Hacker News Reader

Comment by nostrademons | Hacker News Reader

I thought this would be about a bigger and more obvious problem with web3, namely that by default all traffic going through MetaMask runs through Infura and hence through Consensys's servers. If you think you're getting privacy or resilience because you're interacting with a DApp, think again. All your transactions are going through a single organization, which might have logs linking the IP, your ETH address, the smart contract address, and timestamp, and if it goes down web3 won't work for a significant number of users. [It is possible to configure MetaMask to use a different gateway, but how many users fiddle with the defaults or even know what a web3 gateway is?]

Ethereum as a whole and the raw smart contracts of most DApps actually are decentralized, but there are SPOFs in the UI, name service, and transaction gateway. If you aren't willing to run your own geth instance and understand Solidity/EVM, it's not really decentralized for you.

View on HN

Disclaimer: I work on Ethereum core development. One of the coolest things happening that will be available to everyone over the coming year is something called a light client, which is essentially a very light, validating node that tracks the head of the chain with certainty, and can be used as an alternative to services such as Unfura. In the future, Metamask will probably be a light client that actually tracks the head of the chain and can validate proofs of user account state. Source: https://github.com/ethereum/consensus-specs/blob/dev/specs/a...

> light client, which is essentially a very light, validating node that tracks the head of the chain with certainty

How does that work?

Skip over verifying everything and only verify a subset of all things you care about. Use alternative root nodes you trust instead of verifying. Stuff like that. They have a spec: https://eth.wiki/concepts/light-client-protocol

It works by surrendering any pretense of eth being a decentralized cryptocurrency and turning every node into a glorified and bloated transport/identity layer.

If you’re not validating transactions - you’re trusting a third party. There are no light clients that avoid this problem. It remains to be seen if they are even possible.

Sorry it took me ages to clarify this. It's actually a pretty cool mechanism! What I mean by "tracking the head of the chain with certainty" means that you don't have any trust assumptions on the head block. If you track the latest head block, that means you can verify Merkle proofs of the chain state (as the state root is a field embedded in a block). This is neat because a light client, using low resource requirements, can tell verify a proof of some state data you present it.

The way it works is that there is a committee of validators in the consensus protocol that is required to sign the head of the chain. We use cryptography known as BLS signatures to perform signature aggregation, meaning you can verify a single signature to ensure that whole committee is correct. The state of the chain can be represented as a Merkle trie, and we can obtain the actual committee as a branch of this tree which can be used during the verification process.

https://medium.com/chainsafe-systems/lodestar-releases-light...

It's really neat and there are working prototypes out there today.

> If you aren't willing to run your own geth instance and understand Solidity/EVM, it's not really decentralized for you.

This is how I feel about the exchanges generally, which wield an incredible amount of influence in the crypto markets, for better or worse. It's a complete tangent, but reading about Tether's shifting story around its capital reserves terrifies me.

I have yet to see a blockchain implementation that's easy enough to use on its own that it could achieve widespread adoption without a strong market desire to have someone else manage the complexity of it for you. People talk about decentralization all day long while completely ignoring the fact that we've just shifted the centralized authority from one entity to another.

That summarizes a lot.

The system is not simple at all.

The benefits are only potentially here (eth fees are wild).

The solution involves the opposite of religious principles the mob believes in.

It's more than the mob believes it to be an ecumenical matter and you want it to be otherwise. If you want to participate, but aren't willing to trust someone else (which no one would blame you for), then your move is to run your own node. Like, that's the entire premise of blockchain technology - no one trusts each other - but no one has to!

> no one trusts each other - but no one has to!

Isn’t the whole point of a market that we trust each other enough to have a shared understanding of what value is? How can a market function when you trust no one else in it? Cash is a perfect example of this: it’s only worth something because we all agree that it’s worth something, we can’t eat it or do anything else with it other than to exchange it for goods. Crypto isn’t any different.

It will be interesting how this holds up if Tether is actually just “printing” money as they go. If the rumors are true and they go bust or are shut down, one could easily see that event catalyzing a crypto market meltdown similar to what we saw in 2008 where speculation was out of control. Will the energy remain in the crypto space if the crypto markets fall victim to the very thing they were created to prevent?

> Will the energy remain in the crypto space if the crypto markets fall victim to the very thing they were created to prevent?

Yes, because the energy in the cryptocurrency space is based not on rational analysis but religious fervor. The inconvenient objective facts will be explained away rather than addressed.

There are some philosophical question. Even trust need trustlessness at first. Things don't couple blindly. But ultimately I believe a good system is where trust is high.

> that we trust each other enough to have a shared understanding of what value is

No, hence why we need the state to print the money, regulate the markets, and put the bad guys in jail.

This is how I feel about the exchanges generally, which wield an incredible amount of influence in the crypto markets, for better or worse.

This isn’t really true as there’s a bunch of decentralized AMM’s(automated market maker) now: uniswap, sushiswap, pancakeswap

Word had it uniswap is prepping for KYC requirements. Sounds like there is still a centralized decision making element to the smart contracts that are what uniswap is at the core.

uniswap labs != open source uniswap (v1/v2) smart contracts and open source ui, both of which have been forked many times

https://newsletter.banklesshq.com/p/unstoppable-liquidity-ma...

How do you do an onchain swap for real money in a real bank?

>I have yet to see a blockchain implementation that's easy enough to use on its own

Bitcoin core is pretty easy to run yourself, no technical skills required.

you d have to define 'pretty easy' and 'technical skills'

2017 called

Now there are lots of rpc providers and it is much easier to spin up your own node

Check out erigon client it is an archive node with much lower resource requirements than geth archival nodes, about 1/10th the requirements and that gulf will likely expand

pruned geth is still much lower than that though, but at least erigon gets rid of some of the state-storage centralization arguments (and lets inquisitive people browse prior chain states and simulate environments)

anybody that wants their own privacy has much better ways to get it

But Tails + TorBrowser + Metamask extension is also good enough if you want to hide info from Infura, analytics packages etc

How do you know the RPC provider's node isn't logging your transactions or even executing a man-in-the-middle attack?

They can't do a man in the middle attack because the transaction is already signed with your private key and they don't have that.

Regarding logging, you don’t know but the node doesn’t know that it was the first node to receive a transaction.

If you are communicating directly to the node.

Infura, on the other hand, uses a load balancer so it receives transactions before they hit their nodes, which means that server can assume it was the first to receive.

If you are operating on clearnet then you need your own node for privacy.

A TorOS lets you do this on darknet just fine though, its some random onion or exit node IP.

Eehhhhhhhh, maybe true 2-3 years ago, but things are getting more decentralized as time goes on. There are many competitors to Infura and MetaMask coming into the space now! There are even hardware companies creating nodes that work right off the shelf (I only know if a handful of devs in the space that have one though, as they're still a bit pricey).

And there are active efforts to develop ultra-light clients for Ethereum together with the concept of “portal network”:

https://our.status.im/nimbus-fluffly/

Can you name any of these alternative companies? I’d like to at least look into them.

One of the weirdest trends I’ve seen in Web3 discussions is the insistence that better alternatives exist, but for some reason nobody is using them, talking about them, or even naming them in discussions.

I work at ConsenSys so I am definitely not claiming the alternatives are better.

https://moralis.io/ and https://www.alchemy.com/ are Infura alternatives

You can Google "metamask alternatives" if you want, there are lots. I won't vouch for any of them.

For Metamask alternatives, Rabby https://rabby.io/ (MIT-licensed) (it routes all queries through its own RPCs atm) and Frame https://frame.sh/ (GPLv3) are the best desktop alternatives I've tried. The latter is my preferred client and IMO is a strict upgrade from Metamask. It's also getting a $7/$1 match on Gitcoin Grants GR12 right now if anyone wants to contribute in the next week: https://gitcoin.co/grants/1143/frame

There are many, many WalletConnect https://walletconnect.com/ compatible wallets that can be used with most dapps as well. There are close to 100 of these: https://walletconnect.com/registry/wallets

As for RPCs, here's a list for you: https://github.com/arddluma/awesome-list-rpc-nodes-providers

If you want to run you're own RPC node, it's not so hard as there are docker and docker-compose images that will let you get geth (or nethermind, or erigon) that will let you spin up an RPC pretty trivially.

The more important thing for decentralization IMO, is that you can reasonably switch, even if most people don't. Think about how this plays out in the browser or email markets and compare it to how much of a difference that is to completely locked in services like Facebook.

Would like to second Rabby, been trialing it for about a month now and I love it.

Wow, Rabby looks great! Had no idea Metamask had competitors, this is awesome.

https://ava.do is one. Cool founders based in the Swiss “Crypto Valley”.

> maybe true 2-3 years ago, but things are getting more decentralized as time goes on

That's a good indication that it is not decentralized ;).

The name service is a smart contract. Even if one entity is hosting UI for it, anyone else can do the same. It's probably a good idea to build direct support for it into clients.

And whomever owns the interpreter owns everything.

> If you aren't willing to run your own geth instance and understand Solidity/EVM, it's not really decentralized for you.

That's just overly reductive. You certainly benefit from all kinds of vectors of decentralisation regardless of you using MetaMask, or possibly having connectively problems if a popular nodes goes down.

You can test this very simply, because regardless of the common node you are using, are still exposed to all the downsides and responsibilities that decentralisation brings, such as the possibility of losing your private key and being unable to recover your funds. So the decentralisation is still clearly there.

Reply on news.ycombinator.com