Subject: [icnrg] This view on web3has some interesting ties to ICN

From: "David R. Oran" <[email-masked]>
Date: Sun, 9 Jan 2022 07:10:52 -0800

…at least in my opinion. It’s not clear if you follow this person’s reasoning whether some of the similar arguments about NDN/CCNx’s allegedly better distributed protocol design matters in practice.

https://moxie.org/2022/01/07/web3-first-impressions.html?fbclid=IwAR3-Iyb9VPijDaTMt5jajI6UTEChd71VEnXVLUMV3X2k7zxyf5Cpw3fUyTE

___________________________
iDevice - please excuse typos.

---

From: Dirk Kutscher <[email-masked]>
Date: Mon, 10 Jan 2022 21:14:16 +0100

> …at least in my opinion. It’s not clear if you follow this person’s reasoning whether some of the similar arguments about NDN/CCNx’s allegedly better distributed protocol design matters in practice.

Thanks for sharing and for re-kindling this discussion. I had seen the article, too.

My view on this:

* the hilarious difference between "crypto" claims and reality it well observed, in my experience. I could imagine though that most of the contradictions (actual centralized mode of operation) will probably be ascribed to initial deployment factors by web3 proponents.
* in any case, both the scientific quality (peer-review, let alone meritocratic processes as we have in the IETF) as well as the level of operational considerations (that would be required for Internet-scale operation, and that is typically very important in Internet protocol/system design) leaves room for improvement.

On the analogy with ICN on distributed protocol design and decentralization:

* While some web3 proposal make broader claims, it is IMO obvious that these systems generally try to establish an alternative platform for content (i.e., file) access – but **not** for an Internet-level infrastructure. Even for web services, these systems fall short of expectations, because the web today has so many more applications, services and protocols – take WebRTC for example. Totally unclear, how systems such as IPFS would cater to that. Obviously, ICN operates on a different level.
* The discussion and my analysis on centralization so far has many people, including me, to think that the main driver is really economic concentration and correlated phenomenons such as exploiting personal information on centralized platforms, i.e., it could be seen as a failure to apply antitrust and similar actions. There is probably little hope that ICN would be able to induce any measurable difference in the same socio-economic environment.

Still, IMO it's worthwhile zooming a bit into the technologies for a more nuanced comparison: Most web3 proposals that I have seen assumed some kind of overlay, P2P-inspired system, using DHTs for name resolution etc. – plus a good portion of cryptocurrency fluff of course. These systems are not amenable to decentralized operation in a strict sense, because you need access to some form of logically centralized resolution system etc.

ICN has two main tenants that are relevant to mention here: access to named data as first-order principle (i.e., really not requiring resolution conceptually at all) and the built-in security framework, enabling building local trust relationships for communication without dependencies on external trust anchors (in the blockchain or web PKI).

Unlike most web3 systems, you can really build autonomous application in local networks, i.e., operate in a decentralized way. Moreover you can build systems accessing named data without location notion at all, not only for files or web objects, but for any kind of data and service.

Some of complexities in todays networks stem from issues such as:

* complexities in setting up and managing secure communication endpoints, servers etc.
* limitations in TCP/IP or QUIC/UDP with respect to steering traffic to copies or alternative loci of data/computation

The latter is a real issue in CDN, edge computing today, and ICN has a potential opportunity here in making content replication, local provisioning, location-independent access to computation results less complex without compromising on security.

Now, this alone will not change value chains, business models and general capital concentration – this would take political actions etc. However, legislation and regulation also need a solution space to navigate, e.g., when demanding anti-monopolistic measures such as user data and service portability, there needs to be technical alternative in the first place.

All of this a very much theoretic deliberation of course, unless more systems get built to demonstrate some of this.

Looking forward to your comments.

Dirk

---

From: "David R. Oran" <[email-masked]>
Date: Mon, 10 Jan 2022 16:28:39 -0500

Lots to unpack here, but I wanted to react to one particular piece since it seems the basis for a lot of recent optimism about ICN for edge applications, like IoT and localized multi-media such as some AR/VR.

> Unlike most web3 systems, you can really build autonomous application in local networks, i.e., operate in a decentralized way. Moreover you can build systems accessing named data without location n…
You might be able to build it, but some of the things that rapidly raise themselves as thorny issues are:

- you need to do a “leap of faith” enrollment on every single participant in order to get the local trust root installed. This might be somewhat sidestepped with key pinning to the application code but then:

- how do you install/update the application when the participant enters the local trust zone with no root key or an expired one?

- I’m increasingly convinced that a first order deterrent to this kind of decentralization is the very small number of entities any individual is able to assess trust in. I suspect it’s somewhere between 5 and 25; not thousands or millions. Sure, I don’t want to be forced to trust just one or two financial institutions, or just my national government bureaucracy, or the small set of Google/Microsoft/Amazon/Alibaba, etc. but how to I navigate assessing a giant number of trust roots? It seems at least superficially that web-of-trust approaches should work swimmingly well here, but we have 30 years of abject failure (e.g. PGP/GPG) in getting these adopted and maintained in practice.

- If you find the point above modestly convincing, then current proven and reasonably efficient K-out-of-N keying schemes for enabling modestly-sized trusted intermediary sets, and Byzantine fault tolerant agreement protocols for distributed databases seem quite sufficient for all these use cases.

Nice New Year ICN discussion topic, no?

---

From: Joerg Ott <[email-masked]>
Date: Tue, 11 Jan 2022 10:37:44 +0100

Good start into the new year indeed.

I agree on Dave's "thorny", however, Dirk pointed especially to being
able to build local services.

We spent quite some time (with our liberouter and related work) on
designing local services where you actually do get back to your local
trust circles (the 5-25 people Dave mentioned) because you derive trust
from knowing people (even though trusting somebody doesn't automatically
translate into trusting somebody's service building/ops capabilities,
but let's leave that aside for a moment).

This allows ICNs (and related ideas) to help with building local
applications for which you would otherwise get a cloud instance from
some of usual cloud providers (who would also manage those for you).
This comes with the usual caveat of a distributed system that something
somewhere fails and your service stops working.

Especially for everything in-home or in-neighborhood uses there could be
alternatives, e.g., based on ICNs -- whenever it's not about global
reach, large numbers of followers, and so on.  Here, one could argue
that you could get trust somewhat organized (to be demonstrated as soon
as more than one household gets involved).

But you'd still need to get the infrastructure to store data and run
services on nevertheless, to be operated, e.g., by the members of your
local community network.  This appears to be another obstacle if you
wanted to overcome dependencies on the cloud and Internet connectivity.
There is probably a bit of a continuum to be explored on how much you
do locally and how much you rely on generic cloud (or edge) services.

And need to compete on the convenience of the cloud, including backups,
some notion of who is responsible and the corresponding "service level
agreements" as another practicality.

The market for most service designs today, such as IoT, seems to favor
cloud-based solutions.  Maybe for cost, simplicity of operating most
functions in controlled environment, not unlikely for data.  For web3-
style design of such services, (how) could ICN et al. provide a
competitive appeal to those designing them?

Jörg

On 10.01.22 22:28, David R. Oran wrote:
> Lots to unpack here, but I wanted to react to one particular piece since 
> it seems the basis for a lot of recent optimism about ICN for edge 
> applications, like IoT and localized multi-media such as some AR/VR.
> 
>     Unlike most web3 systems, you can really build autonomous
>     application in local networks, i.e., operate in a decentralized way.
>     Moreover you can build systems accessing named data without location
>     notion at all, not only for files or web objects, but for any kind
>     of data and service.
> 
> 
>   *
>     you need to do a “leap of faith” enrollment on every single
>     participant in order to get the local trust root installed. This
>     might be somewhat sidestepped with key pinning to the application
>     code but then:
> 
>   *
> 
>     how do you install/update the application when the participant
>     enters the local trust zone with no root key or an expired one?
> 
>   *
> 
>     I’m increasingly convinced that a first order deterrent to this kind
>     of decentralization is the very small number of entities any
>     individual is able to assess trust in. I suspect it’s somewhere
>     between 5 and 25; not thousands or millions. Sure, I don’t want to
>     be forced to trust just one or two financial institutions, or just
>     my national government bureaucracy, or the small set of
>     Google/Microsoft/Amazon/Alibaba, etc. but how to I navigate
>     assessing a giant number of trust roots? It seems at least
>     superficially that web-of-trust approaches should work swimmingly
>     well here, but we have 30 years of abject failure (e.g. PGP/GPG) in
>     getting these adopted and maintained in practice.
> 
>   *
> 
>     If you find the point above modestly convincing, then current proven
>     and reasonably efficient K-out-of-N keying schemes for enabling
>     modestly-sized trusted intermediary sets, and Byzantine fault
>     tolerant agreement protocols for distributed databases seem quite
>     sufficient for all these use cases.
> 
> _______________________________________________
> icnrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/icnrg

---

From: Dirk Kutscher <[email-masked]>
Date: Tue, 11 Jan 2022 10:45:19 +0100

> - I’m increasingly convinced that a first order deterrent to this kind of decentralization is the very small number of entities any individual is able to assess trust in. I suspect it’s somewhere b…

Yes, I agree – we have to move beyond simplistic scenarios or the assumption that simply applying web of trust concepts will save us.

> Nice New Year ICN discussion topic, no?

Absolutely. The devil is going to be in the details, e.g., robustness against all kinds of attacks, but I'd love to see more research in this space.

Dirk