Comment by simias | Hacker News Reader

Comment by simias | Hacker News Reader

Parent Full thread

>This specific instance grants assurance that neither Walmart or anyone in-between is tampering with the database.

We've had this discussion a billion times before on HN so I'll avoid a huge wall of text but it always boils down to the same conclusion: blockchains (as in bitcoin) are about being completely decentralized and trustless. It's an "and" not an "or", if you remove one of these imperatives they're completely pointless. Detecting tampering can be achieved trivially using public key cryptography and a good hash function.

So you're either saying that what IBM is doing is not a true blockchain or you're fine with anybody using PGP and sha256sum labeling their product as a blockchain. In the latter case it means that bittorent, linux package managers and Windows Updates qualify as "blockchains".

At any rate this is obviously a huge marketing ploy to get free advertising, like "web 2.0" or "cloud computing" before. The problem here is that pumping the "blockchain technology" also means pumping the entire ecosystem of cryptocurrencies which is 90% scams at this point.

“you're fine with anybody using PGP and sha256sum labeling their product as a blockchain”

I like this. I’ve worked in orgs where PKI meant identity and identity proofing and expensive certs. Blockchain changes the pki from “this public key is definitely prepend” to “this public key means the holder of the private key did it.” This is because the “blockchain” either does consensus or has an authority on that key’s action being appropriate.

So being able to use pgp and sha256 as appropriate is a good thing in my book. Could this be done without blockchain with smarter it policy? Yes. But it didn’t, and now there’s some way of formally structuring how non-authoritative identities can perform functions.

So breaking pki out of the authentication world is pretty useful for me.

> blockchains (as in bitcoin) are about being completely decentralized and trustless. It's an "and" not an "or", if you remove one of these imperatives they're completely pointless.

You're completely right, but I want to point out something subtle that I almost missed. For something to be considered a blockchain, it does not have to be distributed (as you noted). There can be a centralized entity (Wal-Mart) controlling the blockchain, but like you said, a controlling entity takes away trust. Without trust, Wal-Mart can still verify any tampering, but the public would still have to trust that Wal-Mart is coming forward with any discrepancies.

You're right but again, blockchain is not needed for that part either. Just have wallmart publish their signed database publicly at regular intervals this way if they cheat and try to modify existing records anybody with an old dump could prove that something weird happened (since the database is signed simply showing a conflicting entry with a valid signature would be enough to demonstrate that either Wall-Mart did something fishy or that they got compromised. You wouldn't have to trust the whistle blower).

>but the public would still have to trust that Wal-Mart is coming forward with any discrepancies.

The entire point of blockchain is trustless. Otherwise a walmart database would be fine.

Sure, but they could also prevent tampering by just running a database themselves and not providing APIs that allow data to be tampered with. If they want to be able to prove it for external auditors, create a write-only audit trail the same way banks have been doing it for decades.

Is Wal-Mart really the threat in this case? I thought the threat was farmers too cheap to give their workers restroom breaks. This system will catch those farmers, and limit the sale of their produce. Wal-Mart doesn't actually want to sell dangerous lettuce.

I didn't mean to say that Wal-Mart was a threat. If the data is held internally, then it's up to the public to trust Wal-Mart's data. This is more a comment about a blockchain being moot than calling Wal-Mart a bad actor, but I can see how it goes the other way as well.

Reply on news.ycombinator.com