Hacker News Reader

If anybody can enter and add entries to your blockchain, how do you ensure that they don't insert bogus data? If you're tracing a roll of paper what prevents somebody from adding an entry saying "the shipment got stolen" then immediately making a new entry for it with different attributes pretending it's something else? Or simply at the source pretending that something is of a higher quality than it is?

The answer is that you need some kind of vetting and certification of the people contributing to your traceability database. So you need a trusted 3rd party to coordinate all that. So you don't need a blockchain. Instead why not just have the trusted 3rd party issue certificates like a CA on the web for instance? People would digitally sign the paperwork and you could collect the documents and their signatures in a central database. If somebody notices something wrong you can show that somebody made a fake or erroneous document and hold them responsible. Then you can publish dump of the database at regular intervals for people to mirror so that they can see if you attempt to rewrite history. There, problem solved using good old 1990's technology.

>very bullish !

Interesting that you finish your technical argument with trading lingo. Hodl, am I right?

This is generally my main source of skepticism relating to blockchain solutions. The ledger is 100% trustable as long as it describes digital assets that are entirely confined within the distributed ledger, but a digital token doesn't stop men with guns from taking your house. Just like a digital signature provides no guarantees that the associated information is true.

No but it certifies who has entered the info, right? That might be part of the solution here

Maybe it just certifies a "company" headquartered in an empty office in some commercial park entered the info.

And how do you know that's the actual person, or that such a person/entity exists?

Isn't that EXACTLY the problem solved by cryptography, ie I can reliably know that only supplier X could have signed the message with the public key of supplier X ?

It depends on the security of supplier X's private keys. I think there's a general conflation of the security of the cryptography with the security of the system overall.

Cryptography lets you make signatures that can't be falsified by anybody not having your key but that's it. It doesn't mean much if you have no way to know who is actually behind the signature.

I could generate a PGP key for Bill Gates right now, distribute it to the keyservers and sign a message saying that "I owe simias on hacker news one billion dollars". You could verify that the message was signed by my key beyond a doubt but so what?

Bitcoin doesn't have this problem thanks to PoW, when a miner submits a newly mined block the network doesn't need to check the miner's credentials, the block itself proves (statistically) that the miner did a certain amount of work to come up with the block. That's all that matters and the coins/fees are credited to the miner's address. That works because all the data necessary to create the consensus are available "objectively" on the blockchain for all to see. It doesn't matter if the miner pretends to be Abraham Lincoln, that's not what the blockchain works with.

Most problems don't have these properties, if I tell the blockchain "I have a brand new PS4 and I'm going to send it to X in exchange for n bitcoins" the blockchain has no objective way to track this transaction.

I know that, but I don't understand why it is seen as such a roadblock. A supplier would add its tag on thousands of parts each day, which would find their way into thousands of products and thousands of end-consumers each day. The suppliers would be well identified by their physical location and the physical products they produce.

I think people raising these objections have not worked in a physical supply chain in the floor plant? I don't know, I have a difficulty to wrap my head around the objection. I am receiving a truckload of parts that I ordered - these parts have a barcode or a RFID identifier that tracks their provenance - the only change in the system would be that when I acknowledge the reception of the truckload, another block is appened to the blockchain-based history of the parts : Supplier + me the manufacturer. And so on across the supply chain.

I don't understand, are we talking about a scenario where a rogue actor would send me for fere a truckload of parts I have not ordered or something like that ?

More like a rogue actor sending you a truckload of parts that are not what they're supposed to be.

Take for instance the blockchain De Beers (the diamond cartel) says it wants to create to track diamonds. Things like country of origin, quality etc... Tracking diamonds is especially important because you want to make sure that the diamonds you buy are not from a conflict zone, the so-called "blood diamonds".

Now imagine that you have a completely trustless bitcoin-like blockchain to track this. What prevents an African warlord from pretending to be Canadian and create fake entries for its diamonds into the blockchain pretending that they were mined in America? Then he can trade them without issue. The blockchain is unable to detect that a user hasn't the right nationality, nor can it track the physical origin and location of a diamond without having to trust somebody to tell it. Ergo your trustless blockchain is no more valuable than a random file on pastebin.com.

To solve this issue you'd need some trusted certification authority that would audit miners and grant them access to the blockchain once they've asserted that they are who they pretend to be. But if you do this then you have a trusted 3rd party and the blockchain can advantageously be replaced by any regular database of your choice managed by this 3rd party.

You can apply this reasoning to any physical good, from organic produce (how do you make sure that the producer isn't lying about making organic oranges?) to paper rolls (how do you know the producer isn't lying about using sustainable foresting techniques?). You need trusted third parties certifying and controlling these things to weed out cheaters.

would the 3rd-party database be natively open to 4rth party apps, like an open API ? Given that no third-party actor has offered a tracability solution from source to consumer (the only one that comes to my mind is the beef tracability in Europe following mad cow disease, very paper intensive), what has changed that makes you think the industry can pull it?

I have worked on factory floors before but honestly I don't see how it's relevant. Toyota and similarly competent manufacturers are are perfectly capable of using centralized databases to track the motion of parts around extremely convoluted manufacturing plants. Blockchain primarily solves the double-spend problem of a distributed spreadsheet. So some supplier can't claim to have sent the same parts to two factories on some spreadsheet. That's solving a non-problem. I expect blockchain to have a massive impact on industries primarily concerned with abstract ledgers (finance), but I have serious doubts about the utility of the technology when applied to problems involving meatspace. I would be happy to be proven wrong.

What if someone else gets their hands on supplier X's keys?

I've thought about this some and one way to at least "sort of" map a private key to a single trusted real-world individual/entity is to require it always keep a balance of some "high" amount on it to be considered valid. So three banks start out signing some new "blockchain" ledger with their private keys, each with $100M on it, and they probably are going to be really careful with those keys from then on, and not let anybody who doesn't really represent the entity sign things with them?

I think this is the idea behind proof-of-stake. I don't see how it mitigates the fact that while the cryptography may be secure, the humans handling the keys are less so.

And how do I know that person actually exists? How would I track them down if they lied?

Why does this need to be a public blockchain? Just make it a permissioned industry chain with access from each of its members. Someone lied, well they signed it, go talk to them, you have immutable proof now. Or smart contract style, someone lied? Send the items back and escrow won't release your money as proof of return it could be signed by the courier and the original sender.

And how is any of that different than the way things work now?

Because you have sent them a purchase order and they have sent you a truckload of parts that you ordered? I'm sorry I don't understand the objection here

Is that part of the problem?

Haha no I initially purchased all the tokens in supply-chain related fields, but I sold them a while ago at a loss. It doesn't matter - I still think these projects are very relevant for the future.

I do not have the answers to your objections. I was replying to the common theme of "this is a solution is search for a problem". I am stating that there is a problem in search for a solution

Hehe. Thats actually a nice artifact, thanks bitcoin. Now individuals can consider the potential of ideas to pan out and participate in funding them. Sure, sounds good -- I'll throw in 1,000$. Suddenly 1,000 like-minded individuals can satisfy the need of projects. Of course thats not always so popular here ;-). I should just mind my own business and focus on the coding right?

Anyhow. I do think you are right. The integrity of the data has to be questioned. But I question why we have to assume that its useless just because it cannot be trusted? This paper trail is immutable. That is valuable. Future evidence can expose prior lies. Once you know that you have to maintain a lie for life, suddenly you are questioning if its really worth making.

" Now individuals can consider the potential of ideas to pan out and participate in funding them. Sure, sounds good -- I'll throw in 1,000$. Suddenly 1,000 like-minded individuals can satisfy the need of projects."

You mean Kickstarter, which has nothing to do with blockchain?

"Anyhow. I do think you are right. The integrity of the data has to be questioned. But I question why we have to assume that its useless just because it cannot be trusted? This paper trail is immutable. That is valuable. Future evidence can expose prior lies. Once you know that you have to maintain a lie for life, suddenly you are questioning if its really worth making."

Says who? Both Bitcoin and Etherium have gone through forks of their chains.

>You mean Kickstarter, which has nothing to do with blockchain?

Blockchain is having all of the functionality (and more) of Kickstarter with 10-20x more reach. Also, explain how you would use kickstarter to crowd-fund a gold-backed digital currency without Blockchain?

>Says who? Both Bitcoin and Etherium have gone through forks of their chains

The whole point if a Blockchain is you can tell if it's been forked, and really forks are just the exception proving the rule of immutability. Meaningful forks have happened a handful of times and they've been heavily publicized. How many times has a bank issued a chargeback?

> This paper trail is immutable. That is valuable.

It is only valuable on the blockchain if its cost to maintain is less than, say, a mid-sized country worth of electricity.

Who will be the miners required for this blockchain? Who will pay for the mining? Who will ensure there is no 51% attack on the blockchain?

You an achieve the same results from writing things to a git repo and publishing it. Any edits on previous commits would result in the entire repo being changed. Publish it to the world, push every commit hash on twitter/RSS/Email. Done.

Or just use a merkle hash tree like CT logs do: https://en.wikipedia.org/wiki/Certificate_Transparency#Certi...

A merkle hash tree is what all of those (Git, Bitcoin and CT) use. BT just made it distributed.

Funnily enough, CT was devised around four years after bitcoin and mentions it in their introduction article: https://queue.acm.org/detail.cfm?id=2668154

Thanks for the link. Was looking for something like this, but couldn't find it.

Immutability is easy to achieve. Anything distributed widely enough is effectively immutable. Anything published on the cover of Time magazine is immutable. Anything commited to the linux kernel is immutable. Anything distributed on thepiratebay is immutable. Anything put in the Ubuntu package repository is immutable.

You can amend it and publish new versions but you can be sure that somebody somewhere will have a copy. You want to make your paper trail immutable? Sign it and publish it widely using any medium you want. Burn it on CDs and mail them to random addresses. Tie them to balloons and release them.

Man trusting paper more at this point is the most backward thing I've heard. You really want us to keep using paper for all contracts, needing to be on site to sign documents, sending documents through fax, making physical backups... when all of it can be done digitally?

What you've described is provenance I believe. And that is the only, imho, use case for blockchain that makes any sense.

It's the only one where the substantial additional overhead and complexity of blockchain is actually still less than the alternative, as your example clearly illustrates.

To attempt to answer a question from sibling comments: these systems are private or closed blockchains, not public. You have a traditional credentials database (the blockchain itself could also be used for this, but that won't usually have inherent benefits) to track who is allowed access to read or submit transactions. Those parties may run a node or you may have one independent third party run all the nodes. It's so different from cryptocurrency setup that it's hard to apply too much of the stuff we've learned from Bitcoin et al to these setups.

At least that's my understanding.

I feel like a private/closed blockchain would defeat the purpose. I want a future where a public blockchain would act a repository of everything that has happened to the final product throughout its history, on top of which applications would be developped, relevant for each step of the chain. The producer A that would input certification of origin, the manufacturer B, and the end consumer C would need very different services, web, app, industrial applications, ERP integrations and so on.

To express it in an analogy with current services, I would like the blockchain to be a database, exposing a universal API. I don't really see a private blockchain allowing this, but I may be wrong. And indeed there will be the thorny authentication issue... I don't know the solution, really !

So why use a blockchain instead of a regular database?

If we imagine the best-case scenario, where all actors are handling their keys with care, and a system works to somehow produce an immutable, always consistent log of all actions, I still don't see how this will be usable for most products. You basically also need an immutable link between the physical product and some kind of cryptographically provable ID in this magic log.

When receiving an item you want to check the provenance of, you need some way to securely identify the product in the log. Otherwise some bad actor along the way could unlink the actual product from the ID in the log, for example by duplicating and stealing a known-good ID, yielding all the provenance information useless.

I guess this could work for electronic products where you could deeply embed something like a TPM that could provide this ID securely (which would be to expensive to extract to make it worth duplicating), but for something like a shipment of steel or even worse coal/oil/grain etc, I don't see how this would work.

A simple SIM card or smart card is a suitable TPM for this, and can be obtained for pennies on the dollar.

The poster's point is that the link between that and the actual object of value is a huge weak point. Let's use expensive art as an example since it's such a commonly cited use case. Blockchain says I own an original Picasso painting. You pay me 1 BTC in exchange for me transferring ownership of the painting to you: blockchain says the painting is now yours, _and_ I have to ship you the physical painting so you can hang it in your house / art gallery / whatever rich people do with art.

The problem is, how do you know I didn't ship you a fake replica and keep the original for myself, sell it to someone else on the sly, etc.? Sure, you could have a TPM which securely holds some data linking the physical smart card to the blockchain provenance record... but what links the physical smart card to the physical painting? Couldn't I just give you the fake painting + real smart card?

You could get an art expert to authenticate the physical painting, of course -- but that's exactly the same reliance on a trusted third party that art collectors have today, and blockchain has done nothing to improve the situation...

I agree, that's the issue. I suppose it will depend on the application need, and the criticality.

If you need to prove that life-saving drugs have been kept at the correct temperature throughout their shelf-life, you can probably afford a RFID tag per pack, with a unique ID.

On the other end of the spectrum, if you are talking about low-criticality tracability of shipments of bulk materials, you can probably admit supplier-defined batch numbers. You could imagine that a rogue manufacturer would try to cheat and re-use a batch number from a "premium" raw material while using a cheaper one. Blockchain would not provide a protection against false declaration, it would on the other end provide an immutable papertrail in case of later legal investigation / certification audit (ie "you purchased X premium parts and Y inferior parts, but you logged using X+Y premium parts, how do you explain that?")

wouldn't a simple system of signatures certified by a certificate authority (like for the web) solve this problem in a much more direct way?

What's to keep a party from chucking out a signed document that they don't like?

The check is a positive one for presence. Items which aren't tagged are untrusted.

If they throw out a signature they don't like, the system works perfectly fine - it's treated like any other untrusted product.

No one should trust a system that has a "don't trust this, it's bad" flag, it should always be "trust this, it's clean".

> What's to keep a party from chucking out a signed document that they don't like?

Courts. Laws. Governments.

I have read somewhere else a very interesting way to look at token projects. There are merely incentive for protocols that could have been baked into our browser.

For example, we could have had an identity verification protocol, bound to our browsers, that would have logged us in websites. We would not have needed FB oauth for ex. But it was not prioritized, and now that the Web has been taken over by closed garden, individual companies have very little incentive to contribute to these general-benefits protocols.

Token can be seen a way to incentivize adoption of these general-benefits protocols

> usable by any actor of the chain

Do you really want an immutable ledger for that? Fat fingers and data entry errors can happen.

I don't know. What about Git ? Errors happen, then you correct them, but you can see the error and its correction, and it's considered quite healthy, right?

I can go back and rewrite history pretty easily in Git.

my answer was not about discussing Git. I was saying that it seems healthy to have a system that tracks errors and corrections

You might want to look into VeChain then, which is a blockchain platform aimed at solving that exact problem, and is already being used by large customers such as DVG NL and China Tobacco. Jim Breyer and DFJ are both strong backers.

https://medium.com/@jimbreyer/announcing-our-vechain-advisor...

https://www.vechain.org/

no need to shill here. I don't know which projects will end up successful, I am however convinced that some of them will be

I feel like shilling contains a lot of negative connotation. Most people still don't know that there are existing coins aiming to solve this exact issue. Some other coins are Ambrosus and WaltonChain. There are a few others that I can't recall on top of my head. So it seems like there are people out there that have recognized this specific use case and started capitalizing it.