Vitalik: Create a fully open source and easy-to-verify stack for high security

Original title:The importance of full-stack openness and verifiability

Author: Vitalik Buterin, founder of Ethereum; compiled by: Bitchain Vision

Perhaps the biggest trend of this century can be summarized by the saying “The Internet has become a real life.”It starts with email and instant messaging.For thousands of years, human private communication has been conducted with mouths, ears, pens and paper, but now it relies on digital infrastructure.Afterwards, we ushered in digital finance – both crypto finance and traditional finance itself.Next is our health: various information about our own bodies is being processed through computers and computer networks, thanks to smartphones, personal health tracking watches, and data inferred from purchasing behavior.Over the next two decades, I expect this trend to cover a wide range of other areas, including various government processes (eventually even voting), monitoring of physical and biological indicators and threats in public environments, and ultimately with brain-computer interfaces, and even our own thinking.

I think these trends are inevitable; they bring too much benefits, and in a highly competitive global environment, civilizations that reject these technologies will lose competitiveness first, while those that accept them will have the advantage.However,In addition to bringing huge benefits, these technologies also have a profound impact on the power structure within and between countries..

The civilizations that benefit the most from the wave of new technologies are not those that consume technology, but those that create technology.The centrally planned equal access scheme can only provide a small portion of it for closed platforms and application programming interfaces, and it will also fail if it exceeds the preset “normality”.In addition, this future requires peopleHave great trust in technology.If this trust is broken (such as backdoors, security vulnerabilities), it will cause very serious problems.Even if it is just the possibility that this trust is broken, it forces people to retreat to a fundamentally exclusive model of social trust (“Is this made by someone I trust?”).This creates an incentive mechanism that spreads upward along the entire technology stack: the person with the decision is the sovereign.

To avoid these problems, the entire technology stack is required (includingSoftware, hardware and biotechnology) has two intertwined characteristics:True openness (i.e. open source, including free licensing) and verifiability (ideally, including direct verification by end users).

The importance of openness and verifiability in the health field

During the COVID-19 pandemic, we have seen the consequences of inequality in access to production technology.Vaccines are only produced in a few countries, resulting in huge differences in the time for vaccines in different countries.Developed countries have obtained high-quality vaccines in 2021, while other countries only have obtained lower-quality vaccines in 2022 or 2023.Although there are some initiatives that try to ensure equal access to vaccines, these initiatives have limited effects because vaccine design relies on capital-intensive proprietary production processes that can only be carried out in a few places.

Coverage rate of new crown vaccine from 2021 to 2023.

The second major problem with vaccines is the opacity of its science and transmission strategies. It attempts to conceal any risks or disadvantages of vaccines from the public, which is inconsistent with the facts and ultimately greatly exacerbates public distrust.Today, this distrust has evolved into a near-repulsive repulsion of scientific research achievements over half a century.

In fact, both problems can be solved.Vaccine development costs like Balvi-funded PopVax, and the R&D and production processes are more open and transparent, reducing inequality in access, while also making it easier to analyze and verify its safety and effectiveness.We can go further in vaccine design and prioritize verifiability.

Similar problems exist inThe field of digitalization of biotechnology.One of the first common sayings you hear when you talk to longevity researchers is that the future of anti-aging medicine is personalized and data-driven.To know which medicines and what nutrients should be recommended to patients today, you need to understand their current physical condition.If it canCollect and process large amounts of data digitally in real time, this will be more effective.

The same philosophy applies to defensive biotechnology designed to prevent adverse effects, such as fighting the epidemic.The earlier the epidemic is detected, the more likely it is to stop it from the source—even if not, every extra week will be to buy more time to prepare and start developing countermeasures.Being able to know in real time where people are sick during the pandemic is of great value to deploying responses.If an average person infected with an epidemic learns the condition and isolates himself within one hour of illness, the spread will be 72 times slower than infecting others everywhere within three days of illness.If you know that 20% of locations cause 80% of the spread, improving the air quality in these places can lead to further results.All of this requires(i) A large number of sensors, and (ii) sensors can communicate in real time to provide information to other systems.

If we go further in the direction of “science fiction”, we will be exposed toBrain-computer interface technology, it can increase productivity, help people better understand each other through telepathy, and open a safer path to highly intelligent AI.

If biological and health tracking infrastructure, including individuals and spaces, is proprietary, then data falls into the hands of large enterprises by default.These businesses have the ability to build various applications on this basis, while others cannot.They may be able to provide data through API access, but API access will be restricted and used for monopoly fee withdrawals and may be reclaimed at any time.This means that only a few people and businesses have access to the most important elements of the 21st century technology field, which in turn limits who can get economic benefits from it.

On the other hand, if such personal health data is not secure, hackers can blackmail you for any health issues, manipulate the prices of insurance and health care products, and squeeze benefits from you.If this data contains location tracking, they even know where to wait to kidnap you.In turn, your location data (usually hacked) can be used to infer your health.If your brain-computer interface is hacked, it means that hostile forces are reading (or worse, tampering with) your mind.This is no longer a science fiction novel.

All in all, this brings great benefits, but there are huge risks: and a high emphasis on openness and verifiability is perfect for reducing these risks.

The importance of openness and verifiability in personal and commercial digital technologies

Earlier this month, I need to fill out and sign a form required for legal matters.I was not in China at that time.Although there is a nationwide electronic signature system, I did not install it at the time.I had to print the form, sign it, and then walk to the nearby DHL Express Company, spend a lot of time filling out the paper form, and finally pay to send the form half way out of the earth by express.Time required: half an hour, cost: $119.On the same day, I need to sign a (digital) transaction on the Ethereum blockchain to perform an operation.Time required: 5 seconds, fee: $0.10 (to be fair, signatures are completely free without blockchain).

Such stories can be seen everywhere in the fields of corporate or non-profit organization governance, intellectual property management, etc.Over the past decade, you can find them in a considerable number of financing options for blockchain startups.In addition, there are the most typical use cases of “digital exercise of personal power”: payments and finance.

Of course, all of this has a great risk: What if the software or hardware is hacked?The cryptocurrency world has realized this risk early on: blockchains are license-free and decentralized, so once you lose access to your funds, there is no resource to ask for.No keys, no coins.Therefore, the cryptocurrency field has been considering multi-signature and social recovery wallets as well as hardware wallets very early.However, in reality, the lack of trustworthy “Uncle in Heaven” in many cases is not an ideological choice, but an inherent component of the scene.In fact, even in traditional finance, “Uncle in Heaven” cannot protect most people: for example, only 4% of fraud victims can recover their losses.In use cases involving personal data hosting, data leakage cannot be recovered even in theory.therefore,We need true verifiability and security – both software and hardware.

A technique to check whether a computer chip is manufactured correctly.

Importantly, in terms of hardware,The risks we are trying to guard against are far more than “Are manufacturers evil?” such questions.The problem is that there are a large number of dependencies, most of which are closed-source, and negligence in any link can lead to unacceptable security consequences..This article presents some recent examples of how microarchitecture choices disrupt the anti-lateral channel attack capabilities of designs that can prove secure in models that only consider software.Attacks like EUCLEAK rely on vulnerabilities that are harder to detect because a large number of components are proprietary.If trained on damaged hardware, the AI ​​model may be implanted into the backdoor during training.

Another problem in all these cases is that even if closed and centralized systems are absolutely secure, there are some drawbacks.Centralization can have a sustained impact between individuals, companies, or countries: If your core infrastructure is built and maintained by a company that may not be trusted in a country that may not be trusted, then you are easily stressed.This is exactly the problem that cryptocurrencies are designed to solve – but there are more areas of this type of problem than finance.

The Importance of Openness and Verification in Digital Citizen Technology

I often talk to people from all walks of life who are trying to explore better forms of government that are more suitable for different national conditions in the context of the 21st century.Some people, trying to take the existing political system to the next level, empower local open source communities, and use mechanisms such as citizen congresses, draw lots and secondary voting.Others, such as economists who study land value-added tax or congestion charges, try to improve their country’s economy.

Different people may have different levels of enthusiasm for each idea.But they all have one thing in common, that isAll require high bandwidth participation, so any realistic implementation must be digital.It is OK to record basic things like who owns what and hold elections every four years, but not for anything that requires higher bandwidth or seeks our opinions more frequently.

Historically, however, security researchers have taken the level of acceptance of ideas such as electronic voting from suspicion to hostility.Here is a good summary of the cases against electronic voting.Content quoted from this file:

First, this technology is “black box software”, which means the public has no access to the software that controls the voting machine.While companies protect their software to prevent fraud (and to combat competitors), this also leaves the public ignorant of how voting software works.It is easy for companies to manipulate software to produce fraudulent results.Furthermore, suppliers selling these machines compete with each other and cannot guarantee that the machines they produce are in the best interests of the voters and ensure the accuracy of votes.

There are many cases in the real world that justify this suspicion.

Critical analysis of the 2014 Estonian Internet Voting.

These arguments apply in a variety of other cases.But I predict that as technology advances, the “we might as well not do it” response will become increasingly impractical in many areas.The world is rapidly becoming more efficient (for better or worse) as technology develops, and I predict that any system that does not follow this trend will become less important as people bypass it.So we need an alternative: really do those difficult things and figure out how to make complex technical solutions safe and verifiable.

In theory, “safety and verifiable” and “open source” are two different things.Some aspects are definitely possible to be both proprietary and safe: Aircraft are highly proprietary technology, but overall, commercial aviation is a very safe way to travel.butWhat is not possible with proprietary models is a safe consensus——The ability to gain trust from participants who do not trust each other.

Citizenship systems like elections are a kind of situation where security consensus is crucial.Another situation is the collection of evidence in court.Recently, in Massachusetts, evidence of a large-capacity alcohol tester was ruled invalid because information about the test failure was found to be withheld.The article quotes are as follows:

Wait, so are all the results wrong?No.In fact, the alcohol test results in most cases have no calibration problems.However, as investigators later discovered that the state crime labs had withheld evidence that the problem was more common than they said, Judge Frank Gaziano wrote that all of these defendants had their due process rights violated.

Due process in courts is essentially a field that requires not only fairness and accuracy, but also a consensus on fairness and accuracy—because society can easily fall into a situation where people are on their own without the consensus that the court is doing the right thing.

In addition to verifiability, openness itself also has inherent advantages.Openness allows local groups to design systems for governance, identity and other needs in a way that is compatible with local goals.If the voting system is proprietary, a country (or province or town) will face greater difficulties in trying out a new voting system: they either have to convince companies to implement their preferred rules as a function, or they have to start from scratch and do all the work to ensure it is safe.This increases the high cost of innovation in the political system.

In any of the above areas, a more focused on open source hacking ethics will give local implementers more autonomy, whether they are individuals or components of governments or businesses.To do this, open build tools need to be widely available, and infrastructure and code bases also require free authorization to allow others to develop and build on this basis.Copyleft is particularly important in order to minimize power differences.

Another important area of ​​citizen technology will be physical security in the coming years.Unfortunately, I predict that the recent rise of drone wars will make “no high-tech security” no longer feasible.Even if a country’s laws do not violate individual freedoms, it doesn’t make sense if this country cannot protect you from other countries (or illegal businesses or individuals) impose their laws on you.Drones make such attacks easier.So we need to take countermeasures, which are likely to involve a large number of anti-drone systems, sensors and cameras.

If these tools are proprietary, data collection will be opaque and centralized.If these tools are open and verifiable, then we have a chance to find a better approach:Security devices can prove that only a limited amount of data is output in limited cases and delete the rest of the data.We can have a digital future of physical security,It’s more like a digital guard dog than a digital panoramic prison.We can imagine a world where public surveillance devices must be open source and verifiable, and anyone has the legal right to randomly select a surveillance device in public, then disassemble it and verify it.University computer science clubs can often use this as an educational activity.

Open source and verifiable way

We cannot avoid digital computers being deeply embedded in every aspect of our lives (personal and collective).By default, we will likely get digital computers built and run by centralized companies that are optimized for the benefit of a few, set backdoors by their governments, and most people in the world cannot participate in their creation and know whether they are safe.But we can try to find better alternatives.

Imagine a world like this:

• You have oneSafe personal electronic devices——It has the functionality of a mobile phone, the security of an encrypted hardware wallet, and the checkability that is not very similar but very close to mechanical watches.

• YoursMessage applications are encrypted, Message mode has been obfuscated through a hybrid network, and allThe code has been formally verified.You can rest assured that your private communications are indeed private.

• YoursfinanceIs a standardized ERC20 asset that is on-chain (or some server that publishes hash and proofs to the chain to ensure correctness), managed by your personal electronic device-controlled wallet.If you lose your device, you can recover it through other devices of your choice, family, friends, or institutions (not necessarily government: if anyone can easily do this, like churches can also provide).

• similarThe open source version of Starlink’s infrastructure already exists, so we can gain a strong global connection without relying on a few individual participants.

• youOpen LLM on the deviceYour activity will be scanned, advised, and completed tasks automatically, and warn you when you may get incorrect information or make an upcoming mistake.

• Shouldoperating systemIt is also open source and has been officially verified.

• You admireWear an all-weather personal health tracking device, the device is alsoOpen source and checkable, allows you to obtain data and ensure that no one else gets the data without your consent.

• We haveMore advanced governance forms, These forms of governance use draws of lots, citizen congresses, secondary voting, and often clever combinations of democratic voting to set goals and use some method to screen opinions from experts to determine how to achieve them.As a participant, you can be sure that the system is executing the rules the way you understand.

• Public places are equipped with monitoring equipment for tracking biological variables(e.g. carbon dioxide and air quality index levels, presence of airborne diseases, wastewater).However, these devices (as well as any surveillance cameras and defense drones) areOpen source and verifiableand there is a legal system through which the public can randomly check these devices.

Compared to today, the world is safer, freer, and more equally involved in the global economy.But to achieve such a world, more money is needed to invest in various technologies:

• More advanced cryptography.What I call the “Egyptian God Card” of cryptography – ZK-SNARK, which is completely homomorphic encryption and obfuscation technology – is so powerful because they allow you to perform arbitrary program calculations on data in a multi-party environment and ensure output results while keeping the data and calculation process private.This makes it possible for a more powerful privacy-protected app.Tools related to cryptography (for example, blockchain can provide strong assurances for applications that ensure that data is not tampered with and users are not excluded; differential privacy technology can add noise to data to further protect privacy) also applies.

• Application and user-level security.The application is only safe when the security guarantees provided by the application can be truly understood and verified by the user.This will require a software framework that makes applications with strong security properties easy to build.Importantly, it also requires browsers, operating systems, and other middleware (such as locally running observer LLM) to play their own roles, validate the application, determine its risk level, and present this information to the user.

• Formal verification.We can use an automated proof method to verify that the program meets the attributes we care about, for example, without data leakage or being vulnerable to unauthorized third-party modifications.Lean has recently become a popular language for formal verification.These technologies have begun to be used to verify Ethereum virtual machines(EVM) and other high-value, high-risk encryption use cases, ZK-SNARK proof algorithms are being used in a wider range of fields.Apart from that, we need to make further progress in other more common security practices.

The cybersecurity fatalism in the 2000s was wrong: vulnerabilities (and backdoors) could be overcome.We “just” need to learn to put safety above other competitive goals.

• Open source and security-oriented operating system.More and more such operating systems are emerging: GrapheneOS as a secure version of Android, streamlined security kernels like Asterinas, and Huawei’s HarmonyOS (its open source version) are using formal verification (as long as it is open, anyone can verify, and it doesn’t matter who produces it. This is a great example of how openness and verifiability fight global divisions.)

• Secure open source hardware security.If you can’t make sure that the hardware does run the software and that data is not leaked separately, then any software is not safe.In this regard, I am most interested in two short-term goals:

• personalSafety electronic equipment——Blockchainists call it “hardware wallet” and open source enthusiasts call it “secure phones,” but once you understand the necessity of security and universality, the two will eventually merge into the same thing.

• Physical infrastructure in public places——Smart locks, the biological monitoring equipment I mentioned above, and general “Internet of Things” technology.We need to be able to trust them.This requires open source and verifiability.

• A secure open toolchain for building open source hardware.Today, hardware design relies on a range of closed source dependencies.This greatly increases the cost of hardware manufacturing and makes the entire process more licensing-dependent.This also makes hardware verification impractical: if the tool that generates the chip design is closed source, you don’t know what to verify.Even existing tools like scanning chains are often unusable in practice because too many necessary tools are closed source.All of this can be changed.

• Hardware verification (such as infrared and X-ray scanning).We need a way to scan chips to verify that they really have the logic they deserve and have no unnecessary components to avoid accidental tampering and data extraction.This can be done in a destructive way: The auditor randomly orders products containing the computer chip (using the identity of a normal end user), then disassembles the chip and verifys that the logic matches.Using infrared or X-ray scanning can be performed non-destructively, making it possible to scan to each chip.

• In order to reach a consensus on trust, we ideally needHardware verification technology allows the public to easily master it.Today’s X-ray machines are not yet at this level.This situation can be improved in two ways.First, we can improve the verification device (and the verification friendliness of the chip) to make the device easier to be acquired by the public.Secondly, we can add some more limited verification forms based on “full verification” that can even be done on smartphones (such as ID tags and key signatures generated by physically non-cloneable functions) to verify stricter statements such as “Does this machine belong to a batch produced by a known manufacturer, and the random samples of the batch have been verified in detail by a third-party agency?”

• Open source, low cost, localized environmental and biological monitoring equipment.Community and individuals should be able to measure themselves and their environment and identify biological risks.This includes many forms of technology: personal-grade medical devices (such as OpenWater), air quality sensors, general-purpose airborne disease sensors (such as Varro), and larger-scale environmental monitoring devices.

The openness and verifiability of each layer of the stack are important

From here to there

A key difference between this vision and a more “traditional” technological vision is that it is more friendly to local sovereignty, personal empowerment and freedom.Security is not achieved by searching the entire world and ensuring there are no bad people everywhere, but by making the world more robust at all levels.Openness means building and improving each layer of technology openly, not just a centrally planned open access API program.Verification is not a patent exclusively to proprietary stamp auditors (who are likely to collude with the companies and governments that launched the technology) – it is a right of the people and a society-encouraged hobby.

I believe this vision is stronger and more in line with our fragmented global landscape of the 21st century.But we don’t have unlimited time to execute this vision.Centralized security means, including more centralized data collection and backdoors, and completely simplifying verification to “whether this is made by a trusted developer or manufacturer”, are developing rapidly.For decades, people have been trying to replace truly open access with a centralized approach.This attempt may have started with Facebook’s internet.org, and it will continue, each attempt is more complicated than the last time.We need to act quickly to compete with these approaches, and we need to demonstrate publicly to the public and institutions that a better solution is possible.

If we can successfully achieve this vision, one way to understand the world we live in is that it is a kind of retro futurism.On the one hand, we benefit from stronger technologies that allow us to improve health, organize in a more efficient, resilient way, and protect us from threats from old and new.On the other hand, the world we have gained has restored some of the features that people accustomed to in 1900: infrastructure is free to be dismantled, verified and modified to meet their own needs; anyone can participate, not just as a consumer or “application developer,” but at any level of the stack; anyone can be sure that the device can operate as it claims.

Verification design comes at a price: While many software and hardware optimizations bring speed improvements that people urgently need, the price is that design becomes more elusive or more vulnerable.Open source makes profitable under many standard business models more difficult.I think both of these issues are exaggerated – but it is not something that convinces the world overnight.This raises the question: What are the pragmatic goals we should pursue in the short term?

I will come up with a solution:Committed to creating a fully open source and easy-to-verify stack for high security and low performance-oriented applications – whether for consumer or institutional, remote or face-to-face.This will cover hardware, software and biometrics technologies.Most computing that really requires security often does not require speed, and even when speed is required, there are often ways to combine high-performance but untrusted components with trustworthy but not high-performance components to achieve high levels of performance and trust for many applications.It is unrealistic to achieve the highest security and openness of everything.But we can start by ensuring that these features are available in areas that are truly important.