ABOUT THIS EPISODE
Episode 43 · 2 years ago
SHARE THIS EPISODE
Episode 43 · 2 years ago
Hashing It Out #43 - Kadena - Stuart Popejoy and Emily Pillmore
ABOUT THIS EPISODE
At everybody before we start to showwe're sa about our spons Orfo, the e so once again, for this episode issponsored by trail of bits. Shirevat is a Sibal security, firmspending, its time making sure you're writing smart secure an efficient coat.We previously talked about some of their toeling that they use such aslother the confereances they put on for to educate people, as well as the blogsthey put out to make sure that you're update on what's currently working howto use thuther products and what to look out for when you're trying tobuild products. Today's the episode we want to tell youabout a new feature that they're building whic will be releasing in thenext Cein wiks called the critic that CR y tic critic is going to becontinuous asserance for smart contracts, and that is a Gidhubitigration. Every time you deploy commit to a good heavery bow smartcontracts in it, critic will run a suite of securityaanels's tools, so you get an immediate security feedback. That means that asyou're doing your development yo're getting immediate feedback bout havingto set up anything just ceit your contract as you're current doing herdevelopments and don't get results without having to set anythingup. That's a big boon for my experience in I mar conce developent, because it'sreally hard to figure out how to set up all of thedifferent smart contract aalysis tools and make sure your environment set upproperly much better to just integrate something, an your good uptomit and getimmediate results. If you're a mictred in this, you should be if you're doingSMARKA development go to critic, daio that CR y tic dat, io andjoin. The show now injury, Kin, tat work, welcome to hashing it out, pocasp orretolk to the TTECK intevators behind blocked in introstructure anddecentralized networds. We dive into the weeds togure at whyand how peoplebuild this technology. The problems they face along the way come, listenand learn from the best in the business. You can join teur renks wopen back everybody eisode forty threeof hashing it out. As always, I am Doctor Corey Petti, your house with mycohost calling cuchet, say: Howdy everybody Callim Howde, everybody inColin, some spunk sa Geo cawit. It now today we're talking again with Cadinaas a returning guests from us. We have emily and Stewart with us from CandinaUm. We really are kind of fans of t e, the concept of the project you're doingand andare interested in and how it's how it's painting out. So I guesswitout further do Stewart Emily. Can you give us a cricking droduction as toUm how you got involved in space and whatyour role is at Cadina and what Katina is shirall start my name's Torpotoy, it'sgreat to be back on hashing it out with Tyou guys really enjoyed discussionlast time and lookg ward talking more I'm a cofounder of Cadena. We Um found itin two thousand and sixteen with a private block, chansolution and open hourse, our smart contractlanguage and later that year and recently welaunched the test net of our public multichain scalable level, oneblockchain chainweb, which also runs the backmart contract language. Sowe're having a lot of fun here and that's whow, we're doing. I guess I'll go next. My Name's Emily Filmore, I am theLmaintainor of the PAC mart contract language and I've been in engineer withCadenna for the past h what eight or nine months I think uh and I iam a sortof chartered mathematician here working on the UH, the core language, as well as theforolerification bits. That's awesome so steward. I believe weKINDOF went over your background before you came mostly from I believe Fintacis that correct, Takyou ere massively scalbl distributed financialtransaction systems Jas cind in your background as ECR Yeah Um, so buildinga high volumed equity trading system for JP Morgan that, amongst otherthings, included a usea programale language for writing, benchmark alegorithms that informed some of the stuff we didimpact and before that I'd been working more in the kind of botique softwarespace, building trading software building, exchange, backgrones and yeah.These are all high frequency systems Y...
...and so kind of make sense why you wouldget onto the Cadena side why you would have the insights you did with regardto cad cadanas. Is it Cadana? It's Nacadina, it's not the day. I know it'sa Dain, okay, kadenas yeah yeah. It's it's one of thoseambiguous, pronunciations Um based off the the way it looks Um, so you've H,you've got a it makes tep. Why you you would pursue this project. I consideryour experience emily. What got you into the space? What Um? What is yourbackground? How did you get in the formovafacation side? Why are you sogood at math thanks? I actually got my start in thefinancial industry, so I I got my start right out of college in Utah as ananalyst for Goldman Sax and I slowly transitioned into the model,verification of Validation, space working for the Boston, consultinggroup here in New York City and eventually fell in level of functionalprogramiing, where I gravitated toward high school. As the you know, bestapplication of my experiences, which just happen to naturally sit in thissort of golden meen between logic programming, where formal varificationsits and the financial industry, which you knowseems to make use of it internally, at least to a a reasonableenough degree to get a job, and then I I came to Cadenna 'cause. Iwas very interested in ther, their textack as well. Some of the peoplethat were here like Stuart and H, one of our as it the director of Engineering DogBardsley, who, as a a huge name in the hogh school space and like here, we arenow that's a nice transition. I' thinkinto,I guess, may be one of the better ways tointroduce this whole concept is what is form of verification and had oflanguages like how was a language choice involvedwith ability to do so. It's an interesting question. Um. Ithink it depends on how you define formrverification 'cause. There are theres, there's a lot of sort of ambiguity inthe term of formal for one and then verification,meaning you know what methods are you actually applying to? Whatever it is that you're trying toformally verify that actually makes it, you know Qu verified, and I think youcan split this into a few diffent levels of h what it means to beverified, and there are some people that think that yeah, if you have a aspeck which says my program, is supposed to do this, for you knowwhatever it is, whether it's a program or distributed system or something. If, ifmy things is supposed to work this way, then if you write a program, then it'ssupposed to work as we say it does and then there's another level whichsays. Not only do you have to have a sort of specification for behavior, butyou also have to show that h through some means, whether it's bouncing offof the ther improver or Um. You know formally specifying in terms of asemantic how your program is supposed to work, Aand verifying it or Yeu of those provers and then there's furtheranother section of people who believe that youcan only quote formerly verify something. If you have a mathematicallyproven semantic for which you can fully specify the language in terms of withyour improver and then execute each one of those proofs in terms of the theorimprover, to show that the the semantics are correct, and then youderive your entire language from that that spestification, instead of proofs, so the language has about to do withwhether or not you're even capable of doing it and and what is what is, howis packed different in such a way that Um you're able to then say you canformerly verify this Rightso. This is a subtle point aboutprogramming languages in general. You can't mathematically, prove or verifynondeterminism. You can only verify the parts of your language which are totalwhat we call total in the space, and by total we mean they reduce to a singlevalue, which is a a concrete value. Um and turning completeness and turndcompleteness have a lot to do with this. So turing complete languages arelanguages which can admit nondeterministic behaviors at theboundaries of the program, so, for instance, recursing indefinitely ortalking over a network or a whole bunch of other types ofbehaviors like that which deal with not exactly concrete values, but like hoperations that can sort of indefinitely, you know hang or throwarrors which h you. Your programs can't really handle unless you have like a away of hadling exceptions, whereas Turing incomplete refers to...
...h only those programs which terminateto his single value right. So when you model themathematical symatics of this there's no real, I guess principled way ofhandling those nondeterministic values, which means that you can only ever verify the behavior of those programswhich actually terminate right so wait a minute ae. Actually, I don't thinkI'd quite follow that. So actually could you just say that one more timeher me, because w a what I heard was, is that ad, ever seenyour definition ofthe difercinturing INPL tering complete, is at turning in complete. Does itnecessarily have to term well? This is my actually. This is more myunderstanding of it. Maybe you can help me. I have a computer sciencebackground, but like the way you said it didn't quite seem to JI t how I'dnormally say it and that turning and complete is Kinda. Like you don't it's,you know it's going to eterminate, because you're operating on basicallyfinite boundaries is, you can't have infinite Forlos, because if on ninfitite amount ADEA, you can't have it's not a long infinite tape of tickertape, of of information even possible within the system, and so you knoweventually it's going to terminate. So what am I missing there and why do youmake those am? I did I misunderstand what you said or right? No, that'sthat's a a sort of medaargument, though that says in the real world. Ourprograms will always termin it because there's a finite amount of data, butwhen you specify you no thi stuff in terms of mathematical properties, you do't consider the Realti just doesinmissing or admitting like infinite boundaries and infinite tapes andinfinite programs. Right so to say, something is turning complete is to saythat in this sort of idealized world you have the ability to model a tapewhich is infinite, which will run infinitely. That's it it's just like the way the machineactually works means that you don't have something that can recurse or lastforever within like ther functions, who hears about the Ticke Tae. You canalways have a ticke tape, but like like infinite loops, definitely means thatit's a it's, it's not a turring in complete language, yes, and so does recursion nd. Theability to append data to a particular array itself would allow you to do that.So, if you could actually or pend the piece of dated Erray in the middle of aloop, then youv basically extended the length of he loop. Unless that Lope hasa terminator which is dependent on you, Kn W. it's like these kind of things,allow you to extend the length of the tape and that kind of extension abilityis what I understood would cause turn completeness now. Um from what Iunderstand for pacts there'sthere's, it's it's basically you'r operating onnons and only nones, and you can't have loops which traverse infinitely areover over a unindeterminable length of data and Yo can't have calls whichfunctions was called themselves, and so that's just baseaft alr conversationwith Stewart before Um. Is that an accurate assessment of whatyou guys are doing there yeah? That's that's fairly accurate.Although there was a point he e, which I think is a an interesting one. Justfor your ownunderstanding of of turing complete his verces in completenessrecursion doesn't mean that you have the potential to have nonterminating recursion. You canhave things which are recursive which terminate you just have to provideproof at each step that the arguments are are decreasing to the point wherethey get to. You know one single step and then that single step is like thefinal step in your your recursion. That is exceptually interesting to me. So isthere there's an ability to actually do that where you could actually say? Icould prove for all, given inputs that this particular recursive function willnot add information to its Sepia, always reduced to zero right, andthat's that's that's sort of bearing on on what we're going to getto eventually, which is witnesses to what we call accessibility, where wecan actually reach the code that we're going to get to and provide. You knowproofs at each step that we we can continually get. There provides proof that our programs willdperminate. So these witnesses to termination are the things that thatdefine whether something is actually turning in complete verses, actuallyturing complete right. If you R you're turing complete, you don't have awitness to termination M at Al. One thing I wan, I want t justjump in here and say too, is that Um? I think one thing we're getting at,which is an interesting subtle point on pact. Is that packs approach to tering incompleteness was motivated before we sought to admit the enti the ID wedidn't even know that we'd be able to...
...admit the entire language to formalverification m. That was something that kind of arrived based on our designdecisions, and so one of the things emily is discussing. There is the factthat you can have recursion h. You K ow. There are, there are waysto admit recursion that make for a well behaved program that terminates Um. Oneof the reasons why packed is even more strict than that is simply because myexperience in H, r inIn designing languages for everybody, not justprogrammers is that non programmers will programmers screw up precursionall the time, just the number one carthobugs and they're the hardest bugsto track down as well so Um. So the idea there is that packed in addition to you know havingthis nice feature of being formarly verifiable wants to make it very hardfor a programmer to make even trivial bugs of the nature. Where y you know,what are you trying to get done? Do you really want to call a function onitself, because if you subtly change state in that mode, it's it's very hard to load thatinto your brain, whereas something simpler where you're operating over alist, which is something that packed encourages, allows you to kind of movethe problem into data which you know you see this. This is more a generalprogram Tan. Do you see this all over, for instance, and game programmingwhere they try to move out of intense logic and try to express as many thingsas they can and kind of a raise of data? For many reasons, and this we foundthis with PAC too- that you actually get better performance out of yoursystem. A lot of these same H, things that seem austere on the on the face ofit. In the case of pact, allow us to inlinecode anetbly H, you can cut that out. OMORY TT givehat a couple of seconds, so in the case of pack, this kind ofthing allows us to. You know inline code aggressively, Uh and you know- and there there's justthere's a myriad amount of benefits that come out of this and formalverification h emerged quickly as something that you know was that wewanted to explore, and then it was very fruitful Um. So I I think this is th.The conversation about recursion, the larger conversation or racursion isgoing to be very interesting if we get a chance to touch on some of the otherefforts and foral varification in blocking outside and we've got plentyof time to kind of get into that. But before we do that, let's, let's ebrought up something that is interesting to me. That's the idea thatI write an algorithm and I have personal expertations of how thisaltorithm not only works but also performs Um. I have never used a formerly verifiedlanguage, I'm going to lay that out there. I don't know of merry many. It'snot something that comes up. You know in my day to day it's not something Ido, I'm going to interact with pack packed.How do I write? Let's just start with the very basics. How do I write from auser experience, perspective a piece of code and tell the system? I reallywanted to do this and it can actually verify that is there? Is that missingthe intent of what you're saying or is that no something you can actually do?What does that? Look like that's precisely the intendend system and- and I think the thing that's going tomake pack unique- is not going to be so much it's formal properties,although they are, you know, emily can talk more about Pa some of the pacts,interesting formal properties, but Um. It's the fact that tax shape makes thisstuff so tractable. U The easiest way to do. It is go to Paot cuown O, do ioand start using our web brebble and there's an example on there Um that M. I don't know if we wanted toshare iff screen, but Um. I just want to make sure I know the name of the example contract there zaudioonlyanyway, okay yeah, so anyways on there there's an example contract that h Um is, I think it's called formal,Erification whor. It's got something like that. N Its title and what itshows you, it's a single function: Smart Contract, Oh no, it's the onethat comes up when you go to so you just go to pack dot Kindo, it's thefirst one to come up Um and there's a before the actual code of the function,which is this absolute value. F function. That's got this really weirdbugin. It Um that basically, is a quadratic equation based on the inputand when that, when you solve that to negative one or when you solve that tosome random number, that's in there', some weird number it'll return negativeone. Otherwise it does ABS right h. The point is: Is that all you have to do totest that is put in a property that says t at it's an a vs function right?Well, what do you want it to do? You want the result to be greater thanarequal to zero, so you put that property in there and the formalverification system finds this magic...
...number H. I mean th th. The F functionis basically like it's it's some ridiculous thing whereit's like, multiplying and dividing then. Finally, I uses this constant,which is like five hundred and twenty two billion and eight hundred andthirty three or something o like it's dividing by that. So it'sit's a number. You couldn't it's pretty hard to do in your head and it it justdiscovers this number and says for this one value: your property will fail, andthis is a done. Throughw people would typically call fuzzing right. It's notjust as NELT ITS OT, throwing thousands of mlanes and Mians of guesses to tryand find this thing it's doing as ru like lalgebric nipulation is ECR, itit's doing it by turning the program into a model and then examining thespace of all database states and all possible inputs and finding a model. That's the thing about oursystem is that I frind's a model. It doesn't find every model, it finds youa model that falsifies it and then it says here it is, and it gives it to youand then you can test it. You put it into the punction, and now it comesnegative one. So if you give it, it will literally go be able to find likethat one number in from zero to intmax that would that would literally failthe P entire program, it's worse with pack, because packed actually supportsmore than inmax Aa as got a Sono. No, no I mean pact has has uses the hiscolinjure type, which is I mean I guess at the end of the day, it's it's machinedependent, but it's it's it's way bigger than like a two hundred andfifty six bint word Isbut that way: Oly B Yeah. So I mean it's examining a hugespace and, unlike a Fuzzher, I mean plezzers are great, but you know ifyou've ever worked with them. They don't always come back with Thoir Buk.You know they t the whole beauty of foralarification. Is that it's it'smathematically true and it surces the whole srice whet. I'm curious about islike in the existence of like complex martcontracts or multiple smart contracts or whatever you call them and packedher NPEDENA. That search pace grows expodentially with, like maybe thenumber of transactions that Umber ufsteps you have to get through tosearch the entire space. Does that become a computational burden?overtimed O does ust stick to now, O of simplicity, no and and the reason. Whyis not through any magic that we're doing, although Z, three, the backendwe use is incredibly fastend is noted as being the the fastest s an t olverout there and was close horse until three years ago, microsop open sourcingt was a huge gift to the open, Forse Comuti, an U, but the way the way packdeals with it is the fact that we, you know if you want to write something. Ifyou wanted to formally verify your contract tat calls some other contractor call some other contractond call some other contract and they're allwriting to the database in line, and you wanted to verify something thatcomes out of that long chain of things and potentially you could get into aproof that would take longer um but th, but the way from a software engineering approach.If you think about it, that's a pretty unsafe way to write a contract. Youknow, like you'd, probably want to write a contract. That knows what it'sgoing to be getting is a pretty good idea. What those are going to be andthen wants to verify what it does it to data. So all I'm trying to say is thatthe same approachis use for good softwer engineering anywhere elsemodularization. You know separation of concerns, benefits Yoirformalverrification layer by limiting the space of what it has to search. Soan the whole question of like linking to other contracts is, is a very deepquestion at pact has a very principal solution for Um for insurance codestability, but one of the things is that sence packed is free text on theblock chain. You know you can go. Look at the actual code. E E excuse,including the proofs, means you can take those c. You can take back thosecode down and run the proofs on that as well. So I it's really kindof broken upin that regard, so that, while yes, you would be the FORML fvarication systemdoes run through all your length code N. it's always verifying the entire systemagain turing it, and we can only do this because it's turning incompletemost languages do not support Lincoln. You know, like a million o thelibraries we have to all this stuff, inpact is once you load your code, allthat stuff is lincton and the formal varification traverses. All of that,and and we have yet to see anything tak, you know the thing to realize about youknow: Complex smart contracts is that they may be complex in terms of theirbusiness logic, but chances are they're not that complex in terms of the rawcomputation. That's going on, because it's just too expensive to do thatstuff in t e blatchching, and that makes perfect sense. Actually I mean from from a contractcalling contract perspective, because each individual contract is formallyverified. You can probably just treat them as isolated functions in eofthemselves. I would think itwould be very, very difficult to I mean very,very easy to to just say: Hey. This is a known and formally verify as thatcontract is utknown, USI CA guarantee,...
...just because it's inpact it's written acertain way and it adheres to certain properties Um. So Emily I have a quesorfor you. If ivere getting a little feedback on the Mike, if somebody's AH got, I I'm not sure all this m might belie. 'LL GO O my own line, I um emily. I I got a question for you: How DoesFon Arification Work? Let's ust start with that, because,like we're going Ini, Lo misver experience die of things from adeveloper's perspective, and that was intentional, because I really wanted totell the snory first before we got into the nitigride deteils what we reallywanted you on the program for all right. So we have an audience of really highlyskilled technical engineers who who really want to learn from you and M just from from starfrom the beginningsquare one. How did you? How do you build this like? What does it take?What parts are involved in this? This is such a huge question, so give us a course all right all right,all right. We'll start, I guess we can start with, like big fear, improverslike cock and agda um, which coq cock Um issort of ther improver from the nineteeneighties built on this one version of the landecacululs called the caculus ofinductive constructions, which is like a fully dependently typed, justbeautiful system. That can prove basically anything you want. That's? U In the subset of constructivemathematics, Um and the idea. Is you start from a language which is sort of thebroadest in generality, which Um, which cack is in this case, and you can writestatements that look like mathematical statements using this this, like it's, it's almost a brandnew foundation for mathematics. You sort of defying your universe from theground up using this core language, which can express all the things youwant to express in constructive mathematics like universal andexessential quantification Um like functions like how they interact with variables,N and so on, and you basically build your entiremathematical universe from scratch, which is what they've done now,something like Z, thr, and that's that's basically it like. If you canexpress something mathematically or constructively in terms of constructivemathematics, then you can probably write it in cock and that's what people do if they want,like, like simplicity, did this or Tezzos did this actually with, I think,was it Michelson some of t one of their Mickelson contract contract? I thinkthey modelled entirely in terms of cock, which is you know, mathematically sound.You can running the program, as the equivaent of of you know, verifyingthat the proof is correct and if you can model something in this end it itruns. Then you've effectively said a correct statement and constructivemathematics, which is really really cool h now, something like SMT solvers.They support certain kinds of theories. So if you want to think about like whatis what is Thasometin, you stand for Foamont right, so satisfiability Modulotheories, so gueatly it looks for like one of theprologue is just sat right yeah, I think so yeah. So it's like the nextlevel of from something like Proo, so theories in that that sense meanwhat theories do the does thet hour improver, actuallysupport, and in the case of Zthree, I think it's like things like real number,arithmetic, intojuror, rithmetic, certain kinds of polynomial, arithmetic,Um, th stuff like that, basically upthrough, I think what first order Pradicaalculus like forall andexistential quantifiers in symbolic Willian Calculus. So if you can write a statement thatlooks like for all x, there exists O Y, such that you know some prediqate, H, Z.Three will be able to take a look at that statement and, ifXon and wire in the spaces that it can can sort of verify, then it will beable to run around and and look to see ifthereis a model that satisfies the negation of that theory, which isexactly what what that example. That Stewart was talking about with Packd,where it will run around and look for. You know not greater than or equal tozero a which is, you know less than zero, and it will produce a witness to the UNSATISSORT, thesatisfiability of the negation of the statement that you just made, which Iit turns out to be. You know, for various reasons, alghrithmicallyquicker and less complex to deal with than actually proving the whole classof things that are satisfied by by the statement. Yeah. Now that makes sense.ECAUSE I mean you, don't want to traverse to the entire. You know apossible search space. You want to find outesense Ecause, I mean you, don'twant to traverse to the entire s. You...
...know a possible searchspace. You wantto find that one case it doesn't. I I'm surprised, there's a method to do that,though, to me that t that that's that's the part that blows my mind and that'sthe part I'm really hoping you could get into is 'cause. I don't understandhow that works. I can understand the but force part of it. I can evenunderstand more, like a more you know, a careful algorithc. U Know, selectionof data to to select down information that can actually find find somethingthat's a candidate for being wrong, but this is not even doing that is belowingpast. All of that, and just going straight to the answer. This is whereit fails, and it only has to find one negation to prove that your thing iswrong and it doesn't have to find all of 'em it just a to find one. How doesit friking do that won on Git a shot o this to see? If the way I currentlyunderstand things is is is appropriate, I mean mathematicians have been doingthis with with proofs like bathproofs for for centuries right and it'sconstruct an Algera, that's built up of acomatic statements. We assume thesethings to be true, then you can say you know, based on that, based on thoseaxioms, these srudes we're going to define these theseconsidents that live inside these domain, so like exllice between so andso forth, while and so o and so forth. So on and so forth- and you say now,I'm going to say be cut gin to say this statement is true and then mathoticianscan work backwards from all the axuioms. They build them up and they say, basedon what you said was true from the foundation. This can't be right becauseI' I've built up all of these true statements from acorpes of things that basically equals an inequality. So this thing equalesthis and also this thing- doesn't equal this at the same time, which means thatit s it just doesn't exist. Well, that's thatthat's, APlan, O Saing,true yeah computers are Doin as bu te Goart faster. Well it such as aboutfaster. That's that's! I. The reason why I'm blown away is cause. What youjust said is actually kind of handwavy mathematicians spend their entire livesworking on prudes. Sometimes you know like this is not like just somethingthat they just pull out of there there's a butch of creative insight. Itfeels like a lot of times and, yes, it cant be Reduced Anologica, and once youhave the answer, you can ab absolutely prove it. But like a lot of this stuffis very. Like I mean proofs are not trivial, you know half a century ofwork in this field like since the I think the sixties. People have beenworking on this stuff and basically like how do we translate uh? You knowimplication into an arithmetic statement in a certain kind ofLandocalculus. How do we, you know, translate entire strings ofBullian preditats into computer speak basically, and it all comes down tohaving a very strong core language which can actually express a e. Youknow subset of mathematics, which is the LAMBAC Calculat in most cases, sotheres ist kind of a famous therem sitting in the space called the curry,Howard isomorphism or the curryhoward Lambak. I some more physm if you'remore recent, which says that there is a a correspondence, a sameness, a degreeof Sameness to the way people talk about logical propositions and the waythey talk about programs for specific kinds of calculae oncomputers. So things like function, types correspond really neatly andactually are sort of the same as an implication. You give me an a andyou've got to be, whereas disjunctions correspond really nicelywith H, UM CO products in our like Hasc orsomething like an either datatype youav either have the thing on the left orthe thing on the right, and you know all the theorems associated with thatwere products in the form of Tuples and these statements, all sort oftranslate you know really really nicely into computer speak and you can buildan entire mathematical universe by exploiting this ISOMORPHISM and andresults from you know, logic and results from computer science and intermingling thetwo. In order to create this, this verifiable space, which is basicallywhat we're doing this whole time, and actually you can do this in anylanguage like jabascript. If you want it well, let me let me letme make this alittle more concrete for one moment, though, all right so to me it's veryeasy to understand. I guess the possibility, even though it's still minblowing the possibility of finding that one thing that negates a particularthing to disprove a particular function. The the converse of that is that youneed to verify that it doesn't have that you know, and so like. Let's say Iwanted to code up something that takes a a map of any kind and will h or y W. I guess H, lisis called Hem Aut,because it's that's what people commonly understand it as, but it'sbasically a graph with regions, and we want to determine whether or notyou can use four colors to color this...
...bath. Okay, you need to only find nowthe four color theorem is proven, like it was prove themi. Two thousands buthiy took all the way that that long for mathematicians and economists was actually in a Conmese et's hand inthat Um to prove the four color there. So what would that? What? How would aformally verified language look at that? And how would they know whether yeah I mean that is always truebased on the Algorithn you give in that it actually satisfies a four color forcolor mapping. OES, that make sense. I the one thing I just jump into say isthat that does fall into the realm of you know, classic like NP, completeproblems and things like that and there's any number of things you mightdo with a computer where you'd employ dynamic programming or you'd, employmachine learning or Youd employ. You know any number of complex algorithmctechniques and being able to prove properties. Youknow to take the next step and prove properties of whatever nifty approachlike sofor instance. Dynamic programming is, you know, is very nifty.I mean it it it manages to take a you know, to shrink a search spacetremendously, but it's an optimization right. It's not. The raw problem isboth simpler and harder. So if you wanted to admit that toformalverification you'd have to decide, are you talking about the raw problemitself, because that might be quite easy to express and say somethingsabout, or are you talking about a specificsolution that will get the job done for you with certain asentotics that gets quite complex and you mighthave a hard time Uh. You know I mean I form. Ofarfication could certainly aidyou there, but you know I I think you'd have a hard time h talking about thatin general, because necessarily your concerns are going to be, you know, andthere are even things you know. People are obviously proving things aboutalgorithms, but Um. You know that's just a space of computer engineeringthat has its own concerns and formal varification is more about thetechniques you know the formality is more aboutthe techniques you do to kind of shrink your search pace unless about the thatmic sense, th, the problemyou're trying to solve, which might be both more elegant and more intractable. So it's just trying to prove thatwhatever you're doing will not produce a wrong ish result. So if youput a tolerant, you know acceptance in there like O, we can have one that'sordered or whatever, and that would be that's two colors that are boardingeach other, but we can't have more than that. L. would that be something like Idon't understand quite the way. I've understood it in terms of how otherother tooling works, that that offers quote unquote. Who overification isthat you give in a list of of O areas, the more invarien to give it the better?It is the reason about whether or not those things are ever broken. Based onwhat you wrote, so you say like this thing will alwayshold true. This thing will always hold ontrue. There's no scenario where thisthing should ever equal. This thing an the more that list of adveriant, yougive it easier. It is for agerification to say Yep all that all that iswithheld within the confines of the thing that you built. Is that a decent way of kind ofexplaining what the whole goal is here? I think one thing that makes thisconversat that threatens to make this conversation overly abstract is thatyou know like, as emily was saying this work has been going on, and I meanthere's been tremendous work in this space Um, you know t the work. onformalverication has never really stopped, but when you're in computer science,the problem in engineering, the problem is that computer engineering has notadvanced nearly as far you know in terms of like formal things. It's like we've advancedin terms of like raw computing power, we've adranched in terms of lots ofthings, but in terms of as programmers there hasn't been a ton of like amazinginnovation, since the sixties or the seventies. You know a lot of theprogramming languages we use are very similar to see or lisp were thesethings that came out a long time ago, and the reason why I say that is notjust not is is to say that one of the things that's weird is that you know coneof programmers whose dayjob it is to solve problems with the computer for normal human beings. A lotof them don't have access to formal verification as a tool, and that's oneof the things that we really wanted to do. WIT PACK is try to make it that the you know the programmer who doesn'tunderstand all these things that we're talking about Um can still saysomething like well Gosh. I know that this thing. I know that my balancecolumn can never go blow zero. I just know that, and if you can give me a wayto express that- and it can show me and show me where I'm wrong- and I cantrust in that system, then that becomes very useful and that's a very unusualthing like I've, never seen it ever in...
...anything. I've done in twenty fiveyears of software engineering. I've never like, for instance, packed asimilar day based program. No one ever offered me something for when I writemy Likewai as there. Oh also we'll find all your bugs for you, like nobody everoffered Dath Ian everyone always bishes on how terrible airor messages are yeah.Well, N. You know, and then in end of the PRACTICIS unit, testing, of course,but unitesting is, of course the programmer trying to think of everyarrorcase they can think of, and then the next best thing is static, analysisand pleasant, and those are all really good things to do. Of course, and thosemight find you things, but though those still require you to think of how youwant to model the domain of your program and, what's so nice about thisthing is that for once we can talk in an abstract way and by abstract I meangeneral about the entire space of what theprogram is trying to do and then actually leverage a computer to help. What I say to people sometimes is thatnon programmers may not realize how primitive the tools programmers workwith are ecause computers, look like Magic to non programmers so, but alsononprograms, probably think, oh well, don't you just use the computer to helpyou find and it's like? No, we don't. We do everything by hand. We write allour tests by hand and that's one of the things that like is, I mean, is youknow? J T from a conceptional point of view is so exciting about. What's goingon in e pact? Is the idea that like well now you can now. You can actuallyuse some of these tools, and maybe one day these things that were that youknow that Callin and emily are are hashing out. Here will become more common knowledge to the work at a programmer, becausethey'll be so much more familiar with using the toos like programmers aremuch more familiar with the intrigacies of TCPIP, which is complicated, but if you're, ifyour job is writing server, applications ore full stacks up one ofthese years, you're going to need to know something about TCBIP, so you're,probably going to do a deep dime on that, so hopefully, foral varication will belike that someday. Oh man do I hope so yeah I mean I don't see why I can'tjust have a every language can't have a littlesubset aforvevication. This function is formally verified. You know put it in adecorator and just stick it over the function, and then it t behaves acertain way and then this little subsed of of calculation would be alwaysformerly verified. I mean like that just seems like an easy languagefeature that particular language designers could probably implement Eno an e forward. I don't know so that'IT SI was. The problem is admitting your language to formal verification,and this is, I think, it's worth. Actually, I think you know, and in theinterest of time we might want Ta gloss over some of the things that arehappening in solidity, land and an evm land which emily can talk about about.Is that is much closer to the model of a javascript or a Java, or somethinglike that and what you would act 'cause, that's what they're attempting to do soI mean maybe amiy you co, give us and by the way I wan'to apologize, I didn'tneed to be reductionist. When I said Es. I know it's very very difficult, but Ifeel like if we engineered ourselves in that direction, there could be astandard set of tools that people be more familiar with Um r o agree withyou. I I think you know that's the whole von Noyman Debe. You know that,like our entire, our entire machines are bill wrong that we built everythingaround this like turning tarpet and as opposed to you know, trying to buildmachines that are actually more predictable. Well, DIS, more ICK Wele, I thinkpeople I mean I've. You've read that paper on functional programming fromthe late Seventies. I forgot it its bonnoyment AFO, Rocke, John Bi,eighteen, seventy seven, I think right and that one you know he really likemakes this case that, like you're doing it wrong, like like nobody listend toHem, you know, worse, is better. That's that's! Where we're at now and it's andyou know it would. It would be great if we could move into this better, but wedo have things like BM and people want to prove things about it, so yeah yeah.So I mean this is kind of what Um. What's going on with K framework orsolidity starwormhm Um, the solidity star, a Youknow, the EBM bicodeis isturned complete and they want to provide some form of verification tothe languages built on on the evm in thiscase solidity, and they found that they actually can't verify the entirety ofthe bite code. They have to defer just to the turring and complete subset ofevim Bite Code and identify that with a sublanguage of solidity, which is theturring in complete sublanguage and in order to prove that solidity actuallyproduces the bite code. Both ways like the BIE code producesthe same solidity script as the Salidothye script produces in terms ofbiecode. They have to...
...restrict themselves to this sublanguageof each of the e languages, and then they can form the the proofs, forverification would show that the two actually do produce each other is thatone people tyically referr to as in intermediate language, intermedialrepresentation? Yes, yes, kind of Um in in an intermediate language, I thinkof like a sort of undecorating or qushing the language tofer sort of intermediate constructors, sothat you, you can do the same stuff that you want to do in a slightly moreprincipled way, sort of like in a lowered version of language. In thiscase, you just have to make sure that your program is in that subset ofsolidity or in that subset of the Eviam Bite Code, which they can actuallyaddress. So it's not quite an intermediaterepresentation. It's more just like a convention of you. You can't verify inanything unless you PARN THISUB OKA a lot of times. Lower representations areactually less safe and you're, usually taking the safety properties ot, thehigher level language, proving things, and then saying because of this, I canodmit faster, more unsafe languages like Lobm, or you know, machinelanguage so that that's the usual kind of like an I r is usually a lessslightly less principale, slightly less safe but simpler and easier for amachine to chew through, whereas here what we're talking about is kind of aprincipaled subset that is basically trying to it. It's basically trying to wrangle alanguage into something that we can reason about when the language wasn'tdesigned that way in the first place yeah, and we actually go over a lot ofthis in the h. The BM is fundamentally unsafe, blocgpost that we we put outover the summer which O o was it summer, notwas fallback in the fall and yeah is yeah. We should 't te that in the postand H, Taeali showed to us a lot of the the solidity stuff istrying to get towards a space where they can see somethingbeautiful about their programs, but finding that they've coded t e language,which is too broad and to H, basically unsafe, to admit a formal specification which is a meaningful specification right and cfreing work kinddodesis aswell. Actually we I I know a few people that are workingon Kfreework, like Martin Lunfall who's done incredible, work, Um. U, I thinkthe what is it the rechability proofs in that area? I think he presented itSBC, if I remember correctly, but they're they're, identifying from anoperational semantic, basically aspestication of how programs shouldwork, trying to use K framework to verifythat programs actually do what they say. They're supposed to do much and thesame way that pact does, except their working in turn, incomplete, ors,complete land and it's very, very difficult to uh verify that programs do what they say.They're going to do in that s in that situation such that it takes minutes toverify simple arithmetic, which is a consequence of the structureof the language itself. So we take the view that you're, because of because of gas andbecause you now, you have a limited stack and limitde data like Colin, wassaying earlier in the show y you're, actually not using any of theproperties of turring. INERSARTUR. Completeness that you think you are inyour language, but you are admitting all of the flaws and nonverifiabilityof turning complete languages into your language, such that you find yourselfin a situation where you have a bigilion, formal verification engineswhich are sort of slow, very interesting concepts, but slow and notterribly usable. Whereas pact can do the same thing in microseconds. No. Iwould assume that the decision to make to model things after jabascript- and Ilanguage like slinity- was not necessarily a competational one as moreof a social one in terms of trianr act developers to start building on thesystem which has its own, which has its own benefits on consequences. But inhindsight Um based O. How we're seeing thistechnology grow and be used an what it could be used for that may that mayhave not been a good decision and you can see that that kind ofmanifesting in the way that people are looking at different language models touse such as viper, which is python based which otherways a beautifullanguage Um. You know M so yeah. No, I I think uh, I I I I really want to getto one more question. We really want to go over chain web okay, but I do haveone question at this point: Incorin I have another but um what ies the performance hit for doing:FORMOF anfication into playing a...
...contract from a from a v Omgraton a you, often because there'snon because we don't formerly verfind the blatcing forl arrication is optionl,I'm a in a CICD Ay. I 's like if all appely developing- and I want to- Iwanted a plenew code. How long does it take for me to know that this coat'scorrect? It's basically you're continually doing it so packd usesthese things called reppel files, which are basically test scripts and the ideais you just call a function called verify and your module and it'sconstantly varifyine, so h, pack, this is Paks. Developent models, youbasically start writi pack in other resonpacking on, do what's calledtestrm development. Um wher. Are You rign? I know WHA get out of my Blod,not deservative Um, but then you can also do kind offormally driven development where you could write your properties. First,have those tests fail and then implement the code? If you wanted to Um? It's also, you know t the language isreally quite rich and we'd happy to send you kind of the introductory topeace on it. Um Th, the property lurch. That's inside that's embedded inside apact, but the idea there is that Um most of what we want to do when youthink of the bugs that have been afflicting solidity, they're, notrocket science, bugs they're exploits on on code. That's supposed to besimple and isn't you know like a Ner C, Twenty Buk is not a rocket science bug.It's somebody who was able to figure out that something that they didadmitted some kind of recursion loop or something like that Ond. So things areunavailable to you by construction inpact, the properties you writertheretherefore going to be. You know that much simpler, so t theplace where you could get in trouble impact if yo wanted. If it was going tospend out of control as if you were, for instance, like you decided, youwanted to pars long strings of text in your smart contract language and Iwould say, you're an idiot just on the face of it. If you want to do that, butyou know people do programmers, do whatever they're going to do and thenthey're going to be like wait a minute. The formal varrification system istaken forever to like go through the entire universe of really long strings. That will happen. You will have youknow. So there are things that I my assertion is that the kinds of thingsyou want to do on the block chain happen to be really easy to verify.Like you know, usually it's ledger activities. Those things are there'sjust not a million things you need to verify, or it's predicat logic to saing.I want to make sure that you know this person. They were always checking thatthis person signed this transaction. If we're going to do this operation on thedatabase, always it can do it in asleep. It's just simple praticof logicits doneor you can even mention it part of this, I'm kind of curious. Youmentioned the way packed is used and and what iscamable, of doing relative to other programming languages. Is thissomething your hoping's going to Tak off outside of the block chamber? We talked about it a lot because it'sso useful for database applications in the sense that pack, if you wanted towrite a really principal back in for your job script application you culddownload pack today, which has got a sequel light engine in it run packed Ashess, which is our webrest server, giving you the hard Blackonepi and write a job scriptopplication. This is what our damoats do um and it's a really it's packed asfast. You know it. It does somewhere in the order of ten to twenty thousanddatabase operations. An second sequel ight is great. I don't know if you'refamiliar with that. That's great yeah, it's amazing! So, like you get thisgreat principal language, you can prove things about it and, in truth, most weaps aren't doing anything that complicated. I mean you know, Membewe're not talking about like Google maps we're talking about, like you know,a store front or a shopping card or whatever you might be doing. You know atask tracker Scheduleer, just something that, like you know, like a scheduler's,a good example. You might have something you might have some greatdynamic programming thing that solves your scheduling problem, but at the endof the day you want to make sure it's storeright and you want to make sure itdoes all the right things or that data and doesn't let somebody write thewrong thing. You could use pack to do all that and I think it would be a p terrificsolution Um. So, but that's you know, that's uh, I think block chain is a very it doesn't seem like, but I actuallythink it's a very satisfying space to work in in terms of building gaps,because I actually think it's it's a nicely constrained space and it'sexactly the space pack is designed for. I think some of the concepts inBlockchan need to make their way out into the larger programming community,namely t the ubiquitous use of public ecryptography to to safeguard systemsis just better security. Men Most, you...
...know, forget, stop logging into yourapplication start using a leger wallet or whatever use a hardware wallet use aNA. You know use a ubikee that is going to be that's the way. The future isstateless authenitication through public keys and Pactis there. For you,it's ready to do all that, but I don't think programmers are there, yet they rthey still want to log into their database. They still want theirinsecure loggans ecause, that's Wausers, whoe used to you know this stuff isn't,as everybody knows, wallets are very unegonomic. So right now, so thosethings get solved and I, I foresee US moving into a a world of safer userapplications that don't necessarily run on a block chain at which point tact is,you know, is purpose buelt to that kind of thing yeah and I think we're allline with that fish and especially oarlisters on this show. I mean we vewe've seen the benefits and W we'rewe see where it's going. It might not bethere yet. The user experience might be a huge barrier to adoption, but we see the benefits already. So I Ithink that's great, but one other thing that people have a problem with is thefact that they can't have certain scale ability guarantees. So I was wondering as os the blame as Seguim sure, but can you talk a little bit aboutchainweb Um? We Ad Jon the program before to talk about it um it's part ofthe Cadana platform as as well as packed. I don'tknow if I should call it a platform or not. I don't know what the right term,forty dollar, we called he hiberd blockting blactform, because we re go ntalk about solutions that can live on private chain hand, pote chain and goback and forth, and that's ideal in my mind. That's what I kind of hope. Teplason would have been um but but h yeah. So that was probably one of themost interesting conversations ye had. You were one of the very early gas inthe pare. I think it mighthave been like psod, O five or something M and Um.You know the reason is: is 'cause. I watched the videos on s BC last yearand wills talk popped out at me immediately as I was like we needd tobook these guys, because chainweb was just fricking cool from its not just asgraphics. You got some pretty cool: U Ainir, crafpings! I think I still gotyour tshirt and I wear it every once in a while Um, but it's I's a cool Tshir.It looks Rad, it looks like love it. It looks like some sort ofslice out of like a time. SCIFI movie, you know about time, travel, anyw, Um, but uh. The H, the thing about CADENTAthat I that I love I just your approach: Tho scill abilities, Tey, baked in andbe extensible and see kind of novel and that it still relies on propl work, buta scaled scalled down person of it Um. I think Itoud be that considering timeconstraints that we reference o the other other episode. If we want to getIno the nitygritty details about Chanbr, but instead, let's just take up thatconversation from where, where we left off before and tells what's been going on with thechain web because system who's using it. And what invasions have you made an hey?What problems have you found in developing it? Because I guarantee youthere were some the POW that you've had to like adjusted him so yeah. What'sthe development like been on that wats designe design going and have therebeen any changes since we last talked yeah great Um, I mean t, you said WHO'susing it. I mean just to touch briefly on that the the most receptive audienceis people who basically want to leverage cripto as a space forlaunching financial products or for representing new types of assets, butWAN to do it in a safe way and don't want to be hampered by scaleabilityconcerns and and want to have tipe controls around things. Like you know,KYC. You know your client and have a have a have a smooth gayway onto aprivate system, because so much stuff shouldn't really be on a publicblackchain when you're you know like uh, but it it all comes down to scalabilityin the end, because you know every every program that runs on that isbased on with Bedpoina backand or with you know now, with a teriim with usback in is basically a taking time. On of you know your program getting popularenough to be like cryptic kitties and then the whole thing slows down so umyeah so chain. Webs design has not changed and in fact we just our papergot accepted for, Oh God, the name of the conference M that proves chain websecurity properties in terms of the ability for a malicious minor, to beable to censor users. CANEWEBB is contuitively correct in terms of how itchecks Hashes, but the thing that we wanted to see was: would it be possiblefor attackers to meaningly attack the liveness of Thiston to you know tocreate things like censorship and some of these things that we've seenAlgarand and some of the other? You know interesting research into kind ofblockchains in general and theisecurity...
...properties beyond just something likedouble Spannd, but two things like censorship. That chain web offers anincredibly resilient solution, TOR, so that that's that paper is coming outshortly. We're very excited about that Um, but h, the other one of the maininteresting things that's coming up now. Well, I mean the big news to share is,of course, that we launched our test net at the end of March, which was abig accomplishment and an a really great shot in the arm for the team. WeSAII public test note, or is it just a clock right now as a close test nut h?The next version is coming out at the end of May, and that is going to be invite participation by invite and then,after that, it's going to be full public. So these are coming out in likean every two month clip. I won't tell you we're going to make abig announcement of our live date, but it's it's not it's! It's we're notgoing to do a million of theslet's put it that way. There's a finite number oftestaets, that's going to happen, and then we're going to go into production,UM and h. One of the most interestingthings about that is that something emily and I work particularly hard onis Um that the coin logic inside of chainwebis actually handled by a pack smart contract. So this means that all gastransactions Um allcoin rewards and then all transfers between users happenin a pack, smart contract that is formally neurified Um. Now that's Nifty,of course, from a dog pood in point of view, and it also means that we won'thave some of the eragonomic issues at a therim encountered between Rs c twentyand the and the Etherian Cok en itself, in the sense that everything can usethe same interfase Um, but also it revealed that one of the things thatalwas part was part of Changwa was the the fact that we needed to burn coinson one chain in order for them to show up on another thing, he needed a way tomove coins aground, and we always knew that we were going to use simplepayment verification. You know mircle proofs, where a chain can find themircleproof the image of the UH of the mircle Hash from the other chain. Thatway, you can have trustless varification. That accoin was indeedburent on the other chain, and now you can create it on this chain and thesystem conserves mass and can't have a double spen and so on so so forth. Whatemerged was that the very technique that we use to do that in the coincontract is, is an automatic two step transaction that will be available toevery smart contractovelper. So every year see twenty will be able to do this.Any asset that lives on chain web will be easy. In fact, it'll be entirelyautomatic for you to burn an asset on one chain and move it over to the otherchain. We always knew that this was going to be possible. We didn't realizeit was going to be this easy. It almost erimitive it. It is a primitive it's.Actually, it isn't that's coming out in V, one it pack has these Um thingscalled packs which are multistep, so we have functions and then we have packsand packs are multistep functions and it it emerged that the shape of themulti step function was the natural shape for a two step transaction acrosschains and allowed it to be automated so that now you can have a trustlessexchange from one exchange. I then other it's as simple as writing one ofthese functions and you can even do formal barrification proofs about thestate that emerges on either side. So actually KINDOF have a question aboutthat. How Wis that managed- because I, from my recollection of how you map UmMatthew chains out, not Everyn, not every chain- is connected to everyother chain. So how do you Ma eventilly? They are have really yes of Mortinproperty up chainweb. Is that uses an expandegraph that has a property calleda diameter which is a maximum shortest path to any other chain? And it's avery important. That's actually what the Tshirt shows right, OAS you get outto the edge the transaction. That's in the middle,you know one Y R. It is travelling thromgh time. So in the past the youknow the the conformation death. If, if you want to see it as that is when yourtransaction has been imaged into every other hash in the entire network- andyou know, and the part going forward is how long it will take you for yourtransaction to show up and and every other one and that's very important,because it means that h. It does mean that like if you want to move assetsfrom one chain, it will take that much longer for that second transaction tobe possible, because I that chain won't have seen your transaction. If it's notright next to it, it won't have seen that transaten Likeo ar and make likeaons. Do things like this, because I think a lot of people have someintuation into that, especially based on the so e people were in thi space.Is that m like just because that may be the case where it takes longer to movefrom one change o the other doesn't mean it's, it's a bad thing, Bu! Thinkof it in terms of like yeah, ing your your yourvideooncharacter from one relm to another and in something mulimassiveLTO play ronline camright. You don't do...
...that all the time, but you can and Rit's useful in some cases, and so l Ke the fact that you're able to do that asa primitive and you can verify that your character will show up with allthe things it had previously is a very good thing to know right that it's safe and that itactually works. I mean that's, I think, and interestingly enough, Um NSBC,Italic sfok, and he talked about etherium too O and how they're going tomove resources around their shorted network, and it turns out they're goingto use a very similar approach. Um I mean the difference is, is that weissued testsin out of this like a month ago, and God knows when they're goingto get that out. Um this already works, and we already have the mechanisms inplace to do this, although is on a new consensusogrinthm as well. So it's kindof like they've got a lot totest and go through so yeahjust. Just for aaudience in Casse, they haven't heard to reek o e ISOD you're scaling proofof work like yeah, no ely. What you're doing you're actually able to scaleproof of work, and so maybe a quick synopsis of that would be would beessential. But I do believe that going through the previous episode, which isa deep tought, would be beneficial to anybody. Listening to this yeah it it'sa simple concept. It basically says that if a blockchain, a bit quinstyleblock chain drives its security from incorporating the ash o e of a blockincorporating tha acthal king before it bi chainweb uses an idea. That's beenaround for quite a while, but canweb is the first apploinment that we know ofthat. Actually does this, and certainly does it at the massive scale that we doit chaingweb says that you can incorporate Hashes from other blockchains that are that are producing blocks. You know in the same networkand the main innovation there is to is to apply the graph theory and say thatwe can conceive of networks that are basically C thesix bandergraphs thatbound how long a chain is separated from any other chaine in the network,which ends up being a very important security property as well goals. Themain thing that I think you ought offer heres is that canactivity grip rightand that's so that's, basically what Changwat is and but what you get for itis you get every single chain: that's in the system is running independentlyand that's a very good thing, because that's where the throughpert comes from,so we're not going to be orders a magnitude pastor on a given Chan, thenthe theorium today or bidcoint. It's the fact that we can run ten a hundreda thousand ten thousand of these things, and we're really only constrained byband with that's been an exciting thing to see too, is that Um is that the network itself doesn't chewup a lot of cvu to compute consensus over the entire. You know because thereis some consensus work that has to happen, which is that you know therecan be different forks on a given chain. There could be different forkshappening in different parts of the network so and there can be differentkind of combinations of porks that are happening s, something that we call acut, which is basically the wavefront of all the flocks that are beingproduced to the essential property of Chana. That's so important thatdiameter is is so important because it bounds how far out of Sinc you can get,and it makes it that that problem never really spins out of control and butthat at the same time it's the property that makes it impossible to censorsomeone else. So it's a very, I think the thing that's very satisfying abyutchain webb an has been very satisfying. Abyt doing the engineering is- and Idon't take credit for this by the way we the people working on this enterTeamor, some dery vanced people, um H- and it's really been amazing- to seesee this thing actually come to life. Um is that the the principals haven'tchanged. H, the you know, the engineering s has had to happen, butit's it's leverage these ideas and been able to come up with a practicalapproach to consensus that doesn't bog down either in simulation or intestetintestat we got to our first milestone was getting to a hundred thousandblocks. That was ten thousand blocks in each Chang and and having it. You know,fork things get things do get out of whack momentarily and then they comeback into consensus and then, in that sense it's no different than like theoccasional appearance of a fork in bicoineorther. So have you done stresstesting on this to to see what kind of ridiculous deput you can get on this?That's that's what we're moving to right now, um! You know we have somelow hanging frod of things that we have to address, such as. Ah We you know theinitial one was a memory based system, so wer we're just starting to roll outthe diskbase system now, so that obviously memory base system is goingto run out of resources. Shortly on that, we are able to stress test interms of like running at very fast mining rates and things like that M andwe were happy with what we saw there Um. So you know the next thing is alsolike really cramming blocksfull and seeing what kinds of h you know whatthe transaction load looks like and what that you know the work requiredthere. Another nice thing is that, unlike a theorium, we don't transmitthe actual results of each transaction...
...or the underlying database, so thebandwith usage is much smaller and eventually we'll be able to do thingslike checkpoint the application database so that, as opposed to havingto download like what is a hering af to download today, it's it Ted, somewhatkind of D or nnotur using, but it can get up there. Yeah, like a big fulenote, I think, is Interrbiz O. I think an Arkhive node is just around a turbayeah, but that's ll. No one runs them six, five on right, so I mean that's something thatwe will. You know this is not something we're going to do for Maynet, but but shortly after maned, we'll startintroducing ways that you can start up with a smaller image. Simply becauseyou know the engineer packed as a separate layer manages its data andthen just introduces Hashes back into the system to verify the content. So Itole how far back? Does somebody need to verify on an arpular Shard to knowthat the whole systemis correct, if you're, only maintaining one? I don'tknow, I don't want to call in a Shard, although it Kinda is a pedicilar Cha,Char, osn'N, empracise, termen yeah, it really is a pardilar chain, Um uh on the chain web, like you, don't haveto maintain the full state of that chain, the full history of thatcanyolneed to retain certain. Unless you want a DI. Unless you want to be asuperproof of work, maxunless be aing th. There will be those people n. TheyFafi that purpose right, itces the thing about creakancle work is tru towork. Is the only system that you could go off. You could have a networkpartition for a year and recover. It's the only system in history that coal dothat, so a maxinlist is going to be like you have to maintain rollbackcapability, till Genesis Block, but in practicality that would be an economicdisaster. Right I mean if big poin admitted a hardwork that was a year old.Everyone would rage quit mean yeah, so I mean Praso, you know sopractically that's not true Um! So, but it'. It's just interestingbecause a lot of these, basically by having kind of solid engineeringpractices like a decouple design, notheds consensus, doesn't care aboutpaloads consensus. Just cares about these mar clashes coming through andmining and making sure that they all agree on their ancestors pack runs as aservice that leverages that and that produces. You know a list of MiracleHashes that form the Black Hash. But the system isn't architected aroundthat. So it would be possible, for instance, to have these kind of lightnodes Y H, that's visioning there, because, like you, don't because you'reD, Youre consensusdependent on other um other h chains in the network, youdon't have to look as far back to get in higher degree of confidence. Thannowtransaction on your current chain is correct, because the whole network isgoing to Screan at you. If that somebody does something wrong on yoursystem were f you're submitting something that doesn't match up. It'sjust like infeasible to even think that maybe even two hundred state changeswould would be more t n. That would even be required for for the system,like You'e Gonta, know, you're going to know ot te to if o and Rost forks arelocal too. So in that sense they get handled by the chain. That's there.It's not like the whole system is porking, thauch or even or a moreaccurate way to say that is that a fork at the cut level doesn't mean thatevery single chain is out of SINC. It means that a few chains Ar Iwu tink-you know there there's there's a probab probability that all could go out ofsink, but that doesn't matter, and it's also very unlikely, so the system-ninety five just like bidcoint, you know, which isn't working all the timethe system. Ninety five percent of the time is a well behaved system andbecause of the security, you can consider a much lower concrirmation det,so to get back a little bit to pact if we're having cross chain. CommunicationUm with with with pact, is poroverification built into that, and what can, if so, is e therearespecial challenges around that, especially given the fact that thingscan fork? No because the the the great thingabout chain web being a trustless, 'cause Emember, one of the things aboutlight clients and simple payment parfocation. Is that there's a trustproblem? Normally the chain web doesn't have this problem. CHAINWEB has ahundred percent reliable, ah Oracle of t of whatever is happening onthis other chain for that cut fork. So, in other words,the same reasons why mass conservation works with forts and Bidcoin is whycross chain stuff works on chainwit. In other words, you you deleted the coin. If that getsforkd. Well, guess what you're never going to be able to create the ot one'cause, the fork will go away if you peleted the coin and you create thecoin and that whole thing gets for it. Well, then they all go away. If justthe crate goes away, fine, you have to send in another creat, and you know intransaction reintroduction. You know this is something I've had to learnabout is the whole. You know like the...
...ways that mempools reintroducetransactions safely, you tatoshe paper, just glosses over the AH OPO can shorothings out but come on. That's not that's a terrible user experience, sothis whole idea that, after a four you'll have to send your transactionand nobody does that that happens automatically. So, as a result, thesethings all Beha they're all very well behaved with respect of works and, likemany other things that if we had more time to talk to a formal of varicationand some of the things emily could dive back into is one of the things about packed. Is thatit's a very well specified system with very tight boundaries, so therre thatRepres, the the cross chain burn create, is verifiable by having an axiom thatsays that this can't produce two states right that that, in other words, thatthat create can happen twice. That's what I was going to have. certalofbacto is effective because you have a a language like peck that has thingsthat are form of verifiable. You have a lot more security, garantees on movingthings across from state to state ecause they're, both operating on thesame foundational, language guarantees right right and you know and like if, if, ifwe were to when Emiley talks about you know, th, there's different levels ofform of Arplication, you know like we're. Gonna, we'regoingto be doing an m a with a certic soon who have done stuff involvingtrying to like formally verify an entire operating system more an entirenetwork. I mean it gets very deep if you want to actually get to the levelof saying so we're going to layour things on top of each other. Instead,we're going to say, we've proven the Chade wa a safe and that it thatcensorship is not possible. We will base pack on a set of principles thatwe demand at the runtime guarantee, and then we will do formal gerifetation ontop of that. So Emily we got ta rap up here, but I haveone more kind o like thing I fel, I feel like a good way to close us out.You just got into the space what eight months ago, you said what has the thing, so this is kind oflike been your domain for a while. What specific challenges have there been in indeveloping onpact, an impact, anforepacked and building pack Um? They kindit threw you off and you didn'treally have to face them in other spaces and if there's anything elsethat maybe we should have covered that we didn't you know, please feelpredoltater, that forokay yeah Um. I suppose it's the the way that pact isconstructed Um normally, when you think of a language you think of a compiledlanguage, but PAC happens to be interpreted and interpreted in aninterpreter that we've written in high school, which is a compiled language. So it's kind of a strange shift andmentality that your concerns have to be. How do I represent my language in termsof not just what I want for a feature or afeature set, which is the pack language, but also? How do I express this inHascol, the language that we wrote this ID and then how do we handle concerns likerun time typing? How do we handle concerns? Like Um? I guess how do we even express formal verification for this languagein terms of this other language that it sits, on top of which has been totally contraryto at most of the thethings that I've done, which have been very much compiled? Um? I guesslanguages that have a denotational semantic, a mathematicalsemetic Um and it's just been a fun experience. That', that's basically it it's justwrapping your head around, not just like the language itself, but but thefeature said that that we offer being not just a programming language but avery opinionated programming language about the things that you should beable to do poses a certain set of challenges whichare really unfamiliar to someone whobelieves that you should be able to do anything in programming, language Um, but yeah it. It's turned out great yeah. I I'm really excited by Cadena. Ithink I can't wait to see the live, testinet Um h steward. Are there anylast minute um announcements you'd like to make h before Weu were off thes Su. Well. One thing I wanted to point outis that on the Turing H, completers incomplete. We have aninteresting post on our medium that was written by non technical person hereTCADENA and if that's just interesting, to see somebody grapple with theseconcepts and why they might you know, be of interest to somebody who was anecessarily a programmer. So I just wanted to put that out there Um, but yeah I mean we. We covered a lot ofthe really exciting stuff. That's going...
...on here, Um, you know I I go. I gotthrough some of the upcoming highlights of our you know, March, to mainnet andare kind of steading Ka and so testin at things Um we're super. I mean it's, it's a reallyexciting time around here. Um. The other thing is that we did h. You knowjust to kind of give a quick shout out to what we've been doing in the privateworld is that we did h roll out a cloud based solution on Amazon in Januarywith a private blotching, and that's that's just something that increasingly,you know the world is going to be one where there's private blockings andpublic boxings and you can. You can use all the tools. Wyou talked about inpacton a prive blockchain as well, so that's something that and there's evensome teachers there that aren't ontrain web like the ability to haveconfidential transactions that, where that other people can't see um withtheir own computational models associated with it, and things likethat so um, it's just been really exciting here andalso working closely with our clents eeas. Some very exciting announcementscoming out about these new financial products that are going to be launchedon Cadenna on the on chainweb, so Um, it's just. I would just encourageeveryway to stay tone because there's a bunch of exciting stuf, that's going tobe coming your way very shortly. Okay, where do they go whet? Do they go tostate soon? CAANADADAO? We have also have a discardchannel. We also have a newsletter you can sign up for there h. You know:We've been we've. Actually, I've been stirring up some starring up someconversations, ontoit or there'se. You know so ee we're finally starting toget our get our message out, but please come join or discord. gener. There's alot of really interesting conversations happening there yeah and I'm on thereall the time. So if you won't ask any questions about formal arrification,more indepth, where I can actually write this stuff out or Porjani yeah difficulty, orm Yeah thisis a difficultptform for indepth, I mean we do try and deep dog as much as possible, butwe have a limited set of time and we are already over and that's H, that'sbecause there's so much interesting work out in it Adina. So I'm reallyreally excited Tha Havyou guys back on, and we will definitely reach out to you tohappy back on again in the future of CEN, Perbetak.
In-Stream Audio Search
NEWSearch across all episodes within this podcast