[ 3 / biz / cgl / ck / diy / fa / ic / jp / lit / sci / vr / vt ] [ index / top / reports ] [ become a patron ] [ status ]
2023-11: Warosu is now out of extended maintenance.

/biz/ - Business & Finance


View post   

File: 166 KB, 1000x972, 1515975668822.png [View same] [iqdb] [saucenao] [google]
13488146 No.13488146 [Reply] [Original]

Chainlink's strategy for security isn't very good. They seem to think that if they describe a large enough volume of different mechanisms, that no one will be able to find a bug in that tangled mess.

A key concept we will use to simplify this analysis is that a mechanism can only be as secure as it's weakest part. As stated in the chainlink white paper: "The security of any system is only as strong as its weakest link"

It is almost always a bad idea to layer different oracle security mechanisms on top of each other, since the resultant mechanism will be as insecure as the least secure of the component mechanisms.

The layers of oracle in-security implemented in Chainlink are:

api data-source
data source aggregation
non-spendable reputation
spendable reputation
certifications
trusted hardware

The chainlink team is already aware that trusting a central api provider is not a secure oracle. From the chainlink white paper "There is, of course, noperfectly trustworthy data source. Data may be benignly or maliciously corrupted due to faulty web sites, cheating service providers, or honest mistakes."

In particular, the cental person running the API could choose to change the data provided over time, or to give different data to different parts of the oracle to cause oracle participants to lose their reputation. In this way, the person who controls the api can not only corrupt data from their own api, they can cause other parts of the oracle system to break down.

Trusting an api data source is a level 4.1 security.

>> No.13488149

>>13488146
The oracles in chainlink have a kind of reputation that they cannot spend to each other. Like a record of the total number of assigned requests for their node.

Non-spendable reputation actually decreases the security of the oracle, because it increases the financial incentive to participate in retirement attacks.

If there is no way to sell the reputation, and a person wants to retire from being an oracle, then a retirement attack is the only way that they can transform their reputation-value into a spendable form.

non-spendable reputation is 4.1 level security.

When you aggregate data from multiple sources, this is called a voting protocol. Voting protocols are well studied in the context of blockchains.

Vitalik wrote this great paper explaining how aggregating data from multiple sources does not increase the security of that data. https://vitalik.ca/general/2019/04/03/collusion.html

data source aggregation is level 4.1 security.

>> No.13488153

>>13488146
>>13488149
Spendable reputation is the security system used in Augur and Bitcoin Hivemind. This is the only layer of chainlink that has the potential to provide more security vs a centralized trusted third party.

As long as the value of reputation owned by the oracle is greater than the total number of bets being judged on by the oracle, then this system has level 3.1 level security.

Maintaining the high value of reputation means that people using the oracle data need to pay transaction fees to the oracle. In the long-run, this is impossible to enforce because people will program parasite contracts that use the oracle data without paying the oracle for the privilege.

Once there are enough parasite contracts, then the 3.1 level security will break down, and the mechanism will be at level 4.1

Trusting one centralized source of data to tell you if another centralized source of data is trustworthy. This does not increase the security at all, both centralized sources of data can be lying to you. 4.1 level security.


Conclusion time....


Chainlink is a piece of shit and a security risk.

>> No.13488158

>>13488146
Where's this from? Do they propose asuperior mechanism?

>> No.13488160
File: 385 KB, 954x1321, 1544125312567.jpg [View same] [iqdb] [saucenao] [google]
13488160

still bill gates chose chainlink

>> No.13488162
File: 81 KB, 212x348, 1549248953292.png [View same] [iqdb] [saucenao] [google]
13488162

>>13488153
Thanks, Timo. Very cool

>> No.13488172
File: 93 KB, 1626x837, 420link.png [View same] [iqdb] [saucenao] [google]
13488172

and u.s government will use it

>> No.13488177

>>13488146
How to level up to level 1.1 level?

>> No.13488203

What other projects are you this knowledgeable about that you consider pieces of shit?

>> No.13488239

>>13488158
https://github.com/zack-bitcoin/amoveo/blob/master/docs/other_blockchains/chainlink.md

>> No.13488248

Blow it out your ass.

>> No.13488335

>>13488146
>>13488149
>>13488153
These types of posts are usually difficult to answer because the argument required to rebut a long thought out argument can sometimes encompass more than the argument itself.

I will analyze just one of your points and leave the rest to others.
>non-spendable reputation actually decreases the security of the oracle, because it increases the financial incentive to participate in retirement attacks.

Can you describe, in detail, how this retirement attack will be accomplished on chainlink?

>> No.13488351

>>13488335
Op is a larper. I posted the source

>> No.13488368

>>13488351
Thanks. That author is pretty stupid. Chainlink doesn’t increase trust in the source, chainlink only tells you that the data sent from source A to source B got there without being tampered with; not that source A is trustworthy. Big difference.

>> No.13488382

>>13488335
A retirement attack as OP described doesn't make much sense because unless you've divested entirely from chain link you still have a stack in the system succeeding

>> No.13488384

>>13488160

Where is this from?

>> No.13488401

>>13488384
bill and melinda gates foundation raport

http://www.iftf.org/fileadmin/user_upload/images/ourwork/Food_Futures_Lab/IFTF_Good_Food_is_Good_Business.pdf

>> No.13488403
File: 56 KB, 621x702, ce8.png [View same] [iqdb] [saucenao] [google]
13488403

>>13488368
>Created Augur
>Created Aeternity
>Both Top 50 Coins

Yes very retarded. So what have you done Anon?

>> No.13488417

>>13488146
>>13488149
>>13488153
It took you over 1.5 years to read the white paper?
Fuck off, this shit has been dealt with ages ago.

>> No.13488421
File: 3.20 MB, 320x180, 114003AD-FB5D-4261-AABE-6EE019600E57.gif [View same] [iqdb] [saucenao] [google]
13488421

>>13488403
I haven’t wasted my time with poor mental gymnastics to try and FUD a competitor’s clearly superior product because I’m jealous. But I’ve done plenty faggot. Thanks for your concern.

>> No.13488433

>>13488239
>The problem is that we are trusting the hardware manufacturer.
Yeah. Not like the entire world runs on computers made by those same hardware manufacturers.

>> No.13488450

>>13488421
So ur a nobody.

Got it.

>> No.13488467

>>13488450
I trust an independent investor more than the head of a competing project.
To be quite honest with you.

>> No.13488478

>>13488467
Fair.

>> No.13488490

>>13488146
>The chainlink team is already aware that trusting a central api provider is not a secure oracle.
fucking lmao
That's like saying "the UPS team is already aware that packages are not delivery trucks".

>> No.13488511
File: 2.34 MB, 4032x3024, 929EED7F-0089-41B1-985B-90A13789356E.jpg [View same] [iqdb] [saucenao] [google]
13488511

>>13488450
>*youre
>>13488467
I unironically have 6 figures invested in chainlink so to be fair to >>13488450,
a competitor might be writing this crap FUD stuff we put to rest in 2017, but I’m also a chainlink investor writing this so I’m biased as well. But I think the tech speaks for itself. DYOR.

>> No.13488520

>>13488511
>but I’m also a chainlink investor writing this so I’m biased as well
Sure, but I still trust that an investor will ultimately be more interested in his profit than in maintaining his confirmation bias than the head of a competing project.

>> No.13488549
File: 154 KB, 986x995, 15F1637F-1FA1-46B6-A0B9-A7234E5ECB8D.jpg [View same] [iqdb] [saucenao] [google]
13488549

>>13488520
True. Thanks for the thought anon.

>> No.13488570

>>13488549
Especially when this head of a competing product is a flaming retard, see >>13488490
and >>13488433

>> No.13489605
File: 152 KB, 1242x1155, 4EB4EFF6-4A5E-44AA-9E21-3F25615FB831.jpg [View same] [iqdb] [saucenao] [google]
13489605

>level 4.2 oracle systems like chainlink are more expensive and less secure than level 3.2 oracles like @AugurProject and @BitcoinHivemind . Which are less secure and more expensive than level 2.2 oracles like Amoveo.

oh he’s an amoveo dev? what a surprise

>> No.13489613
File: 250 KB, 1242x1096, 9F451132-9E95-4302-8B41-682EA2070842.jpg [View same] [iqdb] [saucenao] [google]
13489613

>>13489605
actually i believe him since he probably knows a lot about shitcoins

>> No.13489627
File: 170 KB, 1242x827, 5A32CE72-94B5-49E1-AD85-BFA1CE21C8A3.jpg [View same] [iqdb] [saucenao] [google]
13489627

>>13489613
$1000 24 hour volume interesting

>> No.13489955

>>13489627
He created Augur and Aeternity.

>> No.13490511

>>13488160
Based.. great answer to shit tier fudders

>> No.13490758

>>13490511
Kek

>> No.13490779

>>13488146
>>13488149
Thanks niggers just bought 100k