. It also makes it really easy to encrypt environment dotfiles that safely reside in your source code repository. This is my favorite way of storing sensitive app configs. You don't even need a PGP private key in your keychain to do it. You can use a passphrase.

nemoniac 3y ago
This sounds interesting. Have you got an example of how you do this by any chance?
mstibbard 3y ago
I’d really like to hear more about this

ssivark 3y ago

As a follow-up to the web of trust, I was pretty excited about Keybase and the breadth of applications they enabled, with a slick UX for web-of-trust. Pity they didn't quite succeed (got acqired/acquihired by Zoom), but it would be wonderful if something like that got another life.