Hacker News Reader

Comment by damoonvisuals | Hacker News Reader

Hi Sam,

How do you intend to prevent sybil attacks on seller ratings? Since there are no account sign ups and subsequent verifications, it would be theoretically possible to create a large number of accounts with fake reviews.

View on HN

The honest answer is that we haven't solved the decentralized reputation problem and reviews can't entirely be trusted.

There are a few factors that still make reviews somewhat useful though. People can choose to attach their name, and if they are reputable then their review matters more than an anon account. Reviews also can only be left when there is a full record of trade having occurred, and funds have moved (verified on the blockchain), so at the very least an attacker is paying cryptocurrency fees for each false rating.

But ultimately there's a lot of work to be done in decentralized reputation. The work of projects like Trust is Risk seems promising (we've supported their efforts):

https://github.com/OrfeasLitos/TrustIsRisk

Why isn't a basic version of proof of work a reasonable approximation of that for the time being? Ex. to provide a review you must also provide a value that when postpended to your review gives a hash containing some properties that scales with the number of reviews. This doesn't solve decentralized reputation at all but does prevent review bombing.

If the buyer leaves a review after making a purchase, that's effectively a small proof of work in and of itself, and you can only leave one review per purchase.

We haven't seen review bombing attempted yet, but if someone were willing to pay a bunch of fees then I suppose it is possible to do.

In book publishing an author can purchase copies of their own books in order to increase purchases by others. This effect is actually common in many industries, even in mobile apps :)

And definitely in the record industry

So OpenBazaar's no worse than preexisting systems in this respect.

It's also borderline an unsolvable problem, because how do you identify "legitimate" customers in an anonymous de-centralized system, when it's even too complicated to achieve in a centralized system?

Assign a cost of creating a single anonymous identity: you've got to send xx amount of bitcoin to an unspendable address.

That is somewhat analogous to proof of stake, I guess?

There is a dichotomy in real cost/benefit ratio for PoW systems as spam control between real users and attackers. Attackers have more to gain from accepting the PoW penalty than users do. There is no difficulty of PoW that would both deter attackers with a financial motive and be reasonable for average users.

>gives a hash containing some properties that scales with the number of reviews

That woudl IMO mean that once you have 10k reviews you can scam some customers without worry.

What?

A spammer could easly bypass that with capital/hardware.

Anybody can do anything with enough capital and hardware :-)

The question is always just "Will the cost of fraud exceed the benefits of fraud" and if that is true, no one in his right mind will do it.

Is there a check that the price in the transaction is (greater or) equal to the price of the product?

Or, can I pay for a product from multiple addresses and leave many reviews?

Edit: typos

The buyer can only leave one review per purchase, it's not one review per payment.

What is the logical distinction between purchase and payment? How does one know the differences when the transactions are anonymous?

Each step in the transaction flow appends a new step - digitally signed - into a JSON document that acts as a ledger. So the seller puts out the listing and the buyers signs it and sends the funds. The seller won't proceed with the order until the payment is made in full, so the ledger doesn't get any new information until then. The final step (the review) is the last addition to the ledger.

It's based on the concept of the Ricardian Contract by Ian Grigg, adapted to become a ledger. This allows trade to continue asynchronously.

Every purchase goes to a unique address. Multiple payments can be made to that address but they constitute a single purchase.

Is anonymity only related to identity, and which parties are involved in a transaction?

Could there be a way to leave identity and parties involved anonymous, yet track count and/or value of transactions without knowing what they were?

If this were possible, some weighting could be assigned to reviews based on count and/or value of transactions, to somewhat combat a review bomber willing to pay for many small transactions. In a sense it would raise the cost of a fake review campaign.

I bet if you gave users the option to have only count and value of their transactions public, in exchange for some sort of “trusted reviewer” status badge, that a significant number would opt in to it, because people like to earn badges and points for reasons more motivating that we intuitively think.

edit: better yet, allow opt in to have your transaction count and value incrementee on a per transaction basis, so you could earn reputation power or not depending on the marketplace or persons dealt with.

side note: I think the “free sub” episode on Seinfeld may have been the first reference to gamification mechanics on television.

Reply on news.ycombinator.com