Thread by @RhysLindmark

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org 7b/ @arijuels looking into the game theory of these DEX arbitrage bots.

- Bots tend towards an equilibria (w.r.t. gas price)
- There are Wall St.-like latency wars! (Bots have started to do more raises over time.)

cc @phildaian

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian 7c/ @AriJuels @initc3org

A great reminder that DEX arbitrage is just the tip of the iceberg—only .1% of total volume. See @BitwiseInvest report for example of CEX. (95% of reported volume is fake!)

https://twitter.com/bitwiseinvest/status/1109114656944209921?lang=en

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest 7d/ @AriJuels @initc3org with a hilarious point—they accidentally supercharged the bot community by:

- Creating GasToken (used by bots)
- Publishing blog post (which brought more attention!)

Check out the paper w/ @phildaian! arxiv.org/abs/1904.05234

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest 8a/ @sonjadav and @majidmalaika from @IMFNews on CBDCs. Sonja outlines how central banks are thinking about this:

- Right compliance balance with AML/CFT/KYC vs. anonymity
- Incentivize CBDC by allowing folks to use it to pay interest
- Tech comes after use case

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews 8b/ Great "money matrix" from @MajidMalaika (h/t @profjasonpotts).

i.e. It's not just CBDC vs. Bitcoin but rather dimensions of programmability, collateralization, etc.

https://twitter.com/profjasonpotts/status/1180513890670694402

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts 8c/ @IMFNews @MajidMalaika's does a good deep dive on the cyber security of CBDCs (esp. as more money flows into these systems).

Main scary thing that "hit" me: zero-day vulnerability disclosures for CBDCs. (!)

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts 9a/ @mitDCI's advisor Gary Gensler on "Libra From A Policy Perspective."

First, starting with three contexts:
- Impetus for this (crypto catalyzed innovation; payment fees are 1% of GDP)
- Other CBDC and Corporate Cryptos (Telegram)
- FB's previous 3 attempts

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI 9b/ Gary outlines three policy concerns:

- Monitoring illicit activity (KYC, AML). FinCEN and FATF.
- Macro financial stability. The Fed.
- Consumer/investor protections. Securities law. SEC and CFTC.

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI 9c/ Gary notes it looks like a Pooled Investment Vehicle.

Facebook will try to dodge "looking like a PIV" (see 1940 Act) by keeping 60% in cash, 40% in short-term govt. bonds.

If they do this, Gary recommends they change the *law* itself.

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI 9d/ Gary hypothesizes that if Libra (et al) gets large enough to be systemically relevant it should be regulated under BIS's CPMI (Committee on Payments and Market Infrastructures).

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI 10/

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI 11a/ Matt Weinberg's talk: "A Mechanism Designer's View of Cryptocurrencies".

1. Use the terms "exogenous" and "endogenous".
2. Mechanism design analysis doesn't replace classical distributed systems analysis. But important to add.

(I had a funny seat.)

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI 11b/ Other key point from mechanism design (and EC) perspective:

In a paper they look at *one* aspect very well. Every paper has something unrealistic about the model. By design. To understand a certain mechanism super well.

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI 12a/ @SiaTechHQ's @DavidVorick on "Trust & Blockchain Marketplaces". Starts with current centralization:

- 2 fab providers (TSMC, Samsung)
- <5 chip manufacturers (Bitmain, Bitfury, Genesis)

And rules:
- Zero-sum
- So ethical behavior is difficult

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick 12b/ @DavidVorick

- *Assume* we will have centralized mining. Then what should we do?
--> Minimize powers that miners have.

Stop:
- SPV
- Their ability to change consensus rules
- Their ability to signal soft forks

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick 12c/ @DavidVorick on penalizing miners if they do something wrong.

But the issue is that these penalties need to be off-chain!

Off-chain penalties are generally of the form: Threaten future revenue given how expensive mining and hardware is.

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick 12d/ @DavidVorick brainstorming off-chain penalties:

- Quit all together. (Sell coins. Full exit.)
- Change hashing alg. (When Sia did this, miners lost $100M. And they were more respectful of devs afterwards!)
- Counterattack! (Lots of sub-game theory here.)

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick 12e/ As a reminder, check out @kanzure's full transcripts here: diyhpl.us/wiki/transcrip…

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick 13a/ @TheBlueMatt from @sqcrypto on "Consensus Group Centralization". His thesis:

Instead of assuming (like @DavidVorick's talk did) that mining *will* be centralized...take miner centralization as an *open question* and find ways to defend against it.

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto 13b/ @TheBlueMatt

"The future of decentralization in proof-of-stake is bleak. But w/ proof-of-work it's even bleaker."

"...Actually though, the jury is still out. Lots of research questions to tackle here."

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto 13c/Bonus research questions on Payment Channel Network Privacy that @TheBlueMatt wanted to share:

-Watch out for "timing correlation attacks"
-"Balance discovery attacks" may allow attackers to deduce payment source/destination
-Is "probing protection" possible?

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto 13d/ @neha moderating the panel. Her q:

Is the cost to secure the network ~= the market cap?

@TheBlueMatt's smart response: it's correlated with that, but more a function of "untrusted" volume. (e.g. If KYC'ed exchanges double spend, then state steps in.)

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto 13e/ lol, @DavidVorick says his main break from Bitcoin devs is that:

He predicts a future with 10s of trillions of blockchains (not 1, e.g. BTC). More than one per human being / IoT device. 😂

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto 14a/ I'm glad Hanna Halaburda is giving a talk around the econ of permissioned blockchains.

Permissioned chains have (mostly) been absent from this event (depending on your POV on Libra validators :), but def important for this field.

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto 14b/ Enterprise blockchains:

- Can't accept probabilistic settlement
- Don't need the currency
- Don't want costly validation (pay w/ rep or permission not CPU/kWh)
- Don't want come-and-leave validators
- Don't want transaction transparency

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto 14c/Hanna with an interesting point on transparency:

Transparency is often portrayed as "great for customers". But in fact it may *hurt* consumers by making punishing collusion easier, which makes collusion easier (counterintuitively), which is bad for antitrust.

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto 14d/ Haha, Hanna notes that ~50% of the room wouldn't count this as a "blockchain": a distributed database with permissioned validator set.

She says: And maybe we shouldn't "count" that? Or maybe we should? That's an open definitional q for this community.

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto 14e/ In the Q&A of the econ and cryptoeconomic sessions, this recent blog post by @brynosaurus and @rboe keeps coming up.

#CESSummit2019

bford.info/2019/09/23/rat…

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto @brynosaurus @rboe 15a/ Day 2 begins with:

- @mZargham leading a session on Complex Systems
- @socrates1024 leading a session on how our community should do research and peer review

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto @brynosaurus @rboe @mZargham 15b/ For all of this "meta research" work, I'd love to interact more with the #metascience2019 community.

#CESSummit2019

metascience2019.org

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto @brynosaurus @rboe @mZargham 15c/ @Truebitprotocol @jasonteutsch has these call-to-actions for a tokenized journal.

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto @brynosaurus @rboe @mZargham @Truebitprotocol @JasonTeutsch 15d/ @blockchainrmit's @elinorrennie and @profjasonpotts with a talk on "Economic Models of Journals as Clubs".

The underlying thesis is that journals should be economically modeled as a *club good* (as opposed to a public good or private good).

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto @brynosaurus @rboe @mZargham @Truebitprotocol @JasonTeutsch @BlockchainRMIT @ElinorRennie 15e/ @profjasonpotts w/ a key idea:

- Journals (clubs) have the same producers/consumers
- This is different than journalism, where those are separate

- The internet was good for journalism (broadcasting/narrowcasting).
- Blockchain may map well onto journals.

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto @brynosaurus @rboe @mZargham @Truebitprotocol @JasonTeutsch @BlockchainRMIT @ElinorRennie 15f/ Here's the paper from @profjasonpotts @ElinorRennie "A Journal is a Club: A New Economic Model for Scholarly Publishing".

#CESSummit2019

papers.ssrn.com/sol3/papers.cf…

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto @brynosaurus @rboe @mZargham @Truebitprotocol @JasonTeutsch @BlockchainRMIT @ElinorRennie 15g/ @ElinorRennie "We don't necessary cite work because we *like* it, but because we disagree with it. It would be nice to add this nuance." :)

@profjasonpotts with an interesting point: "Far away events are a costly signal." (As a way to signal/filter clubs.)

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto @brynosaurus @rboe @mZargham @Truebitprotocol @JasonTeutsch @BlockchainRMIT @ElinorRennie 16a/ I tried to live transcribe @kanzure's talk about transcription!

It was *hard*. But it's here!

docs.google.com/document/d/1a1…

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto @brynosaurus @rboe @mZargham @Truebitprotocol @JasonTeutsch @BlockchainRMIT @ElinorRennie 16b/ lol, @metasj did the same thing (on PubPub!). cc @kanzure

#CESSummit2019

https://twitter.com/metasj/status/1180851197936160769

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto @brynosaurus @rboe @mZargham @Truebitprotocol @JasonTeutsch @BlockchainRMIT @ElinorRennie @metasj 17a/ @socrates1024 begins a discussion with the audience about how CES should run its peer review process.

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto @brynosaurus @rboe @mZargham @Truebitprotocol @JasonTeutsch @BlockchainRMIT @ElinorRennie @metasj 17b/ @socrates1024 w/ 3 ideas for CES:

- Assign reps from 2+ different fields to each reviewed paper
- Reviews are asked to collaborate on a summary, a "foreword from the reviewers" to be published alongside each paper.
- Explain standards ("validation" form).

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto @brynosaurus @rboe @mZargham @Truebitprotocol @JasonTeutsch @BlockchainRMIT @ElinorRennie @metasj 17c/ In the town hall, Q&A, @neha brings up a key piece of "brokenness": that half of this room thinks Proof-of-Space is debunked, while half think it's legit. How can we come to consensus here?

(Quick small idea: using @KialoHQ-style UX. kialo.com)

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto @brynosaurus @rboe @mZargham @Truebitprotocol @JasonTeutsch @BlockchainRMIT @ElinorRennie @metasj @KialoHQ 17d/ Interesting note from the audience: keep the reviewers *out* of the paper. (By having the reviewer write the paper, it's an infringement on free speech.)

To some extent, this is against @socrates1024 ideas for CES (to have reviewers write a forward).

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto @brynosaurus @rboe @mZargham @Truebitprotocol @JasonTeutsch @BlockchainRMIT @ElinorRennie @metasj @KialoHQ 17e/ Good q from audience: How should industry collaborate on this journal? Maybe have industry "give" open questions to academia?

Where have we aggregated open research questions for BTC, ETH, etc.?

cc @kanzure @drakefjustin @zmanian

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto @brynosaurus @rboe @mZargham @Truebitprotocol @JasonTeutsch @BlockchainRMIT @ElinorRennie @metasj @KialoHQ @drakefjustin @zmanian 18a/ Session on Long-Term Security! @Ethan_Heilman goes over a couple of Bitcoin CVEs. Full list here.

en.bitcoin.it/wiki/Common_Vu…

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto @brynosaurus @rboe @mZargham @Truebitprotocol @JasonTeutsch @BlockchainRMIT @ElinorRennie @metasj @KialoHQ @drakefjustin @zmanian @Ethan_Heilman 18b/ @Ethan_Heilman's idea for the "worst Bitcoin bug": a worm.

A *valid transaction* that causes a node to *execute a program* written by the attack.

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto @brynosaurus @rboe @mZargham @Truebitprotocol @JasonTeutsch @BlockchainRMIT @ElinorRennie @metasj @KialoHQ @drakefjustin @zmanian @Ethan_Heilman 19a/ @ChaincodeLabs' @carl_dong on Softwares, Binaries, and Trust.

"My name is Carl, and I'm here to haunt your dreams." :)

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto @brynosaurus @rboe @mZargham @Truebitprotocol @JasonTeutsch @BlockchainRMIT @ElinorRennie @metasj @KialoHQ @drakefjustin @zmanian @Ethan_Heilman @ChaincodeLabs @carl_dong 19b/ @ChaincodeLabs @carl_dong

First, how to protect against runtime dependencies?

Minimize the # and audit them. At runtime, Bitcoin Core only allows a subset of these dependencies to run.

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto @brynosaurus @rboe @mZargham @Truebitprotocol @JasonTeutsch @BlockchainRMIT @ElinorRennie @metasj @KialoHQ @drakefjustin @zmanian @Ethan_Heilman @ChaincodeLabs @carl_dong 19c/ @ChaincodeLabs @carl_dong

How to protect against *build-time* vulnerabilities? Gitian Reproducible Builds!

This is a super cool thing that allows folks to run the same build "from scratch" and to check those builds against each other.

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto @brynosaurus @rboe @mZargham @Truebitprotocol @JasonTeutsch @BlockchainRMIT @ElinorRennie @metasj @KialoHQ @drakefjustin @zmanian @Ethan_Heilman @ChaincodeLabs @carl_dong 19d/ @ChaincodeLabs @carl_dong

But reproducible builds aren't enough! A warning about "trusting trust". How do we trust our toolchain?

It's like yogurt: you create the yogurt/toolchains with previous yogurt/toolchains. 😂 (It's turtles all the way down.)

#CESSummit2019

@socrates1024 @neha @ittaia @kanzure @dahlia_malkhi @Libra_ @LivepeerOrg @YondonFu @gnosisPM @AFDudley0 @AriJuels @initc3org @phildaian @BitwiseInvest @sonjadav @MajidMalaika @IMFNews @profjasonpotts @mitDCI @SiaTechHQ @DavidVorick @TheBlueMatt @sqcrypto @brynosaurus @rboe @mZargham @Truebitprotocol @JasonTeutsch @BlockchainRMIT @ElinorRennie @metasj @KialoHQ @drakefjustin @zmanian @Ethan_Heilman @ChaincodeLabs @carl_dong 19e/ @ChaincodeLabs @carl_dong

Solution: use GUIX to audit the toolchain. See dependency graph below.

Eventually the hope is to decrease the size of the binary seed bootstrap.

Right now: 232MB.
Soon: MES 131MB
Optimal: hex0 357 bytes.

#CESSummit2019