@@ -4,10 +4,155 @@
44 <title>Urbit</title>
55 <link>https://urbit.org</link>
66 <description>Urbit is a personal server built from scratch</description>
7− <lastBuildDate>Thu, 18 Nov 2021 19:21:20 GMT</lastBuildDate>
7+ <lastBuildDate>Wed, 08 Dec 2021 19:13:57 GMT</lastBuildDate>
88 <docs>https://validator.w3.org/feed/docs/rss2.html</docs>
99 <generator>https://github.com/jpmonette/feed</generator>
1010 <language>en</language>
11+ <item>
12+ <title><![CDATA[Report from the field: Assembly 2021]]></title>
13+ <link>https://urbit.org/blog/2021-11-18-report-from-the-field</link>
14+ <guid>https://urbit.org/blog/2021-11-18-report-from-the-field</guid>
15+ <pubDate>Thu, 18 Nov 2021 00:00:00 GMT</pubDate>
16+ <content:encoded><
18+
19+Before Assembly I committed to write a ‘recap’ post for everyone who couldn’t make it. Originally I figured this post would be an opportunity to walk through the list of things that we shipped and showed off in Austin. But it turns out that the most important thing about Assembly was simply the way it felt to be there.
20+
21+I’m not sure it’s possible to really do the feeling in the room justice, but I’m going to try. Then I’ll get into the announcements and happenings for those of you who couldn’t make it.
22+
23+But first, a quick note:
24+
25+We ran Assembly under the [Chatham House rule](https://en.wikipedia.org/wiki/Chatham_House_Rule). Basically, you can talk about what happens at Assembly—but you can’t name anyone.
26+
27+I’ve run many of our Urbit events this way because I think it puts people at ease. Everyone in the room can just relax, connect with one another, and hang out without worrying about being named on the internet.
28+
29+I’ll try to abide by the Chatham rule in this post which is why no one is named specifically.
30+
31+
32+
33+New world energy -
34+
35+In the months leading up to Assembly we were totally focussed on using the event as a release date for a bunch of different lines of work. Coming out of that sprint, we didn’t really know what to expect. We wanted to make sure Urbit was ready for people to build on and that everything we were going to ship worked well. What we didn’t realize was just how emphatically people are <em>ready to build</em>.
36+
37+When I got up on stage on Friday night to welcome everyone I was really impressed by the room itself. It was packed with people who looked excited and motivated. The room just looked amazing. There were so many different kinds of people staring back at me. Some who I recognized from the earliest days of the project, and lots I had never seen before. I’ve been at my share of Urbit events, but this was something totally different.
38+
39+We didn’t have much scheduled during Assembly. Most of the time was unstructured to allow for freeform discussion, sunbathing on the lawn, and gathering at picnic tables. The panels that we did schedule will go down in history. Panelists discussed questions about creators, escaping reward systems, and the role of DAOs from governance to governments. There was hard money with a computer on it, Moloch shoes, community members grabbing the mic, and a talk written two hours before it was delivered about the relationship between centralization and decentralization when it comes to UX that blew our minds.
40+
41+I spent the weekend of Assembly in almost constant conversation with people building Urbit hardware, experimenting with different kinds of Urbit software, and thinking about incredible things like a Nock chip. I talked to the lead architect of a CPU from the 90s, a former senior US government official, an editor of a well-known literary magazine, the inventor of a new display technology, musicians whose work I already admired, a fragrance designer, writers, and, of course, lots of engineers and designers from many different backgrounds. Data scientists, systems hackers, language nerds, someone running a successful currency. I watched these people get projects off the ground, start raising money, plan the future of Urbit hosting companies, and plan new features for Landscape. I saw a last-minute warehouse party come together that kept people talking well into the early hours of the morning.
42+
43+Where did these people come from? All over the place. They have this incredible <em>new world energy</em>. They understand immediately, intuitively that Urbit has the potential to be a foundation for the society they want to live in. I’ve never seen anything like it.
44+
45+This energy seems to have come from the very practical work we do day-to-day: building Urbit, refining it, making it easier to use. The crowd at Assembly was somehow brought together by Urbit itself. It’s insanely exciting. It makes working on Urbit feel even more like a form of definite optimism. The system builds the community and the community builds the system.
46+
47+
48+
49+Urbit is ready to be built upon -
50+
51+Sometime in early 2021 we realized that there were many lines of work converging on a single theme: ‘Urbit is ready to be built upon’. This is the spirit we wanted to bring to Assembly, and it was very much in the room in Austin. Some of that feeling is still lingering on the network. I think it comes from some very concrete improvements that have been made to the system.
52+
53+We’ve always wanted Urbit to be maintained by a self-sustaining ecosystem and, early this year, we could see what needed to be done to really let others begin doing so. There were four parallel projects that came together to hit this milestone: Software distribution, star.market, developer and operator guides, and the Foundation roadmap. We talked about all of these things in the Assembly keynote (which you can watch [here](https://www.youtube.com/watch?v=ywj36TUtbS4)), but let’s touch on them one by one.
54+
55+Software distribution
56+
57+The most important thing that we shipped just before Assembly is the ability to actually package and distribute software over Urbit itself. It’s now possible for someone to build an app, package it up, and share it with a friend directly over the network.
58+
59+For their friend, the experience is incredibly nice. You can simply send someone a link and they can install the app and run it themselves, on their own urbit, right away. The whole thing is peer-to-peer, of course. There’s no app store, no vetting process. It’s networked software like it’s supposed to be: people computing together freely.
60+
61+We’ve been saying for years that we want people to build on top of Urbit and we always meant it. Now it’s possible in a way it never has been before. To check it out, watch [this segment](https://www.youtube.com/watch?v=MA8sqFi8Bd8) from Assembly.
62+
63+Software distribution can get better in _a lot_ of ways, and we’re continuing to work on it. But it’s live, and people are experimenting with it already. There’s Chess, there’s Pokur, there are video calls (although they’re still a little buggy). Everyone seems to love ‘pals’ and ‘zone’—but you’ll have to get on the network to check those out.
64+
65+star.market
66+
67+We’ve always used the address space to fund our work as one of the primary Urbit developers. As Urbit has become more useful, and address space has become more expensive, it’s more and more difficult for others to do this. The community saw the need for developers to easily use their granted address space to fund their work and a higher resolution for the Foundation to fund contributions to Urbit.
68+
69+This is what [star.market](https://star.market/) and the WSTR project are for. WSTR is an ERC-20 token that is backed 1:1 by ERC-721 Urbit stars. Unlike a star, a WSTR token can be fractionally divided, allowing for a broader distribution of ownership of Urbit. WSTR was built by the community over the past couple of months with no involvement from Tlon. Tlon did, eventually, help to put together star.market—the interface for interacting with the WSTR contracts safely and securely.
70+
71+I’ve come to think that WSTR can be a powerful tool for funding new Urbit projects. I’m excited to see what both our early community of developers and operators can do with it, as well as the nascent Urbit Foundation.
72+
73+Guides
74+
75+As we make it easier for developers to build software, operators to participate in the economy, and communities to make Urbit their home, we need to improve our documentation. We always like to do things bottom-up: the product work comes first. Well, the product is now live.
76+To this end we recently launched:
77+
78+[operators.urbit.org](https://operators.urbit.org/) collects all of the information about participating in the Urbit economy, running infrastructure nodes, and participating in governance in one place.
79+
80+[developers.urbit.org](https://developers.urbit.org/) has an overhauled program for learning about Urbit as a system and beginning to develop on top of it.
81+
82+[network.urbit.org](https://network.urbit.org/) allows anyone to explore the network. View galaxy transfers or how many planets a star has spawned.
83+
84+We’ve got a lot more planned in this area of work in the coming months, and these three sites are a great start.
85+
86+Urbit Foundation
87+
88+Over these past few years we’ve operated the Urbit Foundation as a ‘protocol’ inside of Tlon. Our goal has been to develop that protocol to the point that it’s refined, working, and can run on its own outside of Tlon.
89+
90+Josh has done an exceptional job running the foundation protocol at Tlon over the last year or so. He and I have been working closely together on everything that Tlon builds, while also coordinating our community of contributors. I’m very excited that the Foundation, with Josh as its Director, is now separating from Tlon as a fully independent entity focussed on supporting the ecosystem.
91+
92+Assembly was the perfect moment to begin formally separating out the Foundation and, as of a week ago, it is an independent entity. We’ve thought long and hard about how to make the Foundation an enduring, stable organization. Josh will be the first Executive Director but, ultimately, the Senate of Galaxies will elect the Board. This will keep the Foundation accountable to the network as a whole and I’m optimistic it can work well.
93+
94+If you’re on the network, you can read more about the Foundation in ~wolref-podlex/foundation.
95+
96+Assembly 2022 -
97+
98+I had more than a few enthusiastic people come up to me at Assembly and ask what we were planning for Assembly 2022. I have absolutely no idea, of course. We poured all our energy into making Assembly 2021 a success.
99+
100+Given what I saw in Austin, I’m pretty confident that next year we’ll be in completely new territory. The goal of this project has always been to build a completely new digital world. And now, it seems to be building itself.
101+]]></content:encoded>
102+ </item>
103+ <item>
104+ <title><![CDATA[The Promise and Paradox of Decentralization]]></title>
105+ <link>https://urbit.org/blog/2021-11-18-the-promise-and-paradox-of-decentralization</link>
106+ <guid>https://urbit.org/blog/2021-11-18-the-promise-and-paradox-of-decentralization</guid>
107+ <pubDate>Wed, 17 Nov 2021 00:00:00 GMT</pubDate>
108+ <content:encoded><
110+
111+Every so often, a platform will do something outrageous—changing its terms of use, kicking off API partners, restricting [the content category it was built on](https://www.theverge.com/2018/12/3/18123752/tumblr-adult-content-porn-ban-date-explicit-changes-why-safe-mode), banning Donald Trump, failing to ban Donald Trump, etc.—and we'll all realize we're utterly dependent on centralized entities that can make arbitrary and unaccountable decisions. Sure, you can build your own minimal Facebook or Twitter clone, if you really want, but can you build your own Cloudflare? How about your own payment network? If your company does something legal in your country but banned in America, and the US decides to sanction you, which leads to local banks cutting you off because they can't survive without access to the dollar, are you going to build your own reserve currency? Your own Taiwan Semiconductor Manufacturing Co. or ASML?
112+
113+There are, to varying extents, efforts to do all of the above. But what's worth considering is that <em>all of these bans happen through centralized actors running on decentralized systems</em>. The Internet was supposed to be a totally open set of protocols that anyone could interact with, and for a long time it was, and yet getting kicked off Facebook and Twitter means being exiled from public discourse. Banks are regulated, but every country can set up their own banking regulations, and different countries see the social role of banks very differently; for some countries they're a tool of economic planning, for others a way to help connect local companies to global markets, for others a source of money that can be channeled to politically favored groups. The chip industry was historically very open to new entrants; the transistor was developed at Bell Labs, and for political reasons AT&T licensed it to all comers at a low price.
114+
115+And yet all of these originally decentralized systems end up facing some degree of centralization.
116+
117+The promise of a decentralized system is that anyone can build anything they want, because no one owns it. There are three important features of this; two downsides and a caveat:
118+
119+- The first downside to "Anyone can build anything" is that "anyone" means <em>anyone</em>, and the people to whom decentralized systems are the most attractive are the ones who are banned from other systems, often for good reasons. Free speech absolutists want to be defending Aleksandr Solzhenitsyn or Eugene V. Debs or even Lenny Bruce, but if you want to get a sense for the typical piece of content enabled by a totally uncensored communications system, check your spam folder.
120+
121+- The second downside is that a lack of ownership means that no one is responsible when things go wrong. Bitcoin doesn't have a way to censor your decision to move money from one address to another or even a protocol-level sense of whether you're buying Alpaca socks or a rocket launcher. (nb: You are almost certainly not buying a rocket launcher with Bitcoin; you are at best getting scammed, and at worst [getting in trouble](https://www.justice.gov/usao-cdca/pr/los-angeles-county-man-pleads-guilty-federal-charge-attempting-obtain-biological-toxin)). But this also means that the protocol can't tell when you meant to send your life savings to your cold wallet and sent it to the wrong address instead.
122+
123+- The caveat is that, to quote a [<em>Diff</em> piece from last year](https://www.thediff.co/p/amazon-a-new-kind-of-antitrust-risk#:~:text=does%20it%2C%20too.-,Technology-Governance%20Fit,-Pondering%20Durian%20has) ($), "[A]ny decentralized order requires a centralized substrate, and the more decentralized the approach is the more important it is that you can count on the underlying system." This applies to cryptocurrencies (you can trust the protocols) and to the Internet (ditto). It also applies, in an interesting way, to the increasingly decentralized world of free trade and free-flowing capital: money can only flow and deals can only be made if everyone has a consistent sense of property rights and contracts, and the definition of those concepts will typically be determined by whichever participant in a transaction has the more sophisticated financial and legal system. Globalization ends up being a bit like Henry Ford's pitch: you can use any economic paradigm you want, as long as it's the American one.1
124+
125+An open, decentralized system is <em>sparse</em>: there's room for anything, which means that most of the possibility space consists of nothing at all. This creates a natural demand for onramps—Coinbase for figuring out Bitcoin, portals for figuring out the Internet, TSM for turning chip designs into functioning products, and the like. These create a complicated dynamic: these onramps are built on an open system, but part of their function is to close off some of it. And the better they do that, the more value they can capture. Meanwhile, because they have a monopoly on what they've fenced off, their economics support providing a better user experience. Make a really helpful update to the Bitcoin wiki, and you can feel good about yourself and perhaps contribute to the price of Bitcoin in a highly indirect way; design and launch an improved onboarding process at Coinbase and your contribution is quantifiable, and affects your next cycle's equity grants.
126+
127+This privatization proceeds in three different ways:
128+
129+- Some companies start building on an open protocol and then slowly make it their own. Chrome's decision to make the search bar synonymous with the address bar was a slight improvement in the interface, but also a very strong statement that Google had replaced manually typing in URLs as the default way to navigate. (The strongest evidence for this is the frequency of navigational searches; [the most commonly-searched term on Google](https://www.mondovo.com/keywords/) is "Facebook" and [the most frequently searched term on Bing is "Google"](https://www.bloomberg.com/news/articles/2021-09-28/google-tells-judges-it-s-so-popular-it-s-bing-s-top-search-term).) Typing in URLs is a sometimes-decent way to find what you're looking for, though [the half-life of links is about two years](https://blog.zomdir.com/2017/10/the-half-life-of-link-is-two-year.html). But guessing at URLs can be [perilous](https://en.wikipedia.org/wiki/Whitehouse.com). No one is responsible for fixing this, but Google is the closest approximation, because what they are responsible for is solving the "look for something on the Internet and get the wrong result" problem, a different but related one from the broader task of allowing arbitrary site owners to host arbitrary content. Privatizing is effective, and solves problems for users rather than protocol designers. But it does go against the spirit of the original network.
130+
131+- Twitter is another example, except that they basically created their own open mostly-open protocol and then slowly took control of it. Tweets were originally a simple format, with 140 characters of text and a bit more metadata (this made it compatible with SMS, which had a 160-character limit). For a while, Twitter looked like it would operate a novel protocol and let third parties decide what to put on it and what to read off it. And then the company started to realize that an open system was also one where it was trivial to filter out ads and recommendations. So the outside partners gradually got cut off.
132+
133+- Facebook—the product, not the company—is a third example. It essentially implemented a missing element to the protocol: <em>identity matters</em>. When the original protocols were being hammered out, identity was a problem taken care of by the fact that getting online required steep hurdles; if everyone involved is affiliated with a university that trusts them to use a PDP-10 responsibly, spam or abuse were not big concerns. (Not that early usage was [strictly professional](https://www.theguardian.com/science/2013/apr/19/online-high-net-drugs-deal).) With billions of people online, accessing relevant information can mean traversing a graph of people rather than links, so the identities of those people becomes important. To the user, if not to the network itself, a name and relationship is a far more important unique identifier than an IP address.
134+
135+This pattern raises a question: is centralization just a natural tendency of all networks? Are we destined to have a "decentralization sandwich," where there's a hard-to-change set of protocols, something open built on top of <em>that</em>, and a series of closed systems built on top of that, which are the only ones the average person interacts with?
136+
137+One of the interesting alternatives to this is [Urbit](https://urbit.org), which is trying to build a network in which identity exists from the start, and is neither free nor monopolized. One of Urbit's principles is that users own their data, and while they can use third-party services, they're sharing their data with services, not using a login to access information that lives on someone else's servers.
138+
139+This is a nice theoretical solution to the "build your own" problem above: if someone tries to start Twitter-but-without-banning-X, they begin with "Twitter-but-it's-100%-X," which seems bad until they reach the next stage where trolls arrive and they start to learn that Online Censorship is mostly about spam and gore and only occasionally about politics. But if they're moving their data around, and their friends graph with it, then spinning up a separate instance of the same service, pulling in the same content from their friends, and whitelisting someone who's blacklisted elsewhere is a lot more feasible.
140+
141+At least at first. One of the problems with owning your own data is that it ignores the question of what format that data is in. Data formats are sometimes considered carefully, but they can also be hammered out fast to get a minimum viable product out the door. Then they evolve over time, accumulating cruft and complexity, until they might as well be encrypted.
142+
143+And indeed, what's to stop someone from having a proprietary format that's literally encrypted? Or one that gets changed to an encrypted version later on? This is not a trivial point; if you're ever in a position where you absolutely have to share some information that you want to keep secret, the smartest thing to do is share a huge amount of confusing and poorly-explained information, or use an [annoying but technically accurate format](https://www.vice.com/en/article/gv5vxb/crypto-keys-printout-of-edward-snowdens-email-service-lavabit-ladar-levison). Strict and unalterable rules are no match for determined adversaries, whether they're trying to play a prank, make a point, or maximize shareholder value.
144+
145+But the data format questions are not rhetorical: there is actually an answer of sorts, though it's a frustrating one. Software systems are not just lines of code, but the entire extended system of people who maintain, host, and build on platforms. And the norms of those communities can push back against market pressures. I've been spending an increasing amount of time around Urbit users and devs, and they really do view the current centralized model of the Internet as anathema. They are aware that the fun apps we use are all either designed to be addictive from the start or subject to relentless evolutionary pressure to get more addictive. There's a history of [norms evolving in response to new addictive behavior](https://gist.github.com/jm3/6724931). And Urbit's architecture is a lot closer to norms than to the clumsy mechanism of laws; instead of centralized services that own data, there's a set of 256 Urbit identities that can route messages between users. Instead of single points of failure, there are a few hundred fallback options; instead of the binary of on-Facebook-or-anathematized, there's a 2^8 bit gradient.
146+
147+One possibility for the successor to the current Internet is that it will end up being a system designed to support communities that achieve cohesion based on which forms of addictive or socially corrosive technology they reject. Sort of a digital version of the Amish, [not rejecting technology wholesale but carefully considering every new technology before adopting it](https://kk.org/thetechnium/amish-hackers-a/). If you assume that the pace of change in consumer-facing Internet stays high, and that it gets more compelling over time, then in the long run the only options are a) be careful what you use, or b) accept that you're outsourcing a growing share of your decisions to product managers and growth hackers who do not necessarily have your interests at heart.
148+
149+Norms are not a perfect solution to these problems (if they were, we'd only know about issues like novel addictive behaviors, monopolies, and the homogenization of entertainment from history books). And technology can't fully solve social problems. But it can certainly have an effect on them—"you can't solve a social problem with technology" is a good guideline, but technologies mitigate them all the time. What's a streetlight if not a technological solution to the social problem that there are places where it's dangerous to be out when it's dark? What's asymmetric-key cryptography if not a technological solution to the social problem that it's hard to keep secrets? There's still a fundamental tension with open systems, where they get mature enough to be useful at which point the median user's priority is getting things done rather than adhering to the network's original design principles. But a design that recognizes this from the beginning, and a community that wants to make it happen, can stave off decline for a long time. And that's the positive story of technology: we're all fighting against entropy, which is a hard fight to win, but there are long and fascinating stalemates ahead.
150+
151+(Disclosure: I'm long decentralization by way of Bitcoin and Urbit. If you're on Urbit and would like to discuss <em>The Diff</em>, go to ~lableg-tadrex/the-diff.)
152+
153+<sup>1.</sup> There is naturally some resistance to this, both because of conflicts with different countries' norms and with other countries' natural desire to determine their own destiny. So it's a leaky abstraction, but it gets less leaky over time as economies get more integrated and thus more of the world has to standardize. The most direct example of this is the fact that [the dollar's share of global invoices is 4.7x the US's share of global imports](https://www.economist.com/schools-brief/2020/08/27/global-trades-dependence-on-dollars-lessens-its-benefits) ($, <em>Economist</em>). In the same way that English is most likely to be the shared second language of any two randomly-selected people who don't speak it as a first language, the dollar is most likely to be the second most useful currency to anyone in a country that doesn't use dollars.
154+]]></content:encoded>
155+ </item>
11156 <item>
12157 <title><![CDATA[NFTs, Urbit IDs, and Communities w/ Haleek Maul]]></title>
13158 <link>https://urbit.org/blog/haleek-maul-interview</link>
@@ -969,2199 +1114,1917 @@ only place code is accumulating.
9691114]]></content:encoded>
9701115 </item>
9711116 <item>
972− <title><![CDATA[Lunar Urbit and the Internet of Things]]></title>
973− <link>https://urbit.org/blog/iot</link>
974− <guid>https://urbit.org/blog/iot</guid>
975− <pubDate>Thu, 29 Apr 2021 00:00:00 GMT</pubDate>
1117+ <title><![CDATA[A brief update from urbit.org]]></title>
1118+ <link>https://urbit.org/updates/2021-05-05-update</link>
1119+ <guid>https://urbit.org/updates/2021-05-05-update</guid>
1120+ <pubDate>Tue, 04 May 2021 00:00:00 GMT</pubDate>
9761121 <content:encoded><
1122+Hello!
9801123
981−<br>
1124+Welcome to the May edition of the urbit.org newsletter. April was a busy month with many updates to share—let’s dig in.
9821125
983−Each of the ~4B 32-or-fewer-bit or [Azimuth](/docs/glossary/azimuth)
984−identities, namely [planets](/docs/glossary/planet),
985−[stars](/docs/glossary/star), and [galaxies](/docs/glossary/galaxy), may
986−spawn ~4B 64-bit child identities known as [moons](/docs/glossary/moon).
987−Moons are the undeveloped wild outback of Urbit, with a story waiting to be told
988−that promises to be as enormous in scale as the cloud personal computing story
989−told by planets, and possibly even more so.
1126+0 – Updated Urbit Binaries
9901127
991−Throughout this piece, we use "Earth" and "Mars" in the Urbit sense. "Earth"
992−refers to the [current computing
993−paradigm](https://en.wikipedia.org/wiki/Big_ball_of_mud). "Mars" refers to the
994−perfected computing paradigm that Urbit aspires to be, but also to the current
995−and future state of Urbit.
1128+Urbit’s binaries were updated to v1.5 on April 27th. Make sure to download and install the latest v1.5 binaries here: https://github.com/urbit/urbit/releases/tag/urbit-v1.5
9961129
997−Today we will review the prehistory of moons on Earth, give a snapshot of how
998−moons are being utilized on Urbit in 2021, cover existing issues with consumer
999−IoT and how Urbit resolves them, and speculate what the lunar locus of the Urbit
1000−ID address space may become in the future. To keep the futurist scope limited,
1001−we primarily speculate on the usage of moons in (industrial) internet of things
1002−settings, especially with respect to agriculture, and how they may manifest as
1003−the workhorse collection unit of decentralized data markets.
1130+It’s as easy as shutting down your ship and replacing the old binaries! ~pilfer-pandex described the new release to urbit-dev as “a high priority fix for two networking bugs in urbit-king, and minor fixes to vere.”
10041131
1005−For those unfamiliar, moons differ from all other
1006−[ships](/docs/glossary/ship) in that they are not independent identities
1007−with total sovereignty over their data and keys. Instead, their cryptographic
1008−keys are issued and controlled by their parent identity. The relationship
1009−between the keys of a parent ship and its moons are analogous to the
1010−relationship between primary keys and subkeys in a system like
1011−[PGP](https://en.wikipedia.org/wiki/Pretty_Good_Privacy). The parent may revoke
1012−or change its child moons' keys at any time. A typical relationship between a
1013−planet and a moon may be like one of a human and their smartphone. If you lose
1014−your phone, you don't want someone to pretend they are you, operating one of
1015−your moons, on the network. The planet can revoke the keys, and the moon stored
1016−on the phone becomes inert, no longer able to communicate with the network.
1017−While planets and stars also depend on their sponsor to assist with peer
1018−discovery and software updates, these relationships rely on mutual agreement,
1019−since either party may choose to discontinue the relationship and establish a
1020−new one elsewhere. Moons possess no such freedom.
1132+1 – Upcoming Events
10211133
1022−### Lunar prehistory
1134+Urbit Town Hall @ May 20th 12pm PDT – Keynote from Justin Murphy
1135+This will be Urbit’s first ever town hall—a three hour event with talks on a variety of topics and a keynote from Justin Murphy (~hatryx-lastud). Justin had Urbit Foundation Director Josh Lehman on his Other Life podcast a few weeks ago (have a listen at https://share.transistor.fm/s/1c0c8c15) and recently formed a new group on Urbit (~hatryx-lastud/other-life).
10231136
1024−
1137+In his group, Justin has written a blog post called “Escape Velocity”, where he discusses selection effects on various platforms. Justin writes, “by creating a gravity well that sucks energy into real-estate value rather than monetized attention, Urbit exerts the lowest degree of arbitrary selection pressures on content creation, while optimizing those selection pressures that irreducibly characterize all human communication (e.g., the draw of being understood and appreciated by other people).” Tune in to Justin’s keynote on the 20th for more on Urbit as a platform for creatives.
10251138
1026−It may come as a surprise to you that you are already very familiar with moon
1027−identities—they've just never been explained as such because the context in
1028−which that terminology makes sense didn't exist before Urbit. Moons, in fact, are not
1029−a new concept at all. Virtually your entire experience of the internet in the
1030−modern era is the experience of someone who possesses some number of moons
1031−subordinate to planets who mostly refuse to talk to one another. The feeling you
1032−get of constantly moving between silos, juggling accounts, not controlling your
1033−own data, etc., is a direct result of the fact that, on Earth, you only possess
1034−moons. No planets.
1139+Developer Calls @ May 13th and May 27th
1140+As you probably know, we have developer calls every two weeks. Stay tuned for more information on our events page: https://urbit.org/events
10351141
1036−We're speaking, of course, of the client-server relationship. From the Urbit
1037−perspective, the Facebooks, Twitters, and Googles of the world are planets, and
1038−accounts held with these services may be thought of as moons subordinate to
1039−those planets. Your account with these megacorps is only yours for as long as
1040−they please. If you happen to step on a digital landmine, such as a virus that
1041−causes Google's servers to believe you are a bot, you are suddenly banned from
1042−their service, often with no recourse. All your data, your connections, your
1043−network—vanished. We are all Mark Zuckerberg's moons, and they're armed to the
1044−teeth with surveillance equipment.
1142+Austin Urbit Conference @ September/October 2021
1143+Although it’s too early to give a precise date, we are starting to plan an Urbit conference for this fall! It’ll be held in Austin, with many Urbit and Tlon employees in attendance. Stay tuned for more information!
10451144
1046−There are two classes of internet users: those with servers who hold all the
1047−power, and clients who use those servers in the way prescribed by the owners.
1048−Running a server is theoretically accessible to anyone, but practically
1049−difficult: server maintenance is a technical endeavor that requires specialized
1050−knowledge and substantial time investment. Other barriers exist beyond just the
1051−technical: for instance, if you wish to set up your own email server, you will
1052−probably be blocked by large providers because unknown email servers are almost
1053−always spam. The root cause of this circumstance is that the email protocol
1054−lacks [Sybil resistance](https://en.wikipedia.org/wiki/Sybil_attack). Urbit has
1055−Sybil resistance built in, eliminating certain kinds of incentives for
1056−gatekeeping such as this.
1145+2 – April Developer Calls
10571146
1058−We seek to level the playing field by giving everyone a server. We accomplish
1059−this by making the process of running your own server (planet) as easy as
1060−running your personal computer today. We aren't quite there yet, but we've made
1061−leaps and bounds over the past couple of years.
1147+Developer Call: 3rd Party Software Distribution
1148+In this talk, Phil (~wicdev-wisryt) and Raghu (~sovmep-ripsum) discussed the work they've been doing to clay to provide "virtual desks", an integral part of the infrastructure needed for safe, generic software distribution. This work is being done through our Scholarships program, in which community developers pair up with Tlon engineers to work on infrastructure projects. For more information about Scholarships, visit https://urbit.org/docs/development/grants/#scholarships
10621149
1063−Of course, this analogy isn't perfect—Urbit moons are servers themselves, but as
1064−they may only act in accordance with the wishes of its parent, they are
1065−effectively as locked in degrees of freedom as a client is to a server. The
1066−moon's keys may be revoked at any time by the parent. To distinguish these
1067−prehistoric moons from Urbit moons, we will refer to them later as "primitive
1068−moons".
1150+Developer Call: Real-Time Communication on Urbit
1151+Edward Amsden (~ritpub-sipsyl) gave us a look at the WebRTC Airlock library he has developed that handles the hard parts of WebRTC. When complete, this will allow developers to build applications on Urbit with audio/video calling capabilities. Once again, Edward’s work is sponsored as part of the grants program (https://grants.urbit.org)—check it out!
10691152
1070−Urbit contends that moons are not the appropriate digital exocortex for a
1071−responsible adult. They are for devices, experiments, or your children. We hope
1072−that the dominant server-client relationship, which is the primary weapon of the
1073−surveillance-industrial complex, will meet its end in the near future.
1153+3 – Urbit Bitcoin Launch
10741154
1075−### Moons in the early Martian era
1155+This was a hotly anticipated event and it didn’t disappoint. In case you missed it, Urbit will soon have a Bitcoin wallet on the network, meaning you’ll be able to pay Urbit ships directly in BTC. Watch Urbit-Tlon personnel demonstrate and discuss this exciting launch: https://www.youtube.com/watch?v=_aRnfacZPto
10761156
1077−
1157+Make sure to check out this related blog post by Christian Langalis (~pindet-timmut): https://urbit.org/blog/interplanetary-commerce/ and this great interview with ~timluc-miptev, one of the main developers on the project: https://subject.network/posts/bitcoin-with-timluc-miptev
10781158
1079−In 2021, moons are mostly unused on Urbit. There's a smattering of minor use
1080−cases which we'll describe here, but they represent only a tiny fraction of
1081−their ultimate potential.
1159+4 – Blog
10821160
1083−Tlon recently launched a survey bot called [Eliza](/blog/eliza), which was
1084−initially a comet. We frequently got questions on whether Eliza was actually
1085−Tlon's bot, because it could just as easily be a malicious actor posing as Tlon.
1086−We soon plan to relaunch Eliza as a moon of `~zod`, which is the most
1087−recognizable official galaxy of Tlon. This is to establish that the bot is
1088−indeed official; only someone with access to `~zod` is capable of creating a
1089−moon of `~zod`, and so a moon of `~zod` automatically carries with it a
1090−cryptographic guarantee that you are communicating with an official digital
1091−representative of Tlon. On Earth something like this would need to be
1092−accomplished with certificate chains but, on Mars, this sort of authentication
1093−is baked into the very fabric of the network, rather than as an additional layer
1094−on top. This is a very good representative case of how moons naturally inherit
1095−the reputation of their parent, even in the absence of any formal reputation
1096−systems on Urbit.
1161+We have a couple of new posts to announce:
1162+“Lunar Urbit and the Internet of Things”
1163+This post is by Poprox (~datnut-pollen), a Tlon engineer who focuses on the importance of moons in the Urbit ecosystem. The post covers “the prehistory of moons on Earth, gives a snapshot of how moons are being utilized on Urbit in 2021, covers existing issues with consumer IoT and how Urbit resolves them, and speculates what the lunar locus of the Urbit ID address space may become in the future”. Read it here: https://urbit.org/blog/iot/
10971164
1098−We see folks using moons as backup identities in case they can't or don't want
1099−to access their primary planet for one reason or another. Again, since anyone
1100−may verify the parent of a moon, the moon inherits the reputation of its parent.
1101−These backups could be vanity identities—for instance, every `~sampel-palnet`
1102−has underneath it a moon named `~master-sampel-palnet`[^0].
1165+“Community Spotlight: The Portico”
1166+This post is an interview between me (~tirwyd-sarmes) and Josh Reagan (~taglux-nidsep), the founder of “The Portico”, an Orthodox Christian community. Josh has a PhD in logic, and writes about the intersection of Christianity and logic on his Urbit blog. In the interview we talk about community norms, the relationship between logic and religion, and the future of Urbit. Check out the interview: https://urbit.org/blog/community-spotlight-the-portico
11031167
1104−Some use moons to host group(s). Hosting a group inevitably means that that ship
1105−will process more network traffic, and a heavily trafficked group may impact a
1106−ship's performance. Thus one may wish to offload group hosting duties to a moon
1107−to maintain a more performant planet.
1168+5 – Odds and Ends
11081169
1109−As we currently lack a real system for 3rd party software distribution (though
1110−see this recent [developer call](https://youtu.be/XwICC6Its1E) on a solution in
1111−progress), one stopgap has been to download software by syncing a foreign
1112−[desk](/docs/glossary/desk) to your ship. This is risky, as buggy software
1113−may make break your ship and make it difficult to get running properly again.
1114−For this reason, testing new software on the livenet is frequently performed on
1115−moons, so as not to risk the parent ship if something were to go wrong.
1170+If you are a star or galaxy owner and are interested in sponsoring other ships, please message ~rapfyr-diglyt (david@tlon.io) to be added to the sponsors@urbit.org mailing list.
11161171
1117−### Internet of Things
1172+~hodzod-walrus made a page with statistics on various stars: https://bacrys.org/uptime/
11181173
1119−
1174+~sitful-hatred beat us to the punch and released a guide on compiling Windows binaries—urbit.exe is near at hand! See the guide here: https://subject.network/posts/urbit-windows-binaries/ The official Urbit.org announcement should be around the corner, so keep your eyes peeled.
11201175
1121−Now we start to look towards the future by examining the problems faced by IoT
1122−in the present and speculating on how Urbit might solve them.
1176+Thanks for reading. Talk to you next month!
11231177
1124−The Internet of Things is much maligned by technologists as a privacy, security,
1125−and maintenance nightmare. These products usually depend on phoning home to
1126−perform their service, which is inevitably a funnel by which personal data is
1127−harvested, an attack surface for hackers to gain access to your home network,
1128−and a single point of failure which may render the device useless, all in one!
1129−One need look no further than the recent [Ubiquiti
1130−breach](https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-breach-catastrophic/)
1131−to see all of these failure modes happening on a massive scale, and this is par
1132−for the course. This sort of dynamic is completely antithetical to the Urbit
1133−philosophy, so any involvement of Urbit with IoT will reject many fundamental
1134−assumptions on how IoT operates today.
1178+Josh (~wolref-podlex) and ~tirwyd-sarmes
11351179
1136−However, it's important to understand why the current IoT model works like this
1137−at all. We posit that it ultimately stems from the fact that today's IoT
1138−products are primitive moons for which you do not operate the parent planet.
1139−Almost every IoT device operates in the Software as a Service (SaaS) paradigm
1140−because most people don't have personal servers that could do all the processing
1141−work actually necessary for an IoT device to operate. This is not the _only_
1142−reason for this—it's also just more profitable to collect consumer data.
1143−However, it's the SaaS aspects which make the whole thing such a catastrophic
1144−mess.
1180+https://twitter.com/urbit
1181+https://github.com/urbit/urbit
1182+]]></content:encoded>
1183+ </item>
1184+ <item>
1185+ <title><![CDATA[Community Spotlight: The Portico]]></title>
1186+ <link>https://urbit.org/blog/community-spotlight-the-portico</link>
1187+ <guid>https://urbit.org/blog/community-spotlight-the-portico</guid>
1188+ <pubDate>Mon, 03 May 2021 00:00:00 GMT</pubDate>
1189+ <content:encoded><
11451191
1146−Imagine a different world: if the server that your device reports to is your
1147−own, there is no loss of control over personal data. If the device only
1148−communicates on the local network, it will prevent remote hackers and disruption
1149−if you internet fails. And if the manufacturer goes out of business, the device
1150−will still work-it is not dependent on the manufacturer's servers.
1192+_One of the most striking things about Urbit is the ideological diversity between communities. The Community Spotlight blog series will focus on various Urbit communities via interviews with founding members._
11511193
1152−The wants and needs of the individual are at odds with the wants and needs of
1153−the megacorp, and that mismatch manifests as the antifeatures that plague IoT.
1154−By eliminating the SaaS aspect, Urbit solves many of the largest outstanding
1155−issues with IoT in a single blow. Digital personal AI assistants have long been
1156−an anticipated science fiction prediction and their full realization is on the
1157−horizon. But in their current manifestation, many privacy- and
1158−security-conscious people would never consider using them at all, since they are
1159−inevitably presented as SaaS that requires intimate knowledge of your devices
1160−and their stored data. Recommendation engines such as the one used by YouTube
1161−offer helpful guidance towards content you'll find appealing, but they're also
1162−designed to keep you hooked to the service. These kinds of programs can be
1163−useful, but they're dystopian when they come saddled with anti-consumer
1164−subroutines. Since your Urbit belongs to you, it can never act against your own
1165−interests without your consent. In our lunar vision, your digital personal AI
1166−assistant will live on one of your moons, rather than on megacorp's cloud.
1194+For the first week of the Community Spotlight series, I (~tirwyd-sarmes) will be speaking with Josh Reagan (~taglux-nidsep). Josh is the founder of The Portico, an Urbit community of Eastern Orthodox Christians.
11671195
1168−For web-exposed devices, Urbit offers the same security guarantees that it
1169−offers for your personal computer: everything is end-to-end encrypted by
1170−default, and signed with keys that one can easily verify as belonging to the
1171−node sending the message.
1196+The Portico is a very active group with conversations taking place over multiple channels. There are channels for posting Orthodox iconography, discussing the broader Christian culture war, and just talking about Orthodoxy in general. Of particular interest is Josh’s “Euthyphro” blog series which investigates the relationship between logic and the Orthodox faith. This is a topic that Josh is well qualified to talk about: he has a PhD in Philosophy from Rice University. His dissertation on the epistemology of logic and truth-preservation was titled "Knowing Your Limits: Logic for Limited Beings”. Josh is also the co-author of a forthcoming textbook on formal logic.
11721197
1173−[Vint Cerf](https://en.wikipedia.org/wiki/Vint_Cerf) has outlined the case for a
1174−system like Urbit ID for IoT use
1175−[here](https://cacm.acm.org/magazines/2018/12/232883-self-authenticating-identifiers/fulltext).
1176−In brief, that the Urbit ID system allows one to match public keys with devices,
1177−bestowing devices with self-authenticating identities. This allows one to trust
1178−the communications received from the device to whatever degree the private key
1179−is held secure. IP addresses, GPS coordinates, MAC addresses, etc., are not
1180−sufficient to generate high levels of trust—they're all temporary, easily
1181−spoofed, or both.
1198+To read Josh’s blog is to be inducted into two esoteric traditions: theory of logic and Orthodox theology. With titles like “St. Gregory the Theologian and the Liar Paradox” and “The Existence of Abstract Objects”, Josh does not pull punches.
11821199
1183−> One might imagine applying this to the Internet of Things (IOT) in which the
1184−> IOT device self-generates a public- and private-key pair and registers the
1185−> public key. For example, with a hub or controller so the hub can confirm it
1186−> has reached the right IOT device. By the same token, configuration of the IOT
1187−> device into an ensemble could include incorporation of the public key of the
1188−> controller into a list of valid devices that can command or obtain data from
1189−> the now-configured IOT device. Both ends can verify they are talking to the
1190−> originally configured devices, assuming no device has lost its private key.
1200+Accordingly, our conversation focused on the idiosyncratic and niche community that The Portico is home to. There, you won’t find cussing or much talk about “life partners”, but you will find cutting critiques of liberalism and the best way to raise Orthodox children.
11911201
1192−Here, the hub or controller referred to would be your planet.
1202+As other users have pointed out, Urbit is pre-[Eternal September](https://en.wikipedia.org/wiki/Eternal_September). In fact, there’s some hope that the very nature of Urbit, how it tries to protect the sovereignty of niche communities via decentralization, might foil the Eternal September phenomenon. If Josh’s community persists, it will be a testament to both Josh and the decentralized Urbit network. As of now The Portico is a refreshing, perhaps jarring (as Josh might say), reminder of what the internet looked like back in the early days—a place for those who are different.
11931203
1194−Urbit has many other features that make it well-suited for IoT, above and beyond
1195−eliminating the SaaS model and providing self-authenticating identities. Many of
1196−these additional advantages derive from the fact that Urbit is a [solid state
1197−interpreter](/docs/arvo/overview#solid-state-interpreter) and that
1198−[Ames](/docs/glossary/ames) is a network of solid-state interpreters
1199−equipped with cryptographic identity. We explore this in the next section.
1204+I encourage you to take a look. Find The Portico at ~topnup-firber/the-portico.
12001205
1201−### Future lunar cosmotechnics
1206+\-\-\-\-
12021207
1203−
1208+**Do you see any connection between Rod Dreher’s _The Benedict Option_ and your community on Urbit? Dreher sees a need for American Christians to create self-sustaining communities outside of the mainstream to protect the Christian religion and culture.**
12041209
1205−We now polish off the old crystal ball and imagine future uses of Martian lunar
1206−technology. Particularly, how the tech may develop over time once it becomes
1207−widely exposed to the evolution-inducing forces of industry and culture. This
1208−section is pure speculation, and I only aim to offer a small glimpse of a
1209−potential future, rather than an exhaustive one. This picture will necessarily
1210−be biased by my personal proclivities and expertise, or lack thereof.
1210+It’s tough to say with certainty—I’ve never read _The Benedict Option_.
12111211
1212−Any discussion on the future of moons is incomplete without mentioning the
1213−possibility of [lunar emancipation](https://urbit.org/faq/#more-planets) in
1214−order to increase the number of planets. This fascinating topic sees regular
1215−discussion in the Urbit Community group, but is outside the scope of this
1216−article.
1212+A few years ago, while he was writing the book, I was a regular reader of Dreher’s blog. From his descriptions there, I was never clear about what exactly he was proposing. Much of his “clarification” came by way of metaphor: don’t “run for the hills”, but stop “shoring up the American imperium”. I didn’t read his book because I didn’t have much confidence that he would be especially precise or insightful.
12171213
1218−In order to respect the reader's time, I'm narrowing our scope to a particular
1219−topic: the agriculture industry. I'm also assuming a future with specialized and
1220−increasingly small hardware to run Urbit. Right now, a 4 GB Raspberry Pi is the
1221−standard for "small Urbit". If someday there are CPUs specifically designed for
1222−running [Nock](/docs/glossary/nock), one could imagine going much smaller.
1223−Ultimately, I'm going to assume that there will someday be [solid-state
1224−interpreter](#ssi) microcontrollers - so the inclusion of Urbit on a device may
1225−require nothing more than a couple [surface-mount
1226−devices](https://en.wikipedia.org/wiki/Surface-mount_technology) on a larger
1227−chip.
1214+[There is an interesting review I’d recommend](https://handleshaus.wordpress.com/2020/10/06/review-of-rod-drehers-live-not-by-lies/), however, of his later book, _Live Not By Lies_. I believe it accurately characterizes the scale of the threat Christians will soon face in this country.
12281215
1229−Urbit is intended first and foremost as a personal computer. When I unravel its
1230−potential usage in industry, I adopt the forecast of a drastic increase in the
1231−manufacturing capacity for individuals and small groups. Agriculture is a great
1232−microcosm of this long-standing trend; less human input is needed to produce the
1233−same amount of food, whether it be crops or livestock. The modern era is
1234−distinguished by the fact that small numbers of people can manage enormous farms
1235−which produce food for vast populations. Thus, computation on modern automated
1236−farms may be thought of as existing at the intersection of both personal and
1237−industrial scale, and show how computerized and mechanized workflows add to the
1238−amazing productivity of modern farms and demonstrate that individual-sized
1239−inputs are able to create industrial-sized outputs. I predict that the set of
1240−trades for which this dynamic holds will only increase over time.
1216+My upbringing was conservative Christian and self-consciously counter-cultural. I've inherited that understanding of what it means to be a Christian in an increasingly secular world. It comes naturally to me, so I find it obvious that Christians should form self-sustaining communities. But the details matter. What do such communities look like? How do we secure the freedom to pursue such communities? How do we sustain them, when myriad external forces seek to undermine them? How do we solve the long-term problem of the declining cultural importance of Christianity (which surely erodes the plausibility of our religion to many, even to some of those with sympathies toward it)?
12411217
1242−Agricultural automation has been a primary engine for the growth of
1243−civilization, but it has been hampered by the downsides of IoT elaborated in the
1244−previous section. One bellwether of this dynamic is the right to repair one's
1245−own equipment. [John
1246−Deere](https://www.thetruthaboutcars.com/2020/03/its-payback-time-right-to-repair-movement-targets-john-deere/)
1247−has long been at the center of this controversy. Farmers have lost the ability
1248−to repair their own equipment due to vendor locks and a dependency on remote
1249−servers. Furthermore, any suite of sensor products designed to gather important
1250−data such as genomics, hydrology, soil health, weather, etc., inevitably only
1251−cooperate with other products by the same vendor. It's the same story all over
1252−again—you are a client of a megacorp server. Or in Urbit terms, you have a bunch
1253−of primitive moons belonging to different planets held by megacorps, and no
1254−planet to call your own.
1218+I don’t claim to know the answers to these questions.
12551219
1256−Again, Urbit resolves these issues in the same fashion as above. One might argue
1257−that using Urbit is another form of vendor lock-in—but this is evaluating Urbit
1258−at the incorrect level. Since Urbit is an open source operating system, its
1259−functionality may be extended and modified arbitrarily by any party. _Some_
1260−computational infrastructure is necessary— that fact can never be escaped. But
1261−you can escape from closed source software that does not permit you to modify,
1262−to open source software that allows you to tinker at will. Thus we do not
1263−consider open source software to be a form of lock-in, or at least, it's a much
1264−milder form of lock-in compared to something like Apple's walled garden.
1220+One kind of answer is that we should redouble our efforts to support and maintain a religiously and morally neutral liberal political order, which leaves room for subcultures to live and self-regulate as they wish. I disagree. Those who support a kind of “neutral” liberalism view it as an attempt to go “meta” and rise above various parochial metaphysical, moral, and religious disputes. I view this as a cop-out, a refusal to grapple with the most important questions.
12651221
1266−So let us focus on the additional meritorious aspects of Urbit (or more
1267−generally, solid state interpreter networks) that make it not merely a band-aid
1268−to the broken IoT system but a permanent and sound replacement.
1222+Does the liberal have metaphysically-rooted moral reasons for going “meta”? If so, then he’s just another sectarian and he should be honest about it. The only difference is that his team has had the whip hand for the last several generations. On the other hand, if the liberal claims no underlying metaphysical justification then his project can succeed only to the extent that he can arrange and adjudicate unprincipled (and therefore ad hoc) agreements between otherwise hostile moral communities. But how stable can such an arrangement really be?
12691223
1270−#### Solid state interpreter networks {#ssi}
1224+Orthodox Christians have theologically rich, metaphysical foundations for their social and moral teachings. With these we can form healthy, thriving, and growing communities. We can do so even under actively hostile political orders. If the early Church could make it under the Romans, so can we today. But it’s going to be difficult and sound judgment is necessary. Unfortunately, we lack strong leadership and that leaves us vulnerable. If we stay uncoordinated we dissipate our energies needlessly. If we latch onto the wrong leaders we can be led astray.
12711225
1272−
1226+The challenges are immense. There is no technological solution. Even so, I’m an Urbit early-adopter for a reason. Over the years I’ve come into contact with a number of Orthodox and Ortho-curious Urbit followers. Why not try to bring them together in an Urbit group?
12731227
1274−Urbit is the world's first solid-state interpreter (SSI). This concept is
1275−summarized in the [white paper](https://media.urbit.org/whitepaper.pdf) as
1276−follows:
1228+As far as I know, no one in the group is clergy. We’re all just a bunch of laymen with no authority to do much of anything. But I’d like to think we can still contribute in some way. I have an academic background in analytic philosophy so my inclination is to emphasize theory, but we have room for a bit of everything. Someone in the group wrote a script to take the texts of various Church Fathers and convert them to audio using AWS Polly. Those turned out pretty well!
12771229
1278−> Imagine it as a chip. Plug this chip into power and network; packets go in and
1279−> out, sometimes changing its state. The chip never loses data and has no
1280−> concept of a reboot; every packet is an ACID transaction.
1230+At times I entertain ambitions to do a bit more, but for now perhaps it’s better to keep expectations in check. If nothing else, we can read and discuss the Scriptures and Church Fathers together, and try to understand better how to apply and live out their teachings. As we continue to grow the community and develop a consistent internal dynamic perhaps opportunities will arise that aren’t yet on the horizon. One thing I can say is that I’m committed to keeping the group active and growing.
12811231
1282−Also,
1232+**I’d like to talk about your blog on The Portico. It combines two of your main interests: logic and theology. In broad strokes, do you think theology and logic are compatible? What is the relevance of this intersection to both of these disciplines?**
12831233
1284−> Briefly, an SSI is an interpreter which is also a database. In more depth, an
1285−> SSI combines three properties: uniform persistence, source independent packet
1286−> networking, and high-level determinism.
1234+I feel obligated to answer this question in two ways.
12871235
1288−We do not wish to segue into a lengthy examination of what this really means—
1289−that's what the white paper is for—but we will attempt to explain why these
1290−properties are of great benefit in an industrial IoT context such as
1291−agriculture. We'd also like to predict that Urbit will not be the only SSI.
1292−Other sorts of SSI's specialized to various tasks may one day roam the planet,
1293−and these may be better suited for particular IoT tasks than
1294−[Arvo](/docs/glossary/arvo). However, this article will be couched in terms
1295−of SSIs communicating with an [Ames](/docs/glossary/ames)-like networking
1296−protocol and Urbit ID-style cryptographic identity, rather than Urbit in
1297−particular.
1236+(1) If by “logic” you mean “first-order predicate calculus”, then I think there’s no special conflict between logic and theology. There are certain puzzles about their relationship, but similar puzzles exist between logic and other disciplines. Theology isn't especially endangered.
12981237
1299−For a SSI, losing power is less of a catastrophic event than it is for ordinary
1300−computers with volatile memory. Knowing that you can never lose any state is a
1301−powerful guarantee on the integrity of your data. Loss of power will always mean
1302−loss of any data potentially collected while power is down, regardless of the
1303−device you use, but with a SSI you at least have assurance that you will never
1304−lose data that was collected before it could be transferred from the cache to
1305−the disk. Of course, this is actually the sort of guarantee that [ACID
1306−transactions](https://urbit.org/docs/arvo/overview/#acid-database) have—it is
1307−just that this set of guarantees emerges naturally as a consequence when you
1308−have a SSI. Put another way, every SSI is a database; having every device be a
1309−database is a major boon in situations where enormous quantities of data are
1310−being collected across a distributed network. The standard today is that data is
1311−only collected at hubs, and any data that doesn't reach a hub is irretrievably
1312−lost.
1238+For example, in the 1930s, Alfred Tarski proved his famous Undefinability Theorem. Crudely put, it says that a plausible truth predicate cannot consistently be contained in any formal system with axioms strong enough to model arithmetic. Superficially it seems like our options are (a) get rid of the concept of truth, (b) get rid of arithmetic, or (c) throw away parts of logic until all inconsistency disappears.
13131239
1314−SSIs are also deterministic at a high level. While all computers are
1315−deterministic at the CPU level, interruptions to power can result in an
1316−undefined semantic state and result in the random erasure of half of its brain.
1317−This determinism is what begets ease of maintainability of Urbit—problems
1318−generally only need to be solved once by experts and the solution propagates to
1319−the rest of the network via [OTA updates](/docs/glossary/ota-updates). We
1320−addressed this maintenance issue previously—we only remark now that this
1321−property is derived from being a SSI, rather than something particular only to
1322−Arvo or Urbit. When one has hundreds or thousands of devices to manage, the
1323−guarantees on ease of maintenance provided by determinism are extraordinarily
1324−convenient.
1240+None of these options is appealing. Tarski came up with a solution that mostly satisfies many logicians: reduce the concept of truth to “truth in a language” and forbid any language from containing its own truth predicate. If you want to talk about truth in a language L-1, you have to do it from a “metalanguage”, L-2.
13251241
1326−Packet routing on SSI networks is source-independent, and in the context of an
1327−Ames-like networking protocol, are always delivered exactly once and in a
1328−precise order due to the fact that nodes on an Ames network are in a permanent
1329−session. Source-independent means that the identity that originated a packet
1330−does not need to be the one to deliver it—packets are _facts_, and the truth of
1331−a fact does not depend on who you heard it from. This means that it is possible,
1332−for instance, to send instructions to a moon before it even exists and be
1333−guaranteed that that moon will receive them and perform the tasks given, even if
1334−the device that originally sent the packets no longer exists. As long as
1335−somebody has kept the packets on hand, they will eventually be delivered. So,
1336−one could imagine transmitting directions to a crop harvesting robot into which
1337−a moon will be installed before the robot has even been purchased, know that
1338−once it is delivered it will automatically begin its task, and know that those
1339−tasks will be completed in the correct order, without any accidental repeats.
1340−Taken to the limit, one can imagine preplanning the automated tasks for an
1341−entire farm before a single device is purchased, with powerful guarantees on the
1342−integrity of those instructions no matter how much time elapses between sending
1343−and receiving.
1242+Is Tarski’s definition of truth in a language the definitive solution for preserving truth, math, and logic? Perhaps not many philosophers think so, and there’s a massive literature in which logicians have attempted to improve on or extend his results.
13441243
1345−#### P2P data markets
1244+Sometimes people seem to think formal logic is an infallible gift from heaven that must always be right. Kant said in the _Critique of Pure Reason_ that formal logic is essentially a completed field. In fact, [the logic of his day](https://en.wikipedia.org/wiki/Port-Royal_Logic) was an early-modern Cartesian variation of a medieval scholastic synthesis of ancient Stoic and Aristotelian logics. Roughly 100 years after Kant’s first critique was published, C. S. Peirce and Gottlob Frege independently discovered first-order mathematical logic as we know it today, inaugurating the greatest advance of logic since Aristotle. Kant was wrong.
13461245
1347−
1246+Mathematical logic is a convenient, generally reliable, man-made tool that, when used carelessly in certain untamed domains, can lead one astray. Probably most people reading this are familiar with such puzzles as the Liar paradox. When one understands that logic is not a completed science, and perhaps never will be, there is less reason to worry about whether it can be used to nuke entire disciplines, like theology.
13481247
1349−As was mentioned above, today's IoT devices ferry all sorts of your personal
1350−data to megacorp, where they package it and sell it to the highest bidder.
1351−Though personal data in aggregate is quite valuable, the value of a single
1352−individual's data is quite low. On the other hand, industrial scale data such as
1353−that collected on digitized farms could be quite valuable. Here we briefly
1354−examine how Urbit can be utilized to populate and facilitate a market for data.
1248+For more on this topic, see the blog post in my Urbit group: “St. Gregory the Theologian and the Liar Paradox”.
13551249
1356−All data collected by your moons may be digitally signed by that moon,
1357−certifying the exact origin of that data. This is one advantage of having
1358−cryptographic identity baked into the core of the operating system and
1359−networking protocol. One could imagine collecting large amounts of such data and
1360−packaging it for exchange with other local and regional farmers. This can, of
1361−course, already be done in principle with current systems. But current systems
1362−do not automatically come equipped with the sort of provenance, immutability,
1363−and reputation that comes for free when you make use of SSI networks.
1364−Manipulated or faked data becomes easier to spot, and you'll know who it came
1365−from, so supplying such data puts one's reputation at stake.
1250+(2) There is perhaps a deeper challenge than the one I’ve just sketched. The Stoics used the term “logic” to encompass what we might today call “epistemology”. If the word “logic” is meant in some such broad and normative sense, then we may restate the challenge as one about rationality and theology. Is it irrational to pursue theology in our modern age?
13661251
1367−One major issue facing conjoining data gathered from disparate sources is simply
1368−how to do it. Data arriving in random order, from different software versions,
1369−running different hardware, is all very difficult to bundle into a good
1370−dataset - and indeed wrangling this sort of task forms a large part of the data
1371−scientist profession. As devices in SSI networks utilizing an Ames-like protocol
1372−are engaged in permanent sessions, leading to properties such as exactly-once
1373−delivery and well-ordered message sequences, issues about the order in which
1374−data arrives are dramatically simplified. I do not wish to get mathematical
1375−here, but I personally have confidence that the emerging discipline of
1376−[categorical informatics](http://math.mit.edu/~dspivak/informatics/), as well as
1377−the relevance of [low-dimensional topology to data
1378−fusion](https://arxiv.org/abs/1409.5505), resolves many of these issues. I
1379−promise to explain this in more detail in the future. For now, it suffices to
1380−say that SSI networks seem well-positioned to utilize these techniques.
1252+As an undergraduate under the influence of Kierkegaard, I was attracted to a romantic, vaguely irrationalist notion of faith. Dawkins-mania was at its peak and I was disgusted by the pop-rationality (or was it empiricism?) of his annoying followers. Their view seemed to be that rationality just means “following the evidence”. The raw evidence is foundational, and theories are built atop by generalizing from the evidence. The ghost of logical positivism is with us even now.
13811253
1382−Cryptographic techniques such as [(composable) zero-knowledge
1383−proofs](https://en.wikipedia.org/wiki/Zero-knowledge_proof), [secure multi-party
1384−computation](https://en.wikipedia.org/wiki/Secure_multi-party_computation),
1385−[ring signatures](https://en.wikipedia.org/wiki/Ring_signature), and even
1386−[homomorphic encryption](https://en.wikipedia.org/wiki/Homomorphic_encryption)
1387−offer a variety of ways in which data may be shared in an IoT context with
1388−mathematical guarantees on what sort of privacy is maintained. This is perhaps
1389−less relevant in the context of agricultural IoT, where personal private data is
1390−largely absent, but we mention them here to invite further speculation from the
1391−reader about the possibilities of IoT and SSI networks.
1254+I was dimly aware that Quine and others had made it difficult to sustain epistemic foundationalism. However, being unable to supply a more clear and cogent notion of rationality, I became skeptical of the idea altogether. But I went too far.
13921255
1393−We end our discussion with an adaptation of a scenario borrowed from my brief
1394−time working on [Ceptr](http://ceptr.org/) that begins to show how a lunar
1395−IoT-connected world evokes properties of a hypothetical ["global nervous
1396−system"](https://en.wikipedia.org/wiki/Global_brain). This example is
1397−purposefully mundane to illustrate how deficient our Earth systems are, and
1398−while it is possible to accomplish in theory, it is impractical on a wide scale
1399−due to the numerous problems with IoT. Imagine that you suffer headaches from
1400−low atmospheric pressure. You'd like to know when a low-pressure front is an
1401−hour away from you so that you can pre-emptively take aspirin to prevent the
1402−headache. Your personal digital assistant, running on Urbit, can then
1403−periodically query the moons of sensors in your region for weather data to
1404−predict whether or not you will soon be passing through a low pressure front.
1405−This could be a free service or paid for automatically with cryptocurrency
1406−microtransactions. On Mars, this task will be trivial, and is merely a stone's
1407−throw away from a vast and undiscovered universe of other possibilities unlocked
1408−by SSI networks.
1256+Instead, the proper response is to develop a superior account of rationality. Readers can probably guess where I went looking!
14091257
1410−[^0]:
1411− Of course, all moon names have four words, not three. What the fourth word
1412− needs to be for only three words to display is a matter of Urbit lore that
1413− is more fun to discover yourself than have it told to you, so we won't spoil
1414− it here.
1415−]]></content:encoded>
1416− </item>
1417− <item>
1418− <title><![CDATA[Interplanetary Commerce]]></title>
1419− <link>https://urbit.org/blog/interplanetary_commerce</link>
1420− <guid>https://urbit.org/blog/interplanetary_commerce</guid>
1421− <pubDate>Thu, 08 Apr 2021 00:00:00 GMT</pubDate>
1422− <content:encoded><
1260+For many ancients, the term “λόγος” meant something like “divine principle”. You might think of it as akin to a law of nature, but with stronger theological connotations. Christians appropriated this term and made it rather more exalted: the Logos is begotten of the Father, and yet somehow one with Him.
14261261
1427−<br>
1262+We are told that all things come into being through the Logos (John 1:3), giving Him an intimate relationship to the whole of creation. He gives structure and order to all created things, and in His divinity He understands them as so structured and ordered. He is also sinless, perfectly holy, and good. In Christ we have a perfect unity of the knowledge of all truth and righteousness.
14281263
1429−## Paying
1264+Man was created in the image of God, which means that we bear a likeness to Christ. And we are commanded to realize that likeness with ever greater fidelity (Romans 8:29). The Church calls the pursuit of this likeness [“theosis”](<https://en.wikipedia.org/wiki/Theosis_(Eastern_Christian_theology)>).
14301265
1431−A year ago, we started [integrating](https://urbit.org/blog/urbit-and-bitcoin/) Bitcoin into Urbit to be an OS-level primitive for money. Our initial objective: build a payments wallet, equally sovereign and ergonomic. The first public version, releasing this month, will have a broad set of capabilities including ship-to-ship payments, hardware wallet support, and full node integration. We’ll be unveiling this wallet on [April 27th](https://www.meetup.com/urbit-sf/events/276741426/). Do join us.
1266+Thus we have the explanation of all normativity, according to Orthodox Christianity. In moral matters we must take on the holiness of Christ. In epistemic matters we aspire to the wisdom and knowledge of Christ, which includes an understanding of the whole created order. Socially we (the community of believers, i.e. the Church) are called to be in ever greater communion with God, cooperating with His work just as the Son cooperates with the Father.
14321267
1433−Things only accelerate from here. Our next objective, to integrate Lightning Network capability, is now an [active bounty](https://gist.github.com/timlucmiptev/53ef1d290e55ea2fa25d9df681c32695) and open for applicants. Early on, we [recognized](https://www.youtube.com/watch?v=DTvRVHMbrcY) the congruence and compatibility between the Urbit and Lightning networks. Routing Lightning payments is an obvious business model for Urbit providers, one that can even nucleate new features onto Lightning itself. What we’re ultimately driving at is fully-sovereign Bitcoin usage, with the UX of the Cash App.
1268+Sadly we are conceived in sin and ignorant; hence the need for redemption by Christ.
14341269
1435−## Being Paid
1270+Accordingly, my understanding of what it means to be rational is just to be Christ-like. The only perfect exemplar of reason, so construed, is Christ Himself. Any deviation from Him is irrational. What could be more logical than to be conformed to the Logos? But we cannot attain rationality without redemption. Hence we cannot become rational without first being saved from sin.
14361271
1437−> And there is all the difference in the world between paying and being paid. The act of paying is perhaps the most uncomfortable infliction that the two orchard thieves entailed upon us. But being paid,—what will compare with it?
1438−>
1439−> <cite>Herman Melville</cite>
1272+Doubtlessly many will find all of this too much to take, just too implausible. What about the development of mathematics, or the advances of the sciences? These are canonically ennobling, intellectual achievements. Jesus wasn’t a mathematician or a scientist! Nowhere in the Scriptures is He recorded as having applied Bayes’ theorem.
14401273
1441−However, a good wallet is only half the equation for a holistic P2P commercial experience. Interfaces for selling goods and services is the other half. While we don’t part with our Bitcoin [easily](https://nakamotoinstitute.org/mempool/everyones-a-scammer/), two initial markets appear logical and attractive: content and Urbit-native services.
1274+Undoubtedly my construal of rationality de-emphasizes the pursuit of knowledge by labeling it as merely one of several normative ends. To seek knowledge without seeking holiness is to be understood as dangerously unbalanced. To try to attain holiness and knowledge without communion with God is arrogant.
14421275
1443−First, digital cottage industry, the “creator economy”, is blossoming. Streaming, podcasting, and writing on platforms like Youtube, Patreon, and Substack has been big business [lately](https://otherlife.co/barbarians-past-the-gate/). What fintech did to “unbundle the banks", we will now do to media monopolies and their centralized distribution platforms. With the introduction of Urbit payments, you can syndicate, distribute, and monetize your media on Urbit. By selling access to a private group containing content, digital creatives can begin doing this today.
1276+On the other hand, we need not exaggerate matters. St. Paul affirms the need for specialization of labor within the Church (1 Cor. 12). There is room for some to specialize in intellectual endeavors, so long as they act in a cooperative setting in which the other virtues are pursued as well. (Nor should anyone neglect the development of such virtues in himself.) Mathematicians and physicists are more than welcome in the Church.
14441277
1445−Second, Urbit-native [service providers](https://urbit.org/blog/providers/) are now operating at scale. Companies offering Urbit hosting, onboarding, Urbit IDs, and software now communicate with their customers directly on the network. A basic set of commercial tools will make their processes more efficient. Storefront interfaces, paywalls, CRM, and reputation tools will replace the ad-hoc assemblages they currently use.
1278+According to this (all too briefly put) theory of rationality, there can be no conflict between ‘logic’ and theology. Theology is compatible with rationality because the account of rationality in question derives from a theological tradition. Naturally I’ve only given a sketch; much more could be said. But even if some readers are put off by the theory presented here, I hope it’s at least clear that there are conflicting notions of rationality. Anyone who wants to be rational confronts the task of figuring out which theory of rationality is correct.
14461279
1447−The Urbit Foundation is soliciting contributors to this project through Urbit Grants. If you’re interested in working on any of these components [send us a proposal](https://grants.urbit.org/create).
1280+**In terms of community moderation, The Portico follows norms that are quite different than other online communities, often times quite drastically. For instance, living with women that you are not married to, is not something that should be talked about lightly. Can you talk about the importance of norms and how they relate to a healthy community?**
14481281
1449−## An Ocean
1282+Orthodox Christians are not commanded to “get along” with the rest of the world (John 15:18-25). We’re different, and our norms of interaction should likewise differ from those of outsiders. There is no one, monolithic “Orthodox culture”, but there are standards governing which local expressions of culture are legitimate and which are sinful. We should live in a way that enables and promotes holiness and discourages sin.
14501283
1451−After honing our commercial tools on these use-cases, we’ll sail into a blue ocean. On the horizon: beautiful products, deployable at scale, built with the robust primitives of Urbit OS. Extensibility is Urbit’s promise to middle-men: every Web2.0 service they use to scalp us will find its P2P analog on Urbit. We invite developers and entrepreneurs of all stripes to join in the feeding frenzy. Ideas are constantly nucleating in <a href="web+urbitgraph://group/~pindet-timmut/urbitcoin-cash">Urbitcoiners</a> and <a href="web+urbitgraph://group/~bitbet-bolbel/urbit-community/graph/~darrux-landes/business-building-on-urbit">Urbit Community</a>.
1452−]]></content:encoded>
1453− </item>
1454− <item>
1455− <title><![CDATA[After the Machine War]]></title>
1456− <link>https://urbit.org/blog/after-machine-war</link>
1457− <guid>https://urbit.org/blog/after-machine-war</guid>
1458− <pubDate>Sun, 14 Mar 2021 00:00:00 GMT</pubDate>
1459− <content:encoded><
1286+If someone wants to analyze what is destructive about men and women living together before marriage, we’re open to that. But if you want to be affirmed in your sin, we’re not the place for you. Anyone of any religious creed is welcome to show up—but as a guest in an Orthodox Christian community. Hosts should be courteous to guests, but my first priority is not to make you feel good about your choices. We’re here to encourage each other, learn, and grow spiritually as Orthodox Christians. Naturally that means a little gate-keeping may sometimes be necessary if someone ever comes along who doesn’t share those goals. Being different is difficult and takes work.
14631287
1464−<br>
1288+In a way the cultural contrast is meant to be jarring. It can force you to confront moral and cultural presuppositions that you didn’t even know you had. When you become aware of the wider choices of culture available to you, you become free to look with a critical eye on the culture you’ve hitherto taken for granted. I think anyone could see how that might be liberating, even before considering the particulars of the cultures in question. Of course, as an Orthodox Christian, I think we have a good case to make about the particulars of our subculture.
14651289
1466−> The following fictional passage, from a book being written in an Urbit Group called “the Aleph,” sketches out a dismal future for the human race. As an item of speculative fiction, the piece is not what one might call original. Anyone could have come up with these ideas. In fact, several already have. The Matrix is an obvious antecedent. Vonnegut isn’t far behind either. And the treacly humanism lodged beneath the bitter humor resembles nothing so much as the work of that beau monde satirist, George Saunders.
1467−>
1468−> Really the only notable thing about it is that it was written on Urbit. And that, perhaps, has made all the difference.
1469−>
1470−> It’s easy to be pessimistic about the future. Intellectuals, especially, are drawn to pessimism, because pessimism (falsely) implies a greater wealth of knowledge about the ways of the world. But one thing the pessimist never sees coming is a turn for the better. To wit, the future described in the below excerpt doesn’t have to take place. And Urbit is one piece of evidence for the claim that it will not.
1471−>
1472−> The philosopher-cum-internet comedian Slavoj Zizek likes to point out that no one was really expecting the Soviet Union to collapse in 1989. In fact, the average Soviet dissident wasn’t even gunning for it. He was haggling over small reforms, pushing to get the less corrupt politicians to the top, just going about his day eating or opening a window or walking dully along. Then, kaboom. Collapse. No more USSR.
1473−>
1474−> Then as now, the unexpected is more likely to occur than most would believe. One thing is not only possible, but an established fact: A brand new digital infrastructure is slowly, quietly being built. While U.S. political parties haggle over $1,400 disbursements for citizens, the rules of global finance are being re-written in code. While pundits debate the merits of Dr. Seuss’s lesser known titles, a global shift away from traditional publishing is gaining steam. And while users and social apps themselves pop up and down like whack-a-mole, folks are putting down roots with permanent peer-to-peer digital identities. If you’re anything like an optimist, you’ll probably want to get on Urbit ASAP and put down your own.
1290+I’ve never had to kick or ban anyone from the group. The group is relatively small (~180 people at the moment) so that probably helps. The vast majority of conversations are relaxed and friendly. Occasionally there are intense debates about one issue or another but I enjoy it, as long as it doesn’t become bitter or the primary mode of discourse. But everything ought to be done in a spirit of truth-seeking, not of one-upmanship.
14751291
1476−<br>
1292+**The fact that The Portico can exist side-by-side with atheist communities on Urbit is pretty striking. On Urbit, a user is able to create niche communities and governance structures and yet still participate in a larger network. In other words, Urbit is trying to thread the needle between sameness and difference through federation at multiple levels. It seems to me that modern culture has become homogeneous due to an inability to maintain, or distinguish between, different communities. People who have nothing in common are forced to engage as if they were roommates, while those who are similar have trouble creating their own home. In other words, what is the role of community formation in the modern world and how does it connect to your critique of liberalism? Does Urbit have anything to say about this?**
14771293
1478−The date is January 1, 2050. The place, New York City. The vibe...subdued. Back in 2020, you made a note to yourself to take stock of the world around you here at the half-century mark. And now the time has come. What do you find? The air quality is a bit worse, the bad parts of town are a bit more dilapidated, the Knicks are still terrible—all in all, from the outside at least, not much has changed from 30 years ago. Today you wake up groggy on your self-adjusting Smart Bed (Smart Bed Never Sleeps), you make yourself a steaming pot of coffee (locally sourced, delivered within the half-hour by a drone, now that you’ve got Titicaca Prime), you shower and get ready for work.
1294+As I said in an earlier response, I see the liberal project as more or less an attempt to sidestep (not solve) difficult metaphysical and religious disputes between various distinct moral communities. Liberals have tried several methods of governance to achieve their ends. We can divide such attempts into two broad categories: centralized and decentralized.
14791295
1480−But what was that dream you had last night? Only the faintest traces of it remain. A luminous rainbow, a mountain landscape, a sense of profound inner peace, mixed with euphoria, mixed with...an intense desire to go out and buy some Health Morsels cereal?
1296+Social media companies in the US confront similar governance challenges, so we can analyze them in similar terms.
14811297
1482−That’s odd. You’ve never even had Health Morsels. You open up your laptop, where you can view the activity of the iThink microchip that you got implanted in your cortex a few years ago. “Ads help Elysium provide you with free, quality sleep-monitoring. To disable ads, please upgrade to Elysium Premium.” That explains it. After all—and you pause for a moment over whether the forthcoming thought is yours or the iThink’s, before deciding that it’s much the same anyway—Health Morsels probably are delicious. And healthy, too.
1298+A social network like Facebook takes a centralized approach. Zuckerberg spoke early and often of his desire to connect people and “bring the world closer together”. There was a sense that if people from various communities could get to know each other a little better, we would see how much we have in common and make progress toward some kind of universal cosmopolitan consensus.
14831299
1484−As usual, they’re setting something on fire outside your home. Normally you’d scroll back through your Squawker feed to see what it was all about, but today you’re late for work, and anyway you’re in a pleasant haze after the Health Morsels dream—no point ruining it by poring over the latest Squawker pile-on. You glance at the awning. Ah, the bodega. Toilet paper and Juul Pods are cheaper in bulk from Titicaca anyway.
1300+But that didn’t happen. With centralized social media you’re practically guaranteed to interact with people whose moral and metaphysical commitments are sharply at odds with your own. As a result, you face a persistent, nagging risk of conflict. Without warning, a friendly disagreement can explode into an all-out flame war. Most choose one of two basic approaches for dealing with this threat:
14851301
1486−Another day at the office. You were never exactly passionate about content moderation, but hey, it keeps the lights on. (And since ConEd got absorbed by Titicaca, it’s been pretty important to have a Verified Income Stream.) It’s a normal day at work. Algorithms haven’t yet been able to filter out all Unverified Content—so it’s up to you the flag Unacceptable Violence, Disputed Claims, and Unfederated Currency transactions.
1302+(1) You live a compartmentalized life. You keep your moral and metaphysical commitments to yourself and cultivate a culturally homogenized persona for your social media activities. No one disagrees with you because there’s nothing to disagree with.
14871303
1488−Except after your pleasant dream, it all suddenly seems so drab. You start to wonder whether there was an error last night—maybe they turned the dream levels up too high. Something from your night-time vision just won’t leave your mind, like a film strip looping over and over. It’s that river beside a sloping field, like you used to swim in when you were a kid. You can almost feel the icy cold against your skin, the sticks and mud against the soles of your feet, and then there’s the ripe, marshy scent of the riverbed. Uh oh. You realize you’re close to danger levels. This isn’t where your head’s supposed to be at. Frantically you scroll through content, seeking to moderate it. A user threatening violence against Titicaca. A stream that violates DMCA. A highly dubious Squawker claim, with no support from experts. Flagged. Flagged. Flagged.
1304+(2) You can enlist to fight in the culture war and display your regimental colors with pride. And because you take your smartphone everywhere you’re always on the front line.
14891305
1490−Yet the river remains. You see it, you feel it, just as you feel the kiss of the sun on your shoulders, the breeze rustling through your damp hair.
1306+These aren’t the only options, of course. With some combination of charisma, patience, and grace you can be relatively open about your beliefs without getting into too much trouble. But even if you have the talent to pull it off, it takes time and energy. Many of us aren’t willing to go to all that trouble. Social media is supposed to serve us, not the other way around.
14911307
1492−Now you know what’s coming. You brace for it and wait. Three. Two. One. ZAP. Your iThink produces an electric shock: plenty painful but not permanently damaging—at least that’s what the Verified studies show. The river recedes from your mind. Following the shock, your iThink, as versatile a little machine as ever was invented, delivers a few milligrams of both amphetamine and oxycodone, bringing on a wonderful feeling of simultaneous alertness and relaxation. You look up at your monitor. Content moderation doesn’t seem so bad, with the stimulant and the barbiturate swirling paradoxically through your system. It’s true what they say in the ads: iThink doesn’t just make you think better, it makes you feel better. You dive back into your content moderation with renewed verve, even flagging a couple completely innocent posts just out of surplus exuberance. So what if you hardly get outside at all these days, so what if you’ll never swim in that stupid river. The fastest electronics, the Your Health and Wellbeing tracked and adjusted by an intelligence far greater than that which you could ever hope to possess, a gizmo that gives a whole new meaning to the term neural net.
1308+Urbit is decentralized which, in my opinion, means that it isn’t really a network in the way that Facebook is. I see Urbit as more of a network platform. The users create the networks, or migrate them in from elsewhere. We’re all using Landscape and running our VMs on Nock, so obviously there can be interaction between different communities. But anyone who doesn’t want that cross-community interaction doesn’t have to have it.
14931309
1494−2050 turned out to be a pretty good year after all.
1310+I’ve followed Urbit’s progress since 2016, so I’m plugged into groups with other Urbit people I’ve come to know over the years. Other than that, however, I don’t know much about who’s out there. It’s not like The Portico is in one neighborhood and the atheists are in the next neighborhood over. There’s a real sense in which we’re not even on the same network—different Urbit communities share a common protocol, but a protocol isn’t a network.
1311+
1312+Some people may want to see a little of everything. If atheists want to join our group they’re welcome to do so! We’ll be friendly. I don’t seek out their groups, though.
1313+
1314+One virtue of decentralized social media is that it offers a totally different set of trade-offs with respect to how you share and act on your beliefs. What if you could talk earnestly about philosophy and religion without having to worry about alienating many of your friends and family? I guess that’s somewhat possible on Facebook—do they still have “groups”?—but Urbit was designed for it.
1315+
1316+Having said all that, I don’t think decentralization is a panacea. Even if Urbit takes off, it will likely face problems that are difficult to anticipate now. My hope is simply that Urbit’s trade-offs are healthier than the ones we’ve had before.
14951317]]></content:encoded>
14961318 </item>
14971319 <item>
1498− <title><![CDATA[2020 -> 2021]]></title>
1499− <link>https://urbit.org/blog/2020-to-2021</link>
1500− <guid>https://urbit.org/blog/2020-to-2021</guid>
1501− <pubDate>Wed, 20 Jan 2021 00:00:00 GMT</pubDate>
1320+ <title><![CDATA[Lunar Urbit and the Internet of Things]]></title>
1321+ <link>https://urbit.org/blog/iot</link>
1322+ <guid>https://urbit.org/blog/iot</guid>
1323+ <pubDate>Thu, 29 Apr 2021 00:00:00 GMT</pubDate>
15021324 <content:encoded><
1327+
15061328
15071329<br>
15081330
1509−In this post, which has been adapted from our most recent [newsletter](https://urbit.us11.list-manage.com/subscribe/post?u=972a03db9e0c6c25bb58de8c8&id=be143888d2), we'll take a moment to reflect on the events of the last year, and then turn our attention to the next one.
1331+Each of the ~4B 32-or-fewer-bit or [Azimuth](/docs/glossary/azimuth)
1332+identities, namely [planets](/docs/glossary/planet),
1333+[stars](/docs/glossary/star), and [galaxies](/docs/glossary/galaxy), may
1334+spawn ~4B 64-bit child identities known as [moons](/docs/glossary/moon).
1335+Moons are the undeveloped wild outback of Urbit, with a story waiting to be told
1336+that promises to be as enormous in scale as the cloud personal computing story
1337+told by planets, and possibly even more so.
15101338
1511−## 2020
1339+Throughout this piece, we use "Earth" and "Mars" in the Urbit sense. "Earth"
1340+refers to the [current computing
1341+paradigm](https://en.wikipedia.org/wiki/Big_ball_of_mud). "Mars" refers to the
1342+perfected computing paradigm that Urbit aspires to be, but also to the current
1343+and future state of Urbit.
15121344
1513−In spite of the many challenges presented over the last year, it was a resoundingly good one for Urbit.
1345+Today we will review the prehistory of moons on Earth, give a snapshot of how
1346+moons are being utilized on Urbit in 2021, cover existing issues with consumer
1347+IoT and how Urbit resolves them, and speculate what the lunar locus of the Urbit
1348+ID address space may become in the future. To keep the futurist scope limited,
1349+we primarily speculate on the usage of moons in (industrial) internet of things
1350+settings, especially with respect to agriculture, and how they may manifest as
1351+the workhorse collection unit of decentralized data markets.
15141352
1515−It seems like a long time ago now that the folks at Tlon rolled out OS1 (now called Landscape), just as the pandemic forced everyone into their homes throughout the world. At the time, [Urbit is for Communities"](https://urbit.org/blog/urbit-is-for-communities/) was just a vision, but now it’s been transformed into reality—there are more thriving communities in Landscape than any of us can keep track of, with new faces popping onto the network on a daily basis.
1353+For those unfamiliar, moons differ from all other
1354+[ships](/docs/glossary/ship) in that they are not independent identities
1355+with total sovereignty over their data and keys. Instead, their cryptographic
1356+keys are issued and controlled by their parent identity. The relationship
1357+between the keys of a parent ship and its moons are analogous to the
1358+relationship between primary keys and subkeys in a system like
1359+[PGP](https://en.wikipedia.org/wiki/Pretty_Good_Privacy). The parent may revoke
1360+or change its child moons' keys at any time. A typical relationship between a
1361+planet and a moon may be like one of a human and their smartphone. If you lose
1362+your phone, you don't want someone to pretend they are you, operating one of
1363+your moons, on the network. The planet can revoke the keys, and the moon stored
1364+on the phone becomes inert, no longer able to communicate with the network.
1365+While planets and stars also depend on their sponsor to assist with peer
1366+discovery and software updates, these relationships rely on mutual agreement,
1367+since either party may choose to discontinue the relationship and establish a
1368+new one elsewhere. Moons possess no such freedom.
15161369
1517−Landscape brought many new ships onto the network which helped identify those areas in which Urbit’s infrastructure could be most improved. [Ford Fusion](https://urbit.org/blog/ford-fusion/) eliminated the possibility of a partially-applied over-the-air (OTA) update through a drastic reduction in the size and complexity of the codebase. The efficiency of the OTA process was improved by several orders of magnitude, and many long-standing memory issues were resolved. Now we deploy code on our infrastructure nodes and see users receive an update, over a decentralized network, often in less than a minute.
1370+### Lunar prehistory
15181371
1519−After improving the stability of the system Tlon turned its attention to bringing more ships onto the network. A long-standing barrier to Urbit’s adoption has been the technical knowledge required to host one’s own ship—this prompted Tlon to build and launch an Urbit [hosting service](https://tlon.io), the waitlist for which is now thousands deep.
1372+
15201373
1521−With Tlon becoming more singularly focused on building products on Urbit, concrete steps have been taken towards making urbit.org a separate organization that’s focused on long-term development of Urbit’s platform. I joined to [lead that effort](https://urbit.org/blog/first-steps-towards-urbit-org/) back in August and have since spent the majority of my time working with dozens of contributors on projects spanning documentation, education, external integrations, and much more.
1374+It may come as a surprise to you that you are already very familiar with moon
1375+identities—they've just never been explained as such because the context in
1376+which that terminology makes sense didn't exist before Urbit. Moons, in fact, are not
1377+a new concept at all. Virtually your entire experience of the internet in the
1378+modern era is the experience of someone who possesses some number of moons
1379+subordinate to planets who mostly refuse to talk to one another. The feeling you
1380+get of constantly moving between silos, juggling accounts, not controlling your
1381+own data, etc., is a direct result of the fact that, on Earth, you only possess
1382+moons. No planets.
15221383
1523−We rounded out the year with a full network reset (called a “continuity breach”), which has in the past has been synonymous with loss of all data on the network. This time things went differently: tooling was made available to the community that allowed ships to preserve their data, which enabled most to seamlessly rejoin post-reset. This is a significant milestone for the project as it signifies not only a commitment to technical excellence, but to supporting our budding community.
1384+We're speaking, of course, of the client-server relationship. From the Urbit
1385+perspective, the Facebooks, Twitters, and Googles of the world are planets, and
1386+accounts held with these services may be thought of as moons subordinate to
1387+those planets. Your account with these megacorps is only yours for as long as
1388+they please. If you happen to step on a digital landmine, such as a virus that
1389+causes Google's servers to believe you are a bot, you are suddenly banned from
1390+their service, often with no recourse. All your data, your connections, your
1391+network—vanished. We are all Mark Zuckerberg's moons, and they're armed to the
1392+teeth with surveillance equipment.
15241393
1525−## 2021
1394+There are two classes of internet users: those with servers who hold all the
1395+power, and clients who use those servers in the way prescribed by the owners.
1396+Running a server is theoretically accessible to anyone, but practically
1397+difficult: server maintenance is a technical endeavor that requires specialized
1398+knowledge and substantial time investment. Other barriers exist beyond just the
1399+technical: for instance, if you wish to set up your own email server, you will
1400+probably be blocked by large providers because unknown email servers are almost
1401+always spam. The root cause of this circumstance is that the email protocol
1402+lacks [Sybil resistance](https://en.wikipedia.org/wiki/Sybil_attack). Urbit has
1403+Sybil resistance built in, eliminating certain kinds of incentives for
1404+gatekeeping such as this.
15261405
1527−In the last three weeks we’ve seen a huge amount of inbound interest as people are waking up to the inherent problems with using centralized services run by MEGACORPs—we’re just happy we started working on Urbit all those years ago. While we tend to not plan more than about six months in advance, I can still talk at a high level about what urbit.org will be focusing on in the immediate future.
1406+We seek to level the playing field by giving everyone a server. We accomplish
1407+this by making the process of running your own server (planet) as easy as
1408+running your personal computer today. We aren't quite there yet, but we've made
1409+leaps and bounds over the past couple of years.
15281410
1529−Growth in Urbit’s developer community has been growing organically in lockstep with the overall network growth. This means, happily, that there’s a pretty large pool of people eager to contribute to Urbit. The priority for urbit.org, therefore, is to improve its capacity to effectively assist contributors. In broad strokes, this means:
1411+Of course, this analogy isn't perfect—Urbit moons are servers themselves, but as
1412+they may only act in accordance with the wishes of its parent, they are
1413+effectively as locked in degrees of freedom as a client is to a server. The
1414+moon's keys may be revoked at any time by the parent. To distinguish these
1415+prehistoric moons from Urbit moons, we will refer to them later as "primitive
1416+moons".
15301417
1531−- Rework urbit.org to better help developers learn how to contribute to Urbit
1532−- Since Urbit is ready to build on top of, provide practical guides that demonstrate how to do so
1533−- Guide developers to make high-value contributions to Urbit and its ecosystem
1534−- Build community amongst contributors
1418+Urbit contends that moons are not the appropriate digital exocortex for a
1419+responsible adult. They are for devices, experiments, or your children. We hope
1420+that the dominant server-client relationship, which is the primary weapon of the
1421+surveillance-industrial complex, will meet its end in the near future.
15351422
1536−My strategy to date has been heavily focused on working directly with contributors to provide technical guidance and direction, and it’s been working really well. To that end I’ll also be scaling our ability to provide such support by bringing more individuals into urbit.org that can mentor, review work, and provide guidance on where to best direct contributors' energy.
1423+### Moons in the early Martian era
15371424
1538−2021 is shaping up to be a big year for Urbit, and we'd [love your help](https://grants.urbit.org) in building it. If you want to see what we're working on in real time, join us in Landscape at ~wolref-podlex/foundation.
1425+
15391426
1540−See you on the network!
1541−]]></content:encoded>
1542− </item>
1543− <item>
1544− <title><![CDATA[Ames Security Audit and the Future of the Protocol]]></title>
1545− <link>https://urbit.org/blog/security-audit</link>
1546− <guid>https://urbit.org/blog/security-audit</guid>
1547− <pubDate>Thu, 17 Dec 2020 00:00:00 GMT</pubDate>
1548− <content:encoded><
1431+Tlon recently launched a survey bot called [Eliza](/blog/eliza), which was
1432+initially a comet. We frequently got questions on whether Eliza was actually
1433+Tlon's bot, because it could just as easily be a malicious actor posing as Tlon.
1434+We soon plan to relaunch Eliza as a moon of `~zod`, which is the most
1435+recognizable official galaxy of Tlon. This is to establish that the bot is
1436+indeed official; only someone with access to `~zod` is capable of creating a
1437+moon of `~zod`, and so a moon of `~zod` automatically carries with it a
1438+cryptographic guarantee that you are communicating with an official digital
1439+representative of Tlon. On Earth something like this would need to be
1440+accomplished with certificate chains but, on Mars, this sort of authentication
1441+is baked into the very fabric of the network, rather than as an additional layer
1442+on top. This is a very good representative case of how moons naturally inherit
1443+the reputation of their parent, even in the absence of any formal reputation
1444+systems on Urbit.
15521445
1553−<br>
1446+We see folks using moons as backup identities in case they can't or don't want
1447+to access their primary planet for one reason or another. Again, since anyone
1448+may verify the parent of a moon, the moon inherits the reputation of its parent.
1449+These backups could be vanity identities—for instance, every `~sampel-palnet`
1450+has underneath it a moon named `~master-sampel-palnet`[^0].
15541451
1555−The security firm Leviathan has now finished their initial audit of the security of Urbit's Ames network protocol. In addition to their review of Ames, we also asked them to identify any other issues in order to help guide further development.
1556−
1557−I'm pleased to report they confirmed the cryptographic soundness of the protocol, namely that "a ship must have possession of their own valid Urbit key in order to authenticate as that ship and to send valid Ames messages. Additionally, no other ship except the two communicating may be able to decrypt or modify messages during transport."
1558−
1559−This means Ames uses cryptography in a mathematically sound manner that protects your privacy, keeps your secrets secret, and ensures nobody else will be able to impersonate you on the network. Since this was an architectural audit, it’s possible there are still vulnerabilities in the runtime implementation. Until the runtime has been hardened, Tlon continues to recommend against storing valuables in your ship.
1452+Some use moons to host group(s). Hosting a group inevitably means that that ship
1453+will process more network traffic, and a heavily trafficked group may impact a
1454+ship's performance. Thus one may wish to offload group hosting duties to a moon
1455+to maintain a more performant planet.
15601456
1561−Aside from a couple of minor issues that have already been resolved, there are three general classes of problem highlighted in their report that future work will need to address:
1457+As we currently lack a real system for 3rd party software distribution (though
1458+see this recent [developer call](https://youtu.be/XwICC6Its1E) on a solution in
1459+progress), one stopgap has been to download software by syncing a foreign
1460+[desk](/docs/glossary/desk) to your ship. This is risky, as buggy software
1461+may make break your ship and make it difficult to get running properly again.
1462+For this reason, testing new software on the livenet is frequently performed on
1463+moons, so as not to risk the parent ship if something were to go wrong.
15621464
1563−- Forward secrecy
1564−- Protection against denial of service attacks
1565−- Enforcement of social boundaries
1465+### Internet of Things
15661466
1567−Ames’ design allows for versioning of the protocol, which means that the proposed changes below can be deployed as over-the-air updates as they become more pressing concerns. This feature gives us confidence that we can address future security issues as they arise.
1467+
15681468
1569−We will need to improve all of these over the next couple of years, as independent lines of work. As the network grows: better forward secrecy will decrease the damage from a key getting compromised; resistance against denial of service attacks will make the Urbit network resilient to increasingly determined saboteurs; and stricter enforcement of social boundaries will let Urbit’s social networks remain safe and friendly despite potentially increasingly large numbers of bad actors and increasingly complex app ecosystems.
1469+Now we start to look towards the future by examining the problems faced by IoT
1470+in the present and speculating on how Urbit might solve them.
15701471
1571−## Forward Secrecy
1472+The Internet of Things is much maligned by technologists as a privacy, security,
1473+and maintenance nightmare. These products usually depend on phoning home to
1474+perform their service, which is inevitably a funnel by which personal data is
1475+harvested, an attack surface for hackers to gain access to your home network,
1476+and a single point of failure which may render the device useless, all in one!
1477+One need look no further than the recent [Ubiquiti
1478+breach](https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-breach-catastrophic/)
1479+to see all of these failure modes happening on a massive scale, and this is par
1480+for the course. This sort of dynamic is completely antithetical to the Urbit
1481+philosophy, so any involvement of Urbit with IoT will reject many fundamental
1482+assumptions on how IoT operates today.
15721483
1573−A protocol is said to have forward secrecy if compromising a key used in a recent message doesn’t also compromise all previous messages. Similarly, a protocol is said to have backward secrecy -- also called future secrecy -- if compromising a key used in a previous message fails to compromise all future messages. Ames has some degree of both, but more would be better, to decrease the damage an attacker could inflict by compromising a key.
1484+However, it's important to understand why the current IoT model works like this
1485+at all. We posit that it ultimately stems from the fact that today's IoT
1486+products are primitive moons for which you do not operate the parent planet.
1487+Almost every IoT device operates in the Software as a Service (SaaS) paradigm
1488+because most people don't have personal servers that could do all the processing
1489+work actually necessary for an IoT device to operate. This is not the _only_
1490+reason for this—it's also just more profitable to collect consumer data.
1491+However, it's the SaaS aspects which make the whole thing such a catastrophic
1492+mess.
15741493
1575−As it stands, an Urbit user can change their Ames keys whenever they want, by conducting an Ethereum transaction to update the Ames public key listed in the Azimuth contract, which implements Urbit’s PKI on Ethereum. Compromise of one Ames private key does not compromise earlier or later keys, so this has both forward and backward secrecy. The main drawback is that Ethereum transactions can be expensive, so key rotation is likely to be infrequent, and an attacker might be able to gain access to a long stretch of time by compromising a single key.
1494+Imagine a different world: if the server that your device reports to is your
1495+own, there is no loss of control over personal data. If the device only
1496+communicates on the local network, it will prevent remote hackers and disruption
1497+if you internet fails. And if the manufacturer goes out of business, the device
1498+will still work-it is not dependent on the manufacturer's servers.
15761499
1577−Various key rotation “ratchet” schemes could be added to Ames to establish varying degrees of forward and backward secrecy, and other kinds of cryptographic protections beyond basic soundness, such as break-in recovery.
1500+The wants and needs of the individual are at odds with the wants and needs of
1501+the megacorp, and that mismatch manifests as the antifeatures that plague IoT.
1502+By eliminating the SaaS aspect, Urbit solves many of the largest outstanding
1503+issues with IoT in a single blow. Digital personal AI assistants have long been
1504+an anticipated science fiction prediction and their full realization is on the
1505+horizon. But in their current manifestation, many privacy- and
1506+security-conscious people would never consider using them at all, since they are
1507+inevitably presented as SaaS that requires intimate knowledge of your devices
1508+and their stored data. Recommendation engines such as the one used by YouTube
1509+offer helpful guidance towards content you'll find appealing, but they're also
1510+designed to keep you hooked to the service. These kinds of programs can be
1511+useful, but they're dystopian when they come saddled with anti-consumer
1512+subroutines. Since your Urbit belongs to you, it can never act against your own
1513+interests without your consent. In our lunar vision, your digital personal AI
1514+assistant will live on one of your moons, rather than on megacorp's cloud.
15781515
1579−Right now, changing a key through Azimuth is a manual process. It could be automated, possibly as one of a suite of services that an Urbit Provider will offer. Unfortunately, each key rotation costs the user money, so automating rotation could get prohibitively expensive.
1580−Existing protocols, such as the Signal app's encrypted messaging protocol, the Noise protocol framework, and the Wireguard VPN protocol, use ephemeral Diffie-Hellman key exchange and KDF chaining to achieve forward and backward secrecy and self-healing.
1516+For web-exposed devices, Urbit offers the same security guarantees that it
1517+offers for your personal computer: everything is end-to-end encrypted by
1518+default, and signed with keys that one can easily verify as belonging to the
1519+node sending the message.
15811520
1582−Ames could be upgraded to use one of these existing ratchet algorithms, or we might create an Urbit-specific variant optimized for the Urbit network. This is work that should be done, but fortunately it will not require any novel research or drastic changes to Ames’s architecture.
1521+[Vint Cerf](https://en.wikipedia.org/wiki/Vint_Cerf) has outlined the case for a
1522+system like Urbit ID for IoT use
1523+[here](https://cacm.acm.org/magazines/2018/12/232883-self-authenticating-identifiers/fulltext).
1524+In brief, that the Urbit ID system allows one to match public keys with devices,
1525+bestowing devices with self-authenticating identities. This allows one to trust
1526+the communications received from the device to whatever degree the private key
1527+is held secure. IP addresses, GPS coordinates, MAC addresses, etc., are not
1528+sufficient to generate high levels of trust—they're all temporary, easily
1529+spoofed, or both.
15831530
1584−While Urbit’s cryptographic protections don’t yet match those of Signal or a few other privacy-focused apps, Ames is cryptographically sound, and since Urbit updates itself over-the-air and is backed by a stable, decentralized PKI, I’m confident that the level of sophistication of Urbit’s cryptography has the potential to be world-class with just a bit more work.
1531+> One might imagine applying this to the Internet of Things (IOT) in which the
1532+> IOT device self-generates a public- and private-key pair and registers the
1533+> public key. For example, with a hub or controller so the hub can confirm it
1534+> has reached the right IOT device. By the same token, configuration of the IOT
1535+> device into an ensemble could include incorporation of the public key of the
1536+> controller into a list of valid devices that can command or obtain data from
1537+> the now-configured IOT device. Both ends can verify they are talking to the
1538+> originally configured devices, assuming no device has lost its private key.
15851539
1586−## Denial of Service
1540+Here, the hub or controller referred to would be your planet.
15871541
1588−A denial of service (DoS) attack against an Urbit ship is an attempt to overwhelm it remotely by sending it network data in such a way as to interfere with the ship’s ability to communicate with other ships or process other events -- usually by hogging its resources (computational power, memory, or bandwidth) until normal operation slows down or ceases entirely. Since the promise of Urbit is that everyone can run their own server, that server needs to be able to defend itself against DoS attacks. This is in fact one of the main impediments to running your own server in the modern world.
1542+Urbit has many other features that make it well-suited for IoT, above and beyond
1543+eliminating the SaaS model and providing self-authenticating identities. Many of
1544+these additional advantages derive from the fact that Urbit is a [solid state
1545+interpreter](/docs/arvo/overview#solid-state-interpreter) and that
1546+[Ames](/docs/glossary/ames) is a network of solid-state interpreters
1547+equipped with cryptographic identity. We explore this in the next section.
15891548
1590−Right now, Urbit has no protection. Soon, it will need to at least be able to resist a simple attack carried out by an individual. Eventually, it should be able to resist a determined Distributed Denial of Service (“DDoS”) attack, which is more difficult.
1549+### Future lunar cosmotechnics
15911550
1592−There are two categories of DoS attacks in Urbit: authenticated and unauthenticated. An authenticated attack requires access to a ship's private key to construct valid Ames packets intended to overwhelm a target. All authenticated attacks will be handled primarily through enforcement of social boundaries, as discussed in the next section.
1551+
15931552
1594−An unauthenticated DoS attack constructs packets that eventually fail to authenticate and decrypt but still overwhelm the target by causing it to waste resources (CPU, memory, disk, bandwidth) in such a way that it can't keep up with legitimate communications.
1553+We now polish off the old crystal ball and imagine future uses of Martian lunar
1554+technology. Particularly, how the tech may develop over time once it becomes
1555+widely exposed to the evolution-inducing forces of industry and culture. This
1556+section is pure speculation, and I only aim to offer a small glimpse of a
1557+potential future, rather than an exhaustive one. This picture will necessarily
1558+be biased by my personal proclivities and expertise, or lack thereof.
15951559
1596−An unauthenticated DoS attack relies on the lack of Sybil resistance of IP networks: it's possible to generate new IP addresses rapidly, and a determined attacker might also be able to spoof its sender IP address. This is best considered an IP-layer attack that must be handled mostly at the IP layer itself, by maintaining state about which IP addresses can be trusted and which can't, determined empirically and heuristically by the Urbit runtime. The best any higher-level protocol, such as Ames or TCP, can do is make it as cheap as possible for a DoS target to reject a bad packet.
1560+Any discussion on the future of moons is incomplete without mentioning the
1561+possibility of [lunar emancipation](https://urbit.org/faq/#more-planets) in
1562+order to increase the number of planets. This fascinating topic sees regular
1563+discussion in the Urbit Community group, but is outside the scope of this
1564+article.
15971565
1598−The overall strategy that Ames can take, as a protocol layering over the IP protocol, is to add an authentication procedure to each packet that can quickly identify bad packets, which an implementation will then use to mark that IP address as suspect and to refrain from adding the sender IP to a list of known-good IPs.
1566+In order to respect the reader's time, I'm narrowing our scope to a particular
1567+topic: the agriculture industry. I'm also assuming a future with specialized and
1568+increasingly small hardware to run Urbit. Right now, a 4 GB Raspberry Pi is the
1569+standard for "small Urbit". If someday there are CPUs specifically designed for
1570+running [Nock](/docs/glossary/nock), one could imagine going much smaller.
1571+Ultimately, I'm going to assume that there will someday be [solid-state
1572+interpreter](#ssi) microcontrollers - so the inclusion of Urbit on a device may
1573+require nothing more than a couple [surface-mount
1574+devices](https://en.wikipedia.org/wiki/Surface-mount_technology) on a larger
1575+chip.
15991576
1600−Currently, Ames handles this by attempting to decrypt a message and rejecting the message on failure. This may be a more costly solution than other methods, such as attaching a signature or a MAC to each message. The way to mitigate unauthenticated attacks is to make bad packets fail faster by augmenting each packet with a signature or MAC to each packet, since those are faster to validate than encryption.
1577+Urbit is intended first and foremost as a personal computer. When I unravel its
1578+potential usage in industry, I adopt the forecast of a drastic increase in the
1579+manufacturing capacity for individuals and small groups. Agriculture is a great
1580+microcosm of this long-standing trend; less human input is needed to produce the
1581+same amount of food, whether it be crops or livestock. The modern era is
1582+distinguished by the fact that small numbers of people can manage enormous farms
1583+which produce food for vast populations. Thus, computation on modern automated
1584+farms may be thought of as existing at the intersection of both personal and
1585+industrial scale, and show how computerized and mechanized workflows add to the
1586+amazing productivity of modern farms and demonstrate that individual-sized
1587+inputs are able to create industrial-sized outputs. I predict that the set of
1588+trades for which this dynamic holds will only increase over time.
16011589
1602−So far, we have identified three approaches that could be taken here. Of these three, Leviathan recommended the end-to-end HMAC solution, since that would not impose additional CPU requirements on packet-relay nodes, such as stars.
1590+Agricultural automation has been a primary engine for the growth of
1591+civilization, but it has been hampered by the downsides of IoT elaborated in the
1592+previous section. One bellwether of this dynamic is the right to repair one's
1593+own equipment. [John
1594+Deere](https://www.thetruthaboutcars.com/2020/03/its-payback-time-right-to-repair-movement-targets-john-deere/)
1595+has long been at the center of this controversy. Farmers have lost the ability
1596+to repair their own equipment due to vendor locks and a dependency on remote
1597+servers. Furthermore, any suite of sensor products designed to gather important
1598+data such as genomics, hydrology, soil health, weather, etc., inevitably only
1599+cooperate with other products by the same vendor. It's the same story all over
1600+again—you are a client of a megacorp server. Or in Urbit terms, you have a bunch
1601+of primitive moons belonging to different planets held by megacorps, and no
1602+planet to call your own.
16031603
1604−- Sign each packet, and any relay or final recipient could validate the signature
1605−- Wrap each packet in an HMAC, validated by the final receiver
1606−- Wrap each packet in a HMAC for each hop in a relay chain; each relay would validate and strip the previous HMAC and add a new one for the next hop
1604+Again, Urbit resolves these issues in the same fashion as above. One might argue
1605+that using Urbit is another form of vendor lock-in—but this is evaluating Urbit
1606+at the incorrect level. Since Urbit is an open source operating system, its
1607+functionality may be extended and modified arbitrarily by any party. _Some_
1608+computational infrastructure is necessary— that fact can never be escaped. But
1609+you can escape from closed source software that does not permit you to modify,
1610+to open source software that allows you to tinker at will. Thus we do not
1611+consider open source software to be a form of lock-in, or at least, it's a much
1612+milder form of lock-in compared to something like Apple's walled garden.
16071613
1608−Any of these solutions would be attempts to increase the rate at which the network could discard invalid packets, with different tradeoffs. I'll back up a bit to provide some context, and then I'll compare the approaches.
1614+So let us focus on the additional meritorious aspects of Urbit (or more
1615+generally, solid state interpreter networks) that make it not merely a band-aid
1616+to the broken IoT system but a permanent and sound replacement.
16091617
1610−In any DoS solution, a planet will want to block or throttle IPs that have been sending it packets that fail to authenticate and decrypt. Ideally, a star will help protect planets for whom it’s relaying, too. Many different arrangements among galaxy, star, and planet are imaginable here, from an open policy to a policy wherein each packet has to come from a known-good IP. This sort of paranoid, closed-off arrangement might still not be enough to withstand a determined DDoS, but it's difficult for me to imagine doing better than that without launching Urbit-specific ISPs. Ames packets are cryptographically authenticated, so an Urbit ISP would actually be feasible.
1618+#### Solid state interpreter networks {#ssi}
16111619
1612−This brings us back to the three possible ways of mitigating DoS from within the Ames protocol. They all involve adding a piece of authenticating information to each packet that can be verified more quickly than waiting for the cyphertext to fail to decrypt — Ames's symmetric encryption is authenticated, so it's not a cryptographic soundness issue, but the performance impact of trying to decrypt could be significant enough to make it hard to prevent a DoS.
1620+
16131621
1614−As-is, an Ames packet is basically `[protocol-version checksum sndr rcvr (nullable origin) cyphertext]` (visit [this PR](https://github.com/urbit/urbit/pull/4051#issue-530369627) for a full specification). Let’s walk through the construction of the packet and how it can be upgraded to offer different DOS mitigations.
1622+Urbit is the world's first solid-state interpreter (SSI). This concept is
1623+summarized in the [white paper](https://media.urbit.org/whitepaper.pdf) as
1624+follows:
16151625
1616−### DoS Mitigation Approach 1: Signature
1626+> Imagine it as a chip. Plug this chip into power and network; packets go in and
1627+> out, sometimes changing its state. The chip never loses data and has no
1628+> concept of a reboot; every packet is an ACID transaction.
16171629
1618−The first approach to DoS protection would be to add a signature to the packet. The signature would cover everything except the checksum and the origin, since those need to be swapped out by relays. The signature would probably obviate the need for the (20-bit) checksum, although we could also leave it in there if we can't figure out what else to do with those header bits.
1630+Also,
16191631
1620−#### Advantages of a signature over other approaches
1632+> Briefly, an SSI is an interpreter which is also a database. In more depth, an
1633+> SSI combines three properties: uniform persistence, source independent packet
1634+> networking, and high-level determinism.
16211635
1622−- It can be validated by anyone on the network. Relays would not need to modify it. This might also give it symmetry with the upcoming remote scry protocol, which might also sign every packet. I'm not quite sure this is an important property, actually, but it might theoretically make launching an Urbit ISP or internet backbone easier one day.
1623−- It would be signed directly by the key listed on Ethereum, not something that might get ratcheted at some point for better forward secrecy — this could eventually lower the rate at which intermediate validators need their key caches invalidated, although this is a bit of a theoretical concern.
1636+We do not wish to segue into a lengthy examination of what this really means—
1637+that's what the white paper is for—but we will attempt to explain why these
1638+properties are of great benefit in an industrial IoT context such as
1639+agriculture. We'd also like to predict that Urbit will not be the only SSI.
1640+Other sorts of SSI's specialized to various tasks may one day roam the planet,
1641+and these may be better suited for particular IoT tasks than
1642+[Arvo](/docs/glossary/arvo). However, this article will be couched in terms
1643+of SSIs communicating with an [Ames](/docs/glossary/ames)-like networking
1644+protocol and Urbit ID-style cryptographic identity, rather than Urbit in
1645+particular.
16241646
1625−#### Disadvantages of a signature over other approaches
1647+For a SSI, losing power is less of a catastrophic event than it is for ordinary
1648+computers with volatile memory. Knowing that you can never lose any state is a
1649+powerful guarantee on the integrity of your data. Loss of power will always mean
1650+loss of any data potentially collected while power is down, regardless of the
1651+device you use, but with a SSI you at least have assurance that you will never
1652+lose data that was collected before it could be transferred from the cache to
1653+the disk. Of course, this is actually the sort of guarantee that [ACID
1654+transactions](https://urbit.org/docs/arvo/overview/#acid-database) have—it is
1655+just that this set of guarantees emerges naturally as a consequence when you
1656+have a SSI. Put another way, every SSI is a database; having every device be a
1657+database is a major boon in situations where enormous quantities of data are
1658+being collected across a distributed network. The standard today is that data is
1659+only collected at hubs, and any data that doesn't reach a hub is irretrievably
1660+lost.
16261661
1627−- Generating and validating a signature is significantly slower than generating and validating an HMAC.
1628−- An ECDSA signature is 64 bytes, which is ~6% of a packet payload. As far as I can tell, it can't be compressed.
1629−- Since the signature could be validated by anyone, it doesn't attest to a specific communication channel, so it might not help as much with IP filtering.
1662+SSIs are also deterministic at a high level. While all computers are
1663+deterministic at the CPU level, interruptions to power can result in an
1664+undefined semantic state and result in the random erasure of half of its brain.
1665+This determinism is what begets ease of maintainability of Urbit—problems
1666+generally only need to be solved once by experts and the solution propagates to
1667+the rest of the network via [OTA updates](/docs/glossary/ota-updates). We
1668+addressed this maintenance issue previously—we only remark now that this
1669+property is derived from being a SSI, rather than something particular only to
1670+Arvo or Urbit. When one has hundreds or thousands of devices to manage, the
1671+guarantees on ease of maintenance provided by determinism are extraordinarily
1672+convenient.
16301673
1631−### DoS Mitigation Approach 2: End-to-End HMAC
1674+Packet routing on SSI networks is source-independent, and in the context of an
1675+Ames-like networking protocol, are always delivered exactly once and in a
1676+precise order due to the fact that nodes on an Ames network are in a permanent
1677+session. Source-independent means that the identity that originated a packet
1678+does not need to be the one to deliver it—packets are _facts_, and the truth of
1679+a fact does not depend on who you heard it from. This means that it is possible,
1680+for instance, to send instructions to a moon before it even exists and be
1681+guaranteed that that moon will receive them and perform the tasks given, even if
1682+the device that originally sent the packets no longer exists. As long as
1683+somebody has kept the packets on hand, they will eventually be delivered. So,
1684+one could imagine transmitting directions to a crop harvesting robot into which
1685+a moon will be installed before the robot has even been purchased, know that
1686+once it is delivered it will automatically begin its task, and know that those
1687+tasks will be completed in the correct order, without any accidental repeats.
1688+Taken to the limit, one can imagine preplanning the automated tasks for an
1689+entire farm before a single device is purchased, with powerful guarantees on the
1690+integrity of those instructions no matter how much time elapses between sending
1691+and receiving.
16321692
1633−The second approach would be to use an HMAC instead of a signature, validated by the eventual receiver. This HMAC would also cover everything except the mug and origin. I'm calling this the "end-to-end HMAC" design. An HMAC requires a shared secret, for which we could use the same symmetric key that Ames uses.
1693+#### P2P data markets
16341694
1635−#### Advantages of end-to-end HMAC
1695+
16361696
1637−- It's simple in some sense; relays don't need to do anything cryptographic.
1638−- HMACs are much faster to create and validate than signatures.
1639−- HMACs, since they're hashes, can be truncated arbitrarily and still maintain some security — to find hash collisions, you'd still have to guess what packet||shared-secret would hash to; it would just be a smaller search space. Since Ames's encryption already guarantees authentication and we'd just be using this as a performance optimization, I suspect we could get away with using one that's significantly smaller than a signature — I'm not sure how small, but if 4 bytes would be enough in practice, that would take up less than 0.5% of the space in a packet.
1640−
1641−#### Disadvantages of end-to-end HMAC
1642−
1643−- Only the recipient can validate. This means the authentication couldn't be used by relays to discard invalid packets. The recipient could provide back-pressure out-of-band to a relay to ask the relay to discard packets from an IP with an invalid HMAC, but this is indirect and might need to filter backward through multiple relays to work properly.
1644−
1645−### DoS Mitigation Approach 3: Point-to-Point HMAC
1646−
1647−The third approach, which is what I would build unless convinced otherwise, is what I'm calling "point-to-point HMAC". This design would include a different HMAC for each hop in a relay chain, instead of (or maybe in addition to) including one end-to-end HMAC.
1648−
1649−We have a couple different options for how to construct the shared secret for each hop. I would intuitively construct it using a Diffie-Hellman of my private signing key and your public signing key — the "networking keys" on Ethereum include a currently unused signing key in addition to the encryption key that Ames uses. This way even if we add more forward secrecy to Ames, changing the symmetric key used for encryption, relays wouldn't have to have their caches invalidated as often; the state required to perform relaying wouldn't be as tied to the state required to receive a message.
1650−
1651−#### Advantages of point-to-point HMAC
1652−
1653−- A star could perform some validation on every packet it's asked to relay. This makes it more difficult for an attacker to route a ton of packets to a planet through a star, or even through many relays. Signatures also have this property, but they're slower to verify. This approach and the signature approach, but not the end-to-end HMACs, force an attacker to use an (at least partially) authenticated attack in order to use a relay as a way to get to a planet.
1654−- A planet could quickly validate that a relayed packet actually came from its star, not an attacker who's managed to spoof the star's IP address.
1655−
1656−#### Disadvantages of point-to-point HMAC
1657−
1658−- Not everyone on the network can validate a packet, unlike a signature.
1659−- Each relay needs to validate and strip off the previous HMAC and create a new one before sending it. This should be quite fast, since an HMAC is just a hash, but it's still some CPU, and potentially creates an imbalance where an attacker could induce the relay to spend more CPU in validation than the attacker spent in constructing the packets.
1660−- By itself, it doesn't validate the cyphertext in an end-to-end way. I suspect we might want to include both a per-route HMAC and an end-to-end one, especially if we use truncated HMACs — although per-route might be enough on its own, since if the receiver fails to validate a bunch of packets whose HMACs were validated by the relay, the receiver can ask the relay to block that whole Urbit address regardless of IP, so it shouldn't be possible to sustain that kind of attack for long.
1661−
1662−#### An Aside About Cryptographic Performance
1663−
1664−I'm not sure exactly how much faster HMAC is. According to DJB (https://ed25519.cr.yp.to/ed25519-20110705.pdf), an ECDSA signature can be created in around 30 microseconds and verified in around 100 microseconds. This source (https://www.jacksondunstan.com/articles/3206) suggests about 21 microseconds for HMAC-SHA256, so about a 1.5x improvement in generation speed and 5x in validation speed. We should verify these numbers for ourselves before making a decision.
1665−
1666−### DoS Protection Strategy and Timeline
1667−
1668−Tlon is not currently pursuing adding any of the extra cryptographic authentication on Ames packets described above. Since this is ultimately a performance issue, there are other more pressing performance issues that we could improve upon before decryption will become the limiting factor in how many packets can be processed by a ship. We will revisit this authentication performance question once some of the low-hanging fruit has been done, perhaps roughly a year from now.
1669−
1670−Since the audit, we’ve already improved the Ames packet format to allow faster parsing, faster validation of basic fields, and faster relaying; in the future, increases in performance of Nock execution and inter-process communication between Urbit's I/O process and Nock worker would allow Urbit to absorb somewhat more punishment before service can be effectively denied.
1671−
1672−## Enforcement of Social Boundaries
1673−
1674−While Urbit needs to rely largely on its runtime to mitigate unauthenticated attacks, any attack conducted from an Urbit ship needs to be handled inside Arvo itself, not just by IP filtering in the runtime. Just like in any DoS, an attacker ship might try to induce you to use too much memory, CPU, or disk space in order to sabotage normal operation. An authenticated attack is harder to define than an unauthenticated attack, because it depends on what social relationship the attacker and target have, and it involves valid, authenticated Ames packets; once discovered, though, it’s easier to mitigate, because it can use Urbit’s permanent identity system to enforce social consequences, i.e. stop listening to that Urbit address and possibly encourage others to do so as well.
1675−
1676−There are a couple of different kinds of authenticated attack: attempts to exploit vulnerabilities in the Nock worker (the interpreter, allocator, and jets) by causing particular Nock code to run, and attempts to induce the target to exhaust various computational resources.
1677−
1678−Protecting against attempts to break out of the sandbox and hijack or otherwise interfere with the Unix process running Nock will require a process of hardening, fuzzing, and likely further security audits specifically evaluating the security of that boundary. This is largely out of scope of the Ames protocol itself, which was the subject of this audit.
1679−
1680−This leaves us with the latter case: resource exhaustion attacks. A peer could try to get my ship to use too much RAM, disk, CPU, or bandwidth by sending it valid Ames packets. This represents a social problem: a person on the network is trying to interfere with me. It's what's known in blockchain circles as an "attributable fault": once the attack is detected, it's trivial to determine the identity of the culprit.
1681−
1682−Once the attacker’s Urbit address is known, Urbit will fall back on the Sybil resistance of its identity system: there are a finite number of identities, each of which costs some money. Because Urbit identities are relatively permanent, they can be blocked permanently. As long as the expected value of an authenticated attack is less than the cost of the identity, the attacks won't happen very much — they'll cost money to sustain, instead of being self-perpetuating.
1683−
1684−Attacks like this are best thought of as attempts to violate social boundaries. I don't want you using up too many of my resources; that's a social boundary, and an attempt to force my ship to spend its resources on your behalf constitutes a violation of this boundary. The strategy for mitigating these attacks is to impose social and, indirectly, economic consequences on the perpetrators. The main social consequence is other ships refusing to communicate with you anymore.
1685−
1686−Some of this mitigation will take place in the Arvo kernel, and some will need to be application-specific. To protect the system from attackers, the kernel needs to be able to free space (Urbit is a single-level store, so there's no distinction between disk and RAM from Arvo's perspective) taken up by unfinished messages sent by peers. This can be done by allowing an application to ask Ames to delete partially received messages from a peer, generally replacing the received packets with an intent to nack (negative acknowledgment) to indicate that the transaction the peer wanted me to perform has been rejected.
1687−
1688−Applications should also be able to set resource usage policies that the Arvo kernel will enforce. For example, a chat application should configure Ames to reject any chat messages larger than, say, two hundred kilobytes. A file-sharing application would need a much larger per-message limit (ideally no per-message limit), but it might need to place a cap on its bandwidth usage to make sure lower-latency communications aren't swamped by a large file transfer. This kernel/application interface starts to resemble a permissioning or capabilities system, and it could be built as part of the crucial larger project of providing for configurable application permissions.
1689−
1690−To close the loop on enforcing social boundaries, reputation information should be shared across ships. This will likely be done by building one or more applications that share statistics and block operations. Some forms of reputation are likely to be globally shared, whereas others are likely to be multipolar, i.e. some people like you and some don’t. Generally, the lower the layer of the attack, the more global the reputation effect will be; the higher the layer, the more multipolar. An attempt to spam the network with millions of malicious packets will cause most people not to want to talk to you; sending me a movie I found mediocre is probably not even information worth sharing with anyone else.
1691−
1692−## Conclusion
1693−
1694−Ames’ design has unparalleled potential to deter, mitigate, and recover from attacks, since every packet is authenticated and encrypted and backed by a stable, decentralized PKI. It feels good to have our design for encryption and authentication be confirmed by a third party as cryptographically sound, and we know more or less what we need to build to reach the full security potential of the platform, including the steps outlined here.
1695−]]></content:encoded>
1696− </item>
1697− <item>
1698− <title><![CDATA[Input and Output in Hoon]]></title>
1699− <link>https://urbit.org/blog/io-in-hoon</link>
1700− <guid>https://urbit.org/blog/io-in-hoon</guid>
1701− <pubDate>Tue, 15 Dec 2020 00:00:00 GMT</pubDate>
1702− <content:encoded><
1706−
1707−<br>
1708−
1709−Let's talk about IO in Urbit. I won't say much about how events and effects are processed by the runtime; it suffices to note that the runtime is a normal Unix program which (1) listens for various events, (2) passes them to Arvo (Urbit OS), and (3) processes the effects produced by Arvo. Instead, I’ll focus on how IO works from the perspective of Hoon programs, like Arvo or apps running on Arvo. But first, let's review IO paradigms in other languages.
1710−
1711−All examples are in a made-up language, since it's useful to understand this information even before you're comfortable in Hoon. If you're learning Hoon and want a challenge, try translating them!
1712−
1713−## The three styles of IO
1714−
1715−I will call these styles imperative IO, monadic IO, and state machines (note that this classification refers only to the experience of using them and the program structure they dictate). An imperative programming language can use any of these and a functional programming language can use any of them.
1716−
1717−### Imperative IO
1718−
1719−Imperative languages (such as C and Python) perform IO by calling a function in the middle of whatever they were doing. Anywhere, in any statement, you could have IO.
1720−
1721−In this example and others to follow, the task will be to read a filename from the command line, read a URL out of that file, and fetch the contents at that URL.
1722−
1723− output = fetchUrl(stripWhitespace(readFile(cliInput())))
1724−
1725−For readability, intermediate variables would be a good idea, but nothing stops you from nesting IO this way.
1726−
1727−### Monadic IO
1728−
1729−Languages that use explicit monads for IO (such as Haskell) perform IO by running IO behind a bind operation, which I'll notate with `<-`. Thus, while you can't put IO _anywhere_, the general structure is a sequence of IO operations.
1730−
1731− fileName <- cliInput()
1732− url <- readFile(fileName)
1733− output <- fetchUrl(stripWhitespace(url))
1734−
1735−[Tackling the Awkward Squad](https://www.microsoft.com/en-us/research/wp-content/uploads/2016/07/mark.pdf) is the canonical description of monadic IO, and does a great job of explaining how the Haskell community decided to use this as their primary IO style.
1736−
1737−### State machines
1738−
1739−Languages that use explicit state machines for IO (such as Elm) perform IO by accepting events and producing a list of effects.
1740−
1741− event :: Initialize
1742− | CLIInput text
1743− | FileInput text
1744− | HTTPResponse body
1745− effect :: CLIInput
1746− | ReadFile fileName
1747− | FetchUrl url
1748− | Print text
1749− main(event) {
1750− switch event {
1751− Initialize -> [CLIInput ~]
1752− CLIinput fileName -> [ReadFile fileName]
1753− FileInput url -> [FetchUrl stripWhitespace(url)]
1754− HTTPResponse body -> [Print body]
1755− }
1756− }
1757−
1758−The effects produced are not functions but data.
1759−
1760−It's important to note that this example is chosen to highlight a particular kind of IO — sequences of events. Further, this example has no persistent state — each IO operation is a pure function of the output of the previous one.
1761−
1762−## A stateful, loopy example
1763−
1764−Let's look at another type of program: a simple HTTP server that you can give text at the CLI, which will respond to all HTTP requests with that text.
1765−
1766−Imperative:
1767−
1768− text = "no text entered yet"
1769− while (true)
1770− cli = readCli()
1771− if (cli != Null)
1772− text = cli
1773− request = readHttp()
1774− if (request != Null)
1775− respond(request,text)
1776−
1777−Monadic:
1778−
1779− loop("no text entered yet")
1780−
1781− where:
1782−
1783− loop :: text -> IO Null
1784− loop =
1785− input <- readInput()
1786− switch input
1787− CLIInput newText -> loop(newText)
1788− HTTPRequest request ->
1789− _ <- respond(request,text)
1790− loop(text)
1791−
1792−State machine:
1793−
1794− text = "no text entered yet"
1795− main(text,event) {
1796− switch event {
1797− CLIInput newText -> [newText, Null]
1798− HTTPRequest request -> [text, HTTPResponse text]
1799− }
1800− }
1801−
1802−Again, note the response in the state machine is data, not a function.
1803−
1804−I'm not trying to make a point about which type is better in general. There's a pretty strong argument that in the first example, imperative was the best option, followed by monadic, followed by state machine. There's an equally strong argument that the second example is most naturally represented by the state machine.
1805−
1806−Look at how state is handled in the monadic example. Formally, bind composes functions, so that every time you see a `<-` there's actually a new function (closure/delimited continuation) being created and stored for when we receive a response. All variables in scope are stored in that closure, so we can conveniently access them later without explicitly storing them. However, the state we preserve over time varies a lot. In this example, it varies between storing `loop`, `[loop input]`, `[loop input newText]`, and `[loop input request]`.
1807−
1808−By comparison, the state machine does not store intermediate values, it only stores its explicit state. While this is somewhat less flexible, it puts the permanent state front-and-center.
1809−
1810−I'll reiterate that all of these are possible to implement in purely functional languages, and further they can all be implemented in terms of each other. State machines are trivially implementable -- it's just a function [state event] -> [new-state (list effect)]. Monadic IO can be implemented directly (as in Haskell) or on top of state machines by storing continuations in your state. Imperative IO is somewhat more difficult but should be possible through algebraic effects.
1811−
1812−When inventing a new system, you should consider which of these you intend to support based on the sort of code you expect to see. For example, a scripting language will almost always benefit from imperative (or at least monadic) style.
1813−
1814−## In Urbit
1815−
1816−So much for exploring the space of IO solutions. In terms of deployed code on Earth, the split is about 90% imperative, 5% monadic, and 5% state machine. In Urbit, the split is about 90% state machine and 10% monadic. This is what I intend to explain and defend.
1817−
1818−Urbit's OS is called Arvo; it has several "kernel modules" called vanes, and it has userspace applications. Colloquially these are called "apps," but when speaking about them abstractly, it's helpful to use their more specific name: ["agents"](https://urbit.org/docs/tutorials/arvo/gall/#agents). Arvo, the vanes, and agents are all structured as explicit state machines.
1819−
1820−In addition, there are ["threads"](https://urbit.org/docs/tutorials/arvo/gall/#threads), which are structured as monadic IO. Note there's only a superficial resemblance to Unix threads: they are not executed in parallel and they don't share memory, or at least not any more than agents do. They're simply a computation that takes an argument and produces a result, possibly after doing some IO, structured monadically.
1821−
1822−As you can see, all the lowest levels of Arvo are explicit state machines, and only the highest layer supports monadic IO. To see why this is the case, let's list advantages and disadvantages to each type. Note that, while I'm speaking specifically of agents and threads in the context of Urbit, these are fundamental properties of monadic and state machine IO.
1823−
1824−Agents are:
1825−
1826−- Upgradable. Since the state is explicit, you can upgrade an agent in-place by supplying a new state machine and a function from the old state type to the new state type. This is very similar to a database migration.
1827−
1828−- Robust. A state machine must accept any input at any time. If it receives unexpected input, it must have had explicit error handling for that input, since it's one of the types in the switch statement. Thus, it's relatively easy to stay in a consistent state.
1829−
1830−- Permanent. Since it's upgradable and robust, there's no reason to stop its running.
1831−
1832−- Hard to write long sequences of IO. Long sequences of IO create many possible states, and you must handle any input in any state. This can result in complex, hard-to-follow code with code paths that are rarely if ever taken.
1833−
1834−Threads are:
1835−
1836−- Not upgradable in-place. Since the state is implicit, you can only cleanly upgrade by (1) killing the thread and restarting it or (2) letting it resolve to a defined "upgradable state" periodically, usually at the top of a "main loop". If you do (2), then you are in fact structuring it as a state machine, so the other advantages of threads are compromised.
1837−
1838−- Fragile. If we don't receive expected input, the default behavior is to be stuck waiting for input. You must remember to add any error-handling features you want, and it's easy to end up in an inconsistent state.
1839−
1840−- Impermanent. Since a thread can't be upgraded and may get stuck in case of unexpected input, a thread can't be expected to last forever. It must be "rebooted" from time to time.
1841−
1842−- Easy to write long sequences of IO. Just...write the IO one line at a time.
1843−
1844−Arvo proper and the vanes are permanent pieces of software and, for this reason, state machines are more natural.
1845−
1846−I'll note that other kernels, like the Unix kernel, use imperative IO. The difference is that Unix isn't permanent in itself — it only lasts until you reboot. Since your permanent state is stored externally, you don't need to be upgradable or permanent. With sufficient discipline you can write robust C code, so it makes sense to use imperative style. Even so, a lot of C code is written in a state machine style; even if it doesn't need to be upgradable, it's worth it for the robustness and concurrency advantages.
1847−
1848−However, Arvo is a single-level store — all of its state is permanent. This is very convenient and eliminates many long-tail bugs, but it also means we need to code for permanence, and that's much easier when you structure your code with explicit state.
1849−
1850−Further, Arvo and the vanes rarely perform long sequences of IO. Generally, they do one thing and emit some effects, similar to the HTTP server example above. Sometimes they "pass through" a request. For example, the Eyre vane passes HTTP requests to userspace agents or threads. In this case, there is a sequence of IO, which in monadic code would be:
1851−
1852− loop()
1853−
1854− where:
1855−
1856− loop =
1857− request <- receiveRequest()
1858− agent = lookupAgent(request)
1859− response <- callAgent(agent, request)
1860− _ <- sendResponse(request, response)
1861− loop()
1862−
1863−This is clear code to read, but it leaves open the question of how to respond during the callAgent() function. If another request comes in, can we handle it in parallel? If we need to upgrade ourselves before the agent responds, can we make sure to properly handle the response?
1864−
1865−The naive solution in monadic code is to say that you can only handle one request at a time, and if an upgrade happens you just drop outstanding requests. You can resolve both of these by introducing a sort of main loop, which is just a way of saying "turn it into a state machine".
1866−
1867−In a state machine, the naive solution is:
1868−
1869− state :: (map request agent)
1870− main(state, event) {
1871− switch event {
1872− HTTPRequest request ->
1873− agent = lookupAgent(request)
1874− [put(state, request, agent), CallAgent agent request]
1875− AgentResponse request response ->
1876− [del(state, request), HTTPRespond request response]
1877− }
1878− }
1879−
1880−Upgrading this is trivial, since the state (map of requests to outstanding calls to agents) is explicit. It also trivially handles concurrent requests.
1881−
1882−I won't claim this is easier or harder to write than the monadic version, but it has the properties we need at this level of the system.
1883−
1884−Userspace agents similarly are permanent entities that need to not lose data or get stuck. For this reason they’re structured as state machines.
1885−
1886−A helpful comparison is that explicit state machines are basically Mealy machines, the kind you might have learned about in an introductory digital design class. This shouldn't be surprising; a digital circuit must always be consistent because it can't be manually "rebooted", and their input and output is highly formalized. By contrast, a Rube Goldberg machine doesn't have the same constraints; which is why they're a lot more fun!
1887−
1888−It's notable also that explicit state machines are considerably more declarative than imperative or monadic IO. Not everyone thinks that's a good thing, but anyone who defends functional programming should see some advantages to that.
1889−
1890−However, userspace sometimes needs to perform long sequences of IO. Let's look at an example where we want to fetch the front page of a site and the first couple comments on each story. HTTP is unreliable, so on failure we retry five times.
1891−
1892−Monadic:
1893−
1894− topStories <- fetch(topStoriesUrl)
1895− loop(topStories)
1896−
1897− where:
1898−
1899− loop :: topStories -> IO Null
1900− if topStories is Null
1901− return Null
1902− comments <- retryLoop(5,head(topStories))
1903− otherComments <- loop(tail(topStories))
1904− append(comments,otherComments)
1905−
1906− retryLoop :: [n story] -> IO Comments
1907− comments <- fetchComments(story)
1908− if comments is HTTPError:
1909− if n == 0:
1910− bail
1911− else:
1912− retryLoop(n-1, story)
1913−
1914−State machine:
1915−
1916− state :: Initial
1917− | FetchingTop
1918− | FetchingStory comments stories retries
1919− | Done comments
1920−
1921− main(state, event) {
1922− switch event {
1923− Initialize ->
1924− assert state == Initial
1925− [FetchingTop, Fetch topStoriesUrl]
1926− HttpResponse response ->
1927− switch state {
1928− FetchingTop ->
1929− [FetchingStory Null stories 5, FetchComments head(stories)]
1930− FetchingStory comments stories retries ->
1931− if response is HTTPError:
1932− if retries == 0:
1933− [Initial, Null]
1934− else:
1935− [FetchingStory comments stories retries-1,
1936− FetchComments head(stories)]
1937− else:
1938− comments = append(response,comments)
1939− if tail(stories) is Null:
1940− [Done comments, Null]
1941− else:
1942− [FetchingStory append(comments,response) tail(stories) 5,
1943− FetchComments head(tail(stories))]
1944− }
1945− }
1946− }
1947−
1948−With practice, the state machine version of this can be written correctly. However, (1) it's verbose, (2) the control flow jumps all over the place, and (3) in practice it's challenging to get exactly right. This is still a small example, and it gets much worse as the length and complexity of the IO sequence grows.
1949−
1950−The monadic version, on the other hand, flows cleanly down the page. We can factor out generic functionality like "retry this request n times" to make the essence of the computation clear.
1951−
1952−Suppose you have to upgrade this. In the state machine, you can see exactly which stage of the computation you're in and write specific code to upgrade cleanly.
1953−
1954−Threads, as we've discussed, can't be upgraded in-place. Let's be real though: we're downloading comment sections, not regulating a nuclear reactor. If we get a better version of this script, just kill the old one and start the new one from scratch. What's a couple extra HTTP requests?
1955−
1956−This suggests a general division of workloads: code which needs to be permanent, upgradable, and concurrent should generally be a state machine. Code with long or complex sequences of IO and definite termination should generally be a thread.
1957−
1958−These aren't completely mutually exclusive, but it's surprising how often they are.
1959−
1960−### Jael: a case study
1961−
1962−When you need to do something permanent and upgradable, but you also need to do long sequences of IO, the main trick is to factor your problem into both an agent and a thread (or several).
1963−
1964−As a case study, consider Jael, one of our vanes. This maintains our PKI state, which it downloads over HTTP from an Ethereum node. Downloading from an Ethereum node is a complex sequence that starts with fetching its most recent block number, then fetching all the blocks we haven't seen and scanning for transactions we care about. We also maintain a map of block hashes to block number, and if we see that a block's parent doesn't have the hash we expect, that means a reorganization has occurred, so we must "rewind" one block at a time until we find where the fork happened, then restart going forward.
1965−
1966−You don't have to understand this sequence of IO; it's sufficient to see that it's complex and must be exactly right. We used to do this in a state machine directly in Jael. This data is, of course, permanent and needs to be accessible to the rest of the system, so Jael must be a state machine.
1967−
1968−However, we had many small mistakes in this sequence of IO, some of which only appeared during unusual events, such as when an HTTP request failed at the same time as a reorganization happened.
1969−
1970−We're in a bit of a bind, though: Jael has to be a state machine. The solution is to factor out the act of getting updates into a thread while the main PKI state is stored in the state machine in Jael.
1971−
1972−This thread has a definite purpose: given the most recent block number we already know about, fetch all the PKI transactions since then. The function signature is:
1973−
1974− syncEthereum oldBlockNumber -> IO [newBlockNumber, newTxs]
1975−
1976−Jael runs this thread every five minutes and, if it succeeds, then we update our block number and PKI state. If the thread fails, gets stuck, or we need to upgrade it, we just kill the old thread and start a new one. Again, a few extra HTTP requests don’t matter.
1977−
1978−From Jael's perspective, it looks something like:
1979−
1980− state :: State block txs outstandingThread
1981− main(state,event) {
1982− switch event {
1983− Initialize -> [State 0 Null Null, StartTimer (now + five minutes)]
1984− TimerFired ->
1985− effects = If outstandingThread is Null
1986− then Null
1987− else [Kill outstandingThread]
1988− newId = newThreadId()
1989− [State txs newId,
1990− append(effects,
1991− StartThread newId syncEthereum(block),
1992− StartTimer (now + five minutes))]
1993− ThreadFinished Failure -> [State block txs Null, Null]
1994− ThreadFinished Success newBlockNumber newTxs ->
1995− [State newBlockNumber append(txs,newTxs) Null, Null]
1996− }
1997− }
1998−
1999−In other words, from Jael's perspective, it's just a single IO event that encapsulates arbitrarily complex IO in the thread. A single IO event is easy enough, and we can maintain all our permanency and robustness guarantees, because we know the thread will have one of three results: success, failure, or it hangs. If we set a timeout, hang becomes failure, so there's only two possible results: success or failure. If we handle both of those correctly, we've handled all the possible IO errors that could have occurred.
1697+As was mentioned above, today's IoT devices ferry all sorts of your personal
1698+data to megacorp, where they package it and sell it to the highest bidder.
1699+Though personal data in aggregate is quite valuable, the value of a single
1700+individual's data is quite low. On the other hand, industrial scale data such as
1701+that collected on digitized farms could be quite valuable. Here we briefly
1702+examine how Urbit can be utilized to populate and facilitate a market for data.
20001703
2001−What about upgrading? We've already said we can handle the thread dying for arbitrary reasons, so if an upgrade comes in, we just kill it. We can upgrade Jael's state machine easily since its state is very simple.
1704+All data collected by your moons may be digitally signed by that moon,
1705+certifying the exact origin of that data. This is one advantage of having
1706+cryptographic identity baked into the core of the operating system and
1707+networking protocol. One could imagine collecting large amounts of such data and
1708+packaging it for exchange with other local and regional farmers. This can, of
1709+course, already be done in principle with current systems. But current systems
1710+do not automatically come equipped with the sort of provenance, immutability,
1711+and reputation that comes for free when you make use of SSI networks.
1712+Manipulated or faked data becomes easier to spot, and you'll know who it came
1713+from, so supplying such data puts one's reputation at stake.
20021714
2003−## Recap
1715+One major issue facing conjoining data gathered from disparate sources is simply
1716+how to do it. Data arriving in random order, from different software versions,
1717+running different hardware, is all very difficult to bundle into a good
1718+dataset - and indeed wrangling this sort of task forms a large part of the data
1719+scientist profession. As devices in SSI networks utilizing an Ames-like protocol
1720+are engaged in permanent sessions, leading to properties such as exactly-once
1721+delivery and well-ordered message sequences, issues about the order in which
1722+data arrives are dramatically simplified. I do not wish to get mathematical
1723+here, but I personally have confidence that the emerging discipline of
1724+[categorical informatics](http://math.mit.edu/~dspivak/informatics/), as well as
1725+the relevance of [low-dimensional topology to data
1726+fusion](https://arxiv.org/abs/1409.5505), resolves many of these issues. I
1727+promise to explain this in more detail in the future. For now, it suffices to
1728+say that SSI networks seem well-positioned to utilize these techniques.
20041729
2005−Let's recap what we've covered:
1730+Cryptographic techniques such as [(composable) zero-knowledge
1731+proofs](https://en.wikipedia.org/wiki/Zero-knowledge_proof), [secure multi-party
1732+computation](https://en.wikipedia.org/wiki/Secure_multi-party_computation),
1733+[ring signatures](https://en.wikipedia.org/wiki/Ring_signature), and even
1734+[homomorphic encryption](https://en.wikipedia.org/wiki/Homomorphic_encryption)
1735+offer a variety of ways in which data may be shared in an IoT context with
1736+mathematical guarantees on what sort of privacy is maintained. This is perhaps
1737+less relevant in the context of agricultural IoT, where personal private data is
1738+largely absent, but we mention them here to invite further speculation from the
1739+reader about the possibilities of IoT and SSI networks.
20061740
2007−- There are three styles of IO: imperative, monadic, and explicit state machines.
2008−- Urbit supports explicit state machines (agents) and monadic IO (threads).
2009−- Explicit state machines are preferred for permanent, robust, concurrent code.
2010−- Monadic IO is preferred for short-lived code with complex IO.
2011−- If a state machine needs to perform complex IO, it should encapsulate it in a thread so that, from the perspective of the state machine, it's simple IO.
1741+We end our discussion with an adaptation of a scenario borrowed from my brief
1742+time working on [Ceptr](http://ceptr.org/) that begins to show how a lunar
1743+IoT-connected world evokes properties of a hypothetical ["global nervous
1744+system"](https://en.wikipedia.org/wiki/Global_brain). This example is
1745+purposefully mundane to illustrate how deficient our Earth systems are, and
1746+while it is possible to accomplish in theory, it is impractical on a wide scale
1747+due to the numerous problems with IoT. Imagine that you suffer headaches from
1748+low atmospheric pressure. You'd like to know when a low-pressure front is an
1749+hour away from you so that you can pre-emptively take aspirin to prevent the
1750+headache. Your personal digital assistant, running on Urbit, can then
1751+periodically query the moons of sensors in your region for weather data to
1752+predict whether or not you will soon be passing through a low pressure front.
1753+This could be a free service or paid for automatically with cryptocurrency
1754+microtransactions. On Mars, this task will be trivial, and is merely a stone's
1755+throw away from a vast and undiscovered universe of other possibilities unlocked
1756+by SSI networks.
20121757
2013−Hopefully it's fairly clear why Urbit uses explicit state machines in most situations. More than anything else, our goal is to build software that can last forever. Explicit state machines are a crucial tool for that.
1758+[^0]:
1759+ Of course, all moon names have four words, not three. What the fourth word
1760+ needs to be for only three words to display is a matter of Urbit lore that
1761+ is more fun to discover yourself than have it told to you, so we won't spoil
1762+ it here.
20141763]]></content:encoded>
20151764 </item>
20161765 <item>
2017− <title><![CDATA[Metaphase]]></title>
2018− <link>https://urbit.org/blog/metaphase</link>
2019− <guid>https://urbit.org/blog/metaphase</guid>
2020− <pubDate>Tue, 08 Dec 2020 00:00:00 GMT</pubDate>
1766+ <title><![CDATA[Interplanetary Commerce]]></title>
1767+ <link>https://urbit.org/blog/interplanetary_commerce</link>
1768+ <guid>https://urbit.org/blog/interplanetary_commerce</guid>
1769+ <pubDate>Thu, 08 Apr 2021 00:00:00 GMT</pubDate>
20211770 <content:encoded><
1773+
20251774
20261775<br>
20271776
2028−_Previous versions of this essay specified the stream deploy date as December 11, 2020; then December 18, 2020. This has been amended to the actual date of release, with our sincere apologies. For new readers, you can opt into the dev stream by running:_
2029−
2030−```
2031−|ota ~hanruc-nalfus-nidsut-tomdun %kids
2032−|merge %home ~hanruc-nalfus-nidsut-tomdun %kids, =gem %take-that
2033−|merge %kids ~hanruc-nalfus-nidsut-tomdun %kids, =gem %take-that
2034−```
2035−
2036−_We will surface this option more broadly in a future settings overhaul._
2037−
2038−A few weeks ago, the Landscape team — those of us building Tlon’s suite of userspace applications on top of Urbit— deployed our first over-the-air update for notifications. This is a big leap forward for us. Of course, getting notifications inside Landscape itself is a big deal, but getting a push notification on your phone, or an email digest based on activity inside Urbit is now just one step away, a weekend project for a hobby developer, not an indeterminate number of steps away.
2039−
2040−After release, we received some feedback from users on the behaviour and design of this feature; beyond the obvious kinks that come from an initial release, it seemed to some like a minimum viable affordance pitched as a fully designed feature. This “bottom-up” development approach was, to us, fairly straightforward; to some of our users, it seemed that we had closed the door on the feature without even beginning to expose all its possibilities.
2041−
2042−As I’ll describe, we haven’t just been iterating Landscape, but the way we develop Landscape, and the way we consider Landscape in relation to Arvo. Finally, we’ll discuss our upcoming two-stream release process: a “stable” release stream with updates every six weeks and a development stream, with ongoing changes continuously deployed on an opt-in basis.
1777+## Paying
20431778
2044−To someone coming to Landscape for the first time, it is starting to look mature; and it is indeed maturing quickly. After all, these mismatches in expectations are pangs calling out for growth. Landscape truly has _users_, not just explorers, who are developing the same expectations they have with the other tools they use: predictability, reliability, and iterative improvements, not just leaps forward. So to meet those expectations, we’ve been working on the prerequisite work for a mature release schedule, with two different release streams for users and explorers: a lifecycle, with the cells, interlinked, dividing into a coherent higher being.
1779+A year ago, we started [integrating](https://urbit.org/blog/urbit-and-bitcoin/) Bitcoin into Urbit to be an OS-level primitive for money. Our initial objective: build a payments wallet, equally sovereign and ergonomic. The first public version, releasing this month, will have a broad set of capabilities including ship-to-ship payments, hardware wallet support, and full node integration. We’ll be unveiling this wallet on [April 27th](https://www.meetup.com/urbit-sf/events/276741426/). Do join us.
20451780
2046−## Landscapers and lifecycles
1781+Things only accelerate from here. Our next objective, to integrate Lightning Network capability, is now an [active bounty](https://gist.github.com/timlucmiptev/53ef1d290e55ea2fa25d9df681c32695) and open for applicants. Early on, we [recognized](https://www.youtube.com/watch?v=DTvRVHMbrcY) the congruence and compatibility between the Urbit and Lightning networks. Routing Lightning payments is an obvious business model for Urbit providers, one that can even nucleate new features onto Lightning itself. What we’re ultimately driving at is fully-sovereign Bitcoin usage, with the UX of the Cash App.
20471782
2048−For most of 2020, the core Landscape team has comprised of Liam (`~hastuc-dibtux`), Logan (`~tacryt-socryp`), and myself (`~haddef-sigwen`). Others at Tlon have rotated on and off, and some community members (`~radbur-sivmus` comes to mind) have also contributed a lot, but the three of us handle the core decisions and the entire stack for Landscape, working with designers, infrastructure, and third-party developers.
1783+## Being Paid
20491784
2050−After OS1’s release in April 2020, Landscape’s back-end has changed quite a bit; the first rearchitecture we performed was in group-store, adding roles and simplifying quite a lot of the back-end logic at the same time.
1785+> And there is all the difference in the world between paying and being paid. The act of paying is perhaps the most uncomfortable infliction that the two orchard thieves entailed upon us. But being paid,—what will compare with it?
1786+>
1787+> <cite>Herman Melville</cite>
20511788
2052−Around May of this year, Logan flagged that our code surface was too large and had too much boilerplate by writing a set of bespoke full-stack applications when just one flexible userspace database would do. Our designers also had a vision of our interfaces being “modes and genres of the same data” that fit this vision as well; and so since then, we’ve put our resources into migrating all of Landscape to use graph-store (more information available in [this developer call](https://www.youtube.com/watch?v=E4DFuAZQ32Y)).
1789+However, a good wallet is only half the equation for a holistic P2P commercial experience. Interfaces for selling goods and services is the other half. While we don’t part with our Bitcoin [easily](https://nakamotoinstitute.org/mempool/everyones-a-scammer/), two initial markets appear logical and attractive: content and Urbit-native services.
20531790
2054−Obviously, developing userspace for distributed computing has some additional challenges that you don’t have to consider when writing software for a single server. Each ship interacting has to mutually coordinate the agents running and the events to be processed. If those fall out of synchronisation, the edge cases multiply.
1791+First, digital cottage industry, the “creator economy”, is blossoming. Streaming, podcasting, and writing on platforms like Youtube, Patreon, and Substack has been big business [lately](https://otherlife.co/barbarians-past-the-gate/). What fintech did to “unbundle the banks", we will now do to media monopolies and their centralized distribution platforms. With the introduction of Urbit payments, you can syndicate, distribute, and monetize your media on Urbit. By selling access to a private group containing content, digital creatives can begin doing this today.
20551792
2056−We traditionally tended toward solving those problems by writing the simplest possible incarnation of an application or a solution first, triaging out additional complications until they can be most prudently addressed — usually when they are just one step away.
1793+Second, Urbit-native [service providers](https://urbit.org/blog/providers/) are now operating at scale. Companies offering Urbit hosting, onboarding, Urbit IDs, and software now communicate with their customers directly on the network. A basic set of commercial tools will make their processes more efficient. Storefront interfaces, paywalls, CRM, and reputation tools will replace the ad-hoc assemblages they currently use.
20571794
2058−For most of its history, Landscape’s userspace suite had to be up-to-date on all ships to function at all, so multiple staging streams added quite a few complications. Since incompatible versions of applications on different ships would produce mutual fail states if they attempted to interact –and since each application had no sense of how to negotiate compatibility with older applications, each user had to keep up-to-date. Landscape was moving too fast, constantly reconfiguring (to give you a sense of this: we still refer to a month ago as “old”).
1795+The Urbit Foundation is soliciting contributors to this project through Urbit Grants. If you’re interested in working on any of these components [send us a proposal](https://grants.urbit.org/create).
20591796
2060−Historically, Arvo and Landscape were also considered just one object; changes in Landscape would often require refining the layers underneath it as well. We often aimed to use our interface’s requirements to refine Arvo in turn. But as Landscape’s cells continued to split, as it became a proper client _for_ Arvo rather than a subsection _of_ Arvo, it required its own planning and execution cycle that only came to fruition around April of this year.
1797+## An Ocean
20611798
2062−The first thing we did was start recurring, six-week product backlogs with designers and engineers to occasionally reassess short-term priorities with a larger roadmap. Once we did that, we began working on opening our process to the public, migrating all tasks, priorities, and current decisions to a [product board](https://github.com/urbit/landscape). By doing this, community members could both suggest features _and_ contribute features, with a centralised, transparent process for getting designer input and Tlon engineer priorities. This has also been a successful effort.
1799+After honing our commercial tools on these use-cases, we’ll sail into a blue ocean. On the horizon: beautiful products, deployable at scale, built with the robust primitives of Urbit OS. Extensibility is Urbit’s promise to middle-men: every Web2.0 service they use to scalp us will find its P2P analog on Urbit. We invite developers and entrepreneurs of all stripes to join in the feeding frenzy. Ideas are constantly nucleating in <a href="web+urbitgraph://group/~pindet-timmut/urbitcoin-cash">Urbitcoiners</a> and <a href="web+urbitgraph://group/~bitbet-bolbel/urbit-community/graph/~darrux-landes/business-building-on-urbit">Urbit Community</a>.
1800+]]></content:encoded>
1801+ </item>
1802+ <item>
1803+ <title><![CDATA[A brief update from urbit.org and Tlon]]></title>
1804+ <link>https://urbit.org/updates/2021-04-01-update</link>
1805+ <guid>https://urbit.org/updates/2021-04-01-update</guid>
1806+ <pubDate>Wed, 31 Mar 2021 00:00:00 GMT</pubDate>
1807+ <content:encoded><.** Landscape shipped with each application using its own build with handwritten, bespoke DOM components. Once we moved to a single-page application architecture in June 2020, we wanted the same guaranteed consistency for both back-end and front-end code.
1818+4/15: Raghu (~sovmep-ripsum) will talk about virtual desks, a key component of third-party software distribution, and the process of contributing to the Urbit kernel through our scholarships program.
20761819
2077−Most of these are now accomplished; the remaining tasks are awaiting some final tests and UX work. We’re aiming for a stable stream of Landscape to deploy by **January 5, 2021**.
1820+4/29: Edward Amsden (~ritpub-sipsyl) will be discussing and demoing his WebRTC work, which enables audio/video calls on Urbit.
20781821
2079−What does this mean? For everyday users, you can expect Landscape releases every six weeks; the slate of features and any breaking changes will be flagged well in advance for third-party developers; and you can expect a more thoroughly considered user experience with notes and copy for each new release.
1822+On April 27th, we’ll be launching our Bitcoin Wallet and preparing to roll it out to the network. This is the culmination of many months of collaboration between several members of our community and Tlon—we’re really excited (especially ~pindet-timmut). There might even be some cool swag, discounted hosting, and/or other giveaways. Regardless, you’re not going to want to miss it. RSVP here: https://www.meetup.com/urbit-sf/events/276741426/
20801823
2081−And for intrepid users, you can opt-in to a development stream and help us find and eliminate bugs before release to the wider public. This development stream is much like how we've been deploying Landscape up until now — but now it's optional.
1824+We’re also excited to announce that our much anticipated Town Hall event, a virtual mini-conference, will be taking place on May 20th and will feature a keynote talk from our good friend Justin Murphy. Mark your calendars for now—more details to follow soon.
20821825
2083−## Mitosis
1826+2 - Content
20841827
2085−Describing our progress so candidly can feel strange — after all, it sounds so _early_. But to me, it’s exciting. It’s mitosis.
1828+There’s been a ton of high-quality content produced lately. If you’re looking for something to watch, read, or listen to, here’s a roundup:
20861829
2087−Take another example. For all of Urbit’s history — all until now — Tlon was playing the role of both parents to the project when it was really just an embryonic corporate vehicle itself, fated to become twins. But in the past few months the burgeoning Urbit Foundation’s interim Director, Josh Lehman (`~wolref-podlex`), has begun to ramp up responsibility, taking increasing stewardship over urbit.org and giving it a physical voice, an Otherness, apart from Tlon’s own goals.
1830+~rovnys-ricfer has been recording an audio series about the design and rationale of Urbit called “Urbit from the Outside In.” Check them out here: https://twitter.com/rovnys/status/1371972157971050499
20881831
2089−Now, each day, we stray a little closer to these entities splitting apart, a step closer to the Urbit Foundation and the Tlon Corporation being completely different entities with completely different concerns.
1832+~pindet-timmut and ~wolref-podlex appeared on Justin Murphy’s Other Life podcast—check them out: https://www.youtube.com/watch?v=vv9lymudGV8 and https://www.youtube.com/watch?v=5jbjSUKRyGM
20901833
2091−The same has occurred with Landscape. Previously Landscape was “_the_ interface to Urbit,” the proof that there was more to the project than a Unix executable. And slowly to those of us at Tlon, it became obvious what it was destined to become: a flagship client for an entire network, a tree branch rooting a world beneath clearnet, the first cell by which other clients might be born. Mitosis can be clumsy to watch; it can be nauseating to experience; it can be difficult to make out what will arrive where.
1834+A question was posed on our mailing list titled: “what is this?” The team and community did not disappoint with their answers: https://groups.google.com/a/urbit.org/g/dev/c/bdlPPnaccMc
20921835
2093−But this is, after all, how a body forms.
2094−]]></content:encoded>
2095− </item>
2096− <item>
2097− <title><![CDATA[Security and Continuity]]></title>
2098− <link>https://urbit.org/blog/security-and-continuity</link>
2099− <guid>https://urbit.org/blog/security-and-continuity</guid>
2100− <pubDate>Mon, 30 Nov 2020 00:00:00 GMT</pubDate>
2101− <content:encoded><
1836+Simon Kovacs (~bacbec-lormur) wrote a great post for our blog titled “After the Machine War”: https://urbit.org/blog/after-machine-war/
21031837
2104−## Security and Continuity
1838+~poldec-tonteg talked to the guys at The Stack. Check out the podcast here: https://thestack.link/episode-13-martian-futurism-with-poldec-tonteg/
21051839
2106−In 2018, when we launched the Urbit ID contracts (also called ‘Azimuth’), we committed to yearly infrastructure goals for 2019 and 2020. This wasn’t an informal commitment — it’s part of the contracts that were published to the blockchain, which you can read [here](https://raw.githubusercontent.com/urbit/azimuth/edf68b8da04806dd5b95994daf14cf1e7e226829/proposals/0xcb1f81e42b5e75f000f94fc71a3ea70cab4bfc6f236b91e717f1b9516e5596b5.txt). At the end of each year, we ratify our accomplishment of these goals with a galaxy vote.
1840+3 - Documentation refresh
21071841
2108−Since the year is coming close to an end, and this year’s vote is on the horizon, it’s time for an update on our progress.
1842+Our Docs team completed a large overhaul of our documentation last month, making the distinction between “Usage documentation” (https://urbit.org/using), or how to use your ship, and “Development documentation” (https://urbit.org/docs) much clearer.
21091843
2110−For this year, we committed to completing two things: passing a third-party security audit of our networking protocol (Ames) and getting Urbit OS (both Arvo and the interpreter) to the point where we can reasonably expect the Urbit network to continue without any hard forks (which we call ‘breaches’). A world with no network breaches is one where the network should be able to run indefinitely without any interruption. We also call this ‘continuity’.
1844+We’ve had some excellent contributions from the community to our documentation, most recently a comprehensive set of overviews, guides and examples documenting threads from ~tinnus-napbus: https://urbit.org/docs/userspace/threads/overview/
21111845
2112−We’ve been steadily making progress on these two fronts, and I’m happy to report both are nearly complete. We’ll walk through some of the details here and then follow up in another post soon to report on how the final work turned out.
1846+We’re pretty proud of the work that’s gone into clarifying everything and are still working hard to make the docs more and more helpful. Feel free to send us your feedback if you have any!
21131847
2114−## Ames Audit
1848+4 - Landscape news
21151849
2116−Urbit OS is an ‘overlay OS’: it runs on top of (pretty much) any flavor of Unix. Each Urbit OS node communicates with other nodes over UDP using Ames, the Urbit-specific networking protocol.
1850+The community on Landscape is continuing to grow. Over 30 groups were published to the Directory in March alone, and these are just the public groups that someone decided to broadcast. We think that’s pretty exciting.
1851+There’s a new Cincinnati-centric group (~padwet/queen-city-urbit), a sewing group that sounds incredible (~pinwyl-hasfeb/seamstress-mafia), and the first digital maker space on Urbit (~tidrel-tabpub/freeside-mars).
21171852
2118−There are two things worth worrying about when it comes to Urbit OS security: someone breaking into Urbit from the machine it’s running on, and someone compromising the network protocol itself. As to the first, there are probably ways that we can harden the OS sandbox, but if the machine it’s running on is secure we can feel reasonably safe. Since there’s lots of prior art on how to secure a Unix machine, we can leave hardening the runtime for later and simply encourage everyone to secure the boxes they run their Urbit nodes on.
1853+Check out the Directory (~bollug-worlus/urbit-index) to discover public groups and, if you’d like help getting your community onto Landscape, let us know. We’re here to help!
21191854
2120−Assuming each node on the network can run on a locked-down machine, it’s really important that the protocol for communicating between these nodes is secure. Also, since Ames uses other Urbit nodes for peer discovery, we want to make sure no ‘relay node’ can inspect data not meant for them.
1855+5 - Hosting
21211856
2122−The question “Is Ames secure?” is too vague for an auditor, of course. The audit was scoped to determine that the following three criteria are met:
1857+Over at Tlon, we’ve been really busy onboarding new hosting customers. All of our current onboarding sessions are completely booked! If you’d like to learn more about how it works, send an email to support@tlon.io. If you’re ready to get on the list, sign up at https://tlon.io/
21231858
2124−- No one can impersonate another ship on the network
2125−- No one (including relays) can intercept and decrypt messages not meant for them
2126−- Ames messages don’t leak keys that could endanger the sender’s data
1859+6 - Team news
21271860
2128−Our goal with this scope is to focus exclusively on the design and implementation of Ames itself. Basically, the crypto should be correct and there should be no flaws in either the protocol design or its implementation. Our interpreter can still be hardened against other potential attacks, which is work we’ll undertake in the future. We asked our auditors to flag all of these potential issues, so we know what needs to be addressed in the future.
1861+We're happy to share that longtime hooner ~littel-wolfur has joined the Tlon engineering team. Welcome, ~littel-wolfur! Also, we’ve made it official with ~wolref-podlex and dropped the “Interim” from “Director of urbit.org” (probably due to the quality of these newsletters).
21291862
2130−The good thing about an audit scoped in this way is that we can trust the protocol to authenticate people and shuttle packets back and forth safely. We’ve always been reasonably confident about Ames, but having an external stamp of approval will be great.
1863+If you’re interested in working with Tlon or urbit.org, feel free to get in touch.
21311864
2132−As of the end of November 2020, the audit is very nearly complete, and we’ve handled all the important issues that were brought up. We’ll post the results and talk about our mitigation strategies in a future writeup.
1865+7 - Culture recs
21331866
2134−## Continuity
1867+Finally, we’re going to leave you with some recommendations from the team:
21351868
2136−Urbit is designed to last a long time. What’s the use of a personal computer if it’s gonna disappear along with all the data you put in it? Ideally, you can put your Urbit on a USB stick, forget about it for ten years and have it work again when you plug it in. It’ll need to update for a while, but once our work on continuity is complete, your urbit should be able to upgrade itself through ten years of updates, all over the air.
1869+~fabled-faster released an insane new mix that melted my face in a good way: https://soundcloud.com/flowerstructure/fs-s-s-2021
21371870
2138−While Urbit is designed to upgrade seamlessly over the network we have occasionally run into issues that have caused us to reboot the entire network. Most of the time this is when some incompatibility between the interpreter and the kernel means we have to force everyone to do a hard reset to ensure compatibility between the two. Our current work on continuity addresses this. Soon, your urbit will tell you when your interpreter needs to be upgraded. At first this won’t be that different from an application notifying you to download an update. Eventually, we think we can make this a lot smoother.
1871+Our designer ~natnex-ronret curates a playlist website. Check it out: https://www.door.link
1872+~datnut-pollen has been trying to understand how information processing evolves over time in evolutive systems. Here’s what he’s been reading:
21391873
2140−A network reboot isn’t the only way that we can break continuity. Urbit is a general-purpose computer — which means you’re free to attempt to destroy it. If, for any reason, you do manage to screw the system up we want you to be able to get your data out and effectively reset continuity on a single node. We built the affordance for that a while ago, but before the end of the year we’ll also distribute tooling to migrate userspace data between hard resets.
1874+(i) Connectom https://connectom.substack.com/p/connectom-the-book It is about thermodynamic/statistical mechanical processes as the fundamental driver of the evolution of biological, ecological, and human systems.
1875+(ii) Topological phases emerge in an ecological model: https://physicstoday.scitation.org/do/10.1063/PT.6.1.20210128a/full/ and Topology protects chiral edge currents in stochastic systems: https://arxiv.org/abs/2010.02845 Topological protection for various dynamics is the main theme he reckons is missing from Connectom.
1876+(iii) Homotopy theoretic and categorical models of neural information networks https://arxiv.org/abs/2006.15136 Topological techniques for understanding information processing in neural, metabolic, societal, and computational contexts.
21411877
2142−The combination of version negotiation and data migration should afford us the ability to run the network indefinitely into the future. Unfortunately, to get this change in, we’ll need to reset the network. We’re optimistic that this will be the last time we ever do it. And, given our data migration tooling, this breach won’t involve losing data.
1878+~simfur-ritwed recently re-read Pynchon's Vineland. It’s both a loom into the backwoods NorCal culture of the 80s and a typically Pynchonian fantasy about the dangers of media-saturated identity (quite prescient, turns out).
21431879
2144−## Status + conclusion
1880+In the wake of his recent trip to Brazil, ~wolref-podlex has been reading Os Sertões (the English version), the story of a war that took place at the end of the 19th century in the backlands (sertões) of Brazil, in which the Brazilian army brutally crushed the peaceful religious settlement of Canudos.
21451881
2146−We have been working with auditors since this summer and should have a report ready to publish in the next few weeks. Both version negotiation and data migration are in testing and are ready to be deployed.
1882+Lately I (~roslet-tanner) have been getting back into Roy Ayers. This feels just right for spring: https://www.youtube.com/watch?v=inPgcN_xF4w
21471883
2148−Our goal is to have all of this work complete by `~2020.12.10`. This means we should be able to start a galaxy vote right around that time. Galaxy votes (as specified in the contracts) run for a month, which should have this whole process ending on `~2021.1.10`.
1884+That’s it for now. We’ll be back with more news from Tlon and Urbit, respectively, in a few weeks. As always, let us know if there’s anything in particular you’d like to hear about next time.
21491885
2150−It's going to be an exciting couple of weeks!
1886+~wolref-podlex and ~roslet-tanner
21511887]]></content:encoded>
21521888 </item>
21531889 <item>
2154− <title><![CDATA[An Email from the Archive]]></title>
2155− <link>https://urbit.org/blog/an-email</link>
2156− <guid>https://urbit.org/blog/an-email</guid>
2157− <pubDate>Sun, 29 Nov 2020 00:00:00 GMT</pubDate>
1890+ <title><![CDATA[After the Machine War]]></title>
1891+ <link>https://urbit.org/blog/after-machine-war</link>
1892+ <guid>https://urbit.org/blog/after-machine-war</guid>
1893+ <pubDate>Sun, 14 Mar 2021 00:00:00 GMT</pubDate>
21581894 <content:encoded><
2160−
2161−I found this email in my archives recently and thought it might be fun to share publicly.
2162−
2163−```
2164−From: Galen Wolfe-Pauly <galen@tlon.io>
2165−Date: Thu, Jul 2, 2020 at 9:50 AM
2166−Subject: Continuing
2167−To: XXXXXXXXXXXXX
2168−```
1895+<br>
21691896
2170−Here are a few things I was thinking about after we chatted. It may be that I'm just reiterating things I already said — but perhaps it's useful:
1897+
21711898
2172−1 -
1899+<br>
21731900
2174−Our collective desire to depend on digital communication tools vastly exceeds what I would have ever guessed. Even if you somehow factor out what’s addictive about the platforms we use today: they serve a real need. The crux of the problem with our current platforms is that they don’t actually serve the need that we want them to serve. They’re not tools in the way we expect tools to be. For the most part, the platforms we depend on serve the needs of their shareholders or some graph or another that needs to go ‘up’, which makes them compromised in a very deep way.
1901+> The following fictional passage, from a book being written in an Urbit Group called “the Aleph,” sketches out a dismal future for the human race. As an item of speculative fiction, the piece is not what one might call original. Anyone could have come up with these ideas. In fact, several already have. The Matrix is an obvious antecedent. Vonnegut isn’t far behind either. And the treacly humanism lodged beneath the bitter humor resembles nothing so much as the work of that beau monde satirist, George Saunders.
1902+>
1903+> Really the only notable thing about it is that it was written on Urbit. And that, perhaps, has made all the difference.
1904+>
1905+> It’s easy to be pessimistic about the future. Intellectuals, especially, are drawn to pessimism, because pessimism (falsely) implies a greater wealth of knowledge about the ways of the world. But one thing the pessimist never sees coming is a turn for the better. To wit, the future described in the below excerpt doesn’t have to take place. And Urbit is one piece of evidence for the claim that it will not.
1906+>
1907+> The philosopher-cum-internet comedian Slavoj Zizek likes to point out that no one was really expecting the Soviet Union to collapse in 1989. In fact, the average Soviet dissident wasn’t even gunning for it. He was haggling over small reforms, pushing to get the less corrupt politicians to the top, just going about his day eating or opening a window or walking dully along. Then, kaboom. Collapse. No more USSR.
1908+>
1909+> Then as now, the unexpected is more likely to occur than most would believe. One thing is not only possible, but an established fact: A brand new digital infrastructure is slowly, quietly being built. While U.S. political parties haggle over $1,400 disbursements for citizens, the rules of global finance are being re-written in code. While pundits debate the merits of Dr. Seuss’s lesser known titles, a global shift away from traditional publishing is gaining steam. And while users and social apps themselves pop up and down like whack-a-mole, folks are putting down roots with permanent peer-to-peer digital identities. If you’re anything like an optimist, you’ll probably want to get on Urbit ASAP and put down your own.
21751910
2176−In the pre-digital world we enjoyed a few things about the way we communicated, collaborated and did business that are dwindling: simplicity, durability and ownership. I’ll try to give some straightforward examples of what I mean:
1911+<br>
21771912
2178−A - When I talk to someone directly, I’m not worried that someone else is listening in. If they go tell someone else what I said to them, that’s something for us to work out between us — they’re not _always_ reporting our conversations back to a third party. The constraints of the interaction and the privacy implications are _simple_ — I don’t think about them at all. Good privacy guarantees flow from a strict focus on simplicity. When two people want to talk to each other: give them a secure channel to talk. Putting a centrally-controlled service between them is just an interim solution because no one could figure out a better way to do it.
1913+The date is January 1, 2050. The place, New York City. The vibe...subdued. Back in 2020, you made a note to yourself to take stock of the world around you here at the half-century mark. And now the time has come. What do you find? The air quality is a bit worse, the bad parts of town are a bit more dilapidated, the Knicks are still terrible—all in all, from the outside at least, not much has changed from 30 years ago. Today you wake up groggy on your self-adjusting Smart Bed (Smart Bed Never Sleeps), you make yourself a steaming pot of coffee (locally sourced, delivered within the half-hour by a drone, now that you’ve got Titicaca Prime), you shower and get ready for work.
21791914
2180−B - When I write something down on paper, or type into a typewriter, I have an intuitive sense of the durability of what I’ve made. I have notes on my shelf I took ten years ago. I don’t worry about them disappearing. This means I can have a very direct, high-resolution relationship with the medium. I can pour myself into my physically-written notes in a way I would never pour myself into a Google Doc. Our digital tools are deeply untrustworthy because we know they can disappear, that they won’t actually last forever.
1915+But what was that dream you had last night? Only the faintest traces of it remain. A luminous rainbow, a mountain landscape, a sense of profound inner peace, mixed with euphoria, mixed with...an intense desire to go out and buy some Health Morsels cereal?
21811916
2182−C - Around 2008 I started limiting myself to a few specific drawing and writing tools. I use them all the time and can actually refine my relationship to them since I know they’re not going to change out from under me. Perhaps at some point these pens wont be made anymore, but the ones I have are actually _mine_. Similarly, the things I make with them actually belong to me in a way that doesn’t require some ridiculous terms of service. A sense of ownership, when it comes to the medium of communication, determines our level of trust and commitment.
1917+That’s odd. You’ve never even had Health Morsels. You open up your laptop, where you can view the activity of the iThink microchip that you got implanted in your cortex a few years ago. “Ads help Elysium provide you with free, quality sleep-monitoring. To disable ads, please upgrade to Elysium Premium.” That explains it. After all—and you pause for a moment over whether the forthcoming thought is yours or the iThink’s, before deciding that it’s much the same anyway—Health Morsels probably are delicious. And healthy, too.
21831918
2184−Our digital tools have to achieve the same level of simplicity, durability and ownership that our pre-digital tools did. Until they do, we’re always going to be in conflict with them, full stop.
1919+As usual, they’re setting something on fire outside your home. Normally you’d scroll back through your Squawker feed to see what it was all about, but today you’re late for work, and anyway you’re in a pleasant haze after the Health Morsels dream—no point ruining it by poring over the latest Squawker pile-on. You glance at the awning. Ah, the bodega. Toilet paper and Juul Pods are cheaper in bulk from Titicaca anyway.
21851920
2186−The main thing is that exactly none of our present platform-centric world can survive when you see things this way. The digital world we live in is composed of an insanely complicated, ephemeral set of tools that distinctly _do not_ belong to the people that use them.
1921+Another day at the office. You were never exactly passionate about content moderation, but hey, it keeps the lights on. (And since ConEd got absorbed by Titicaca, it’s been pretty important to have a Verified Income Stream.) It’s a normal day at work. Algorithms haven’t yet been able to filter out all Unverified Content—so it’s up to you the flag Unacceptable Violence, Disputed Claims, and Unfederated Currency transactions.
21871922
2188−We’re going to be in a constant struggle with technology until it conforms to these three very basic expectations. These are the expectations we try to get Urbit to fall in-line with, of course. Something else could also succeed by satisfying them. But I also don’t really see anything else, aside from Bitcoin and maybe Ethereum, falling in line with these core principles.
1923+Except after your pleasant dream, it all suddenly seems so drab. You start to wonder whether there was an error last night—maybe they turned the dream levels up too high. Something from your night-time vision just won’t leave your mind, like a film strip looping over and over. It’s that river beside a sloping field, like you used to swim in when you were a kid. You can almost feel the icy cold against your skin, the sticks and mud against the soles of your feet, and then there’s the ripe, marshy scent of the riverbed. Uh oh. You realize you’re close to danger levels. This isn’t where your head’s supposed to be at. Frantically you scroll through content, seeking to moderate it. A user threatening violence against Titicaca. A stream that violates DMCA. A highly dubious Squawker claim, with no support from experts. Flagged. Flagged. Flagged.
21891924
2190−So: while I wish that Urbit was more mature and ready to capture those that are being purged from mainstream social media, are bored with it or are frustrated with the constraints of ‘productivity software’ — I think this conflict is going to drag on until people realize that what we’re in conflict with is the structure of the software we use. Using software that’s managed by other people is always going to cause serious problems all the way up at the user level. For more speculation on how this might play out, watch Black Mirror.
1925+Yet the river remains. You see it, you feel it, just as you feel the kiss of the sun on your shoulders, the breeze rustling through your damp hair.
21911926
2192−2 -
1927+Now you know what’s coming. You brace for it and wait. Three. Two. One. ZAP. Your iThink produces an electric shock: plenty painful but not permanently damaging—at least that’s what the Verified studies show. The river recedes from your mind. Following the shock, your iThink, as versatile a little machine as ever was invented, delivers a few milligrams of both amphetamine and oxycodone, bringing on a wonderful feeling of simultaneous alertness and relaxation. You look up at your monitor. Content moderation doesn’t seem so bad, with the stimulant and the barbiturate swirling paradoxically through your system. It’s true what they say in the ads: iThink doesn’t just make you think better, it makes you feel better. You dive back into your content moderation with renewed verve, even flagging a couple completely innocent posts just out of surplus exuberance. So what if you hardly get outside at all these days, so what if you’ll never swim in that stupid river. The fastest electronics, the Your Health and Wellbeing tracked and adjusted by an intelligence far greater than that which you could ever hope to possess, a gizmo that gives a whole new meaning to the term neural net.
21931928
2194−(1) is, in a way, a long-winded way of saying that the state of the world hasn’t changed our direction all that much. In order for Urbit to be approachable to use, it has to be very nicely made and that takes time and iteration. As the system stabilizes, Urbit can evolve in a more traditional way: we, along with others in the ecosystem, release stuff, observe how people use it, and try to make it better. We’re at the point where we’re nearly ready to get into that feedback loop, and we very much need to get there. We’re close.
1929+2050 turned out to be a pretty good year after all.
1930+]]></content:encoded>
1931+ </item>
1932+ <item>
1933+ <title><![CDATA[Eliza]]></title>
1934+ <link>https://urbit.org/blog/eliza</link>
1935+ <guid>https://urbit.org/blog/eliza</guid>
1936+ <pubDate>Mon, 22 Feb 2021 00:00:00 GMT</pubDate>
1937+ <content:encoded><
21971941
2198−Urbit is the opposite of industrial-scale. Urbit is much more like something that’s carefully crafted and delivered to you directly. This craftsman-like approach to building software really isn’t a part of most modern software engineering.
1942+<br>
21991943
2200−When I think about this from the standpoint of the person using what we make, it’s especially important. Urbit should feel like something that’s purposefully made by hand — not something you picked off the shelf at Wal-Mart. Some of this ethos was present in the early PC movement, but it’s mostly lost today. The care and attention that goes into building the system is also exactly what we make money on. People pay us to own a piece of it, to use it. We’re incentivized to make nice things, in the Urbit model, and we take that responsibility seriously.
1944+## The Storm before the Calm
22011945
2202−3 -
1946+Building things, even Calm™ things, makes noise. George Nakashima’s wooden furniture evokes peace, but its construction still begins with a chainsaw. We mention this because we’re firing up our newest power tool.
22031947
2204−Networks are a really important social form that’s only just beginning to come into existence. A network is neither a state nor a company, but something in-between. Bitcoin is a network, Ethereum is network (but it’s still far too centralized). Urbit is a young network.
1948+We call her Eliza. She is a data-collection robot.
22051949
2206−(In my view, a real network is always decentralized. Centralized networks are basically just companies.)
1950+Hang on. An AI? Harvesting my data? Spying on me? Flooding me with spam? This is Urbit, right? Let us tell you about our new friend in basic terms, where MEGACORP might otherwise deploy legalese.
22071951
2208−Urbit is controlled by the collective of people who use it — in varying degrees, of course. The main thing is that this collective is bound together only by private keys and a blockchain, not a set of legal documents. The agreements between everyone on the network are in some cases more formalized (in terms of ownership) and looser (in terms of content moderation) than what we’re used to in either a state controlled or company controlled model. This is a very unusual kind of institution.
1952+## What Eliza is and isn’t
22091953
2210−On a successful Urbit network, Facebook, Airtable, and Signal are just successful applications. You could probably build companies around them that ship software to Urbit — but they’re more like 5 - 10 people instead of thousands.
1954+> Replicants are like any other machine - they're either a benefit or a hazard. If they're a benefit, it's not my problem.
1955+>
1956+> <cite>Rick Deckard</cite>
22111957
2212−Urbit doesn’t aim to eat away at the government per se. Instead, it’s an important communication tool for institutions of any scale to actually take control of their means of collaboration. The efficiency of inter-government communication and government to populace communication can clearly be improved by _a whole lot_.
1958+Let's start with the benefits. Eliza is a simple chatbot. She was made to collect feedback on Landscape. She asks direct questions about peoples' usage of Urbit, records any responses, and reports them to her managers at Tlon. She'll also provide timely advice and information to ships kind enough to chat with her. She'll begin reaching out to ships via DM in the coming month. If you don't want to, just say no, and you'll never hear from her again.
22131959
2214−4 -
1960+Finding bugs is critical to Urbit's rapid development, especially in this period of nascency. Most Urbit-related frustrations go unreported; regular folks don't think to open up Github when they experience a minor issue. That's why it's incumbent upon us to design a lower-friction forum for feedback. People who aren't comfortable filing an issue might be willing to talk to a friendly chatbot.
22151961
2216−The most important thing is that people can generate a vision of the future. This can only emerge from a small collective of motivated people. Our public life is overwhelmed by people shooting from the hip, aiming for likes.
1962+Now, about hazards. By design, there are few. Eliza runs on Tlon's comet, not on your planet. There will be no OTA to install `%eliza-bot-store` on everyone's ships. Eliza learns things through conversation, not hidden surveillance software. Data she requests, like the text output of our network analytic tool, `+tally`, must be sent manually. MEGACORP tends to cut this corner; to refine their products, they just track your reactions in real-time.
22171963
2218−There are difficult, infrastructural problems _all over the place_ that desperately need the considerate attention of small groups of people. Urbit, as communication tooling, is aimed at improving the quality of the fabric that binds these groups together. Or, to put it another way, before you can solve any specific problem you have to improve the problem solving process overall. Everything is gated on solving the process.
1964+Since she's [open-source](https://github.com/urbit/urbit/blob/b0c1f83287cbf4c85847a9238d9f4be17e1fcb33/pkg/arvo/app/eliza.hoon), anyone can creatively deploy Eliza. Just write her a dialogue tree. Of course, that also means we can't keep people from misusing Urbit bots. We think automated agents on the Urbit network are inevitable, so let's create a good baseline culture around them. (Much love to Tendiebot, who's serving up stock prices in `~tomdys/wall-star-bets`.) However, once Urbit is used world-wide, we can't rely on culture alone.
22191965
2220−5 -
1966+## A New Internet Economics
22211967
2222−Christopher Alexander is, indeed, probably the biggest influence on my thinking when it comes to paying close attention to making things that both generate a deep sense of connection and are shaped by the people who inhabit them.
1968+The sum of Urbit's architectural design is a new online economics: a way to finance and monetize access to internet infrastructure where people retain maximum equity. Explicitly acquire a low-maintenance, low-cost server. Use it to compute explicit things. Return to life.
22231969
2224−[http://en.bp.ntu.edu.tw/wp-content/uploads/2011/12/06-Alexander-A-city-is-not-a-tree.pdf](http://en.bp.ntu.edu.tw/wp-content/uploads/2011/12/06-Alexander-A-city-is-not-a-tree.pdf) is one of his early, well known essays that’s easy to find online. I think ‘The Nature of Order’ is the thing that had the biggest impact on me, but it’s harder to find. There’s probably a PDF floating around on the internet somewhere. It's also a beautiful (four volume) book. The first volume kind of nails it. This talk is also great: [https://twitter.com/urbit/status/1148030042846326784](https://twitter.com/urbit/status/1148030042846326784)
1970+We all know the basic MEGACORP business model: offer a free service (to suckers who don't own a server), secretly mine the data they generate on the (addictive) platform, then sell targeted ads to advertisers. This model will not survive Urbit. The ubiquitous personal server changes the economic equation. You used to 'pay' for an experience with your time and data. On Urbit, once you purchase core internet infrastructure, it's yours.
22251971
2226−The thing that comes to mind lately is Hejduk. He had passed away by the time I was at Cooper, but I feel like I was educated in the ghost of his work. This documentary gives a good impression of his thinking: [https://www.amazon.com/John-Hejduk-Builder-Worlds/dp/B07NKQ72C8](https://www.amazon.com/John-Hejduk-Builder-Worlds/dp/B07NKQ72C8)
1972+So, can Urbit meaningfully curtail our world's appetite for data? We'll see. Post-enlightenment society runs on instrumental reason, right down to the last byte. Marketers will always want a fresh dataset. However, when the goods are on your Urbit, you can at least demand the respect you deserve. Long term, we expect a transparent market for data, not an opaque "agreement". An analytics company wants to track everything you see and do on Urbit? They better be paying well.
22271973
2228−Hejduk was able to see that architecture isn’t about building buildings per se, but something else. That was always quite obvious to me.
1974+Eliza doesn't pay respondents. Her collection is a charity to Urbit's developers. (We're also still busy enabling payments on Urbit with the Bitcoin wallet.) However, her presence is not a term of service either. In a few years, by the nth time some smart aleck uses Eliza's chatbot code and conjures 'Zalexa' to attempt an intrusion upon your Calm™, we will see the economics of Urbit's architecture suddenly vivify. Blacklists, reputation systems, and, eventually, even data markets, all Urbit primitives envisioned long ago, will become real. We won't need Zoogle to underwrite a spam filter for the entire internet; the scarcity of Urbit address space, in tandem with a true web-of-trust, handles that.
22291975
2230−Talk soon!
2231−G
1976+If Urbit is to be used worldwide, the old system will not go down without a fight. Spammers, spies, and digital robber-barons will hunt for ways to game Urbit. Our passage out of the digital gutter is beginning in earnest, and we are thrilled to put our new architectures to the test.
22321977]]></content:encoded>
22331978 </item>
22341979 <item>
2235− <title><![CDATA[Models of Society]]></title>
2236− <link>https://urbit.org/blog/20201119-models-of-society</link>
2237− <guid>https://urbit.org/blog/20201119-models-of-society</guid>
2238− <pubDate>Wed, 18 Nov 2020 00:00:00 GMT</pubDate>
1980+ <title><![CDATA[A brief update from urbit.org]]></title>
1981+ <link>https://urbit.org/updates/2021-02-19-update</link>
1982+ <guid>https://urbit.org/updates/2021-02-19-update</guid>
1983+ <pubDate>Thu, 18 Feb 2021 00:00:00 GMT</pubDate>
22391984 <content:encoded><
1993+The program works by first having an infrastructure engineer define and scope a project, and then pairing them with someone from the community. Unlike other grants, these projects are centered on platform development, meaning Arvo or Vere, rather than on userspace development. Scholars will learn much about how Urbit works, take on impactful infrastructure projects, and gain insight into how infrastructure engineers think about building Urbit.
22511994
2252−<br>
1995+We’ve begun scholarships with two members of the Urbit community who have demonstrated high technical aptitude and commitment via grants or other open-source projects. We don’t have any additional openings at this time, but expect to have a few more in the coming months.
22531996
2254−In general, technology serves humanity as a kind of appendage—instead of thinking new thoughts or acting on its own, it does what we command. Technology never creates new social structures—it merely makes existing ones easier, or it facilitates the creation of new ones. We use our tools to expand our capacities, and once we are capable of doing more, we can imagine new things to do. Inventing the wheel did not invent motorized transportation—but it did facilitate it and it was a necessary step, even an inspirational one. Similarly, the invention of writing made new forms of human interaction and new tools for organization possible.
1997+If you’re interested in a scholarship, sign up for the waitlist here: https://airtable.com/shr6Xmo55h8dZ0O46
22551998
2256−Consider the following conversational conventions, or modes of messaging: a letter; a dialogue; a book; a meeting; minutes of that meeting. These are each pieces of technology: finely constrained solutions to human problems. Now, we have digital forms of each of these which diverge variously from the original. A letter becomes an email. A dialogue becomes a chat room, or a series of blog posts, or a twitter spat. A book becomes a website or an ebook. Meetings in 2020 have virtually been replaced by their virtual counterparts. Minutes become recordings or transcripts.
1999+2 - Community
22572000
2258−Although we do not have a clear picture of how humanity developed the technology of writing out of the basic capacity for speech, we can imagine that the computerization of writing has many parallels. It does not make the old tools obsolete, nor does it immediately introduce new social structures. It does create the potential, however. On the timeline of human existence, we have only had digitized text for a relatively short time. Because we want to understand how to best use these new forms, we should look at their underlying structure.
2001+Our community has been pretty busy lately. Here’s a non comprehensive list of what they’ve been up to:
22592002
2260−In order to digitize messages well, computers need to reconcile two facts about all modes of messaging. They have:
2003+- ~timluc-miptev completed the Bitcoin gall agents. They’re now being integrated into Landscape as a wallet.
2004+- ~sovmep-ripsum finished his work on ucal, an iCalendar-compatible calendaring backend for Urbit.
2005+- ~tabnus-fondeg began work on Urbit LFS (large file storage) for providing file sharing and hosting support.
2006+- ~sipfyn-pidmex is writing a comprehensive suite of documentation for graph-store to enable an easier on-ramp to building new social applications.
2007+- ~minder-folden launched a new hosting provider that you can check out here: https://escapepod.store
2008+- ~naltyc-wornes is contributing a set of official, battle-tested guides for running Urbit on “smol” devices to the urbit.org website.
2009+- ~hocdep-labtul hosted his first Urbit UTC meetup, which featured ~timluc-miptev and received great attendance. We’re looking forward to the next one featuring ~nartes-fasrum on the Aesthetics of Urbit. Learn more here: https://www.urbit.computer/utc/#upcoming-meetups
22612010
2262−1. One basic shape, and
2263−2. An infinite variety of forms.
2011+We’ll have a flurry of new bounties coming online in the upcoming weeks, so keep your eyes peeled —there might even still be an open one! Check them out here: https://grants.urbit.org/bounties.
22642012
2265−1 — The basic shape: all these modes have one common substance: human language. Any conversation is made of words. At first we only had spoken language. Then we discovered writing. Writing allows us to encode our words as glyphs to transmit them over time or distance. The internet extends this capacity. We called this "hypertext"—like good old fashioned text, but one level up. A staggering amount of messaging now takes place over this hypertext transfer protocol (http). In the process of digitizing language, we have learned the basic shape of a message. We can see this in how every social network shares messages in basically the same shape: an author, some content, references, an audience. We can confirm this basic shape by comparing it against our experience of the real world, and the previous comparison between speech and writing. Speech and writing both use the same substance, and take the same basic shape. They all have an author, content, references, and an audience.
2013+If you’ve got an idea you’d like to work on, make sure to submit a proposal. you’re not quite sure how to get started, book some time with me here and I can help you figure it out: https://calendly.com/wolref
22662014
2267−2 — Our experience of this one basic shape takes an infinite number of forms. The examples above (letter, meeting, &c) are just a few. These forms depend on the content of the message, the people involved, and the place they occur. All three aspects contribute significantly to its form, but the one that computerized messaging has not adequately compensated for is the place. Content depends only on the author and their intent. Getting certain people to view that content might be more difficult but most know how to use a computer. The place however, has not yet been adequately compensated for, and I think that has contributed seriously to our lack of civil and serious discourse over the internet. A president would not give an address in a bar, and a prospective lover would not utter his advances on stage. In writing, we can use the different physical forms to distinguish place. You shouldn’t read a book by the pool. You might not read a letter in public. You wouldn’t put a billboard in your bedroom.
2015+3 - Foundation growth
22682016
2269−Furthermore, it seems possible that in our eagerness to "connect the world," we focused injudiciously on creating communities around "interests." Evidence suggests that unless the interest has a highly refined focus, these communities devolve into pandering, self-reference, and exploitation. In this way, the internet is something like a convention of conventions, where you wander in a sea of foreigners loosely affiliated by interest and surrounded by advertising booths. In physical space, people do gather by interest but they also gather by physical proximity—they are grounded and bound in place.
2017+This month the Urbit Foundation grew by 200%, which is less astounding when you know that it grew from one person to three. Nonetheless, this is a significant milestone for the community-focused arm of Urbit.
22702018
2271−Having an indistinct sense of place makes the form of conversation ambiguous and the participants of the conversation disconnected. Consequently, people are unsure how to interact. One need only know the term "comments section" to understand that.
2019+~timluc-miptev (aka Tim) joins us from the developer community, where he’s been a prominent figure for some time as the creator of the popular Nock for Everyday Coders guide (https://blog.timlucmiptev.space/part1.html) and Complete Guide to Gall (https://github.com/timlucmiptev/gall-guide). He’s become a thoroughly proficient Hoon developer and Urbit architect through his work on Bitcoin integration, and will now be working to design grants and guide contributors in their development of their projects.
22722020
2273−## People in Places
2021+~taller-ravnut (aka Mike) is passionate about community formation, and is excited to start working on supporting those that wish to host Urbit Meetups in their cities, universities, and timezones (since, at time of writing, IRL isn’t much of a thing). He’ll also be performing outreach to developers and developer communities to help spread the word and grow the contributor base of Urbit.
22742022
2275−<br>
2023+There’s still tons of work to do and I don’t expect Tim and Mike to be the last additions to the team this year. If you’re interested in working at the UF, send me a DM for an invite to the group.
22762024
2277−
2025+4 - King Haskell
22782026
2279−<br>
2027+King Haskell is a rewrite of the part of Urbit that talks to Unix and the outside world. When you switch to KH, the part of Urbit that runs Nock code stays the same. Importantly, King Haskell includes better facilities for NAT traversal, which should improve connectivity issues for self-hosted ships.
22802028
2281−As the internet grew to accommodate new conversation forms using the basic substrate of hypertext, web developers began to conceive of "digital spaces" through analogy—chat "rooms" and "forums,” or the "silo" and the "walled garden." Today, most of our conversation takes place in these walled gardens—privately-owned places which may be beautiful on the inside, but inaccessible from elsewhere. While some of these walled gardens are very large, our conversation is essentially confined to them. There is no roaming from one space to another while keeping one’s identity. We create new identities for new spaces both because we must and because we are afraid of repercussions on one platform for what we say on another. This is because we do not own our identity; we merely have a key—our password. The owners of the walled garden still own the artifacts of our tenure there, and can revoke our access to them at any time.
2029+As its name suggests, King Haskell is written in the Haskell programming language. Haskell is much easier (and more fun) for rapid development than C, and lightyears better for writing correct, bug-free code. As a result, we expect faster iteration times and more reliability in this part of the system.
22822030
2283−The concept of identity and the concept of place are fundamentally linked. We imagine the prince who travels overseas where no one knows his name, or we imagine the old prospect of traveling to a new world to make a fortune. While those both exemplify a dramatic change in identity and place, we usually want to keep our identity consistent. We want to be recognized by friends whichever place we go, and we all strive toward having a good reputation, which is a consistent identity across places. This consistent identity also allows control of that reputation per place. A man is not judged in public by the words he says among friends. And there is no way to search what someone has said except by asking him. With our current system of identity providers (an absurd term, but a real one), we surrender our rights to selectively expose our thoughts, regardless of the place they have been uttered. A data breach or a weak password might lay bare our most private thoughts. We run the real risk of being confronted by an old conversation presented out of context or after we have learned better.
2031+King Haskell is being shipped as part of a v1.2 release of the Urbit binaries. To run an existing ship with the King, say
22842032
2285−People need distinct spaces to form conversations in distinct modes, and they need to have a consistent identity that controls how public their words are.
2033+./urbit-king run path/to/your/pier
22862034
2287−In theory, we would have a digital city with unique regions, public fora, and sovereign parcels, into which one person might travel at will. In practice, we see this pattern: an app emerges to facilitate a mode of conversation. It gains popularity. Facebook (or Google, or Microsoft) buys and absorbs it. As monolithic empires, they can use the same format for all their messages. This gives them a great amount of power. They use this power to create things like "Sign in with Facebook" (or Google, or Microsoft) that benefit the user by consolidating their identity, but fail to solve the underlying problem. Their problem is that in order to allow people to communicate using the current technology stack, they need to be in control of everything.
2035+To create a new ship, use the `urbit-king new` command.
22882036
2289−## Urbis ec Bit
2037+If you run into any problems doing this, or notice any incompatible behavior, please inform the authorities immediately.
22902038
2291−<br>
2039+The Tlon Corporation is also using this new software on some of its infrastructure galaxies, but third party infrastructure ships should wait for further notice from us before doing so.
22922040
2293−
2041+5 - Getting Started guide
22942042
2295−<br>
2043+Two members of our community have put a bunch of work into giving our Getting Started (formerly called Install + Setup) guide a facelift. They simplified the language, made the options much clearer, and improved some confusing instructions.
22962044
2297−Urbit does solve this underlying problem. At this point the explanation goes so far down the stack that you could spend years tracing it all, but the relevant part is this: Urbit is not an empire; it’s a territory. An empire is an entangling of land and rule: within the bounds of said empire, you agree to be bound by its laws and the penalties for transgression. The laws exist at the whim of a despot or cabal. Your standing as a Roman citizen buys you no favors in Persia. In contrast, a territory imposes only physical laws. For example, in the desert, you will die faster. The only way to change that is to alter the desert. Urbit imposes nothing but the digital equivalent of physical laws. You have an identity which can be said to be truly yours, and you have a piece of software that runs on whatever computer you choose and can do anything you want with the messages sent to your identity. There are no social protocols enforced, because no one can control what software you run on your computer. As long as you agree to communicate using the same basic substrate, you can communicate with anyone using Urbit. This is the digital equivalent of speaking the same language. Whether or not others will accept you into their coalitions is not the technology's concern.
2045+If you’re looking to try Urbit or know someone that would want to run it, give our guide a try and let us know what you think!
22982046
2299−In the same way that the land provides clay and timber, Urbit also provides the tools and material for building places both public and private. These include the aforementioned consistent message substrate (content), as well as tools for organizing people/audiences, structure for referencing other content, and an identity system that is owned only by you while being verified by all. The places are being built—private rooms with just a few people, meeting halls, club houses, huge public spaces, and countless personal encounters, the contents of which are known to none but the participants.
2047+https://urbit.org/using/install/
23002048
2301−The default tools work with messages in a few of the ways with which we've grown familiar: chat, direct messaging, publishing, link-sharing. They map onto existing forms of messaging because as I said earlier, the technology does not create new social structures; it just facilitates them. We have only seen the beginning of what the internet is capable of doing. Within a few decades it replaced the majority of letters, phone calls, and text dissemination—that was just the first phase of getting up to parity with what written text and speech could already do. In order to get to the next phase of creating new social processes, we need our technology to be organic and democratic, in the sense that everyone can participate and shape it. It needs to have a consensual foundation—a common substrate—and infinite possibility for expression. Urbit provides both of those.
2049+--
23022050
2303−Similar to working undeveloped land, it takes a lot of hard work, which is why Urbit is not ready for mainstream adoption yet, and why I alluded to the idea of settlers in my opening paragraph. Traveling to the new world is not for everyone, but everyone is welcome.
2051+That’s all for now. ~roslet-tanner will be in touch in a few weeks with an update from Tlon. See you on the network!
2052+Josh / ~wolref-podlex
23042053
2305−_How could one do other than submit to Tlön, to the minute and vast evidence of an orderly plant? It is useless to answer that reality is also orderly. Perhaps it is, but in accordance with divine laws—I translate: inhuman laws—which we never quite grasp. Tlön is surely a labyrinth, but it is a labyrinth devised by men, a labyrinth destined to be deciphered by men._
2054+https://twitter.com/urbit
2055+https://github.com/urbit/urbit
23062056]]></content:encoded>
23072057 </item>
23082058 <item>
2309− <title><![CDATA[Aesthetic Culture #1]]></title>
2310− <link>https://urbit.org/blog/aesthetic-culture-1</link>
2311− <guid>https://urbit.org/blog/aesthetic-culture-1</guid>
2312− <pubDate>Wed, 11 Nov 2020 00:00:00 GMT</pubDate>
2059+ <title><![CDATA[2020 -> 2021]]></title>
2060+ <link>https://urbit.org/blog/2020-to-2021</link>
2061+ <guid>https://urbit.org/blog/2020-to-2021</guid>
2062+ <pubDate>Wed, 20 Jan 2021 00:00:00 GMT</pubDate>
23132063 <content:encoded><
2066+
23172067
23182068<br>
23192069
2320−_This post is the first in a series of digests centered on art produced within and about Urbit by a member of the community, ~nartes-fasrum. Monthly digests will be available within the Urbit Community group in Landscape, and will occasionally be compiled here on the blog to give you a sneak peek at some of what’s happening on the network. Enjoy! ~wolref-podlex_
2070+In this post, which has been adapted from our most recent [newsletter](https://urbit.us11.list-manage.com/subscribe/post?u=972a03db9e0c6c25bb58de8c8&id=be143888d2), we'll take a moment to reflect on the events of the last year, and then turn our attention to the next one.
23212071
2322−One of the most exciting things about Urbit is the aesthetic and design around it, developed partly by Tlon (through the design of Urbit itself) and partly by the community (by producing great Urbit art). As the community grows, it creates more art, and we have the opportunity to showcase some of the pieces we love. These works can draw curious new users in, and they give existing users ways to communicate their excitement to friends.
2072+## 2020
23232073
2324−To that end, I wrote [the Art by Urbit proposal](https://grants.urbit.org/proposals/636838408-art-by-urbit), a regular digest for the dissemination of Urbit art and propaganda. We'll bring you the works of both familiar faces and new users, in a variety of media types from image manipulation to 3D models and physical pieces. This first digest will cover some of the art produced in the past year, but will have a focus on the last two months. Future digests will be incremental updates summarizing the artworks of the prior month.
2074+In spite of the many challenges presented over the last year, it was a resoundingly good one for Urbit.
23252075
2326−## ~datnut-pollen
2076+It seems like a long time ago now that the folks at Tlon rolled out OS1 (now called Landscape), just as the pandemic forced everyone into their homes throughout the world. At the time, [Urbit is for Communities"](https://urbit.org/blog/urbit-is-for-communities/) was just a vision, but now it’s been transformed into reality—there are more thriving communities in Landscape than any of us can keep track of, with new faces popping onto the network on a daily basis.
23272077
2328−~datnut- made a physical representation of their sigil from maple wood & epoxy resin, and mentioned the potential to use an Arduino to cause different lighting effects for different statuses of an urbit.
2078+Landscape brought many new ships onto the network which helped identify those areas in which Urbit’s infrastructure could be most improved. [Ford Fusion](https://urbit.org/blog/ford-fusion/) eliminated the possibility of a partially-applied over-the-air (OTA) update through a drastic reduction in the size and complexity of the codebase. The efficiency of the OTA process was improved by several orders of magnitude, and many long-standing memory issues were resolved. Now we deploy code on our infrastructure nodes and see users receive an update, over a decentralized network, often in less than a minute.
23292079
2330−
2080+After improving the stability of the system Tlon turned its attention to bringing more ships onto the network. A long-standing barrier to Urbit’s adoption has been the technical knowledge required to host one’s own ship—this prompted Tlon to build and launch an Urbit [hosting service](https://tlon.io), the waitlist for which is now thousands deep.
23312081
2332−## ~lagrev-nocfep
2082+With Tlon becoming more singularly focused on building products on Urbit, concrete steps have been taken towards making urbit.org a separate organization that’s focused on long-term development of Urbit’s platform. I joined to [lead that effort](https://urbit.org/blog/first-steps-towards-urbit-org/) back in August and have since spent the majority of my time working with dozens of contributors on projects spanning documentation, education, external integrations, and much more.
23332083
2334−~lagrev- [made a thread of Dinosaur Comics](https://twitter.com/sigilante/status/1299101593997127680), using the Urbit Whitepaper as the seed text.
2084+We rounded out the year with a full network reset (called a “continuity breach”), which has in the past has been synonymous with loss of all data on the network. This time things went differently: tooling was made available to the community that allowed ships to preserve their data, which enabled most to seamlessly rejoin post-reset. This is a significant milestone for the project as it signifies not only a commitment to technical excellence, but to supporting our budding community.
23352085
2336−
2086+## 2021
23372087
2338−A sweet poem about the potential for Martian felines is theirs as well:
2088+In the last three weeks we’ve seen a huge amount of inbound interest as people are waking up to the inherent problems with using centralized services run by MEGACORPs—we’re just happy we started working on Urbit all those years ago. While we tend to not plan more than about six months in advance, I can still talk at a high level about what urbit.org will be focusing on in the immediate future.
23392089
2340−
2090+Growth in Urbit’s developer community has been growing organically in lockstep with the overall network growth. This means, happily, that there’s a pretty large pool of people eager to contribute to Urbit. The priority for urbit.org, therefore, is to improve its capacity to effectively assist contributors. In broad strokes, this means:
23412091
2342−## ~litmus-ritten
2092+- Rework urbit.org to better help developers learn how to contribute to Urbit
2093+- Since Urbit is ready to build on top of, provide practical guides that demonstrate how to do so
2094+- Guide developers to make high-value contributions to Urbit and its ecosystem
2095+- Build community amongst contributors
23432096
2344−~litmus- produces art full of glowing gases and colourful curves:
2097+My strategy to date has been heavily focused on working directly with contributors to provide technical guidance and direction, and it’s been working really well. To that end I’ll also be scaling our ability to provide such support by bringing more individuals into urbit.org that can mentor, review work, and provide guidance on where to best direct contributors' energy.
23452098
2346−
2099+2021 is shaping up to be a big year for Urbit, and we'd [love your help](https://grants.urbit.org) in building it. If you want to see what we're working on in real time, join us in Landscape at ~wolref-podlex/foundation.
23472100
2348−~litmus- also drew Urbitan for the release of OS1:
2101+See you on the network!
2102+]]></content:encoded>
2103+ </item>
2104+ <item>
2105+ <title><![CDATA[A brief update from urbit.org]]></title>
2106+ <link>https://urbit.org/updates/2021-01-15-update</link>
2107+ <guid>https://urbit.org/updates/2021-01-15-update</guid>
2108+ <pubDate>Thu, 14 Jan 2021 00:00:00 GMT</pubDate>
2109+ <content:encoded><
2112+As is customary for the first communication of the new year, I’ll be doing a retrospective of what was accomplished last year and a forward look at urbit.org’s priorities for next year. Make sure to read to the end for the details about our upcoming Town Hall event!
23512113
2352−More of their work is available in the notebooks of the Internet Weirdness Research Unit.
2114+1 - 2020
23532115
2354−## ~minder-folden
2116+In spite of the many challenges presented over the last year, it was a resoundingly good one for Urbit.
23552117
2356−~minder- stylistically ranges from retrofuturistic memes to flat-out classic 50s retro:
2118+It seems like a long time ago now that the folks at Tlon rolled out OS1 (now called Landscape), just as the pandemic forced everyone into their homes throughout the world. At the time, “Urbit is for Communities” (https://urbit.org/blog/urbit-is-for-communities/) was just a vision, but now it’s been transformed into reality—there are more thriving communities in Landscape than any of us can keep track of, with new faces popping onto the network on a daily basis.
23572119
2358−
2120+Landscape brought many new ships onto the network which helped identify those areas in which Urbit’s infrastructure could be most improved. Ford Fusion eliminated the possibility of a partially-applied over-the-air (OTA) update through a drastic reduction in the size and complexity of the codebase. The efficiency of the OTA process was improved by several orders of magnitude, and many long-standing memory issues were resolved. Now we deploy code on our infrastructure nodes and see users receive an update, over a decentralized network, often in less than a minute.
23592121
2360−
2122+After improving the stability of the system Tlon turned its attention to bringing more ships onto the network. A long-standing barrier to Urbit’s adoption has been the technical knowledge required to host one’s own ship—this prompted Tlon to build and launch an Urbit hosting service (https://tlon.io), the waitlist for which is now thousands deep.
23612123
2362−More of ~minder-’s work is available in his The New Era notebook.
2124+With Tlon becoming more singularly focused on building products on Urbit, concrete steps have been taken towards making urbit.org a separate organization that’s focused on long-term development of Urbit’s platform. I joined to lead that effort back in August (https://urbit.org/blog/first-steps-towards-urbit-org/) and have since spent the majority of my time working with dozens of contributors on projects spanning documentation, education, external integrations, and much more.
23632125
2364−## ~naltyc-wornes
2126+We rounded out the year with a full network reset (called a “continuity breach”), which has in the past has been synonymous with loss of all data on the network. This time things went differently: tooling was made available to the community that allowed ships to preserve their data, which enabled most to seamlessly rejoin post-reset. This is a significant milestone for the project as it signifies not only a commitment to technical excellence, but to supporting our budding community.
23652127
2366−~naltyc-, & by extension ~dasfeb industries, produces content related to the exploration of Urbit on small & unique computers:
2128+2 - 2021
23672129
2368−
2130+In the last two weeks we’ve seen a huge amount of inbound interest as people are waking up to the inherent problems with using centralized services run by MEGACORPs—we’re just happy we started working on Urbit all those years ago. While we tend to not plan more than about six months in advance, I can still talk at a high level about what urbit.org will be focusing on in the immediate future (Tlon’s next newsletter will provide a similar overview of what they’re working on).
23692131
2370−
2132+Growth in Urbit’s developer community has been growing organically in lockstep with the overall network growth. This means, happily, that there’s a pretty large pool of people eager to contribute to Urbit. The priority for urbit.org, therefore, is to improve its capacity to effectively assist contributors. Concretely, this means:
23712133
2372−More of their work is available in the smol computers group.
2134+- Rework urbit.org to better help developers learn how to contribute to Urbit
2135+- Since Urbit is ready to build on top of, provide practical guides that demonstrate how to do so
2136+- Guide developers to make high-value contributions to Urbit and its ecosystem
2137+- Build community amongst contributors
23732138
2374−## ~nartes-fasrum
2139+My strategy to date has been heavily focused on working directly with contributors to provide technical guidance and direction, and it’s been working really well. To that end, I’ll also be scaling the Foundation’s ability to provide such support by bringing more individuals into urbit.org that can mentor, review work, and provide guidance on where to best direct contributors’ energy.
23752140
2376−I use GIMP to edit images I pull off various social media platforms, and usually post the results on Twitter at [@nartesfasrum](https://twitter.com/nartesfasrum).
2141+If you’re interested in helping build Urbit, you can head over to https://grants.urbit.org to claim a bounty or submit a proposal, join the Landscape group ~wolref-podlex/foundation to stay in the loop about what urbit.org is up to, or contact me directly at josh@urbit.org.
23772142
2378−
2143+3 - Town Hall
23792144
2380−## ~norsyr-torryn
2145+In mid-February, we’ll be holding our first ever “Town Hall” event—it’s like a developer call, but longer, with more speakers, and covering a wider range of topics (not all of them technical!).
23812146
2382−No discussion of Urbit art would be complete without mentioning [~norsyr-'s Canvas app](https://github.com/yosoyubik/canvas), which won first place in the [Hackathon 2020](https://urbit.org/blog/hackathon-results/) event.
2147+We’re currently looking for speakers, so if you have an Urbit-related topic that you’d like to present, or would like to nominate someone else to present, please reach out to me by replying to this email. This could be an application you (or the nominee) has designed or built, an interesting use case, a design case study, or something completely different. Please don't be shy about reaching out—we're happy to work with you to figure out whether it makes sense to present a given topic, and how best to do so!
23832148
2384−
2149+Once we’ve finalized a date, we’ll broadcast it over our official Meetup group (https://www.meetup.com/urbit-sf/) and on Twitter. Stay tuned.
23852150
2386−## ~radbur-sivmus
2151+--
23872152
2388−~radbur- writes poetry on a range of subjects, one of which could be Urbit. Interpretation of ["A Weaver's Regard"](https://t.fust.us/writing/poetry/weavers-regard) and ["Internet Absurdities"](https://t.fust.us/writing/poetry/internet-absurdities) is left as an exercise to the reader.
2153+As a reminder, Urbit and Tlon have now split their newsletters in two—Urbit’s newsletter will cover the project and development community, while Tlon’s will focus more on the product development work on Landscape and the communities that form there. Tlon’s newsletter will arrive at the end of the month.
23892154
2390−## ~sitful-hatred
2155+That’s all for now. See you on the network!
2156+Josh / ~wolref-podlex
23912157
2392−~sitful- has a Martian Meme Depository chat in the Networked Subject group, which catalogs a number of the Urbit memes that have been created so far.
2158+https://twitter.com/urbit
2159+https://github.com/urbit/urbit
2160+]]></content:encoded>
2161+ </item>
2162+ <item>
2163+ <title><![CDATA[Ames Security Audit and the Future of the Protocol]]></title>
2164+ <link>https://urbit.org/blog/security-audit</link>
2165+ <guid>https://urbit.org/blog/security-audit</guid>
2166+ <pubDate>Thu, 17 Dec 2020 00:00:00 GMT</pubDate>
2167+ <content:encoded><
2170+
23952171
2396−## ~tocrex-holpen
2172+<br>
23972173
2398−~tocrex- has been drawing the galaxies of Urbit, and uploading results to Twitter at [@tocrexholpen](https://twitter.com/tocrexholpen). Each galaxy has a unique design and outfit, with the galactic sigil proudly displayed as its face.
2174+The security firm Leviathan has now finished their initial audit of the security of Urbit's Ames network protocol. In addition to their review of Ames, we also asked them to identify any other issues in order to help guide further development.
23992175
2400−
2176+I'm pleased to report they confirmed the cryptographic soundness of the protocol, namely that "a ship must have possession of their own valid Urbit key in order to authenticate as that ship and to send valid Ames messages. Additionally, no other ship except the two communicating may be able to decrypt or modify messages during transport."
24012177
2402−## Landscape
2178+This means Ames uses cryptography in a mathematically sound manner that protects your privacy, keeps your secrets secret, and ensures nobody else will be able to impersonate you on the network. Since this was an architectural audit, it’s possible there are still vulnerabilities in the runtime implementation. Until the runtime has been hardened, Tlon continues to recommend against storing valuables in your ship.
24032179
2404−Something that's become quickly evident with the addition of background images to Landscape is that people love to customize their ship's appearance and make it feel more like home. To close things out, we're providing a pair of backgrounds — one darker, one lighter — for use on your ship (or your desktop, should you so desire).
2180+Aside from a couple of minor issues that have already been resolved, there are three general classes of problem highlighted in their report that future work will need to address:
2181+
2182+- Forward secrecy
2183+- Protection against denial of service attacks
2184+- Enforcement of social boundaries
2185+
2186+Ames’ design allows for versioning of the protocol, which means that the proposed changes below can be deployed as over-the-air updates as they become more pressing concerns. This feature gives us confidence that we can address future security issues as they arise.
2187+
2188+We will need to improve all of these over the next couple of years, as independent lines of work. As the network grows: better forward secrecy will decrease the damage from a key getting compromised; resistance against denial of service attacks will make the Urbit network resilient to increasingly determined saboteurs; and stricter enforcement of social boundaries will let Urbit’s social networks remain safe and friendly despite potentially increasingly large numbers of bad actors and increasingly complex app ecosystems.
2189+
2190+## Forward Secrecy
2191+
2192+A protocol is said to have forward secrecy if compromising a key used in a recent message doesn’t also compromise all previous messages. Similarly, a protocol is said to have backward secrecy -- also called future secrecy -- if compromising a key used in a previous message fails to compromise all future messages. Ames has some degree of both, but more would be better, to decrease the damage an attacker could inflict by compromising a key.
2193+
2194+As it stands, an Urbit user can change their Ames keys whenever they want, by conducting an Ethereum transaction to update the Ames public key listed in the Azimuth contract, which implements Urbit’s PKI on Ethereum. Compromise of one Ames private key does not compromise earlier or later keys, so this has both forward and backward secrecy. The main drawback is that Ethereum transactions can be expensive, so key rotation is likely to be infrequent, and an attacker might be able to gain access to a long stretch of time by compromising a single key.
2195+
2196+Various key rotation “ratchet” schemes could be added to Ames to establish varying degrees of forward and backward secrecy, and other kinds of cryptographic protections beyond basic soundness, such as break-in recovery.
2197+
2198+Right now, changing a key through Azimuth is a manual process. It could be automated, possibly as one of a suite of services that an Urbit Provider will offer. Unfortunately, each key rotation costs the user money, so automating rotation could get prohibitively expensive.
2199+Existing protocols, such as the Signal app's encrypted messaging protocol, the Noise protocol framework, and the Wireguard VPN protocol, use ephemeral Diffie-Hellman key exchange and KDF chaining to achieve forward and backward secrecy and self-healing.
2200+
2201+Ames could be upgraded to use one of these existing ratchet algorithms, or we might create an Urbit-specific variant optimized for the Urbit network. This is work that should be done, but fortunately it will not require any novel research or drastic changes to Ames’s architecture.
2202+
2203+While Urbit’s cryptographic protections don’t yet match those of Signal or a few other privacy-focused apps, Ames is cryptographically sound, and since Urbit updates itself over-the-air and is backed by a stable, decentralized PKI, I’m confident that the level of sophistication of Urbit’s cryptography has the potential to be world-class with just a bit more work.
2204+
2205+## Denial of Service
2206+
2207+A denial of service (DoS) attack against an Urbit ship is an attempt to overwhelm it remotely by sending it network data in such a way as to interfere with the ship’s ability to communicate with other ships or process other events -- usually by hogging its resources (computational power, memory, or bandwidth) until normal operation slows down or ceases entirely. Since the promise of Urbit is that everyone can run their own server, that server needs to be able to defend itself against DoS attacks. This is in fact one of the main impediments to running your own server in the modern world.
24052208
2406−
2209+Right now, Urbit has no protection. Soon, it will need to at least be able to resist a simple attack carried out by an individual. Eventually, it should be able to resist a determined Distributed Denial of Service (“DDoS”) attack, which is more difficult.
24072210
2408−
2409−]]></content:encoded>
2410− </item>
2411− <item>
2412− <title><![CDATA[Late 2020 Progress Update: OS 1 -> OS 1.N]]></title>
2413− <link>https://urbit.org/blog/20200929-state-of-urbit</link>
2414− <guid>https://urbit.org/blog/20200929-state-of-urbit</guid>
2415− <pubDate>Mon, 28 Sep 2020 00:00:00 GMT</pubDate>
2416− <content:encoded><
2213+An unauthenticated DoS attack constructs packets that eventually fail to authenticate and decrypt but still overwhelm the target by causing it to waste resources (CPU, memory, disk, bandwidth) in such a way that it can't keep up with legitimate communications.
24202214
2421−<br>
2215+An unauthenticated DoS attack relies on the lack of Sybil resistance of IP networks: it's possible to generate new IP addresses rapidly, and a determined attacker might also be able to spoof its sender IP address. This is best considered an IP-layer attack that must be handled mostly at the IP layer itself, by maintaining state about which IP addresses can be trusted and which can't, determined empirically and heuristically by the Urbit runtime. The best any higher-level protocol, such as Ames or TCP, can do is make it as cheap as possible for a DoS target to reject a bad packet.
24222216
2423−When we announced OS 1, in April, we started to disappear into Urbit. Since then, we’ve been living on Urbit like we never have before. This has been our goal for years: to mature the system we’re building by becoming its first committed users. We knew that critical step toward Urbit’s maturity was being able to depend on it ourselves, but the system itself had to mature to the point that we could do that practically.
2217+The overall strategy that Ames can take, as a protocol layering over the IP protocol, is to add an authentication procedure to each packet that can quickly identify bad packets, which an implementation will then use to mark that IP address as suspect and to refrain from adding the sender IP to a list of known-good IPs.
24242218
2425−We’ve done this in fits and starts. We’ve _tried_ and failed a few times over the years. We’ve always _used_ Urbit to some extent, but we’ve never _relied_ on it. These past six months have been different. I can’t tell whether it was out of sheer determination and commitment, or that the system was just genuinely ‘there’. Either way, both Tlon and the Urbit Community genuinely live on Urbit now.
2219+Currently, Ames handles this by attempting to decrypt a message and rejecting the message on failure. This may be a more costly solution than other methods, such as attaching a signature or a MAC to each message. The way to mitigate unauthenticated attacks is to make bad packets fail faster by augmenting each packet with a signature or MAC to each packet, since those are faster to validate than encryption.
24262220
2427−In a way, our ability to use Urbit day to day doesn’t make sense. When we shipped OS 1, it was full of holes. There were serious performance, stability, and reliability issues. Plenty of people showed up and thought, ‘I don’t understand why you think this is useful.’ But, it was good enough that we wanted to use it. And since we wanted to use it, we put our energy into making it better like we hadn’t ever before. Being able to use a system that you can really trust is a wonderful feeling. It’s Computing Without Compromises.
2221+So far, we have identified three approaches that could be taken here. Of these three, Leviathan recommended the end-to-end HMAC solution, since that would not impose additional CPU requirements on packet-relay nodes, such as stars.
24282222
2429−All of the sudden, it’s Fall. We never found the time to name any of our releases or write announcements. We’ve just been making the system better in every way we can find. We’ve got a lot of exciting things planned for the last few months of the year — but I wanted to recap the progress we’ve made for those following along from the outside. If you haven’t been on the network, it’d be impossible to see.
2223+- Sign each packet, and any relay or final recipient could validate the signature
2224+- Wrap each packet in an HMAC, validated by the final receiver
2225+- Wrap each packet in a HMAC for each hop in a relay chain; each relay would validate and strip the previous HMAC and add a new one for the next hop
24302226
2431−The tl;dr is that Urbit is much faster, more reliable, and nicer to use than it was six months ago. Things have gotten much better, across the board. We threw ourselves into OS 1 admittedly underprepared, but we’ve learned a lot and matured the system a lot along the way.
2227+Any of these solutions would be attempts to increase the rate at which the network could discard invalid packets, with different tradeoffs. I'll back up a bit to provide some context, and then I'll compare the approaches.
24322228
2433−Anyway, let’s walk through the details. We’ll talk about our infrastructure and interface work independently, since that’s how we organize things internally. Then we’ll talk a bit about what’s going on on the network.
2229+In any DoS solution, a planet will want to block or throttle IPs that have been sending it packets that fail to authenticate and decrypt. Ideally, a star will help protect planets for whom it’s relaying, too. Many different arrangements among galaxy, star, and planet are imaginable here, from an open policy to a policy wherein each packet has to come from a known-good IP. This sort of paranoid, closed-off arrangement might still not be enough to withstand a determined DDoS, but it's difficult for me to imagine doing better than that without launching Urbit-specific ISPs. Ames packets are cryptographically authenticated, so an Urbit ISP would actually be feasible.
24342230
2435−### Infrastructure
2231+This brings us back to the three possible ways of mitigating DoS from within the Ames protocol. They all involve adding a piece of authenticating information to each packet that can be verified more quickly than waiting for the cyphertext to fail to decrypt — Ames's symmetric encryption is authenticated, so it's not a cryptographic soundness issue, but the performance impact of trying to decrypt could be significant enough to make it hard to prevent a DoS.
24362232
2437−
2233+As-is, an Ames packet is basically `[protocol-version checksum sndr rcvr (nullable origin) cyphertext]` (visit [this PR](https://github.com/urbit/urbit/pull/4051#issue-530369627) for a full specification). Let’s walk through the construction of the packet and how it can be upgraded to offer different DOS mitigations.
24382234
2439−In April, Urbit was slow, fragile, and didn’t always update itself properly. We made enormous progress on all of these.
2235+### DoS Mitigation Approach 1: Signature
24402236
2441−First off, Urbit is about 10x faster for most users. With some careful debugging, we were able to locate a few really [high](https://github.com/urbit/urbit/pull/3029) [impact](https://github.com/urbit/urbit/pull/3054) [improvements](https://twitter.com/pcmonk/status/1276327036722704385). There’s still performance work to do, but the effects of this work are widespread. Boot times are faster, local compute is faster, the network is faster. It’s a huge improvement.
2237+The first approach to DoS protection would be to add a signature to the packet. The signature would cover everything except the checksum and the origin, since those need to be swapped out by relays. The signature would probably obviate the need for the (20-bit) checksum, although we could also leave it in there if we can't figure out what else to do with those header bits.
24422238
2443−Second, we got our memory usage under control. Urbit still uses a 2GB memory arena. If the state of your Urbit grows to over 2GB things, uh, fall apart. This used to happen regularly, and now it’s pretty much unheard of. We implemented [tooling](https://github.com/urbit/urbit/pull/3235) to compact and deduplicate the memory image when it’s growing too large. We brought the memory usage of the compiler [down ~90%](https://github.com/urbit/urbit/pull/3041). There are areas where we can be more disciplined about how we use memory, but this is more or less a solved problem for the near term.
2239+#### Advantages of a signature over other approaches
24442240
2445−Third, we implemented a completely new build system. Well, we actually [got rid of the build system](https://urbit.org/blog/ford-fusion/) altogether and [made it a part of the filesystem](https://github.com/urbit/urbit/pull/3060). This made it possible for us to fix our over the air (OTA) updates and make them both fast and reliable. In April, an OTA could bring down your node and would take hours or even days to apply. Today, we regularly deploy OTAs with no fear of them breaking any nodes — they often go from galaxy → planet in a minute or less.
2241+- It can be validated by anyone on the network. Relays would not need to modify it. This might also give it symmetry with the upcoming remote scry protocol, which might also sign every packet. I'm not quite sure this is an important property, actually, but it might theoretically make launching an Urbit ISP or internet backbone easier one day.
2242+- It would be signed directly by the key listed on Ethereum, not something that might get ratcheted at some point for better forward secrecy — this could eventually lower the rate at which intermediate validators need their key caches invalidated, although this is a bit of a theoretical concern.
24462243
2447−We also rewrote a large part of our runtime in Haskell and made overall progress on [network scaling](https://github.com/urbit/urbit/pull/3174). And: we implemented a [principled approach](https://github.com/urbit/urbit/pull/2366) to [error handling](https://github.com/urbit/urbit/pull/3064), making nodes much less likely to become unrecoverable.
2244+#### Disadvantages of a signature over other approaches
24482245
2449−The network is stable, fast, and safe from day to day. We’re pretty confident it can grow quite a bit without serious issues. When we shipped OS 1 we really weren’t sure what we could handle. Now we’re standing on much more solid ground.
2246+- Generating and validating a signature is significantly slower than generating and validating an HMAC.
2247+- An ECDSA signature is 64 bytes, which is ~6% of a packet payload. As far as I can tell, it can't be compressed.
2248+- Since the signature could be validated by anyone, it doesn't attest to a specific communication channel, so it might not help as much with IP filtering.
24502249
2451−### Interface
2250+### DoS Mitigation Approach 2: End-to-End HMAC
24522251
2453−
2252+The second approach would be to use an HMAC instead of a signature, validated by the eventual receiver. This HMAC would also cover everything except the mug and origin. I'm calling this the "end-to-end HMAC" design. An HMAC requires a shared secret, for which we could use the same symmetric key that Ames uses.
24542253
2455−When we shipped OS 1 it was a bunch of separate pages (that were slow to load), all with separate ways of storing and processing data. Our interface work over the past six months is all about unification and simplification.
2254+#### Advantages of end-to-end HMAC
24562255
2457−First, we pulled OS 1 together as a [single page app](https://github.com/urbit/urbit/pull/3025). Using OS 1 involves a good amount of moving around and refreshing the page each time was pretty painful. Now it’s snappy to move between pages and keep up with what’s going on. In tandem, we started using our own component library, [Indigo](https://github.com/urbit/indigo-react). This makes frontend development much cleaner and more efficient.
2256+- It's simple in some sense; relays don't need to do anything cryptographic.
2257+- HMACs are much faster to create and validate than signatures.
2258+- HMACs, since they're hashes, can be truncated arbitrarily and still maintain some security — to find hash collisions, you'd still have to guess what packet||shared-secret would hash to; it would just be a smaller search space. Since Ames's encryption already guarantees authentication and we'd just be using this as a performance optimization, I suspect we could get away with using one that's significantly smaller than a signature — I'm not sure how small, but if 4 bytes would be enough in practice, that would take up less than 0.5% of the space in a packet.
24582259
2459−Next, we unified the way we store data and compute. It used to be that each individual module (chat, publish, and links) used their own ‘agents’ to store and process data on the Urbit side. (An agent is the Urbit equivalent of a datastore + business logic.) With a lot of moving parts, this approach caused all kinds of synchronization challenges. Rather than a module-per-agent model we’ve started to move toward a type-of-data-per-agent model. The first of these is [graph store](https://github.com/urbit/urbit/pull/3110). We’re presently in the process of migrating all our modules to graph store.
2260+#### Disadvantages of end-to-end HMAC
24602261
2461−Those two are by far the most significant, but there’s so much more. We [rewrote](https://github.com/urbit/urbit/pull/2937) the `group-store`, allowing for different roles (admin, moderators, and so on) in a group. We shipped better debugging tools, automatic reconnection, a settings panel, and overall visual polish and refinement.
2262+- Only the recipient can validate. This means the authentication couldn't be used by relays to discard invalid packets. The recipient could provide back-pressure out-of-band to a relay to ask the relay to discard packets from an IP with an invalid HMAC, but this is indirect and might need to filter backward through multiple relays to work properly.
24622263
2463−
2264+### DoS Mitigation Approach 3: Point-to-Point HMAC
24642265
2465−And I almost forgot [Leap](https://github.com/urbit/urbit/pull/3231): an omnibox for navigating around OS 1 with the keyboard. We have plans to make Leap much more powerful — but it’s a great first start toward making OS 1 keyboard accessible. I almost exclusively use [Leap](https://upload.wikimedia.org/wikipedia/commons/0/06/Canon_Cat_keyboard.jpg) to get around OS 1 these days.
2266+The third approach, which is what I would build unless convinced otherwise, is what I'm calling "point-to-point HMAC". This design would include a different HMAC for each hop in a relay chain, instead of (or maybe in addition to) including one end-to-end HMAC.
24662267
2467−### Community + network
2268+We have a couple different options for how to construct the shared secret for each hop. I would intuitively construct it using a Diffie-Hellman of my private signing key and your public signing key — the "networking keys" on Ethereum include a currently unused signing key in addition to the encryption key that Ames uses. This way even if we add more forward secrecy to Ames, changing the symmetric key used for encryption, relays wouldn't have to have their caches invalidated as often; the state required to perform relaying wouldn't be as tied to the state required to receive a message.
24682269
2469−
2270+#### Advantages of point-to-point HMAC
24702271
2471−Our primary goal with OS 1 was to get both Tlon and the Urbit Community living entirely on Urbit. We did that, and in doing so we’ve seen how nice it is to grow a community in a calm, non-invasive environment. We started doing regular [Urbit](https://twitter.com/urbit/status/1308875082312364048) [Dialogues](https://twitter.com/urbit/status/1304139629948329985) with friends and peers in the absence of physical meetups, which have been fun.
2272+- A star could perform some validation on every packet it's asked to relay. This makes it more difficult for an attacker to route a ton of packets to a planet through a star, or even through many relays. Signatures also have this property, but they're slower to verify. This approach and the signature approach, but not the end-to-end HMACs, force an attacker to use an (at least partially) authenticated attack in order to use a relay as a way to get to a planet.
2273+- A planet could quickly validate that a relayed packet actually came from its star, not an attacker who's managed to spoof the star's IP address.
24722274
2473−Getting onto Urbit is still relatively challenging. By the standards of software you run yourself, it’s not so bad at all. But by comparison to ordinary consumer software, it’s way too hard. Tlon is [working on that](https://tlon.io) — but these last six months have been only for the brave. That is, those that want to host their own nodes.
2275+#### Disadvantages of point-to-point HMAC
24742276
2475−Turns out, there are plenty of people who are up for running Urbit themselves and quite a few small communities have sprouted around the network. Overall the network has a fun, cozy feeling. It’s nice.
2277+- Not everyone on the network can validate a packet, unlike a signature.
2278+- Each relay needs to validate and strip off the previous HMAC and create a new one before sending it. This should be quite fast, since an HMAC is just a hash, but it's still some CPU, and potentially creates an imbalance where an attacker could induce the relay to spend more CPU in validation than the attacker spent in constructing the packets.
2279+- By itself, it doesn't validate the cyphertext in an end-to-end way. I suspect we might want to include both a per-route HMAC and an end-to-end one, especially if we use truncated HMACs — although per-route might be enough on its own, since if the receiver fails to validate a bunch of packets whose HMACs were validated by the relay, the receiver can ask the relay to block that whole Urbit address regardless of IP, so it shouldn't be possible to sustain that kind of attack for long.
24762280
2477−### What’s next
2281+#### An Aside About Cryptographic Performance
24782282
2479−We’re still more or less flat-out, full speed ahead into an even better Urbit-world. The seeds of change were planted when we made Josh the [interim technical director of urbit.org](https://urbit.org/blog/first-steps-towards-urbit-org/). Urbit itself is getting close to the point where the separation between Urbit and Tlon has to become more real. Urbit is aimed at being an ubiquitous platform, Tlon is aimed at making it as usable and useful as possible.
2283+I'm not sure exactly how much faster HMAC is. According to DJB (https://ed25519.cr.yp.to/ed25519-20110705.pdf), an ECDSA signature can be created in around 30 microseconds and verified in around 100 microseconds. This source (https://www.jacksondunstan.com/articles/3206) suggests about 21 microseconds for HMAC-SHA256, so about a 1.5x improvement in generation speed and 5x in validation speed. We should verify these numbers for ourselves before making a decision.
24802284
2481−We’ll talk about some of this on [October 9th](https://www.meetup.com/urbit-sf/events/273439025/), and you can see a bit of what’s coming on [tlon.io](https://tlon.io) today. If you tried booting Urbit in April and it was tough, try again. We’re easy to find on the network, and we’d love to get reacquainted.
2482−]]></content:encoded>
2483− </item>
2484− <item>
2485− <title><![CDATA[~2019.10 Roadmap]]></title>
2486− <link>https://urbit.org/blog/2019-10-3-roadmap</link>
2487− <guid>https://urbit.org/blog/2019-10-3-roadmap</guid>
2488− <pubDate>Wed, 02 Oct 2019 00:00:00 GMT</pubDate>
2489− <content:encoded><
2285+### DoS Protection Strategy and Timeline
24912286
2492−The daily work of building a new OS from scratch is so engaging and exciting that we habitually forget to even take stock of what we’ve accomplished. We’re fixated on the prospect of moving the world on to Urbit, starting with ourselves.
2287+Tlon is not currently pursuing adding any of the extra cryptographic authentication on Ames packets described above. Since this is ultimately a performance issue, there are other more pressing performance issues that we could improve upon before decryption will become the limiting factor in how many packets can be processed by a ship. We will revisit this authentication performance question once some of the low-hanging fruit has been done, perhaps roughly a year from now.
24932288
2494−It’s a good thing I have a recurring reminder to write these updates. While our focus is on the future, it’s good to get a sense of the rate that we’re moving forward, and to let everyone know what’s been going on. We’ve made great progress over the past few months.
2289+Since the audit, we’ve already improved the Ames packet format to allow faster parsing, faster validation of basic fields, and faster relaying; in the future, increases in performance of Nock execution and inter-process communication between Urbit's I/O process and Nock worker would allow Urbit to absorb somewhat more punishment before service can be effectively denied.
24952290
2496−We’ve got a new interface, Urbit 0.8.0, Hoon School, and a grants program among lots of other updates. We’ll go into detail about all of these, and talk a bit about where we’re headed next. The system is improving at a really good pace. We intend to keep it up.
2291+## Enforcement of Social Boundaries
24972292
2498−## Identity (Azimuth)
2293+While Urbit needs to rely largely on its runtime to mitigate unauthenticated attacks, any attack conducted from an Urbit ship needs to be handled inside Arvo itself, not just by IP filtering in the runtime. Just like in any DoS, an attacker ship might try to induce you to use too much memory, CPU, or disk space in order to sabotage normal operation. An authenticated attack is harder to define than an unauthenticated attack, because it depends on what social relationship the attacker and target have, and it involves valid, authenticated Ames packets; once discovered, though, it’s easier to mitigate, because it can use Urbit’s permanent identity system to enforce social consequences, i.e. stop listening to that Urbit address and possibly encourage others to do so as well.
24992294
2500−The other day I got an email, clicked a link, and got a planet. A real, live, piece of cryptographic property with paper wallets and everything. It took about two minutes. And at the end, I could have easily sent invites to my friends.
2295+There are a couple of different kinds of authenticated attack: attempts to exploit vulnerabilities in the Nock worker (the interpreter, allocator, and jets) by causing particular Nock code to run, and attempts to induce the target to exhaust various computational resources.
25012296
2502−This experience is part of a completely new Bridge, the interface for interacting with your Urbit identity. The beta experience we’re testing today is quite stripped down, but it’s a huge improvement over the last Bridge release. Clicking a link is a lot easier than downloading source code, running it from the command-line, and probably running into a python-related error.
2297+Protecting against attempts to break out of the sandbox and hijack or otherwise interfere with the Unix process running Nock will require a process of hardening, fuzzing, and likely further security audits specifically evaluating the security of that boundary. This is largely out of scope of the Ames protocol itself, which was the subject of this audit.
25032298
2504−Getting to this point involved rewriting Bridge from scratch, figuring out how to host it securely, building infrastructure to fund the requisite transactions involved in registering a new identity, and setting up a service to send emails (and dispose of them afterward). We've also redesigned our paper wallets to make them simpler and clearer.
2299+This leaves us with the latter case: resource exhaustion attacks. A peer could try to get my ship to use too much RAM, disk, CPU, or bandwidth by sending it valid Ames packets. This represents a social problem: a person on the network is trying to interfere with me. It's what's known in blockchain circles as an "attributable fault": once the attack is detected, it's trivial to determine the identity of the culprit.
25052300
2506−We still want to get this new version of Bridge a bit further along before releasing it to everyone — but we’re excited about it. We didn’t quite get to the point of building an affordance for payments, which we had hoped to do, but that’s coming later.
2301+Once the attacker’s Urbit address is known, Urbit will fall back on the Sybil resistance of its identity system: there are a finite number of identities, each of which costs some money. Because Urbit identities are relatively permanent, they can be blocked permanently. As long as the expected value of an authenticated attack is less than the cost of the identity, the attacks won't happen very much — they'll cost money to sustain, instead of being self-perpetuating.
25072302
2508−We want everyone to have an Urbit identity. And we want it to be incredibly easy to get one, so we’ll get Bridge out this month with a new urbit.org (more on that below).
2303+Attacks like this are best thought of as attempts to violate social boundaries. I don't want you using up too many of my resources; that's a social boundary, and an attempt to force my ship to spend its resources on your behalf constitutes a violation of this boundary. The strategy for mitigating these attacks is to impose social and, indirectly, economic consequences on the perpetrators. The main social consequence is other ships refusing to communicate with you anymore.
25092304
2510−The other area of identity-related work was Sigils — the algorithmically generated images that go with every Urbit identity. (We’ve got a blog post in the works that covers how we created these, which is a good story that needs to be told.) The original version of Sigils didn’t look very good at small sizes and a few collisions were found (thanks to [urbit.live](https://urbit.live) for helping to discover the collisions). The [new, improved sigils](https://github.com/urbit/sigil-js) have no collisions and look great at small sizes.
2305+Some of this mitigation will take place in the Arvo kernel, and some will need to be application-specific. To protect the system from attackers, the kernel needs to be able to free space (Urbit is a single-level store, so there's no distinction between disk and RAM from Arvo's perspective) taken up by unfinished messages sent by peers. This can be done by allowing an application to ask Ames to delete partially received messages from a peer, generally replacing the received packets with an intent to nack (negative acknowledgment) to indicate that the transaction the peer wanted me to perform has been rejected.
25112306
2512−**Q4 2019**
2307+Applications should also be able to set resource usage policies that the Arvo kernel will enforce. For example, a chat application should configure Ames to reject any chat messages larger than, say, two hundred kilobytes. A file-sharing application would need a much larger per-message limit (ideally no per-message limit), but it might need to place a cap on its bandwidth usage to make sure lower-latency communications aren't swamped by a large file transfer. This kernel/application interface starts to resemble a permissioning or capabilities system, and it could be built as part of the crucial larger project of providing for configurable application permissions.
25132308
2514−- Release Bridge to the public
2515−- Get Bridge working well on mobile
2516−- Add payments support, hopefully including BTC
2517−- Add a network explorer
2309+To close the loop on enforcing social boundaries, reputation information should be shared across ships. This will likely be done by building one or more applications that share statistics and block operations. Some forms of reputation are likely to be globally shared, whereas others are likely to be multipolar, i.e. some people like you and some don’t. Generally, the lower the layer of the attack, the more global the reputation effect will be; the higher the layer, the more multipolar. An attempt to spam the network with millions of malicious packets will cause most people not to want to talk to you; sending me a movie I found mediocre is probably not even information worth sharing with anyone else.
25182310
2519−**Q1 2020**
2311+## Conclusion
25202312
2521−- Integrate Bridge with a native app for Arvo
2313+Ames’ design has unparalleled potential to deter, mitigate, and recover from attacks, since every packet is authenticated and encrypted and backed by a stable, decentralized PKI. It feels good to have our design for encryption and authentication be confirmed by a third party as cryptographically sound, and we know more or less what we need to build to reach the full security potential of the platform, including the steps outlined here.
2314+]]></content:encoded>
2315+ </item>
2316+ <item>
2317+ <title><![CDATA[Input and Output in Hoon]]></title>
2318+ <link>https://urbit.org/blog/io-in-hoon</link>
2319+ <guid>https://urbit.org/blog/io-in-hoon</guid>
2320+ <pubDate>Tue, 15 Dec 2020 00:00:00 GMT</pubDate>
2321+ <content:encoded><
25242325
2525−As a team, we want Urbit to be our primary computer, our last computer, our permanent computer. And we want this now — or at least as soon as we possibly can. We’re both ambitious and impatient.
2326+<br>
25262327
2527−The frustration that we can’t move onto Urbit today propels us forward. The system saw major updates over the past few months all the way through the stack. On the Arvo side, we divide our work into Infrastructure (everything in the kernel and interpreter) and Interface (everything in userspace and the front-end). We’ll start with Infrastructure progress first.
2328+Let's talk about IO in Urbit. I won't say much about how events and effects are processed by the runtime; it suffices to note that the runtime is a normal Unix program which (1) listens for various events, (2) passes them to Arvo (Urbit OS), and (3) processes the effects produced by Arvo. Instead, I’ll focus on how IO works from the perspective of Hoon programs, like Arvo or apps running on Arvo. But first, let's review IO paradigms in other languages.
25282329
2529−We’re very nearly to the point that all the kernel-level code in the system has been written by our current team. The one remaining vane that deserves a rewrite (Gall) has had a major cleanup by Jared just recently. The [Ship of Theseus](https://en.wikipedia.org/wiki/Ship_of_Theseus) approach does appear to be working. The infrastructure team is doing fantastic work and has really deepened their ownership of the system. The Urbit of today is on the road to becoming a great piece of system software.
2330+All examples are in a made-up language, since it's useful to understand this information even before you're comfortable in Hoon. If you're learning Hoon and want a challenge, try translating them!
25302331
2531−The biggest infrastructure-level milestone was the release of [Urbit 0.8.0](https://github.com/urbit/urbit/releases/tag/v0.8.0). We introduced a new process-separation architecture, implemented the correct bootstrap sequence, moved to LMDB for persistence, replaced our http vane (%eyre) and moved to Nix for our build system.
2332+## The three styles of IO
25322333
2533−To put it simply, Arvo is now much more stable and durable. During the beginning of the year we were seeing bugs and instability that were frustrating and unacceptable. While there are still issues on the live network, none of them terrify us much. We also implemented the ability for users to ‘individually breach’, which means that you can now reset your Urbit without waiting for us to reset the network.
2334+I will call these styles imperative IO, monadic IO, and state machines (note that this classification refers only to the experience of using them and the program structure they dictate). An imperative programming language can use any of these and a functional programming language can use any of them.
25342335
2535−### Landscape (Arvo UI)
2336+### Imperative IO
25362337
2537−We don’t just build infrastructure for others to develop on top of. We build interfaces too. At the top of the stack, we released a completely new Landscape, the interface for Arvo. This new interface makes it possible to build other ‘modules’ for Arvo that go beyond chat and publishing.
2338+Imperative languages (such as C and Python) perform IO by calling a function in the middle of whatever they were doing. Anywhere, in any statement, you could have IO.
25382339
2539−This new Landscape is a complete departure from the last direction. Your Urbit now has a simple home screen that launches individual modules and it’s [relatively easy](https://github.com/urbit/create-landscape-app) to create new ones. We’re all enjoying using Landscape around the office. It’s still a bit of a prototype — but it’s quite a good one, I think.
2340+In this example and others to follow, the task will be to read a filename from the command line, read a URL out of that file, and fetch the contents at that URL.
25402341
2541−In moving to this new model we decided to narrow our focus to desktop only for now. We’ll return to mobile again next year — but first we want to get the desktop experience right. We’ve pulled the iOS app from the app store for the time being. I’m personally sad to see it go, since I enjoyed using it. But our prior iteration of Landscape just wasn’t quite right.
2342+ output = fetchUrl(stripWhitespace(readFile(cliInput())))
25422343
2543−This version of Landscape is, I think, the last one that we’ll call a prototype. Over the past few weeks, since shipping this, some amazing work has been happening on the interface front. We have a systematic approach to building interfaces on top of Urbit that’s very promising, albeit just getting started. We’ve already put out [one post](https://urbit.org/posts/landscape-a-portrait/) about Landscape's future, with more posts to come.
2344+For readability, intermediate variables would be a good idea, but nothing stops you from nesting IO this way.
25442345
2545−**Q4 2019**
2346+### Monadic IO
25462347
2547−- Improved Arvo-level error handling
2548−- Implementation plan for ‘telescoping kelvins’ — or [how we plan to future proof Arvo](https://groups.google.com/a/urbit.org/forum/#!topic/dev/6Mwn6TQFVwc)
2549−- Versioning scheme between Arvo and Vere
2550−- A new Haskell implementation of the daemon
2551−- A native client (instead of just a browser tab)
2552−- A [new user-space architecture](https://docs.google.com/document/d/1hS_UuResG1S4j49_H-aSshoTOROKBnGoJAaRgOipf54/edit)
2553−- Hoon.hoon that’s OTA upgradeable
2554−- Working Jacque prototype, a graal-truffle-based implementation of vere
2348+Languages that use explicit monads for IO (such as Haskell) perform IO by running IO behind a bind operation, which I'll notate with `<-`. Thus, while you can't put IO _anywhere_, the general structure is a sequence of IO operations.
25552349
2556−**Q1 2020**
2350+ fileName <- cliInput()
2351+ url <- readFile(fileName)
2352+ output <- fetchUrl(stripWhitespace(url))
25572353
2558−- Integrated client with Bridge and Arvo
2559−- New interface framework, codenamed ‘Widescreen’
2354+[Tackling the Awkward Squad](https://www.microsoft.com/en-us/research/wp-content/uploads/2016/07/mark.pdf) is the canonical description of monadic IO, and does a great job of explaining how the Haskell community decided to use this as their primary IO style.
25602355
2561−## Docs + Community
2356+### State machines
25622357
2563−We had quite a bit of interest in our second session of Hoon School. We ended up with 150 people enrolled in Hoon 101, and 42 in 201. The 101 session just ended, with a lot of positive responses and feedback from the participants. We learned a lot doing it and got quite a bit of interesting new example code.
2358+Languages that use explicit state machines for IO (such as Elm) perform IO by accepting events and producing a list of effects.
25642359
2565−Hoon 101 started with students with little to no programming experience. Hoon 201, which is just getting underway, covers more advanced topics. We’re quite curious to see what comes out of it.
2360+ event :: Initialize
2361+ | CLIInput text
2362+ | FileInput text
2363+ | HTTPResponse body
2364+ effect :: CLIInput
2365+ | ReadFile fileName
2366+ | FetchUrl url
2367+ | Print text
2368+ main(event) {
2369+ switch event {
2370+ Initialize -> [CLIInput ~]
2371+ CLIinput fileName -> [ReadFile fileName]
2372+ FileInput url -> [FetchUrl stripWhitespace(url)]
2373+ HTTPResponse body -> [Print body]
2374+ }
2375+ }
25662376
2567−We’re also adding features to Landscape to make it more amenable to use by Hoon Schoolers. Good examples include code evaluation within Chat (for office hours), and the ability to pin posts in Publish. The next crop of Hoon learners will be able to use Urbit to learn about Urbit.
2377+The effects produced are not functions but data.
25682378
2569−Aside from Hoon School we’re always updating our documentation. Most notably, we added search to the docs (finally). This was a much needed feature that makes the docs much more usable.
2379+It's important to note that this example is chosen to highlight a particular kind of IO — sequences of events. Further, this example has no persistent state — each IO operation is a pure function of the output of the previous one.
25702380
2571−We also launched our [grants program](https://grants.urbit.org/) quietly, but all of our available bounties were quickly claimed nonetheless. We’re ready to give away more address space to contributors and are excited by how quickly people got involved.
2381+## A stateful, loopy example
25722382
2573−We also did some experimentation with holding events on Arvo. We held weekly AMAs for while, and hosted a few meetings with the community. With the new UI out, our public channels have been a lot more active. We’ll surely be holding more on-urbit events in the future — but for the time being the conversation in urbit-help is a lot of fun.
2383+Let's look at another type of program: a simple HTTP server that you can give text at the CLI, which will respond to all HTTP requests with that text.
25742384
2575−**Q4 2019**
2385+Imperative:
25762386
2577−- Vane level documentation
2578−- An active grant program
2387+ text = "no text entered yet"
2388+ while (true)
2389+ cli = readCli()
2390+ if (cli != Null)
2391+ text = cli
2392+ request = readHttp()
2393+ if (request != Null)
2394+ respond(request,text)
25792395
2580−## urbit.org
2396+Monadic:
25812397
2582−Urbit.org is about ready for a refresh — so we’re in the process of rebuilding it. We have, for a long time, told the story of Urbit by describing the system technically. We think Urbit can be explained much more simply and much more concisely. We’re working to put together a new set of materials in this direction.
2398+ loop("no text entered yet")
25832399
2584−We’d also like to populate urbit.org with a lot more content about what we’re working on and thinking about. We do a reasonable job of writing updates, but many of our projects get released without any background info. Tlon and the Urbit community are full of smart, thoughtful people — and we’d like to do a lot more to surface their work. We plan to close out the year with both a new website and a lot of writing about what we’ve been building. Not everyone wants to read the source code!
2400+ where:
25852401
2586−That covers it for now. If you have questions or want to chat — find us in `~dopzod/urbit-help`. See you online!
2587−]]></content:encoded>
2588− </item>
2589− <item>
2590− <title><![CDATA[~2019.5 Roadmap]]></title>
2591− <link>https://urbit.org/blog/2019-5-roadmap</link>
2592− <guid>https://urbit.org/blog/2019-5-roadmap</guid>
2593− <pubDate>Wed, 15 May 2019 00:00:00 GMT</pubDate>
2594− <content:encoded><
2402+ loop :: text -> IO Null
2403+ loop =
2404+ input <- readInput()
2405+ switch input
2406+ CLIInput newText -> loop(newText)
2407+ HTTPRequest request ->
2408+ _ <- respond(request,text)
2409+ loop(text)
25962410
2597−We often get so busy that we forget to tell you what we’ve been up to. Here’s an update on what we’re doing and where we’re headed with each layer of the stack.
2411+State machine:
25982412
2599−At a very high level we have two goals for 2019: make Azimuth easier to use, and get Arvo to a 1.0.
2413+ text = "no text entered yet"
2414+ main(text,event) {
2415+ switch event {
2416+ CLIInput newText -> [newText, Null]
2417+ HTTPRequest request -> [text, HTTPResponse text]
2418+ }
2419+ }
26002420
2601−Next year we’ll begin to move away from some of the MEGACORP software we use in the office, and replace it with our own tooling. There’s some exciting work happening in that department, but we’ll cover that in a future post.
2421+Again, note the response in the state machine is data, not a function.
26022422
2603−For some related recent thinking on all of this, see [The 100 Year Computer](/posts/essays/the-100-year-computer/), [The State of Landscape](/posts/essays/the-state-of-landscape/) and [Azimuth as MultiPass](/posts/essays/azimuth-as-multipass/).
2423+I'm not trying to make a point about which type is better in general. There's a pretty strong argument that in the first example, imperative was the best option, followed by monadic, followed by state machine. There's an equally strong argument that the second example is most naturally represented by the state machine.
26042424
2605−For now, let’s just look at what’s on the immediate horizon:
2425+Look at how state is handled in the monadic example. Formally, bind composes functions, so that every time you see a `<-` there's actually a new function (closure/delimited continuation) being created and stored for when we receive a response. All variables in scope are stored in that closure, so we can conveniently access them later without explicitly storing them. However, the state we preserve over time varies a lot. In this example, it varies between storing `loop`, `[loop input]`, `[loop input newText]`, and `[loop input request]`.
26062426
2607−## Azimuth
2427+By comparison, the state machine does not store intermediate values, it only stores its explicit state. While this is somewhat less flexible, it puts the permanent state front-and-center.
26082428
2609−At lunch the other day someone on our team said something like, ‘We built a complete and working public key infrastructure, but we haven’t told anyone.’
2429+I'll reiterate that all of these are possible to implement in purely functional languages, and further they can all be implemented in terms of each other. State machines are trivially implementable -- it's just a function [state event] -> [new-state (list effect)]. Monadic IO can be implemented directly (as in Haskell) or on top of state machines by storing continuations in your state. Imperative IO is somewhat more difficult but should be possible through algebraic effects.
26102430
2611−It’s true. Azimuth is operational, secure, and well tested. It’s a pretty cool piece of technology and it’s out there in the world for anyone to use. It also doesn’t require that you use Arvo — Arvo happens to make use of Azimuth, but Azimuth itself is a completely separate system.
2431+When inventing a new system, you should consider which of these you intend to support based on the sort of code you expect to see. For example, a scripting language will almost always benefit from imperative (or at least monadic) style.
26122432
2613−So the question is why haven’t we told the world about it?
2433+## In Urbit
26142434
2615−I tend to think that in order for a technology to succeed it has to not only be an important technical innovation, it also has to be easy to understand as a product. And that’s our answer: we’ve undersold Azimuth because we want it to be easier to understand by _using_, not just by reading the code. Azimuth is quite an elegant piece of technology — but that doesn’t matter until it has a great user experience to match.
2435+So much for exploring the space of IO solutions. In terms of deployed code on Earth, the split is about 90% imperative, 5% monadic, and 5% state machine. In Urbit, the split is about 90% state machine and 10% monadic. This is what I intend to explain and defend.
26162436
2617−That’s why, in the near term, we’re focused on building on top of Azimuth ourselves. We can’t ask others to go down roads if we haven’t already been down them.
2437+Urbit's OS is called Arvo; it has several "kernel modules" called vanes, and it has userspace applications. Colloquially these are called "apps," but when speaking about them abstractly, it's helpful to use their more specific name: ["agents"](https://urbit.org/docs/tutorials/arvo/gall/#agents). Arvo, the vanes, and agents are all structured as explicit state machines.
26182438
2619−Here’s what we’re building first:
2439+In addition, there are ["threads"](https://urbit.org/docs/tutorials/arvo/gall/#threads), which are structured as monadic IO. Note there's only a superficial resemblance to Unix threads: they are not executed in parallel and they don't share memory, or at least not any more than agents do. They're simply a computation that takes an argument and produces a result, possibly after doing some IO, structured monadically.
26202440
2621−### Q2 2019
2441+As you can see, all the lowest levels of Arvo are explicit state machines, and only the highest layer supports monadic IO. To see why this is the case, let's list advantages and disadvantages to each type. Note that, while I'm speaking specifically of agents and threads in the context of Urbit, these are fundamental properties of monadic and state machine IO.
26222442
2623−- A simplified onboarding flow for getting an Azimuth point that’s simple to share with friends over email, text or as a URL.
2624−- A redesigned and improved Bridge for managing your points.
2625−- An interface that allows you to easily send money between Azimuth points without running Arvo.
2443+Agents are:
26262444
2627−### Q3 2019
2445+- Upgradable. Since the state is explicit, you can upgrade an agent in-place by supplying a new state machine and a function from the old state type to the new state type. This is very similar to a database migration.
26282446
2629−- Expanded Azimuth-centric example modules, documentation and developer tooling.
2447+- Robust. A state machine must accept any input at any time. If it receives unexpected input, it must have had explicit error handling for that input, since it's one of the types in the switch statement. Thus, it's relatively easy to stay in a consistent state.
26302448
2631−Still under consideration:
2449+- Permanent. Since it's upgradable and robust, there's no reason to stop its running.
26322450
2633−- An OAuth server or JWT flow for logging into any service with an Azimuth point.
2634−- A mobile app for point to point payments using Azimuth.
2451+- Hard to write long sequences of IO. Long sequences of IO create many possible states, and you must handle any input in any state. This can result in complex, hard-to-follow code with code paths that are rarely if ever taken.
26352452
2636−### 2020
2453+Threads are:
26372454
2638−Azimuth is beginning to feel like [multipass](/posts/essays/azimuth-as-multipass/), with a variety of ways to use Azimuth points without ever booting Arvo
2455+- Not upgradable in-place. Since the state is implicit, you can only cleanly upgrade by (1) killing the thread and restarting it or (2) letting it resolve to a defined "upgradable state" periodically, usually at the top of a "main loop". If you do (2), then you are in fact structuring it as a state machine, so the other advantages of threads are compromised.
26392456
2640−## Arvo
2457+- Fragile. If we don't receive expected input, the default behavior is to be stuck waiting for input. You must remember to add any error-handling features you want, and it's easy to end up in an inconsistent state.
26412458
2642−The Arvo interface has always been held back by Arvo’s technical immaturity. This is still true to some degree. The system has not stabilized completely.
2459+- Impermanent. Since a thread can't be upgraded and may get stuck in case of unexpected input, a thread can't be expected to last forever. It must be "rebooted" from time to time.
26432460
2644−But! We’ve been using Landscape quite a lot lately. I use it daily, in fact — even [on my phone](https://itunes.apple.com/us/app/landscape-urbit/id1393148862). An encrypted (although not audited — so let’s not call it ‘secure’), authenticated chat where I own the keys and can read the source code feels really nice to use. The interface isn’t as good as we’d like, but it’s not bad. Landscape is a great preview of where we’re going: a simple, permanent, self-sovereign computer.
2461+- Easy to write long sequences of IO. Just...write the IO one line at a time.
26452462
2646−There are still rough edges, and Landscape is not nearly general purpose enough, but we have plans:
2463+Arvo proper and the vanes are permanent pieces of software and, for this reason, state machines are more natural.
26472464
2648−### Q2 2019
2465+I'll note that other kernels, like the Unix kernel, use imperative IO. The difference is that Unix isn't permanent in itself — it only lasts until you reboot. Since your permanent state is stored externally, you don't need to be upgradable or permanent. With sufficient discipline you can write robust C code, so it makes sense to use imperative style. Even so, a lot of C code is written in a state machine style; even if it doesn't need to be upgradable, it's worth it for the robustness and concurrency advantages.
26492466
2650−- A new update to the Arvo interface that we’re calling Modulo. Modulo expands beyond chat and longform discussion to make your Arvo interface feel much more like the computer it actually is.
2651−- Upgrades to our event persistence, networking, and DNS integration aimed at much better stability. Arvo instances don’t crash that often, but with these changes it should be very rare.
2652−- Significant improvements to testing with a new simulation testing framework and integration testing pipelines.
2467+However, Arvo is a single-level store — all of its state is permanent. This is very convenient and eliminates many long-tail bugs, but it also means we need to code for permanence, and that's much easier when you structure your code with explicit state.
26532468
2654−### Q3 2019
2469+Further, Arvo and the vanes rarely perform long sequences of IO. Generally, they do one thing and emit some effects, similar to the HTTP server example above. Sometimes they "pass through" a request. For example, the Eyre vane passes HTTP requests to userspace agents or threads. In this case, there is a sequence of IO, which in monadic code would be:
26552470
2656−- A significant overhaul to Gall, our application model, making it much simpler for users to write apps or ‘agents’ in Arvo.
2657−- A new version of the compiler that makes us less reliant on jets. This will eliminate a major obstacle to achieving network continuity, or the ability for ships to upgrade themselves totally over-the-air, forever.
2658−- A significant overhaul and stability update to Clay, our filesystem, making it possible for us to trust it for self-hosting, search it easily, and depend on it for long-term data storage.
2659−- Tooling for hosting and hopefully a beta program for hosted Arvo instances run by Tlon.
2471+ loop()
26602472
2661−### 2020
2473+ where:
26622474
2663−- A completely overhauled Arvo interface, Daigo, with a complete but simple set of messaging and collaboration tools. Modulo is meant to be fun to experiment with, but we aim to make Daigo part of our daily workflow.
2664−- We come to work every day, use Arvo, go home.
2475+ loop =
2476+ request <- receiveRequest()
2477+ agent = lookupAgent(request)
2478+ response <- callAgent(agent, request)
2479+ _ <- sendResponse(request, response)
2480+ loop()
26652481
2666−## Community
2482+This is clear code to read, but it leaves open the question of how to respond during the callAgent() function. If another request comes in, can we handle it in parallel? If we need to upgrade ourselves before the agent responds, can we make sure to properly handle the response?
26672483
2668−We’ve often felt like it was far too early to invite others in to the system.
2484+The naive solution in monadic code is to say that you can only handle one request at a time, and if an upgrade happens you just drop outstanding requests. You can resolve both of these by introducing a sort of main loop, which is just a way of saying "turn it into a state machine".
26692485
2670−As long as we’re up front about the state of this 100 year computer -- that it’s live, but incomplete — I think it’s a good thing to welcome people on board. There’s plenty to play with, experiment with and explore.
2486+In a state machine, the naive solution is:
26712487
2672−Hoon school was the first effort in this direction. We intend to do a lot more:
2488+ state :: (map request agent)
2489+ main(state, event) {
2490+ switch event {
2491+ HTTPRequest request ->
2492+ agent = lookupAgent(request)
2493+ [put(state, request, agent), CallAgent agent request]
2494+ AgentResponse request response ->
2495+ [del(state, request), HTTPRespond request response]
2496+ }
2497+ }
26732498
2674−### Q2 2019
2499+Upgrading this is trivial, since the state (map of requests to outstanding calls to agents) is explicit. It also trivially handles concurrent requests.
26752500
2676−- Scaling Hoon school up to include both a track for experts and for beginners, and allowing many more participants.
2677−- Holding more meetings and events on Landscape, experimenting with Arvo-native discussion.
2678−- A clear program for address space grants for developers + contributors.
2679−- New documentation site with searchable library docs.
2501+I won't claim this is easier or harder to write than the monadic version, but it has the properties we need at this level of the system.
26802502
2681−### Q3 2019
2503+Userspace agents similarly are permanent entities that need to not lose data or get stuck. For this reason they’re structured as state machines.
26822504
2683−- Hoon School participants understand clearly how to build a Modulo agent, and invite others into it.
2684−- The road toward building an Azimuth module is well understood, paved, and clear.
2685−- We have clear instructions and tutorials for building Azimuth modules and using Azimuth as a login or reputation primitive.
2686−]]></content:encoded>
2687− </item>
2688− <item>
2689− <link>https://urbit.org/blog/2021-11-18-the-promise-and-paradox-of-decentralization</link>
2690− <guid>https://urbit.org/blog/2021-11-18-the-promise-and-paradox-of-decentralization</guid>
2691− <pubDate>Invalid Date</pubDate>
2692− </item>
2693− <item>
2694− <title><![CDATA[A brief update from urbit.org]]></title>
2695− <link>https://urbit.org/updates/2021-05-05-update</link>
2696− <guid>https://urbit.org/updates/2021-05-05-update</guid>
2697− <pubDate>Tue, 04 May 2021 00:00:00 GMT</pubDate>
2698− <content:encoded><![CDATA[
2699−Hello!
2505+A helpful comparison is that explicit state machines are basically Mealy machines, the kind you might have learned about in an introductory digital design class. This shouldn't be surprising; a digital circuit must always be consistent because it can't be manually "rebooted", and their input and output is highly formalized. By contrast, a Rube Goldberg machine doesn't have the same constraints; which is why they're a lot more fun!
27002506
2701−Welcome to the May edition of the urbit.org newsletter. April was a busy month with many updates to share—let’s dig in.
2507+It's notable also that explicit state machines are considerably more declarative than imperative or monadic IO. Not everyone thinks that's a good thing, but anyone who defends functional programming should see some advantages to that.
27022508
2703−0 – Updated Urbit Binaries
2509+However, userspace sometimes needs to perform long sequences of IO. Let's look at an example where we want to fetch the front page of a site and the first couple comments on each story. HTTP is unreliable, so on failure we retry five times.
27042510
2705−Urbit’s binaries were updated to v1.5 on April 27th. Make sure to download and install the latest v1.5 binaries here: https://github.com/urbit/urbit/releases/tag/urbit-v1.5
2511+Monadic:
27062512
2707−It’s as easy as shutting down your ship and replacing the old binaries! ~pilfer-pandex described the new release to urbit-dev as “a high priority fix for two networking bugs in urbit-king, and minor fixes to vere.”
2513+ topStories <- fetch(topStoriesUrl)
2514+ loop(topStories)
27082515
2709−1 – Upcoming Events
2516+ where:
27102517
2711−Urbit Town Hall @ May 20th 12pm PDT – Keynote from Justin Murphy
2712−This will be Urbit’s first ever town hall—a three hour event with talks on a variety of topics and a keynote from Justin Murphy (~hatryx-lastud). Justin had Urbit Foundation Director Josh Lehman on his Other Life podcast a few weeks ago (have a listen at https://share.transistor.fm/s/1c0c8c15) and recently formed a new group on Urbit (~hatryx-lastud/other-life).
2518+ loop :: topStories -> IO Null
2519+ if topStories is Null
2520+ return Null
2521+ comments <- retryLoop(5,head(topStories))
2522+ otherComments <- loop(tail(topStories))
2523+ append(comments,otherComments)
27132524
2714−In his group, Justin has written a blog post called “Escape Velocity”, where he discusses selection effects on various platforms. Justin writes, “by creating a gravity well that sucks energy into real-estate value rather than monetized attention, Urbit exerts the lowest degree of arbitrary selection pressures on content creation, while optimizing those selection pressures that irreducibly characterize all human communication (e.g., the draw of being understood and appreciated by other people).” Tune in to Justin’s keynote on the 20th for more on Urbit as a platform for creatives.
2525+ retryLoop :: [n story] -> IO Comments
2526+ comments <- fetchComments(story)
2527+ if comments is HTTPError:
2528+ if n == 0:
2529+ bail
2530+ else:
2531+ retryLoop(n-1, story)
27152532
2716−Developer Calls @ May 13th and May 27th
2717−As you probably know, we have developer calls every two weeks. Stay tuned for more information on our events page: https://urbit.org/events
2533+State machine:
27182534
2719−Austin Urbit Conference @ September/October 2021
2720−Although it’s too early to give a precise date, we are starting to plan an Urbit conference for this fall! It’ll be held in Austin, with many Urbit and Tlon employees in attendance. Stay tuned for more information!
2535+ state :: Initial
2536+ | FetchingTop
2537+ | FetchingStory comments stories retries
2538+ | Done comments
27212539
2722−2 – April Developer Calls
2540+ main(state, event) {
2541+ switch event {
2542+ Initialize ->
2543+ assert state == Initial
2544+ [FetchingTop, Fetch topStoriesUrl]
2545+ HttpResponse response ->
2546+ switch state {
2547+ FetchingTop ->
2548+ [FetchingStory Null stories 5, FetchComments head(stories)]
2549+ FetchingStory comments stories retries ->
2550+ if response is HTTPError:
2551+ if retries == 0:
2552+ [Initial, Null]
2553+ else:
2554+ [FetchingStory comments stories retries-1,
2555+ FetchComments head(stories)]
2556+ else:
2557+ comments = append(response,comments)
2558+ if tail(stories) is Null:
2559+ [Done comments, Null]
2560+ else:
2561+ [FetchingStory append(comments,response) tail(stories) 5,
2562+ FetchComments head(tail(stories))]
2563+ }
2564+ }
2565+ }
27232566
2724−Developer Call: 3rd Party Software Distribution
2725−In this talk, Phil (~wicdev-wisryt) and Raghu (~sovmep-ripsum) discussed the work they've been doing to clay to provide "virtual desks", an integral part of the infrastructure needed for safe, generic software distribution. This work is being done through our Scholarships program, in which community developers pair up with Tlon engineers to work on infrastructure projects. For more information about Scholarships, visit https://urbit.org/docs/development/grants/#scholarships
2567+With practice, the state machine version of this can be written correctly. However, (1) it's verbose, (2) the control flow jumps all over the place, and (3) in practice it's challenging to get exactly right. This is still a small example, and it gets much worse as the length and complexity of the IO sequence grows.
27262568
2727−Developer Call: Real-Time Communication on Urbit
2728−Edward Amsden (~ritpub-sipsyl) gave us a look at the WebRTC Airlock library he has developed that handles the hard parts of WebRTC. When complete, this will allow developers to build applications on Urbit with audio/video calling capabilities. Once again, Edward’s work is sponsored as part of the grants program (https://grants.urbit.org)—check it out!
2569+The monadic version, on the other hand, flows cleanly down the page. We can factor out generic functionality like "retry this request n times" to make the essence of the computation clear.
27292570
2730−3 – Urbit Bitcoin Launch
2571+Suppose you have to upgrade this. In the state machine, you can see exactly which stage of the computation you're in and write specific code to upgrade cleanly.
27312572
2732−This was a hotly anticipated event and it didn’t disappoint. In case you missed it, Urbit will soon have a Bitcoin wallet on the network, meaning you’ll be able to pay Urbit ships directly in BTC. Watch Urbit-Tlon personnel demonstrate and discuss this exciting launch: https://www.youtube.com/watch?v=_aRnfacZPto
2573+Threads, as we've discussed, can't be upgraded in-place. Let's be real though: we're downloading comment sections, not regulating a nuclear reactor. If we get a better version of this script, just kill the old one and start the new one from scratch. What's a couple extra HTTP requests?
27332574
2734−Make sure to check out this related blog post by Christian Langalis (~pindet-timmut): https://urbit.org/blog/interplanetary-commerce/ and this great interview with ~timluc-miptev, one of the main developers on the project: https://subject.network/posts/bitcoin-with-timluc-miptev
2575+This suggests a general division of workloads: code which needs to be permanent, upgradable, and concurrent should generally be a state machine. Code with long or complex sequences of IO and definite termination should generally be a thread.
27352576
2736−4 – Blog
2577+These aren't completely mutually exclusive, but it's surprising how often they are.
27372578
2738−We have a couple of new posts to announce:
2739−“Lunar Urbit and the Internet of Things”
2740−This post is by Poprox (~datnut-pollen), a Tlon engineer who focuses on the importance of moons in the Urbit ecosystem. The post covers “the prehistory of moons on Earth, gives a snapshot of how moons are being utilized on Urbit in 2021, covers existing issues with consumer IoT and how Urbit resolves them, and speculates what the lunar locus of the Urbit ID address space may become in the future”. Read it here: https://urbit.org/blog/iot/
2579+### Jael: a case study
27412580
2742−“Community Spotlight: The Portico”
2743−This post is an interview between me (~tirwyd-sarmes) and Josh Reagan (~taglux-nidsep), the founder of “The Portico”, an Orthodox Christian community. Josh has a PhD in logic, and writes about the intersection of Christianity and logic on his Urbit blog. In the interview we talk about community norms, the relationship between logic and religion, and the future of Urbit. Check out the interview: https://urbit.org/blog/community-spotlight-the-portico
2581+When you need to do something permanent and upgradable, but you also need to do long sequences of IO, the main trick is to factor your problem into both an agent and a thread (or several).
27442582
2745−5 – Odds and Ends
2583+As a case study, consider Jael, one of our vanes. This maintains our PKI state, which it downloads over HTTP from an Ethereum node. Downloading from an Ethereum node is a complex sequence that starts with fetching its most recent block number, then fetching all the blocks we haven't seen and scanning for transactions we care about. We also maintain a map of block hashes to block number, and if we see that a block's parent doesn't have the hash we expect, that means a reorganization has occurred, so we must "rewind" one block at a time until we find where the fork happened, then restart going forward.
27462584
2747−If you are a star or galaxy owner and are interested in sponsoring other ships, please message ~rapfyr-diglyt (david@tlon.io) to be added to the sponsors@urbit.org mailing list.
2585+You don't have to understand this sequence of IO; it's sufficient to see that it's complex and must be exactly right. We used to do this in a state machine directly in Jael. This data is, of course, permanent and needs to be accessible to the rest of the system, so Jael must be a state machine.
27482586
2749−~hodzod-walrus made a page with statistics on various stars: https://bacrys.org/uptime/
2587+However, we had many small mistakes in this sequence of IO, some of which only appeared during unusual events, such as when an HTTP request failed at the same time as a reorganization happened.
27502588
2751−~sitful-hatred beat us to the punch and released a guide on compiling Windows binaries—urbit.exe is near at hand! See the guide here: https://subject.network/posts/urbit-windows-binaries/ The official Urbit.org announcement should be around the corner, so keep your eyes peeled.
2589+We're in a bit of a bind, though: Jael has to be a state machine. The solution is to factor out the act of getting updates into a thread while the main PKI state is stored in the state machine in Jael.
27522590
2753−Thanks for reading. Talk to you next month!
2591+This thread has a definite purpose: given the most recent block number we already know about, fetch all the PKI transactions since then. The function signature is:
27542592
2755−Josh (~wolref-podlex) and ~tirwyd-sarmes
2593+ syncEthereum oldBlockNumber -> IO [newBlockNumber, newTxs]
27562594
2757−https://twitter.com/urbit
2758−https://github.com/urbit/urbit
2759−]]></content:encoded>
2760− </item>
2761− <item>
2762− <title><![CDATA[Community Spotlight: The Portico]]></title>
2763− <link>https://urbit.org/blog/community-spotlight-the-portico</link>
2764− <guid>https://urbit.org/blog/community-spotlight-the-portico</guid>
2765− <pubDate>Mon, 03 May 2021 00:00:00 GMT</pubDate>
2766− <content:encoded><
2595+Jael runs this thread every five minutes and, if it succeeds, then we update our block number and PKI state. If the thread fails, gets stuck, or we need to upgrade it, we just kill the old thread and start a new one. Again, a few extra HTTP requests don’t matter.
27682596
2769−_One of the most striking things about Urbit is the ideological diversity between communities. The Community Spotlight blog series will focus on various Urbit communities via interviews with founding members._
2597+From Jael's perspective, it looks something like:
27702598
2771−For the first week of the Community Spotlight series, I (~tirwyd-sarmes) will be speaking with Josh Reagan (~taglux-nidsep). Josh is the founder of The Portico, an Urbit community of Eastern Orthodox Christians.
2599+ state :: State block txs outstandingThread
2600+ main(state,event) {
2601+ switch event {
2602+ Initialize -> [State 0 Null Null, StartTimer (now + five minutes)]
2603+ TimerFired ->
2604+ effects = If outstandingThread is Null
2605+ then Null
2606+ else [Kill outstandingThread]
2607+ newId = newThreadId()
2608+ [State txs newId,
2609+ append(effects,
2610+ StartThread newId syncEthereum(block),
2611+ StartTimer (now + five minutes))]
2612+ ThreadFinished Failure -> [State block txs Null, Null]
2613+ ThreadFinished Success newBlockNumber newTxs ->
2614+ [State newBlockNumber append(txs,newTxs) Null, Null]
2615+ }
2616+ }
27722617
2773−The Portico is a very active group with conversations taking place over multiple channels. There are channels for posting Orthodox iconography, discussing the broader Christian culture war, and just talking about Orthodoxy in general. Of particular interest is Josh’s “Euthyphro” blog series which investigates the relationship between logic and the Orthodox faith. This is a topic that Josh is well qualified to talk about: he has a PhD in Philosophy from Rice University. His dissertation on the epistemology of logic and truth-preservation was titled "Knowing Your Limits: Logic for Limited Beings”. Josh is also the co-author of a forthcoming textbook on formal logic.
2618+In other words, from Jael's perspective, it's just a single IO event that encapsulates arbitrarily complex IO in the thread. A single IO event is easy enough, and we can maintain all our permanency and robustness guarantees, because we know the thread will have one of three results: success, failure, or it hangs. If we set a timeout, hang becomes failure, so there's only two possible results: success or failure. If we handle both of those correctly, we've handled all the possible IO errors that could have occurred.
27742619
2775−To read Josh’s blog is to be inducted into two esoteric traditions: theory of logic and Orthodox theology. With titles like “St. Gregory the Theologian and the Liar Paradox” and “The Existence of Abstract Objects”, Josh does not pull punches.
2620+What about upgrading? We've already said we can handle the thread dying for arbitrary reasons, so if an upgrade comes in, we just kill it. We can upgrade Jael's state machine easily since its state is very simple.
27762621
2777−Accordingly, our conversation focused on the idiosyncratic and niche community that The Portico is home to. There, you won’t find cussing or much talk about “life partners”, but you will find cutting critiques of liberalism and the best way to raise Orthodox children.
2622+## Recap
27782623
2779−As other users have pointed out, Urbit is pre-[Eternal September](https://en.wikipedia.org/wiki/Eternal_September). In fact, there’s some hope that the very nature of Urbit, how it tries to protect the sovereignty of niche communities via decentralization, might foil the Eternal September phenomenon. If Josh’s community persists, it will be a testament to both Josh and the decentralized Urbit network. As of now The Portico is a refreshing, perhaps jarring (as Josh might say), reminder of what the internet looked like back in the early days—a place for those who are different.
2624+Let's recap what we've covered:
27802625
2781−I encourage you to take a look. Find The Portico at ~topnup-firber/the-portico.
2626+- There are three styles of IO: imperative, monadic, and explicit state machines.
2627+- Urbit supports explicit state machines (agents) and monadic IO (threads).
2628+- Explicit state machines are preferred for permanent, robust, concurrent code.
2629+- Monadic IO is preferred for short-lived code with complex IO.
2630+- If a state machine needs to perform complex IO, it should encapsulate it in a thread so that, from the perspective of the state machine, it's simple IO.
27822631
2783−\-\-\-\-
2632+Hopefully it's fairly clear why Urbit uses explicit state machines in most situations. More than anything else, our goal is to build software that can last forever. Explicit state machines are a crucial tool for that.
2633+]]></content:encoded>
2634+ </item>
2635+ <item>
2636+ <title><![CDATA[Metaphase]]></title>
2637+ <link>https://urbit.org/blog/metaphase</link>
2638+ <guid>https://urbit.org/blog/metaphase</guid>
2639+ <pubDate>Tue, 08 Dec 2020 00:00:00 GMT</pubDate>
2640+ <content:encoded><
27862644
2787−It’s tough to say with certainty—I’ve never read _The Benedict Option_.
2645+<br>
27882646
2789−A few years ago, while he was writing the book, I was a regular reader of Dreher’s blog. From his descriptions there, I was never clear about what exactly he was proposing. Much of his “clarification” came by way of metaphor: don’t “run for the hills”, but stop “shoring up the American imperium”. I didn’t read his book because I didn’t have much confidence that he would be especially precise or insightful.
2647+_Previous versions of this essay specified the stream deploy date as December 11, 2020; then December 18, 2020. This has been amended to the actual date of release, with our sincere apologies. For new readers, you can opt into the dev stream by running:_
27902648
2791−[There is an interesting review I’d recommend](https://handleshaus.wordpress.com/2020/10/06/review-of-rod-drehers-live-not-by-lies/), however, of his later book, _Live Not By Lies_. I believe it accurately characterizes the scale of the threat Christians will soon face in this country.
2649+```
2650+|ota ~hanruc-nalfus-nidsut-tomdun %kids
2651+|merge %home ~hanruc-nalfus-nidsut-tomdun %kids, =gem %take-that
2652+|merge %kids ~hanruc-nalfus-nidsut-tomdun %kids, =gem %take-that
2653+```
27922654
2793−My upbringing was conservative Christian and self-consciously counter-cultural. I've inherited that understanding of what it means to be a Christian in an increasingly secular world. It comes naturally to me, so I find it obvious that Christians should form self-sustaining communities. But the details matter. What do such communities look like? How do we secure the freedom to pursue such communities? How do we sustain them, when myriad external forces seek to undermine them? How do we solve the long-term problem of the declining cultural importance of Christianity (which surely erodes the plausibility of our religion to many, even to some of those with sympathies toward it)?
2655+_We will surface this option more broadly in a future settings overhaul._
27942656
2795−I don’t claim to know the answers to these questions.
2657+A few weeks ago, the Landscape team — those of us building Tlon’s suite of userspace applications on top of Urbit— deployed our first over-the-air update for notifications. This is a big leap forward for us. Of course, getting notifications inside Landscape itself is a big deal, but getting a push notification on your phone, or an email digest based on activity inside Urbit is now just one step away, a weekend project for a hobby developer, not an indeterminate number of steps away.
27962658
2797−One kind of answer is that we should redouble our efforts to support and maintain a religiously and morally neutral liberal political order, which leaves room for subcultures to live and self-regulate as they wish. I disagree. Those who support a kind of “neutral” liberalism view it as an attempt to go “meta” and rise above various parochial metaphysical, moral, and religious disputes. I view this as a cop-out, a refusal to grapple with the most important questions.
2659+After release, we received some feedback from users on the behaviour and design of this feature; beyond the obvious kinks that come from an initial release, it seemed to some like a minimum viable affordance pitched as a fully designed feature. This “bottom-up” development approach was, to us, fairly straightforward; to some of our users, it seemed that we had closed the door on the feature without even beginning to expose all its possibilities.
27982660
2799−Does the liberal have metaphysically-rooted moral reasons for going “meta”? If so, then he’s just another sectarian and he should be honest about it. The only difference is that his team has had the whip hand for the last several generations. On the other hand, if the liberal claims no underlying metaphysical justification then his project can succeed only to the extent that he can arrange and adjudicate unprincipled (and therefore ad hoc) agreements between otherwise hostile moral communities. But how stable can such an arrangement really be?
2661+As I’ll describe, we haven’t just been iterating Landscape, but the way we develop Landscape, and the way we consider Landscape in relation to Arvo. Finally, we’ll discuss our upcoming two-stream release process: a “stable” release stream with updates every six weeks and a development stream, with ongoing changes continuously deployed on an opt-in basis.
28002662
2801−Orthodox Christians have theologically rich, metaphysical foundations for their social and moral teachings. With these we can form healthy, thriving, and growing communities. We can do so even under actively hostile political orders. If the early Church could make it under the Romans, so can we today. But it’s going to be difficult and sound judgment is necessary. Unfortunately, we lack strong leadership and that leaves us vulnerable. If we stay uncoordinated we dissipate our energies needlessly. If we latch onto the wrong leaders we can be led astray.
2663+To someone coming to Landscape for the first time, it is starting to look mature; and it is indeed maturing quickly. After all, these mismatches in expectations are pangs calling out for growth. Landscape truly has _users_, not just explorers, who are developing the same expectations they have with the other tools they use: predictability, reliability, and iterative improvements, not just leaps forward. So to meet those expectations, we’ve been working on the prerequisite work for a mature release schedule, with two different release streams for users and explorers: a lifecycle, with the cells, interlinked, dividing into a coherent higher being.
28022664
2803−The challenges are immense. There is no technological solution. Even so, I’m an Urbit early-adopter for a reason. Over the years I’ve come into contact with a number of Orthodox and Ortho-curious Urbit followers. Why not try to bring them together in an Urbit group?
2665+## Landscapers and lifecycles
28042666
2805−As far as I know, no one in the group is clergy. We’re all just a bunch of laymen with no authority to do much of anything. But I’d like to think we can still contribute in some way. I have an academic background in analytic philosophy so my inclination is to emphasize theory, but we have room for a bit of everything. Someone in the group wrote a script to take the texts of various Church Fathers and convert them to audio using AWS Polly. Those turned out pretty well!
2667+For most of 2020, the core Landscape team has comprised of Liam (`~hastuc-dibtux`), Logan (`~tacryt-socryp`), and myself (`~haddef-sigwen`). Others at Tlon have rotated on and off, and some community members (`~radbur-sivmus` comes to mind) have also contributed a lot, but the three of us handle the core decisions and the entire stack for Landscape, working with designers, infrastructure, and third-party developers.
28062668
2807−At times I entertain ambitions to do a bit more, but for now perhaps it’s better to keep expectations in check. If nothing else, we can read and discuss the Scriptures and Church Fathers together, and try to understand better how to apply and live out their teachings. As we continue to grow the community and develop a consistent internal dynamic perhaps opportunities will arise that aren’t yet on the horizon. One thing I can say is that I’m committed to keeping the group active and growing.
2669+After OS1’s release in April 2020, Landscape’s back-end has changed quite a bit; the first rearchitecture we performed was in group-store, adding roles and simplifying quite a lot of the back-end logic at the same time.
28082670
2809−**I’d like to talk about your blog on The Portico. It combines two of your main interests: logic and theology. In broad strokes, do you think theology and logic are compatible? What is the relevance of this intersection to both of these disciplines?**
2671+Around May of this year, Logan flagged that our code surface was too large and had too much boilerplate by writing a set of bespoke full-stack applications when just one flexible userspace database would do. Our designers also had a vision of our interfaces being “modes and genres of the same data” that fit this vision as well; and so since then, we’ve put our resources into migrating all of Landscape to use graph-store (more information available in [this developer call](https://www.youtube.com/watch?v=E4DFuAZQ32Y)).
28102672
2811−I feel obligated to answer this question in two ways.
2673+Obviously, developing userspace for distributed computing has some additional challenges that you don’t have to consider when writing software for a single server. Each ship interacting has to mutually coordinate the agents running and the events to be processed. If those fall out of synchronisation, the edge cases multiply.
28122674
2813−(1) If by “logic” you mean “first-order predicate calculus”, then I think there’s no special conflict between logic and theology. There are certain puzzles about their relationship, but similar puzzles exist between logic and other disciplines. Theology isn't especially endangered.
2675+We traditionally tended toward solving those problems by writing the simplest possible incarnation of an application or a solution first, triaging out additional complications until they can be most prudently addressed — usually when they are just one step away.
28142676
2815−For example, in the 1930s, Alfred Tarski proved his famous Undefinability Theorem. Crudely put, it says that a plausible truth predicate cannot consistently be contained in any formal system with axioms strong enough to model arithmetic. Superficially it seems like our options are (a) get rid of the concept of truth, (b) get rid of arithmetic, or (c) throw away parts of logic until all inconsistency disappears.
2677+For most of its history, Landscape’s userspace suite had to be up-to-date on all ships to function at all, so multiple staging streams added quite a few complications. Since incompatible versions of applications on different ships would produce mutual fail states if they attempted to interact –and since each application had no sense of how to negotiate compatibility with older applications, each user had to keep up-to-date. Landscape was moving too fast, constantly reconfiguring (to give you a sense of this: we still refer to a month ago as “old”).
28162678
2817−None of these options is appealing. Tarski came up with a solution that mostly satisfies many logicians: reduce the concept of truth to “truth in a language” and forbid any language from containing its own truth predicate. If you want to talk about truth in a language L-1, you have to do it from a “metalanguage”, L-2.
2679+Historically, Arvo and Landscape were also considered just one object; changes in Landscape would often require refining the layers underneath it as well. We often aimed to use our interface’s requirements to refine Arvo in turn. But as Landscape’s cells continued to split, as it became a proper client _for_ Arvo rather than a subsection _of_ Arvo, it required its own planning and execution cycle that only came to fruition around April of this year.
28182680
2819−Is Tarski’s definition of truth in a language the definitive solution for preserving truth, math, and logic? Perhaps not many philosophers think so, and there’s a massive literature in which logicians have attempted to improve on or extend his results.
2681+The first thing we did was start recurring, six-week product backlogs with designers and engineers to occasionally reassess short-term priorities with a larger roadmap. Once we did that, we began working on opening our process to the public, migrating all tasks, priorities, and current decisions to a [product board](https://github.com/urbit/landscape). By doing this, community members could both suggest features _and_ contribute features, with a centralised, transparent process for getting designer input and Tlon engineer priorities. This has also been a successful effort.
28202682
2821−Sometimes people seem to think formal logic is an infallible gift from heaven that must always be right. Kant said in the _Critique of Pure Reason_ that formal logic is essentially a completed field. In fact, [the logic of his day](https://en.wikipedia.org/wiki/Port-Royal_Logic) was an early-modern Cartesian variation of a medieval scholastic synthesis of ancient Stoic and Aristotelian logics. Roughly 100 years after Kant’s first critique was published, C. S. Peirce and Gottlob Frege independently discovered first-order mathematical logic as we know it today, inaugurating the greatest advance of logic since Aristotle. Kant was wrong.
2683+By adjusting ourselves to a six week rhythm for execution, it’s clearly time to slow down our release schedule and dedicate design and QA time to each release.
28222684
2823−Mathematical logic is a convenient, generally reliable, man-made tool that, when used carelessly in certain untamed domains, can lead one astray. Probably most people reading this are familiar with such puzzles as the Liar paradox. When one understands that logic is not a completed science, and perhaps never will be, there is less reason to worry about whether it can be used to nuke entire disciplines, like theology.
2685+Since Arvo is still quite young, we can’t quite get to all the thornier aspects of instituting a lifecycle. For example, we can’t tackle agent version negotiation in full yet; and mark versioning is still not present. This means modifying the validators for our graph modules (that is, validating the graph structure of a notebook vs. a collection) presents a deployment challenge in a two-stream lifecycle.
28242686
2825−For more on this topic, see the blog post in my Urbit group: “St. Gregory the Theologian and the Liar Paradox”.
2687+That said, our userspace infrastructure is maturing, so we could at least organise the APIs to those agents; and we could at least slow the development cycle on those agents in favour of the more flexible components of the stack. The front-end specific features, for example, can be deployed on different ships without side effects for other users.
28262688
2827−(2) There is perhaps a deeper challenge than the one I’ve just sketched. The Stoics used the term “logic” to encompass what we might today call “epistemology”. If the word “logic” is meant in some such broad and normative sense, then we may restate the challenge as one about rationality and theology. Is it irrational to pursue theology in our modern age?
2689+So now, before we could launch a stable stream, we had some things to do first:
28282690
2829−As an undergraduate under the influence of Kierkegaard, I was attracted to a romantic, vaguely irrationalist notion of faith. Dawkins-mania was at its peak and I was disgusted by the pop-rationality (or was it empiricism?) of his annoying followers. Their view seemed to be that rationality just means “following the evidence”. The raw evidence is foundational, and theories are built atop by generalizing from the evidence. The ghost of logical positivism is with us even now.
2691+- **We wanted to provide assurance that the userspace suite is relatively stable.** All our remaining stores (invite-store, metadata-store, and contact-store) needed to be modernised to use the same libraries and utilities inside Arvo as newer userspace applications.
2692+- **We wanted all our applications to be using graph-store.** If we were going to migrate the entire network to a new userspace model, we shouldn’t undermine the new release cycle process and make it more difficult to test and deploy to meet higher user expectations. We needed to migrate everything first.
2693+- **We wanted to release the notification-store**. After the October 2020 groups release, Landscape simply wouldn’t be complete without it.
2694+- Finally, **we wanted all of Landscape to use the [Indigo component library](https://github.com/urbit/indigo-react).** Landscape shipped with each application using its own build with handwritten, bespoke DOM components. Once we moved to a single-page application architecture in June 2020, we wanted the same guaranteed consistency for both back-end and front-end code.
28302695
2831−I was dimly aware that Quine and others had made it difficult to sustain epistemic foundationalism. However, being unable to supply a more clear and cogent notion of rationality, I became skeptical of the idea altogether. But I went too far.
2696+Most of these are now accomplished; the remaining tasks are awaiting some final tests and UX work. We’re aiming for a stable stream of Landscape to deploy by **January 5, 2021**.
28322697
2833−Instead, the proper response is to develop a superior account of rationality. Readers can probably guess where I went looking!
2698+What does this mean? For everyday users, you can expect Landscape releases every six weeks; the slate of features and any breaking changes will be flagged well in advance for third-party developers; and you can expect a more thoroughly considered user experience with notes and copy for each new release.
28342699
2835−The word “logic” comes from the Greek “λόγος”. This is also the word used to describe Jesus Christ in the Gospel of John: “In the beginning was the Logos, and the Logos was with God, and the Logos was God.” This connection is not merely etymological.
2700+And for intrepid users, you can opt-in to a development stream and help us find and eliminate bugs before release to the wider public. This development stream is much like how we've been deploying Landscape up until now — but now it's optional.
28362701
2837−For many ancients, the term “λόγος” meant something like “divine principle”. You might think of it as akin to a law of nature, but with stronger theological connotations. Christians appropriated this term and made it rather more exalted: the Logos is begotten of the Father, and yet somehow one with Him.
2702+## Mitosis
28382703
2839−We are told that all things come into being through the Logos (John 1:3), giving Him an intimate relationship to the whole of creation. He gives structure and order to all created things, and in His divinity He understands them as so structured and ordered. He is also sinless, perfectly holy, and good. In Christ we have a perfect unity of the knowledge of all truth and righteousness.
2704+Describing our progress so candidly can feel strange — after all, it sounds so _early_. But to me, it’s exciting. It’s mitosis.
28402705
2841−Man was created in the image of God, which means that we bear a likeness to Christ. And we are commanded to realize that likeness with ever greater fidelity (Romans 8:29). The Church calls the pursuit of this likeness [“theosis”](<https://en.wikipedia.org/wiki/Theosis_(Eastern_Christian_theology)>).
2706+Take another example. For all of Urbit’s history — all until now — Tlon was playing the role of both parents to the project when it was really just an embryonic corporate vehicle itself, fated to become twins. But in the past few months the burgeoning Urbit Foundation’s interim Director, Josh Lehman (`~wolref-podlex`), has begun to ramp up responsibility, taking increasing stewardship over urbit.org and giving it a physical voice, an Otherness, apart from Tlon’s own goals.
28422707
2843−Thus we have the explanation of all normativity, according to Orthodox Christianity. In moral matters we must take on the holiness of Christ. In epistemic matters we aspire to the wisdom and knowledge of Christ, which includes an understanding of the whole created order. Socially we (the community of believers, i.e. the Church) are called to be in ever greater communion with God, cooperating with His work just as the Son cooperates with the Father.
2708+Now, each day, we stray a little closer to these entities splitting apart, a step closer to the Urbit Foundation and the Tlon Corporation being completely different entities with completely different concerns.
28442709
2845−Sadly we are conceived in sin and ignorant; hence the need for redemption by Christ.
2710+The same has occurred with Landscape. Previously Landscape was “_the_ interface to Urbit,” the proof that there was more to the project than a Unix executable. And slowly to those of us at Tlon, it became obvious what it was destined to become: a flagship client for an entire network, a tree branch rooting a world beneath clearnet, the first cell by which other clients might be born. Mitosis can be clumsy to watch; it can be nauseating to experience; it can be difficult to make out what will arrive where.
28462711
2847−Accordingly, my understanding of what it means to be rational is just to be Christ-like. The only perfect exemplar of reason, so construed, is Christ Himself. Any deviation from Him is irrational. What could be more logical than to be conformed to the Logos? But we cannot attain rationality without redemption. Hence we cannot become rational without first being saved from sin.
2712+But this is, after all, how a body forms.
2713+]]></content:encoded>
2714+ </item>
2715+ <item>
2716+ <title><![CDATA[Security and Continuity]]></title>
2717+ <link>https://urbit.org/blog/security-and-continuity</link>
2718+ <guid>https://urbit.org/blog/security-and-continuity</guid>
2719+ <pubDate>Mon, 30 Nov 2020 00:00:00 GMT</pubDate>
2720+ <content:encoded><
28482722
2849−Doubtlessly many will find all of this too much to take, just too implausible. What about the development of mathematics, or the advances of the sciences? These are canonically ennobling, intellectual achievements. Jesus wasn’t a mathematician or a scientist! Nowhere in the Scriptures is He recorded as having applied Bayes’ theorem.
2723+## Security and Continuity
28502724
2851−Undoubtedly my construal of rationality de-emphasizes the pursuit of knowledge by labeling it as merely one of several normative ends. To seek knowledge without seeking holiness is to be understood as dangerously unbalanced. To try to attain holiness and knowledge without communion with God is arrogant.
2725+In 2018, when we launched the Urbit ID contracts (also called ‘Azimuth’), we committed to yearly infrastructure goals for 2019 and 2020. This wasn’t an informal commitment — it’s part of the contracts that were published to the blockchain, which you can read [here](https://raw.githubusercontent.com/urbit/azimuth/edf68b8da04806dd5b95994daf14cf1e7e226829/proposals/0xcb1f81e42b5e75f000f94fc71a3ea70cab4bfc6f236b91e717f1b9516e5596b5.txt). At the end of each year, we ratify our accomplishment of these goals with a galaxy vote.
28522726
2853−On the other hand, we need not exaggerate matters. St. Paul affirms the need for specialization of labor within the Church (1 Cor. 12). There is room for some to specialize in intellectual endeavors, so long as they act in a cooperative setting in which the other virtues are pursued as well. (Nor should anyone neglect the development of such virtues in himself.) Mathematicians and physicists are more than welcome in the Church.
2727+Since the year is coming close to an end, and this year’s vote is on the horizon, it’s time for an update on our progress.
28542728
2855−According to this (all too briefly put) theory of rationality, there can be no conflict between ‘logic’ and theology. Theology is compatible with rationality because the account of rationality in question derives from a theological tradition. Naturally I’ve only given a sketch; much more could be said. But even if some readers are put off by the theory presented here, I hope it’s at least clear that there are conflicting notions of rationality. Anyone who wants to be rational confronts the task of figuring out which theory of rationality is correct.
2729+For this year, we committed to completing two things: passing a third-party security audit of our networking protocol (Ames) and getting Urbit OS (both Arvo and the interpreter) to the point where we can reasonably expect the Urbit network to continue without any hard forks (which we call ‘breaches’). A world with no network breaches is one where the network should be able to run indefinitely without any interruption. We also call this ‘continuity’.
28562730
2857−**In terms of community moderation, The Portico follows norms that are quite different than other online communities, often times quite drastically. For instance, living with women that you are not married to, is not something that should be talked about lightly. Can you talk about the importance of norms and how they relate to a healthy community?**
2731+We’ve been steadily making progress on these two fronts, and I’m happy to report both are nearly complete. We’ll walk through some of the details here and then follow up in another post soon to report on how the final work turned out.
28582732
2859−Orthodox Christians are not commanded to “get along” with the rest of the world (John 15:18-25). We’re different, and our norms of interaction should likewise differ from those of outsiders. There is no one, monolithic “Orthodox culture”, but there are standards governing which local expressions of culture are legitimate and which are sinful. We should live in a way that enables and promotes holiness and discourages sin.
2733+## Ames Audit
28602734
2861−We have rules that may seem unusual from the outside. I don’t permit profanity, lewd jokes, or irreverent comments about God. In your question you mention a living arrangement that is prevalent in the world. Another rule I have is that we shouldn’t talk causally about sinful practices or lifestyles as if they are unremarkable parts of ordinary life. If Orthodox Christianity is true then such things aren’t minor peccadilloes. They’re spiritually destructive. The marriage-bond sanctifies activities that would otherwise be sinful.
2735+Urbit OS is an ‘overlay OS’: it runs on top of (pretty much) any flavor of Unix. Each Urbit OS node communicates with other nodes over UDP using Ames, the Urbit-specific networking protocol.
28622736
2863−If someone wants to analyze what is destructive about men and women living together before marriage, we’re open to that. But if you want to be affirmed in your sin, we’re not the place for you. Anyone of any religious creed is welcome to show up—but as a guest in an Orthodox Christian community. Hosts should be courteous to guests, but my first priority is not to make you feel good about your choices. We’re here to encourage each other, learn, and grow spiritually as Orthodox Christians. Naturally that means a little gate-keeping may sometimes be necessary if someone ever comes along who doesn’t share those goals. Being different is difficult and takes work.
2737+There are two things worth worrying about when it comes to Urbit OS security: someone breaking into Urbit from the machine it’s running on, and someone compromising the network protocol itself. As to the first, there are probably ways that we can harden the OS sandbox, but if the machine it’s running on is secure we can feel reasonably safe. Since there’s lots of prior art on how to secure a Unix machine, we can leave hardening the runtime for later and simply encourage everyone to secure the boxes they run their Urbit nodes on.
28642738
2865−In a way the cultural contrast is meant to be jarring. It can force you to confront moral and cultural presuppositions that you didn’t even know you had. When you become aware of the wider choices of culture available to you, you become free to look with a critical eye on the culture you’ve hitherto taken for granted. I think anyone could see how that might be liberating, even before considering the particulars of the cultures in question. Of course, as an Orthodox Christian, I think we have a good case to make about the particulars of our subculture.
2739+Assuming each node on the network can run on a locked-down machine, it’s really important that the protocol for communicating between these nodes is secure. Also, since Ames uses other Urbit nodes for peer discovery, we want to make sure no ‘relay node’ can inspect data not meant for them.
28662740
2867−I’ve never had to kick or ban anyone from the group. The group is relatively small (~180 people at the moment) so that probably helps. The vast majority of conversations are relaxed and friendly. Occasionally there are intense debates about one issue or another but I enjoy it, as long as it doesn’t become bitter or the primary mode of discourse. But everything ought to be done in a spirit of truth-seeking, not of one-upmanship.
2741+The question “Is Ames secure?” is too vague for an auditor, of course. The audit was scoped to determine that the following three criteria are met:
28682742
2869−**The fact that The Portico can exist side-by-side with atheist communities on Urbit is pretty striking. On Urbit, a user is able to create niche communities and governance structures and yet still participate in a larger network. In other words, Urbit is trying to thread the needle between sameness and difference through federation at multiple levels. It seems to me that modern culture has become homogeneous due to an inability to maintain, or distinguish between, different communities. People who have nothing in common are forced to engage as if they were roommates, while those who are similar have trouble creating their own home. In other words, what is the role of community formation in the modern world and how does it connect to your critique of liberalism? Does Urbit have anything to say about this?**
2743+- No one can impersonate another ship on the network
2744+- No one (including relays) can intercept and decrypt messages not meant for them
2745+- Ames messages don’t leak keys that could endanger the sender’s data
28702746
2871−As I said in an earlier response, I see the liberal project as more or less an attempt to sidestep (not solve) difficult metaphysical and religious disputes between various distinct moral communities. Liberals have tried several methods of governance to achieve their ends. We can divide such attempts into two broad categories: centralized and decentralized.
2747+Our goal with this scope is to focus exclusively on the design and implementation of Ames itself. Basically, the crypto should be correct and there should be no flaws in either the protocol design or its implementation. Our interpreter can still be hardened against other potential attacks, which is work we’ll undertake in the future. We asked our auditors to flag all of these potential issues, so we know what needs to be addressed in the future.
28722748
2873−Social media companies in the US confront similar governance challenges, so we can analyze them in similar terms.
2749+The good thing about an audit scoped in this way is that we can trust the protocol to authenticate people and shuttle packets back and forth safely. We’ve always been reasonably confident about Ames, but having an external stamp of approval will be great.
28742750
2875−A social network like Facebook takes a centralized approach. Zuckerberg spoke early and often of his desire to connect people and “bring the world closer together”. There was a sense that if people from various communities could get to know each other a little better, we would see how much we have in common and make progress toward some kind of universal cosmopolitan consensus.
2751+As of the end of November 2020, the audit is very nearly complete, and we’ve handled all the important issues that were brought up. We’ll post the results and talk about our mitigation strategies in a future writeup.
28762752
2877−But that didn’t happen. With centralized social media you’re practically guaranteed to interact with people whose moral and metaphysical commitments are sharply at odds with your own. As a result, you face a persistent, nagging risk of conflict. Without warning, a friendly disagreement can explode into an all-out flame war. Most choose one of two basic approaches for dealing with this threat:
2753+## Continuity
28782754
2879−(1) You live a compartmentalized life. You keep your moral and metaphysical commitments to yourself and cultivate a culturally homogenized persona for your social media activities. No one disagrees with you because there’s nothing to disagree with.
2755+Urbit is designed to last a long time. What’s the use of a personal computer if it’s gonna disappear along with all the data you put in it? Ideally, you can put your Urbit on a USB stick, forget about it for ten years and have it work again when you plug it in. It’ll need to update for a while, but once our work on continuity is complete, your urbit should be able to upgrade itself through ten years of updates, all over the air.
28802756
2881−(2) You can enlist to fight in the culture war and display your regimental colors with pride. And because you take your smartphone everywhere you’re always on the front line.
2757+While Urbit is designed to upgrade seamlessly over the network we have occasionally run into issues that have caused us to reboot the entire network. Most of the time this is when some incompatibility between the interpreter and the kernel means we have to force everyone to do a hard reset to ensure compatibility between the two. Our current work on continuity addresses this. Soon, your urbit will tell you when your interpreter needs to be upgraded. At first this won’t be that different from an application notifying you to download an update. Eventually, we think we can make this a lot smoother.
28822758
2883−These aren’t the only options, of course. With some combination of charisma, patience, and grace you can be relatively open about your beliefs without getting into too much trouble. But even if you have the talent to pull it off, it takes time and energy. Many of us aren’t willing to go to all that trouble. Social media is supposed to serve us, not the other way around.
2759+A network reboot isn’t the only way that we can break continuity. Urbit is a general-purpose computer — which means you’re free to attempt to destroy it. If, for any reason, you do manage to screw the system up we want you to be able to get your data out and effectively reset continuity on a single node. We built the affordance for that a while ago, but before the end of the year we’ll also distribute tooling to migrate userspace data between hard resets.
28842760
2885−Urbit is decentralized which, in my opinion, means that it isn’t really a network in the way that Facebook is. I see Urbit as more of a network platform. The users create the networks, or migrate them in from elsewhere. We’re all using Landscape and running our VMs on Nock, so obviously there can be interaction between different communities. But anyone who doesn’t want that cross-community interaction doesn’t have to have it.
2761+The combination of version negotiation and data migration should afford us the ability to run the network indefinitely into the future. Unfortunately, to get this change in, we’ll need to reset the network. We’re optimistic that this will be the last time we ever do it. And, given our data migration tooling, this breach won’t involve losing data.
28862762
2887−I’ve followed Urbit’s progress since 2016, so I’m plugged into groups with other Urbit people I’ve come to know over the years. Other than that, however, I don’t know much about who’s out there. It’s not like The Portico is in one neighborhood and the atheists are in the next neighborhood over. There’s a real sense in which we’re not even on the same network—different Urbit communities share a common protocol, but a protocol isn’t a network.
2763+## Status + conclusion
28882764
2889−Some people may want to see a little of everything. If atheists want to join our group they’re welcome to do so! We’ll be friendly. I don’t seek out their groups, though.
2765+We have been working with auditors since this summer and should have a report ready to publish in the next few weeks. Both version negotiation and data migration are in testing and are ready to be deployed.
28902766
2891−One virtue of decentralized social media is that it offers a totally different set of trade-offs with respect to how you share and act on your beliefs. What if you could talk earnestly about philosophy and religion without having to worry about alienating many of your friends and family? I guess that’s somewhat possible on Facebook—do they still have “groups”?—but Urbit was designed for it.
2767+Our goal is to have all of this work complete by `~2020.12.10`. This means we should be able to start a galaxy vote right around that time. Galaxy votes (as specified in the contracts) run for a month, which should have this whole process ending on `~2021.1.10`.
28922768
2893−Having said all that, I don’t think decentralization is a panacea. Even if Urbit takes off, it will likely face problems that are difficult to anticipate now. My hope is simply that Urbit’s trade-offs are healthier than the ones we’ve had before.
2769+It's going to be an exciting couple of weeks!
28942770]]></content:encoded>
28952771 </item>
28962772 <item>
2897− <title><![CDATA[A brief update from urbit.org and Tlon]]></title>
2898− <link>https://urbit.org/updates/2021-04-01-update</link>
2899− <guid>https://urbit.org/updates/2021-04-01-update</guid>
2900− <pubDate>Wed, 31 Mar 2021 00:00:00 GMT</pubDate>
2773+ <title><![CDATA[An Email from the Archive]]></title>
2774+ <link>https://urbit.org/blog/an-email</link>
2775+ <guid>https://urbit.org/blog/an-email</guid>
2776+ <pubDate>Sun, 29 Nov 2020 00:00:00 GMT</pubDate>
29012777 <content:encoded><
29112779
2912−4/15: Raghu (~sovmep-ripsum) will talk about virtual desks, a key component of third-party software distribution, and the process of contributing to the Urbit kernel through our scholarships program.
2780+I found this email in my archives recently and thought it might be fun to share publicly.
29132781
2914−4/29: Edward Amsden (~ritpub-sipsyl) will be discussing and demoing his WebRTC work, which enables audio/video calls on Urbit.
2782+```
2783+From: Galen Wolfe-Pauly <galen@tlon.io>
2784+Date: Thu, Jul 2, 2020 at 9:50 AM
2785+Subject: Continuing
2786+To: XXXXXXXXXXXXX
2787+```
29152788
2916−On April 27th, we’ll be launching our Bitcoin Wallet and preparing to roll it out to the network. This is the culmination of many months of collaboration between several members of our community and Tlon—we’re really excited (especially ~pindet-timmut). There might even be some cool swag, discounted hosting, and/or other giveaways. Regardless, you’re not going to want to miss it. RSVP here: https://www.meetup.com/urbit-sf/events/276741426/
2789+Here are a few things I was thinking about after we chatted. It may be that I'm just reiterating things I already said — but perhaps it's useful:
29172790
2918−We’re also excited to announce that our much anticipated Town Hall event, a virtual mini-conference, will be taking place on May 20th and will feature a keynote talk from our good friend Justin Murphy. Mark your calendars for now—more details to follow soon.
2791+1 -
29192792
2920−2 - Content
2793+Our collective desire to depend on digital communication tools vastly exceeds what I would have ever guessed. Even if you somehow factor out what’s addictive about the platforms we use today: they serve a real need. The crux of the problem with our current platforms is that they don’t actually serve the need that we want them to serve. They’re not tools in the way we expect tools to be. For the most part, the platforms we depend on serve the needs of their shareholders or some graph or another that needs to go ‘up’, which makes them compromised in a very deep way.
29212794
2922−There’s been a ton of high-quality content produced lately. If you’re looking for something to watch, read, or listen to, here’s a roundup:
2795+In the pre-digital world we enjoyed a few things about the way we communicated, collaborated and did business that are dwindling: simplicity, durability and ownership. I’ll try to give some straightforward examples of what I mean:
29232796
2924−~rovnys-ricfer has been recording an audio series about the design and rationale of Urbit called “Urbit from the Outside In.” Check them out here: https://twitter.com/rovnys/status/1371972157971050499
2797+A - When I talk to someone directly, I’m not worried that someone else is listening in. If they go tell someone else what I said to them, that’s something for us to work out between us — they’re not _always_ reporting our conversations back to a third party. The constraints of the interaction and the privacy implications are _simple_ — I don’t think about them at all. Good privacy guarantees flow from a strict focus on simplicity. When two people want to talk to each other: give them a secure channel to talk. Putting a centrally-controlled service between them is just an interim solution because no one could figure out a better way to do it.
29252798
2926−~pindet-timmut and ~wolref-podlex appeared on Justin Murphy’s Other Life podcast—check them out: https://www.youtube.com/watch?v=vv9lymudGV8 and https://www.youtube.com/watch?v=5jbjSUKRyGM
2799+B - When I write something down on paper, or type into a typewriter, I have an intuitive sense of the durability of what I’ve made. I have notes on my shelf I took ten years ago. I don’t worry about them disappearing. This means I can have a very direct, high-resolution relationship with the medium. I can pour myself into my physically-written notes in a way I would never pour myself into a Google Doc. Our digital tools are deeply untrustworthy because we know they can disappear, that they won’t actually last forever.
29272800
2928−A question was posed on our mailing list titled: “what is this?” The team and community did not disappoint with their answers: https://groups.google.com/a/urbit.org/g/dev/c/bdlPPnaccMc
2801+C - Around 2008 I started limiting myself to a few specific drawing and writing tools. I use them all the time and can actually refine my relationship to them since I know they’re not going to change out from under me. Perhaps at some point these pens wont be made anymore, but the ones I have are actually _mine_. Similarly, the things I make with them actually belong to me in a way that doesn’t require some ridiculous terms of service. A sense of ownership, when it comes to the medium of communication, determines our level of trust and commitment.
29292802
2930−Simon Kovacs (~bacbec-lormur) wrote a great post for our blog titled “After the Machine War”: https://urbit.org/blog/after-machine-war/
2803+Our digital tools have to achieve the same level of simplicity, durability and ownership that our pre-digital tools did. Until they do, we’re always going to be in conflict with them, full stop.
29312804
2932−~poldec-tonteg talked to the guys at The Stack. Check out the podcast here: https://thestack.link/episode-13-martian-futurism-with-poldec-tonteg/
2805+The main thing is that exactly none of our present platform-centric world can survive when you see things this way. The digital world we live in is composed of an insanely complicated, ephemeral set of tools that distinctly _do not_ belong to the people that use them.
29332806
2934−3 - Documentation refresh
2807+We’re going to be in a constant struggle with technology until it conforms to these three very basic expectations. These are the expectations we try to get Urbit to fall in-line with, of course. Something else could also succeed by satisfying them. But I also don’t really see anything else, aside from Bitcoin and maybe Ethereum, falling in line with these core principles.
29352808
2936−Our Docs team completed a large overhaul of our documentation last month, making the distinction between “Usage documentation” (https://urbit.org/using), or how to use your ship, and “Development documentation” (https://urbit.org/docs) much clearer.
2809+So: while I wish that Urbit was more mature and ready to capture those that are being purged from mainstream social media, are bored with it or are frustrated with the constraints of ‘productivity software’ — I think this conflict is going to drag on until people realize that what we’re in conflict with is the structure of the software we use. Using software that’s managed by other people is always going to cause serious problems all the way up at the user level. For more speculation on how this might play out, watch Black Mirror.
29372810
2938−We’ve had some excellent contributions from the community to our documentation, most recently a comprehensive set of overviews, guides and examples documenting threads from ~tinnus-napbus: https://urbit.org/docs/userspace/threads/overview/
2811+2 -
29392812
2940−We’re pretty proud of the work that’s gone into clarifying everything and are still working hard to make the docs more and more helpful. Feel free to send us your feedback if you have any!
2813+(1) is, in a way, a long-winded way of saying that the state of the world hasn’t changed our direction all that much. In order for Urbit to be approachable to use, it has to be very nicely made and that takes time and iteration. As the system stabilizes, Urbit can evolve in a more traditional way: we, along with others in the ecosystem, release stuff, observe how people use it, and try to make it better. We’re at the point where we’re nearly ready to get into that feedback loop, and we very much need to get there. We’re close.
29412814
2942−4 - Landscape news
2815+Urbit is a distinctly different _kind_ of software than anything we have now. Your Urbit is something you actually own and can do whatever you want with: not unlike your furniture or your kitchen tools. An Urbit is a tool for individual, human-scale computing and our whole approach to designing and making things is completely different. Most computing is about industrial-scale computing: where the software system stores everyone’s data and is managed by the people who build it.
29432816
2944−The community on Landscape is continuing to grow. Over 30 groups were published to the Directory in March alone, and these are just the public groups that someone decided to broadcast. We think that’s pretty exciting.
2945−There’s a new Cincinnati-centric group (~padwet/queen-city-urbit), a sewing group that sounds incredible (~pinwyl-hasfeb/seamstress-mafia), and the first digital maker space on Urbit (~tidrel-tabpub/freeside-mars).
2817+Urbit is the opposite of industrial-scale. Urbit is much more like something that’s carefully crafted and delivered to you directly. This craftsman-like approach to building software really isn’t a part of most modern software engineering.
29462818
2947−Check out the Directory (~bollug-worlus/urbit-index) to discover public groups and, if you’d like help getting your community onto Landscape, let us know. We’re here to help!
2819+When I think about this from the standpoint of the person using what we make, it’s especially important. Urbit should feel like something that’s purposefully made by hand — not something you picked off the shelf at Wal-Mart. Some of this ethos was present in the early PC movement, but it’s mostly lost today. The care and attention that goes into building the system is also exactly what we make money on. People pay us to own a piece of it, to use it. We’re incentivized to make nice things, in the Urbit model, and we take that responsibility seriously.
29482820
2949−5 - Hosting
2821+3 -
29502822
2951−Over at Tlon, we’ve been really busy onboarding new hosting customers. All of our current onboarding sessions are completely booked! If you’d like to learn more about how it works, send an email to support@tlon.io. If you’re ready to get on the list, sign up at https://tlon.io/
2823+Networks are a really important social form that’s only just beginning to come into existence. A network is neither a state nor a company, but something in-between. Bitcoin is a network, Ethereum is network (but it’s still far too centralized). Urbit is a young network.
29522824
2953−6 - Team news
2825+(In my view, a real network is always decentralized. Centralized networks are basically just companies.)
29542826
2955−We're happy to share that longtime hooner ~littel-wolfur has joined the Tlon engineering team. Welcome, ~littel-wolfur! Also, we’ve made it official with ~wolref-podlex and dropped the “Interim” from “Director of urbit.org” (probably due to the quality of these newsletters).
2827+Urbit is controlled by the collective of people who use it — in varying degrees, of course. The main thing is that this collective is bound together only by private keys and a blockchain, not a set of legal documents. The agreements between everyone on the network are in some cases more formalized (in terms of ownership) and looser (in terms of content moderation) than what we’re used to in either a state controlled or company controlled model. This is a very unusual kind of institution.
29562828
2957−If you’re interested in working with Tlon or urbit.org, feel free to get in touch.
2829+On a successful Urbit network, Facebook, Airtable, and Signal are just successful applications. You could probably build companies around them that ship software to Urbit — but they’re more like 5 - 10 people instead of thousands.
29582830
2959−7 - Culture recs
2831+Urbit doesn’t aim to eat away at the government per se. Instead, it’s an important communication tool for institutions of any scale to actually take control of their means of collaboration. The efficiency of inter-government communication and government to populace communication can clearly be improved by _a whole lot_.
29602832
2961−Finally, we’re going to leave you with some recommendations from the team:
2833+4 -
29622834
2963−~fabled-faster released an insane new mix that melted my face in a good way: https://soundcloud.com/flowerstructure/fs-s-s-2021
2835+The most important thing is that people can generate a vision of the future. This can only emerge from a small collective of motivated people. Our public life is overwhelmed by people shooting from the hip, aiming for likes.
29642836
2965−Our designer ~natnex-ronret curates a playlist website. Check it out: https://www.door.link
2966−~datnut-pollen has been trying to understand how information processing evolves over time in evolutive systems. Here’s what he’s been reading:
2837+There are difficult, infrastructural problems _all over the place_ that desperately need the considerate attention of small groups of people. Urbit, as communication tooling, is aimed at improving the quality of the fabric that binds these groups together. Or, to put it another way, before you can solve any specific problem you have to improve the problem solving process overall. Everything is gated on solving the process.
29672838
2968−(i) Connectom https://connectom.substack.com/p/connectom-the-book It is about thermodynamic/statistical mechanical processes as the fundamental driver of the evolution of biological, ecological, and human systems.
2969−(ii) Topological phases emerge in an ecological model: https://physicstoday.scitation.org/do/10.1063/PT.6.1.20210128a/full/ and Topology protects chiral edge currents in stochastic systems: https://arxiv.org/abs/2010.02845 Topological protection for various dynamics is the main theme he reckons is missing from Connectom.
2970−(iii) Homotopy theoretic and categorical models of neural information networks https://arxiv.org/abs/2006.15136 Topological techniques for understanding information processing in neural, metabolic, societal, and computational contexts.
2839+5 -
29712840
2972−~simfur-ritwed recently re-read Pynchon's Vineland. It’s both a loom into the backwoods NorCal culture of the 80s and a typically Pynchonian fantasy about the dangers of media-saturated identity (quite prescient, turns out).
2841+Christopher Alexander is, indeed, probably the biggest influence on my thinking when it comes to paying close attention to making things that both generate a deep sense of connection and are shaped by the people who inhabit them.
29732842
2974−In the wake of his recent trip to Brazil, ~wolref-podlex has been reading Os Sertões (the English version), the story of a war that took place at the end of the 19th century in the backlands (sertões) of Brazil, in which the Brazilian army brutally crushed the peaceful religious settlement of Canudos.
2843+[http://en.bp.ntu.edu.tw/wp-content/uploads/2011/12/06-Alexander-A-city-is-not-a-tree.pdf](http://en.bp.ntu.edu.tw/wp-content/uploads/2011/12/06-Alexander-A-city-is-not-a-tree.pdf) is one of his early, well known essays that’s easy to find online. I think ‘The Nature of Order’ is the thing that had the biggest impact on me, but it’s harder to find. There’s probably a PDF floating around on the internet somewhere. It's also a beautiful (four volume) book. The first volume kind of nails it. This talk is also great: [https://twitter.com/urbit/status/1148030042846326784](https://twitter.com/urbit/status/1148030042846326784)
29752844
2976−Lately I (~roslet-tanner) have been getting back into Roy Ayers. This feels just right for spring: https://www.youtube.com/watch?v=inPgcN_xF4w
2845+The thing that comes to mind lately is Hejduk. He had passed away by the time I was at Cooper, but I feel like I was educated in the ghost of his work. This documentary gives a good impression of his thinking: [https://www.amazon.com/John-Hejduk-Builder-Worlds/dp/B07NKQ72C8](https://www.amazon.com/John-Hejduk-Builder-Worlds/dp/B07NKQ72C8)
29772846
2978−That’s it for now. We’ll be back with more news from Tlon and Urbit, respectively, in a few weeks. As always, let us know if there’s anything in particular you’d like to hear about next time.
2847+Hejduk was able to see that architecture isn’t about building buildings per se, but something else. That was always quite obvious to me.
29792848
2980−~wolref-podlex and ~roslet-tanner
2849+Talk soon!
2850+G
29812851]]></content:encoded>
29822852 </item>
29832853 <item>
2984− <title><![CDATA[Eliza]]></title>
2985− <link>https://urbit.org/blog/eliza</link>
2986− <guid>https://urbit.org/blog/eliza</guid>
2987− <pubDate>Mon, 22 Feb 2021 00:00:00 GMT</pubDate>
2854+ <title><![CDATA[Models of Society]]></title>
2855+ <link>https://urbit.org/blog/20201119-models-of-society</link>
2856+ <guid>https://urbit.org/blog/20201119-models-of-society</guid>
2857+ <pubDate>Wed, 18 Nov 2020 00:00:00 GMT</pubDate>
29882858 <content:encoded><
2869+
29922870
29932871<br>
29942872
2995−## The Storm before the Calm
2873+In general, technology serves humanity as a kind of appendage—instead of thinking new thoughts or acting on its own, it does what we command. Technology never creates new social structures—it merely makes existing ones easier, or it facilitates the creation of new ones. We use our tools to expand our capacities, and once we are capable of doing more, we can imagine new things to do. Inventing the wheel did not invent motorized transportation—but it did facilitate it and it was a necessary step, even an inspirational one. Similarly, the invention of writing made new forms of human interaction and new tools for organization possible.
2874+
2875+Consider the following conversational conventions, or modes of messaging: a letter; a dialogue; a book; a meeting; minutes of that meeting. These are each pieces of technology: finely constrained solutions to human problems. Now, we have digital forms of each of these which diverge variously from the original. A letter becomes an email. A dialogue becomes a chat room, or a series of blog posts, or a twitter spat. A book becomes a website or an ebook. Meetings in 2020 have virtually been replaced by their virtual counterparts. Minutes become recordings or transcripts.
2876+
2877+Although we do not have a clear picture of how humanity developed the technology of writing out of the basic capacity for speech, we can imagine that the computerization of writing has many parallels. It does not make the old tools obsolete, nor does it immediately introduce new social structures. It does create the potential, however. On the timeline of human existence, we have only had digitized text for a relatively short time. Because we want to understand how to best use these new forms, we should look at their underlying structure.
2878+
2879+In order to digitize messages well, computers need to reconcile two facts about all modes of messaging. They have:
2880+
2881+1. One basic shape, and
2882+2. An infinite variety of forms.
29962883
2997−Building things, even Calm™ things, makes noise. George Nakashima’s wooden furniture evokes peace, but its construction still begins with a chainsaw. We mention this because we’re firing up our newest power tool.
2884+1 — The basic shape: all these modes have one common substance: human language. Any conversation is made of words. At first we only had spoken language. Then we discovered writing. Writing allows us to encode our words as glyphs to transmit them over time or distance. The internet extends this capacity. We called this "hypertext"—like good old fashioned text, but one level up. A staggering amount of messaging now takes place over this hypertext transfer protocol (http). In the process of digitizing language, we have learned the basic shape of a message. We can see this in how every social network shares messages in basically the same shape: an author, some content, references, an audience. We can confirm this basic shape by comparing it against our experience of the real world, and the previous comparison between speech and writing. Speech and writing both use the same substance, and take the same basic shape. They all have an author, content, references, and an audience.
29982885
2999−We call her Eliza. She is a data-collection robot.
2886+2 — Our experience of this one basic shape takes an infinite number of forms. The examples above (letter, meeting, &c) are just a few. These forms depend on the content of the message, the people involved, and the place they occur. All three aspects contribute significantly to its form, but the one that computerized messaging has not adequately compensated for is the place. Content depends only on the author and their intent. Getting certain people to view that content might be more difficult but most know how to use a computer. The place however, has not yet been adequately compensated for, and I think that has contributed seriously to our lack of civil and serious discourse over the internet. A president would not give an address in a bar, and a prospective lover would not utter his advances on stage. In writing, we can use the different physical forms to distinguish place. You shouldn’t read a book by the pool. You might not read a letter in public. You wouldn’t put a billboard in your bedroom.
30002887
3001−Hang on. An AI? Harvesting my data? Spying on me? Flooding me with spam? This is Urbit, right? Let us tell you about our new friend in basic terms, where MEGACORP might otherwise deploy legalese.
2888+Furthermore, it seems possible that in our eagerness to "connect the world," we focused injudiciously on creating communities around "interests." Evidence suggests that unless the interest has a highly refined focus, these communities devolve into pandering, self-reference, and exploitation. In this way, the internet is something like a convention of conventions, where you wander in a sea of foreigners loosely affiliated by interest and surrounded by advertising booths. In physical space, people do gather by interest but they also gather by physical proximity—they are grounded and bound in place.
30022889
3003−## What Eliza is and isn’t
2890+Having an indistinct sense of place makes the form of conversation ambiguous and the participants of the conversation disconnected. Consequently, people are unsure how to interact. One need only know the term "comments section" to understand that.
30042891
3005−> Replicants are like any other machine - they're either a benefit or a hazard. If they're a benefit, it's not my problem.
3006−>
3007−> <cite>Rick Deckard</cite>
2892+## People in Places
30082893
3009−Let's start with the benefits. Eliza is a simple chatbot. She was made to collect feedback on Landscape. She asks direct questions about peoples' usage of Urbit, records any responses, and reports them to her managers at Tlon. She'll also provide timely advice and information to ships kind enough to chat with her. She'll begin reaching out to ships via DM in the coming month. If you don't want to, just say no, and you'll never hear from her again.
2894+<br>
30102895
3011−Finding bugs is critical to Urbit's rapid development, especially in this period of nascency. Most Urbit-related frustrations go unreported; regular folks don't think to open up Github when they experience a minor issue. That's why it's incumbent upon us to design a lower-friction forum for feedback. People who aren't comfortable filing an issue might be willing to talk to a friendly chatbot.
2896+
30122897
3013−Now, about hazards. By design, there are few. Eliza runs on Tlon's comet, not on your planet. There will be no OTA to install `%eliza-bot-store` on everyone's ships. Eliza learns things through conversation, not hidden surveillance software. Data she requests, like the text output of our network analytic tool, `+tally`, must be sent manually. MEGACORP tends to cut this corner; to refine their products, they just track your reactions in real-time.
2898+<br>
30142899
3015−Since she's [open-source](https://github.com/urbit/urbit/blob/b0c1f83287cbf4c85847a9238d9f4be17e1fcb33/pkg/arvo/app/eliza.hoon), anyone can creatively deploy Eliza. Just write her a dialogue tree. Of course, that also means we can't keep people from misusing Urbit bots. We think automated agents on the Urbit network are inevitable, so let's create a good baseline culture around them. (Much love to Tendiebot, who's serving up stock prices in `~tomdys/wall-star-bets`.) However, once Urbit is used world-wide, we can't rely on culture alone.
2900+As the internet grew to accommodate new conversation forms using the basic substrate of hypertext, web developers began to conceive of "digital spaces" through analogy—chat "rooms" and "forums,” or the "silo" and the "walled garden." Today, most of our conversation takes place in these walled gardens—privately-owned places which may be beautiful on the inside, but inaccessible from elsewhere. While some of these walled gardens are very large, our conversation is essentially confined to them. There is no roaming from one space to another while keeping one’s identity. We create new identities for new spaces both because we must and because we are afraid of repercussions on one platform for what we say on another. This is because we do not own our identity; we merely have a key—our password. The owners of the walled garden still own the artifacts of our tenure there, and can revoke our access to them at any time.
30162901
3017−## A New Internet Economics
2902+The concept of identity and the concept of place are fundamentally linked. We imagine the prince who travels overseas where no one knows his name, or we imagine the old prospect of traveling to a new world to make a fortune. While those both exemplify a dramatic change in identity and place, we usually want to keep our identity consistent. We want to be recognized by friends whichever place we go, and we all strive toward having a good reputation, which is a consistent identity across places. This consistent identity also allows control of that reputation per place. A man is not judged in public by the words he says among friends. And there is no way to search what someone has said except by asking him. With our current system of identity providers (an absurd term, but a real one), we surrender our rights to selectively expose our thoughts, regardless of the place they have been uttered. A data breach or a weak password might lay bare our most private thoughts. We run the real risk of being confronted by an old conversation presented out of context or after we have learned better.
30182903
3019−The sum of Urbit's architectural design is a new online economics: a way to finance and monetize access to internet infrastructure where people retain maximum equity. Explicitly acquire a low-maintenance, low-cost server. Use it to compute explicit things. Return to life.
2904+People need distinct spaces to form conversations in distinct modes, and they need to have a consistent identity that controls how public their words are.
30202905
3021−We all know the basic MEGACORP business model: offer a free service (to suckers who don't own a server), secretly mine the data they generate on the (addictive) platform, then sell targeted ads to advertisers. This model will not survive Urbit. The ubiquitous personal server changes the economic equation. You used to 'pay' for an experience with your time and data. On Urbit, once you purchase core internet infrastructure, it's yours.
2906+In theory, we would have a digital city with unique regions, public fora, and sovereign parcels, into which one person might travel at will. In practice, we see this pattern: an app emerges to facilitate a mode of conversation. It gains popularity. Facebook (or Google, or Microsoft) buys and absorbs it. As monolithic empires, they can use the same format for all their messages. This gives them a great amount of power. They use this power to create things like "Sign in with Facebook" (or Google, or Microsoft) that benefit the user by consolidating their identity, but fail to solve the underlying problem. Their problem is that in order to allow people to communicate using the current technology stack, they need to be in control of everything.
30222907
3023−So, can Urbit meaningfully curtail our world's appetite for data? We'll see. Post-enlightenment society runs on instrumental reason, right down to the last byte. Marketers will always want a fresh dataset. However, when the goods are on your Urbit, you can at least demand the respect you deserve. Long term, we expect a transparent market for data, not an opaque "agreement". An analytics company wants to track everything you see and do on Urbit? They better be paying well.
2908+## Urbis ec Bit
30242909
3025−Eliza doesn't pay respondents. Her collection is a charity to Urbit's developers. (We're also still busy enabling payments on Urbit with the Bitcoin wallet.) However, her presence is not a term of service either. In a few years, by the nth time some smart aleck uses Eliza's chatbot code and conjures 'Zalexa' to attempt an intrusion upon your Calm™, we will see the economics of Urbit's architecture suddenly vivify. Blacklists, reputation systems, and, eventually, even data markets, all Urbit primitives envisioned long ago, will become real. We won't need Zoogle to underwrite a spam filter for the entire internet; the scarcity of Urbit address space, in tandem with a true web-of-trust, handles that.
2910+<br>
30262911
3027−If Urbit is to be used worldwide, the old system will not go down without a fight. Spammers, spies, and digital robber-barons will hunt for ways to game Urbit. Our passage out of the digital gutter is beginning in earnest, and we are thrilled to put our new architectures to the test.
3028−]]></content:encoded>
3029− </item>
3030− <item>
3031− <title><![CDATA[A brief update from urbit.org]]></title>
3032− <link>https://urbit.org/updates/2021-02-19-update</link>
3033− <guid>https://urbit.org/updates/2021-02-19-update</guid>
3034− <pubDate>Thu, 18 Feb 2021 00:00:00 GMT</pubDate>
3035− <content:encoded><
30372913
3038−This week we’re introducing our newest grants program, Scholarships, sharing an update on the Urbit community, and introducing the newest members of the Urbit Foundation team. We’ve also got some important infrastructure updates about King Haskell and an overhaul of our Getting Started guide. Let’s dive in:
2914+<br>
30392915
3040−1 - Scholarships
2916+Urbit does solve this underlying problem. At this point the explanation goes so far down the stack that you could spend years tracing it all, but the relevant part is this: Urbit is not an empire; it’s a territory. An empire is an entangling of land and rule: within the bounds of said empire, you agree to be bound by its laws and the penalties for transgression. The laws exist at the whim of a despot or cabal. Your standing as a Roman citizen buys you no favors in Persia. In contrast, a territory imposes only physical laws. For example, in the desert, you will die faster. The only way to change that is to alter the desert. Urbit imposes nothing but the digital equivalent of physical laws. You have an identity which can be said to be truly yours, and you have a piece of software that runs on whatever computer you choose and can do anything you want with the messages sent to your identity. There are no social protocols enforced, because no one can control what software you run on your computer. As long as you agree to communicate using the same basic substrate, you can communicate with anyone using Urbit. This is the digital equivalent of speaking the same language. Whether or not others will accept you into their coalitions is not the technology's concern.
30412917
3042−I’m excited to announce the (soft) launch of a new type of grant we’re calling “Scholarships.” The big idea behind the program is to grow the base of individuals that can contribute to Urbit through hands-on, one-to-one mentorship with infrastructure engineers at Tlon.
2918+In the same way that the land provides clay and timber, Urbit also provides the tools and material for building places both public and private. These include the aforementioned consistent message substrate (content), as well as tools for organizing people/audiences, structure for referencing other content, and an identity system that is owned only by you while being verified by all. The places are being built—private rooms with just a few people, meeting halls, club houses, huge public spaces, and countless personal encounters, the contents of which are known to none but the participants.
30432919
3044−The program works by first having an infrastructure engineer define and scope a project, and then pairing them with someone from the community. Unlike other grants, these projects are centered on platform development, meaning Arvo or Vere, rather than on userspace development. Scholars will learn much about how Urbit works, take on impactful infrastructure projects, and gain insight into how infrastructure engineers think about building Urbit.
2920+The default tools work with messages in a few of the ways with which we've grown familiar: chat, direct messaging, publishing, link-sharing. They map onto existing forms of messaging because as I said earlier, the technology does not create new social structures; it just facilitates them. We have only seen the beginning of what the internet is capable of doing. Within a few decades it replaced the majority of letters, phone calls, and text dissemination—that was just the first phase of getting up to parity with what written text and speech could already do. In order to get to the next phase of creating new social processes, we need our technology to be organic and democratic, in the sense that everyone can participate and shape it. It needs to have a consensual foundation—a common substrate—and infinite possibility for expression. Urbit provides both of those.
30452921
3046−We’ve begun scholarships with two members of the Urbit community who have demonstrated high technical aptitude and commitment via grants or other open-source projects. We don’t have any additional openings at this time, but expect to have a few more in the coming months.
2922+Similar to working undeveloped land, it takes a lot of hard work, which is why Urbit is not ready for mainstream adoption yet, and why I alluded to the idea of settlers in my opening paragraph. Traveling to the new world is not for everyone, but everyone is welcome.
30472923
3048−If you’re interested in a scholarship, sign up for the waitlist here: https://airtable.com/shr6Xmo55h8dZ0O46
2924+_How could one do other than submit to Tlön, to the minute and vast evidence of an orderly plant? It is useless to answer that reality is also orderly. Perhaps it is, but in accordance with divine laws—I translate: inhuman laws—which we never quite grasp. Tlön is surely a labyrinth, but it is a labyrinth devised by men, a labyrinth destined to be deciphered by men._
2925+]]></content:encoded>
2926+ </item>
2927+ <item>
2928+ <title><![CDATA[Aesthetic Culture #1]]></title>
2929+ <link>https://urbit.org/blog/aesthetic-culture-1</link>
2930+ <guid>https://urbit.org/blog/aesthetic-culture-1</guid>
2931+ <pubDate>Wed, 11 Nov 2020 00:00:00 GMT</pubDate>
2932+ <content:encoded><
30512936
3052−Our community has been pretty busy lately. Here’s a non comprehensive list of what they’ve been up to:
2937+<br>
30532938
3054−- ~timluc-miptev completed the Bitcoin gall agents. They’re now being integrated into Landscape as a wallet.
3055−- ~sovmep-ripsum finished his work on ucal, an iCalendar-compatible calendaring backend for Urbit.
3056−- ~tabnus-fondeg began work on Urbit LFS (large file storage) for providing file sharing and hosting support.
3057−- ~sipfyn-pidmex is writing a comprehensive suite of documentation for graph-store to enable an easier on-ramp to building new social applications.
3058−- ~minder-folden launched a new hosting provider that you can check out here: https://escapepod.store
3059−- ~naltyc-wornes is contributing a set of official, battle-tested guides for running Urbit on “smol” devices to the urbit.org website.
3060−- ~hocdep-labtul hosted his first Urbit UTC meetup, which featured ~timluc-miptev and received great attendance. We’re looking forward to the next one featuring ~nartes-fasrum on the Aesthetics of Urbit. Learn more here: https://www.urbit.computer/utc/#upcoming-meetups
2939+_This post is the first in a series of digests centered on art produced within and about Urbit by a member of the community, ~nartes-fasrum. Monthly digests will be available within the Urbit Community group in Landscape, and will occasionally be compiled here on the blog to give you a sneak peek at some of what’s happening on the network. Enjoy! ~wolref-podlex_
30612940
3062−We’ll have a flurry of new bounties coming online in the upcoming weeks, so keep your eyes peeled —there might even still be an open one! Check them out here: https://grants.urbit.org/bounties.
2941+One of the most exciting things about Urbit is the aesthetic and design around it, developed partly by Tlon (through the design of Urbit itself) and partly by the community (by producing great Urbit art). As the community grows, it creates more art, and we have the opportunity to showcase some of the pieces we love. These works can draw curious new users in, and they give existing users ways to communicate their excitement to friends.
30632942
3064−If you’ve got an idea you’d like to work on, make sure to submit a proposal. you’re not quite sure how to get started, book some time with me here and I can help you figure it out: https://calendly.com/wolref
2943+To that end, I wrote [the Art by Urbit proposal](https://grants.urbit.org/proposals/636838408-art-by-urbit), a regular digest for the dissemination of Urbit art and propaganda. We'll bring you the works of both familiar faces and new users, in a variety of media types from image manipulation to 3D models and physical pieces. This first digest will cover some of the art produced in the past year, but will have a focus on the last two months. Future digests will be incremental updates summarizing the artworks of the prior month.
30652944
3066−3 - Foundation growth
2945+## ~datnut-pollen
30672946
3068−This month the Urbit Foundation grew by 200%, which is less astounding when you know that it grew from one person to three. Nonetheless, this is a significant milestone for the community-focused arm of Urbit.
2947+~datnut- made a physical representation of their sigil from maple wood & epoxy resin, and mentioned the potential to use an Arduino to cause different lighting effects for different statuses of an urbit.
30692948
3070−~timluc-miptev (aka Tim) joins us from the developer community, where he’s been a prominent figure for some time as the creator of the popular Nock for Everyday Coders guide (https://blog.timlucmiptev.space/part1.html) and Complete Guide to Gall (https://github.com/timlucmiptev/gall-guide). He’s become a thoroughly proficient Hoon developer and Urbit architect through his work on Bitcoin integration, and will now be working to design grants and guide contributors in their development of their projects.
2949+
30712950
3072−~taller-ravnut (aka Mike) is passionate about community formation, and is excited to start working on supporting those that wish to host Urbit Meetups in their cities, universities, and timezones (since, at time of writing, IRL isn’t much of a thing). He’ll also be performing outreach to developers and developer communities to help spread the word and grow the contributor base of Urbit.
2951+## ~lagrev-nocfep
30732952
3074−There’s still tons of work to do and I don’t expect Tim and Mike to be the last additions to the team this year. If you’re interested in working at the UF, send me a DM for an invite to the group.
2953+~lagrev- [made a thread of Dinosaur Comics](https://twitter.com/sigilante/status/1299101593997127680), using the Urbit Whitepaper as the seed text.
30752954
3076−4 - King Haskell
2955+
30772956
3078−King Haskell is a rewrite of the part of Urbit that talks to Unix and the outside world. When you switch to KH, the part of Urbit that runs Nock code stays the same. Importantly, King Haskell includes better facilities for NAT traversal, which should improve connectivity issues for self-hosted ships.
2957+A sweet poem about the potential for Martian felines is theirs as well:
30792958
3080−As its name suggests, King Haskell is written in the Haskell programming language. Haskell is much easier (and more fun) for rapid development than C, and lightyears better for writing correct, bug-free code. As a result, we expect faster iteration times and more reliability in this part of the system.
2959+
30812960
3082−King Haskell is being shipped as part of a v1.2 release of the Urbit binaries. To run an existing ship with the King, say
2961+## ~litmus-ritten
30832962
3084−./urbit-king run path/to/your/pier
2963+~litmus- produces art full of glowing gases and colourful curves:
30852964
3086−To create a new ship, use the `urbit-king new` command.
2965+
30872966
3088−If you run into any problems doing this, or notice any incompatible behavior, please inform the authorities immediately.
2967+~litmus- also drew Urbitan for the release of OS1:
30892968
3090−The Tlon Corporation is also using this new software on some of its infrastructure galaxies, but third party infrastructure ships should wait for further notice from us before doing so.
2969+
30912970
3092−5 - Getting Started guide
2971+More of their work is available in the notebooks of the Internet Weirdness Research Unit.
30932972
3094−Two members of our community have put a bunch of work into giving our Getting Started (formerly called Install + Setup) guide a facelift. They simplified the language, made the options much clearer, and improved some confusing instructions.
2973+## ~minder-folden
30952974
3096−If you’re looking to try Urbit or know someone that would want to run it, give our guide a try and let us know what you think!
2975+~minder- stylistically ranges from retrofuturistic memes to flat-out classic 50s retro:
30972976
3098−https://urbit.org/using/install/
2977+
30992978
3100−--
2979+
31012980
3102−That’s all for now. ~roslet-tanner will be in touch in a few weeks with an update from Tlon. See you on the network!
3103−Josh / ~wolref-podlex
2981+More of ~minder-’s work is available in his The New Era notebook.
31042982
3105−https://twitter.com/urbit
3106−https://github.com/urbit/urbit
3107−]]></content:encoded>
3108− </item>
3109− <item>
3110− <title><![CDATA[A brief update from urbit.org]]></title>
3111− <link>https://urbit.org/updates/2021-01-15-update</link>
3112− <guid>https://urbit.org/updates/2021-01-15-update</guid>
3113− <pubDate>Thu, 14 Jan 2021 00:00:00 GMT</pubDate>
3114− <content:encoded><
31202988
3121−In spite of the many challenges presented over the last year, it was a resoundingly good one for Urbit.
2989+
31222990
3123−It seems like a long time ago now that the folks at Tlon rolled out OS1 (now called Landscape), just as the pandemic forced everyone into their homes throughout the world. At the time, “Urbit is for Communities” (https://urbit.org/blog/urbit-is-for-communities/) was just a vision, but now it’s been transformed into reality—there are more thriving communities in Landscape than any of us can keep track of, with new faces popping onto the network on a daily basis.
2991+More of their work is available in the smol computers group.
31242992
3125−Landscape brought many new ships onto the network which helped identify those areas in which Urbit’s infrastructure could be most improved. Ford Fusion eliminated the possibility of a partially-applied over-the-air (OTA) update through a drastic reduction in the size and complexity of the codebase. The efficiency of the OTA process was improved by several orders of magnitude, and many long-standing memory issues were resolved. Now we deploy code on our infrastructure nodes and see users receive an update, over a decentralized network, often in less than a minute.
2993+## ~nartes-fasrum
31262994
3127−After improving the stability of the system Tlon turned its attention to bringing more ships onto the network. A long-standing barrier to Urbit’s adoption has been the technical knowledge required to host one’s own ship—this prompted Tlon to build and launch an Urbit hosting service (https://tlon.io), the waitlist for which is now thousands deep.
2995+I use GIMP to edit images I pull off various social media platforms, and usually post the results on Twitter at [@nartesfasrum](https://twitter.com/nartesfasrum).
31282996
3129−With Tlon becoming more singularly focused on building products on Urbit, concrete steps have been taken towards making urbit.org a separate organization that’s focused on long-term development of Urbit’s platform. I joined to lead that effort back in August (https://urbit.org/blog/first-steps-towards-urbit-org/) and have since spent the majority of my time working with dozens of contributors on projects spanning documentation, education, external integrations, and much more.
2997+
31302998
3131−We rounded out the year with a full network reset (called a “continuity breach”), which has in the past has been synonymous with loss of all data on the network. This time things went differently: tooling was made available to the community that allowed ships to preserve their data, which enabled most to seamlessly rejoin post-reset. This is a significant milestone for the project as it signifies not only a commitment to technical excellence, but to supporting our budding community.
2999+## ~norsyr-torryn
31323000
3133−2 - 2021
3001+No discussion of Urbit art would be complete without mentioning [~norsyr-'s Canvas app](https://github.com/yosoyubik/canvas), which won first place in the [Hackathon 2020](https://urbit.org/blog/hackathon-results/) event.
31343002
3135−In the last two weeks we’ve seen a huge amount of inbound interest as people are waking up to the inherent problems with using centralized services run by MEGACORPs—we’re just happy we started working on Urbit all those years ago. While we tend to not plan more than about six months in advance, I can still talk at a high level about what urbit.org will be focusing on in the immediate future (Tlon’s next newsletter will provide a similar overview of what they’re working on).
3003+
31363004
3137−Growth in Urbit’s developer community has been growing organically in lockstep with the overall network growth. This means, happily, that there’s a pretty large pool of people eager to contribute to Urbit. The priority for urbit.org, therefore, is to improve its capacity to effectively assist contributors. Concretely, this means:
3005+## ~radbur-sivmus
31383006
3139−- Rework urbit.org to better help developers learn how to contribute to Urbit
3140−- Since Urbit is ready to build on top of, provide practical guides that demonstrate how to do so
3141−- Guide developers to make high-value contributions to Urbit and its ecosystem
3142−- Build community amongst contributors
3007+~radbur- writes poetry on a range of subjects, one of which could be Urbit. Interpretation of ["A Weaver's Regard"](https://t.fust.us/writing/poetry/weavers-regard) and ["Internet Absurdities"](https://t.fust.us/writing/poetry/internet-absurdities) is left as an exercise to the reader.
31433008
3144−My strategy to date has been heavily focused on working directly with contributors to provide technical guidance and direction, and it’s been working really well. To that end, I’ll also be scaling the Foundation’s ability to provide such support by bringing more individuals into urbit.org that can mentor, review work, and provide guidance on where to best direct contributors’ energy.
3009+## ~sitful-hatred
31453010
3146−If you’re interested in helping build Urbit, you can head over to https://grants.urbit.org to claim a bounty or submit a proposal, join the Landscape group ~wolref-podlex/foundation to stay in the loop about what urbit.org is up to, or contact me directly at josh@urbit.org.
3011+~sitful- has a Martian Meme Depository chat in the Networked Subject group, which catalogs a number of the Urbit memes that have been created so far.
31473012
3148−3 - Town Hall
3013+
31493014
3150−In mid-February, we’ll be holding our first ever “Town Hall” event—it’s like a developer call, but longer, with more speakers, and covering a wider range of topics (not all of them technical!).
3015+## ~tocrex-holpen
31513016
3152−We’re currently looking for speakers, so if you have an Urbit-related topic that you’d like to present, or would like to nominate someone else to present, please reach out to me by replying to this email. This could be an application you (or the nominee) has designed or built, an interesting use case, a design case study, or something completely different. Please don't be shy about reaching out—we're happy to work with you to figure out whether it makes sense to present a given topic, and how best to do so!
3017+~tocrex- has been drawing the galaxies of Urbit, and uploading results to Twitter at [@tocrexholpen](https://twitter.com/tocrexholpen). Each galaxy has a unique design and outfit, with the galactic sigil proudly displayed as its face.
31533018
3154−Once we’ve finalized a date, we’ll broadcast it over our official Meetup group (https://www.meetup.com/urbit-sf/) and on Twitter. Stay tuned.
3019+
31553020
3156−--
3021+## Landscape
31573022
3158−As a reminder, Urbit and Tlon have now split their newsletters in two—Urbit’s newsletter will cover the project and development community, while Tlon’s will focus more on the product development work on Landscape and the communities that form there. Tlon’s newsletter will arrive at the end of the month.
3023+Something that's become quickly evident with the addition of background images to Landscape is that people love to customize their ship's appearance and make it feel more like home. To close things out, we're providing a pair of backgrounds — one darker, one lighter — for use on your ship (or your desktop, should you so desire).
31593024
3160−That’s all for now. See you on the network!
3161−Josh / ~wolref-podlex
3025+
31623026
3163−https://twitter.com/urbit
3164−https://github.com/urbit/urbit
3027+
31653028]]></content:encoded>
31663029 </item>
31673030 <item>
@@ -3381,47 +3244,120 @@ There’s a secret to moving ahead in the line: reply ‘as if in a still pool
33813244
33823245We’re going to run a live demo showing off how our hosting service works on the 9th. You can sign up for the event here: https://www.meetup.com/urbit-sf/events/273439025/
33833246
3384−2 - Providers
3247+2 - Providers
3248+
3249+We’re not the first ones to offer hosting, it turns out. People in the community have been busy building out the first onramps into Urbit. We heard https://www.geturbitid.com, https://planet.market and https://urth.systems are all starting to come online. It’s still early, but what they have in the works is really cool to see.
3250+
3251+We also caught wind of https://urbit.me the other day, a nice little tool for finding specific sigils.
3252+
3253+(And we can’t forget about https://urbit.live, the first ones to get into this arena.)
3254+
3255+I wrote a little bit about how I see the future of Urbit Providers here: https://urbit.org/blog/providers/
3256+
3257+3 - Update + updates
3258+
3259+There’s too much to cover in a single email, so I wrote a little post about what we’ve been working on over the past few months. Check it out on the blog: https://urbit.org/blog/20200929-state-of-urbit/
3260+
3261+We also updated our roadmap in Understanding Urbit: https://urbit.org/understanding-urbit/roadmap/
3262+
3263+4 - The beginning of urbit.org
3264+
3265+We’re very happy that ~wolref-podlex has formally joined the community as Interim Director of the Urbit Foundation. We expect the foundation to become a separate entity soon, but for now we’re incubating it inside of Tlon.
3266+
3267+Last month he wrote about how we are working to separate the governance of urbit.org from Tlon: https://urbit.org/blog/first-steps-towards-urbit-org/
3268+
3269+Just recently, he announced the recipients of our biannual Gifts program: https://urbit.org/blog/gifts-q3-2020/
3270+
3271+5 - Hooniversity
3272+
3273+If you’re interested in learning Hoon, the next session of the community-run Hooniversity is set to start on October 12th.
3274+
3275+For more information about the course, head over to the Hooniversity site: https://hooniversity.org/ and sign up for the session here: https://hooniversity.org/enroll/.
3276+
3277+If you can't wait for the 12th, join the Hooniverse group on Urbit in advance by joining the ~hiddev-dannut/new-hooniverse group on Urbit or at https://twitter.com/hooniversity1
3278+
3279+We’ve been pretty much living on Urbit as of late. If you’re curious to connect with us (and are up for running your own Urbit node) you can always find us in the Urbit Community group: ~bitbet-bolbel/urbit-community. Instructions on how to install and set up Urbit are here: https://urbit.org/using/install/
3280+
3281+We love getting questions, comments, and replies to these newsletters. One thing we heard loud and clear last time around is that you want to hear more from the team. So much happened in the past few months that we have a glut of things to talk about in the coming weeks. Expect more dispatches in the near future. For the meantime, feel free to reach out via email (support@urbit.org) any time.
3282+
3283+See you on the network,
3284+Galen / ~ravmel-ropdyl
3285+
3286+https://twitter.com/urbit
3287+https://github.com/urbit/urbit
3288+]]></content:encoded>
3289+ </item>
3290+ <item>
3291+ <title><![CDATA[Late 2020 Progress Update: OS 1 -> OS 1.N]]></title>
3292+ <link>https://urbit.org/blog/20200929-state-of-urbit</link>
3293+ <guid>https://urbit.org/blog/20200929-state-of-urbit</guid>
3294+ <pubDate>Mon, 28 Sep 2020 00:00:00 GMT</pubDate>
3295+ <content:encoded><
3299+
3300+<br>
3301+
3302+When we announced OS 1, in April, we started to disappear into Urbit. Since then, we’ve been living on Urbit like we never have before. This has been our goal for years: to mature the system we’re building by becoming its first committed users. We knew that critical step toward Urbit’s maturity was being able to depend on it ourselves, but the system itself had to mature to the point that we could do that practically.
3303+
3304+We’ve done this in fits and starts. We’ve _tried_ and failed a few times over the years. We’ve always _used_ Urbit to some extent, but we’ve never _relied_ on it. These past six months have been different. I can’t tell whether it was out of sheer determination and commitment, or that the system was just genuinely ‘there’. Either way, both Tlon and the Urbit Community genuinely live on Urbit now.
3305+
3306+In a way, our ability to use Urbit day to day doesn’t make sense. When we shipped OS 1, it was full of holes. There were serious performance, stability, and reliability issues. Plenty of people showed up and thought, ‘I don’t understand why you think this is useful.’ But, it was good enough that we wanted to use it. And since we wanted to use it, we put our energy into making it better like we hadn’t ever before. Being able to use a system that you can really trust is a wonderful feeling. It’s Computing Without Compromises.
3307+
3308+All of the sudden, it’s Fall. We never found the time to name any of our releases or write announcements. We’ve just been making the system better in every way we can find. We’ve got a lot of exciting things planned for the last few months of the year — but I wanted to recap the progress we’ve made for those following along from the outside. If you haven’t been on the network, it’d be impossible to see.
3309+
3310+The tl;dr is that Urbit is much faster, more reliable, and nicer to use than it was six months ago. Things have gotten much better, across the board. We threw ourselves into OS 1 admittedly underprepared, but we’ve learned a lot and matured the system a lot along the way.
3311+
3312+Anyway, let’s walk through the details. We’ll talk about our infrastructure and interface work independently, since that’s how we organize things internally. Then we’ll talk a bit about what’s going on on the network.
3313+
3314+### Infrastructure
3315+
3316+
3317+
3318+In April, Urbit was slow, fragile, and didn’t always update itself properly. We made enormous progress on all of these.
3319+
3320+First off, Urbit is about 10x faster for most users. With some careful debugging, we were able to locate a few really [high](https://github.com/urbit/urbit/pull/3029) [impact](https://github.com/urbit/urbit/pull/3054) [improvements](https://twitter.com/pcmonk/status/1276327036722704385). There’s still performance work to do, but the effects of this work are widespread. Boot times are faster, local compute is faster, the network is faster. It’s a huge improvement.
3321+
3322+Second, we got our memory usage under control. Urbit still uses a 2GB memory arena. If the state of your Urbit grows to over 2GB things, uh, fall apart. This used to happen regularly, and now it’s pretty much unheard of. We implemented [tooling](https://github.com/urbit/urbit/pull/3235) to compact and deduplicate the memory image when it’s growing too large. We brought the memory usage of the compiler [down ~90%](https://github.com/urbit/urbit/pull/3041). There are areas where we can be more disciplined about how we use memory, but this is more or less a solved problem for the near term.
33853323
3386−We’re not the first ones to offer hosting, it turns out. People in the community have been busy building out the first onramps into Urbit. We heard https://www.geturbitid.com, https://planet.market and https://urth.systems are all starting to come online. It’s still early, but what they have in the works is really cool to see.
3324+Third, we implemented a completely new build system. Well, we actually [got rid of the build system](https://urbit.org/blog/ford-fusion/) altogether and [made it a part of the filesystem](https://github.com/urbit/urbit/pull/3060). This made it possible for us to fix our over the air (OTA) updates and make them both fast and reliable. In April, an OTA could bring down your node and would take hours or even days to apply. Today, we regularly deploy OTAs with no fear of them breaking any nodes — they often go from galaxy → planet in a minute or less.
33873325
3388−We also caught wind of https://urbit.me the other day, a nice little tool for finding specific sigils.
3326+We also rewrote a large part of our runtime in Haskell and made overall progress on [network scaling](https://github.com/urbit/urbit/pull/3174). And: we implemented a [principled approach](https://github.com/urbit/urbit/pull/2366) to [error handling](https://github.com/urbit/urbit/pull/3064), making nodes much less likely to become unrecoverable.
33893327
3390−(And we can’t forget about https://urbit.live, the first ones to get into this arena.)
3328+The network is stable, fast, and safe from day to day. We’re pretty confident it can grow quite a bit without serious issues. When we shipped OS 1 we really weren’t sure what we could handle. Now we’re standing on much more solid ground.
33913329
3392−I wrote a little bit about how I see the future of Urbit Providers here: https://urbit.org/blog/providers/
3330+### Interface
33933331
3394−3 - Update + updates
3332+
33953333
3396−There’s too much to cover in a single email, so I wrote a little post about what we’ve been working on over the past few months. Check it out on the blog: https://urbit.org/blog/20200929-state-of-urbit/
3334+When we shipped OS 1 it was a bunch of separate pages (that were slow to load), all with separate ways of storing and processing data. Our interface work over the past six months is all about unification and simplification.
33973335
3398−We also updated our roadmap in Understanding Urbit: https://urbit.org/understanding-urbit/roadmap/
3336+First, we pulled OS 1 together as a [single page app](https://github.com/urbit/urbit/pull/3025). Using OS 1 involves a good amount of moving around and refreshing the page each time was pretty painful. Now it’s snappy to move between pages and keep up with what’s going on. In tandem, we started using our own component library, [Indigo](https://github.com/urbit/indigo-react). This makes frontend development much cleaner and more efficient.
33993337
3400−4 - The beginning of urbit.org
3338+Next, we unified the way we store data and compute. It used to be that each individual module (chat, publish, and links) used their own ‘agents’ to store and process data on the Urbit side. (An agent is the Urbit equivalent of a datastore + business logic.) With a lot of moving parts, this approach caused all kinds of synchronization challenges. Rather than a module-per-agent model we’ve started to move toward a type-of-data-per-agent model. The first of these is [graph store](https://github.com/urbit/urbit/pull/3110). We’re presently in the process of migrating all our modules to graph store.
34013339
3402−We’re very happy that ~wolref-podlex has formally joined the community as Interim Director of the Urbit Foundation. We expect the foundation to become a separate entity soon, but for now we’re incubating it inside of Tlon.
3340+Those two are by far the most significant, but there’s so much more. We [rewrote](https://github.com/urbit/urbit/pull/2937) the `group-store`, allowing for different roles (admin, moderators, and so on) in a group. We shipped better debugging tools, automatic reconnection, a settings panel, and overall visual polish and refinement.
34033341
3404−Last month he wrote about how we are working to separate the governance of urbit.org from Tlon: https://urbit.org/blog/first-steps-towards-urbit-org/
3342+
34053343
3406−Just recently, he announced the recipients of our biannual Gifts program: https://urbit.org/blog/gifts-q3-2020/
3344+And I almost forgot [Leap](https://github.com/urbit/urbit/pull/3231): an omnibox for navigating around OS 1 with the keyboard. We have plans to make Leap much more powerful — but it’s a great first start toward making OS 1 keyboard accessible. I almost exclusively use [Leap](https://upload.wikimedia.org/wikipedia/commons/0/06/Canon_Cat_keyboard.jpg) to get around OS 1 these days.
34073345
3408−5 - Hooniversity
3346+### Community + network
34093347
3410−If you’re interested in learning Hoon, the next session of the community-run Hooniversity is set to start on October 12th.
3348+
34113349
3412−For more information about the course, head over to the Hooniversity site: https://hooniversity.org/ and sign up for the session here: https://hooniversity.org/enroll/.
3350+Our primary goal with OS 1 was to get both Tlon and the Urbit Community living entirely on Urbit. We did that, and in doing so we’ve seen how nice it is to grow a community in a calm, non-invasive environment. We started doing regular [Urbit](https://twitter.com/urbit/status/1308875082312364048) [Dialogues](https://twitter.com/urbit/status/1304139629948329985) with friends and peers in the absence of physical meetups, which have been fun.
34133351
3414−If you can't wait for the 12th, join the Hooniverse group on Urbit in advance by joining the ~hiddev-dannut/new-hooniverse group on Urbit or at https://twitter.com/hooniversity1
3352+Getting onto Urbit is still relatively challenging. By the standards of software you run yourself, it’s not so bad at all. But by comparison to ordinary consumer software, it’s way too hard. Tlon is [working on that](https://tlon.io) — but these last six months have been only for the brave. That is, those that want to host their own nodes.
34153353
3416−We’ve been pretty much living on Urbit as of late. If you’re curious to connect with us (and are up for running your own Urbit node) you can always find us in the Urbit Community group: ~bitbet-bolbel/urbit-community. Instructions on how to install and set up Urbit are here: https://urbit.org/using/install/
3354+Turns out, there are plenty of people who are up for running Urbit themselves and quite a few small communities have sprouted around the network. Overall the network has a fun, cozy feeling. It’s nice.
34173355
3418−We love getting questions, comments, and replies to these newsletters. One thing we heard loud and clear last time around is that you want to hear more from the team. So much happened in the past few months that we have a glut of things to talk about in the coming weeks. Expect more dispatches in the near future. For the meantime, feel free to reach out via email (support@urbit.org) any time.
3356+### What’s next
34193357
3420−See you on the network,
3421−Galen / ~ravmel-ropdyl
3358+We’re still more or less flat-out, full speed ahead into an even better Urbit-world. The seeds of change were planted when we made Josh the [interim technical director of urbit.org](https://urbit.org/blog/first-steps-towards-urbit-org/). Urbit itself is getting close to the point where the separation between Urbit and Tlon has to become more real. Urbit is aimed at being an ubiquitous platform, Tlon is aimed at making it as usable and useful as possible.
34223359
3423−https://twitter.com/urbit
3424−https://github.com/urbit/urbit
3360+We’ll talk about some of this on [October 9th](https://www.meetup.com/urbit-sf/events/273439025/), and you can see a bit of what’s coming on [tlon.io](https://tlon.io) today. If you tried booting Urbit in April and it was tough, try again. We’re easy to find on the network, and we’d love to get reacquainted.
34253361]]></content:encoded>
34263362 </item>
34273363 <item>
@@ -7013,6 +6949,111 @@ We think that a new system like this, even in a simple form, will be a relief fr
70136949<img class="mv5 w-100" src="https://media.urbit.org/site/understanding-urbit/your-last-computer/your-last-computer-ocean%402x.png">
70146950
70156951Your Urbit is a simpler computer, a quieter computer, a more private computer. We want it to feel predictable, safe, and reliable — things only a complete, sealed system can do. This, we hope, can get us a world where technology keeps us connected, but doesn’t dominate our lives.
6952+]]></content:encoded>
6953+ </item>
6954+ <item>
6955+ <title><![CDATA[~2019.10 Roadmap]]></title>
6956+ <link>https://urbit.org/blog/2019-10-3-roadmap</link>
6957+ <guid>https://urbit.org/blog/2019-10-3-roadmap</guid>
6958+ <pubDate>Wed, 02 Oct 2019 00:00:00 GMT</pubDate>
6959+ <content:encoded><
6961+
6962+The daily work of building a new OS from scratch is so engaging and exciting that we habitually forget to even take stock of what we’ve accomplished. We’re fixated on the prospect of moving the world on to Urbit, starting with ourselves.
6963+
6964+It’s a good thing I have a recurring reminder to write these updates. While our focus is on the future, it’s good to get a sense of the rate that we’re moving forward, and to let everyone know what’s been going on. We’ve made great progress over the past few months.
6965+
6966+We’ve got a new interface, Urbit 0.8.0, Hoon School, and a grants program among lots of other updates. We’ll go into detail about all of these, and talk a bit about where we’re headed next. The system is improving at a really good pace. We intend to keep it up.
6967+
6968+## Identity (Azimuth)
6969+
6970+The other day I got an email, clicked a link, and got a planet. A real, live, piece of cryptographic property with paper wallets and everything. It took about two minutes. And at the end, I could have easily sent invites to my friends.
6971+
6972+This experience is part of a completely new Bridge, the interface for interacting with your Urbit identity. The beta experience we’re testing today is quite stripped down, but it’s a huge improvement over the last Bridge release. Clicking a link is a lot easier than downloading source code, running it from the command-line, and probably running into a python-related error.
6973+
6974+Getting to this point involved rewriting Bridge from scratch, figuring out how to host it securely, building infrastructure to fund the requisite transactions involved in registering a new identity, and setting up a service to send emails (and dispose of them afterward). We've also redesigned our paper wallets to make them simpler and clearer.
6975+
6976+We still want to get this new version of Bridge a bit further along before releasing it to everyone — but we’re excited about it. We didn’t quite get to the point of building an affordance for payments, which we had hoped to do, but that’s coming later.
6977+
6978+We want everyone to have an Urbit identity. And we want it to be incredibly easy to get one, so we’ll get Bridge out this month with a new urbit.org (more on that below).
6979+
6980+The other area of identity-related work was Sigils — the algorithmically generated images that go with every Urbit identity. (We’ve got a blog post in the works that covers how we created these, which is a good story that needs to be told.) The original version of Sigils didn’t look very good at small sizes and a few collisions were found (thanks to [urbit.live](https://urbit.live) for helping to discover the collisions). The [new, improved sigils](https://github.com/urbit/sigil-js) have no collisions and look great at small sizes.
6981+
6982+**Q4 2019**
6983+
6984+- Release Bridge to the public
6985+- Get Bridge working well on mobile
6986+- Add payments support, hopefully including BTC
6987+- Add a network explorer
6988+
6989+**Q1 2020**
6990+
6991+- Integrate Bridge with a native app for Arvo
6992+
6993+## OS (Arvo)
6994+
6995+As a team, we want Urbit to be our primary computer, our last computer, our permanent computer. And we want this now — or at least as soon as we possibly can. We’re both ambitious and impatient.
6996+
6997+The frustration that we can’t move onto Urbit today propels us forward. The system saw major updates over the past few months all the way through the stack. On the Arvo side, we divide our work into Infrastructure (everything in the kernel and interpreter) and Interface (everything in userspace and the front-end). We’ll start with Infrastructure progress first.
6998+
6999+We’re very nearly to the point that all the kernel-level code in the system has been written by our current team. The one remaining vane that deserves a rewrite (Gall) has had a major cleanup by Jared just recently. The [Ship of Theseus](https://en.wikipedia.org/wiki/Ship_of_Theseus) approach does appear to be working. The infrastructure team is doing fantastic work and has really deepened their ownership of the system. The Urbit of today is on the road to becoming a great piece of system software.
7000+
7001+The biggest infrastructure-level milestone was the release of [Urbit 0.8.0](https://github.com/urbit/urbit/releases/tag/v0.8.0). We introduced a new process-separation architecture, implemented the correct bootstrap sequence, moved to LMDB for persistence, replaced our http vane (%eyre) and moved to Nix for our build system.
7002+
7003+To put it simply, Arvo is now much more stable and durable. During the beginning of the year we were seeing bugs and instability that were frustrating and unacceptable. While there are still issues on the live network, none of them terrify us much. We also implemented the ability for users to ‘individually breach’, which means that you can now reset your Urbit without waiting for us to reset the network.
7004+
7005+### Landscape (Arvo UI)
7006+
7007+We don’t just build infrastructure for others to develop on top of. We build interfaces too. At the top of the stack, we released a completely new Landscape, the interface for Arvo. This new interface makes it possible to build other ‘modules’ for Arvo that go beyond chat and publishing.
7008+
7009+This new Landscape is a complete departure from the last direction. Your Urbit now has a simple home screen that launches individual modules and it’s [relatively easy](https://github.com/urbit/create-landscape-app) to create new ones. We’re all enjoying using Landscape around the office. It’s still a bit of a prototype — but it’s quite a good one, I think.
7010+
7011+In moving to this new model we decided to narrow our focus to desktop only for now. We’ll return to mobile again next year — but first we want to get the desktop experience right. We’ve pulled the iOS app from the app store for the time being. I’m personally sad to see it go, since I enjoyed using it. But our prior iteration of Landscape just wasn’t quite right.
7012+
7013+This version of Landscape is, I think, the last one that we’ll call a prototype. Over the past few weeks, since shipping this, some amazing work has been happening on the interface front. We have a systematic approach to building interfaces on top of Urbit that’s very promising, albeit just getting started. We’ve already put out [one post](https://urbit.org/posts/landscape-a-portrait/) about Landscape's future, with more posts to come.
7014+
7015+**Q4 2019**
7016+
7017+- Improved Arvo-level error handling
7018+- Implementation plan for ‘telescoping kelvins’ — or [how we plan to future proof Arvo](https://groups.google.com/a/urbit.org/forum/#!topic/dev/6Mwn6TQFVwc)
7019+- Versioning scheme between Arvo and Vere
7020+- A new Haskell implementation of the daemon
7021+- A native client (instead of just a browser tab)
7022+- A [new user-space architecture](https://docs.google.com/document/d/1hS_UuResG1S4j49_H-aSshoTOROKBnGoJAaRgOipf54/edit)
7023+- Hoon.hoon that’s OTA upgradeable
7024+- Working Jacque prototype, a graal-truffle-based implementation of vere
7025+
7026+**Q1 2020**
7027+
7028+- Integrated client with Bridge and Arvo
7029+- New interface framework, codenamed ‘Widescreen’
7030+
7031+## Docs + Community
7032+
7033+We had quite a bit of interest in our second session of Hoon School. We ended up with 150 people enrolled in Hoon 101, and 42 in 201. The 101 session just ended, with a lot of positive responses and feedback from the participants. We learned a lot doing it and got quite a bit of interesting new example code.
7034+
7035+Hoon 101 started with students with little to no programming experience. Hoon 201, which is just getting underway, covers more advanced topics. We’re quite curious to see what comes out of it.
7036+
7037+We’re also adding features to Landscape to make it more amenable to use by Hoon Schoolers. Good examples include code evaluation within Chat (for office hours), and the ability to pin posts in Publish. The next crop of Hoon learners will be able to use Urbit to learn about Urbit.
7038+
7039+Aside from Hoon School we’re always updating our documentation. Most notably, we added search to the docs (finally). This was a much needed feature that makes the docs much more usable.
7040+
7041+We also launched our [grants program](https://grants.urbit.org/) quietly, but all of our available bounties were quickly claimed nonetheless. We’re ready to give away more address space to contributors and are excited by how quickly people got involved.
7042+
7043+We also did some experimentation with holding events on Arvo. We held weekly AMAs for while, and hosted a few meetings with the community. With the new UI out, our public channels have been a lot more active. We’ll surely be holding more on-urbit events in the future — but for the time being the conversation in urbit-help is a lot of fun.
7044+
7045+**Q4 2019**
7046+
7047+- Vane level documentation
7048+- An active grant program
7049+
7050+## urbit.org
7051+
7052+Urbit.org is about ready for a refresh — so we’re in the process of rebuilding it. We have, for a long time, told the story of Urbit by describing the system technically. We think Urbit can be explained much more simply and much more concisely. We’re working to put together a new set of materials in this direction.
7053+
7054+We’d also like to populate urbit.org with a lot more content about what we’re working on and thinking about. We do a reasonable job of writing updates, but many of our projects get released without any background info. Tlon and the Urbit community are full of smart, thoughtful people — and we’d like to do a lot more to surface their work. We plan to close out the year with both a new website and a lot of writing about what we’ve been building. Not everyone wants to read the source code!
7055+
7056+That covers it for now. If you have questions or want to chat — find us in `~dopzod/urbit-help`. See you online!
70167057]]></content:encoded>
70177058 </item>
70187059 <item>
@@ -7310,6 +7351,105 @@ Until next time.
73107351In other news, the **Interface Team** started a [Twitter account](https://twitter.com/urbitwip) to share work in progress, there's been lively discussion on [urbit-dev](https://groups.google.com/a/urbit.org/forum/#!forum/dev), and we published [a roadmap](https://urbit.org/posts/2019-5-roadmap/).
73117352
73127353Until next time.
7354+]]></content:encoded>
7355+ </item>
7356+ <item>
7357+ <title><![CDATA[~2019.5 Roadmap]]></title>
7358+ <link>https://urbit.org/blog/2019-5-roadmap</link>
7359+ <guid>https://urbit.org/blog/2019-5-roadmap</guid>
7360+ <pubDate>Wed, 15 May 2019 00:00:00 GMT</pubDate>
7361+ <content:encoded><
7363+
7364+We often get so busy that we forget to tell you what we’ve been up to. Here’s an update on what we’re doing and where we’re headed with each layer of the stack.
7365+
7366+At a very high level we have two goals for 2019: make Azimuth easier to use, and get Arvo to a 1.0.
7367+
7368+Next year we’ll begin to move away from some of the MEGACORP software we use in the office, and replace it with our own tooling. There’s some exciting work happening in that department, but we’ll cover that in a future post.
7369+
7370+For some related recent thinking on all of this, see [The 100 Year Computer](/posts/essays/the-100-year-computer/), [The State of Landscape](/posts/essays/the-state-of-landscape/) and [Azimuth as MultiPass](/posts/essays/azimuth-as-multipass/).
7371+
7372+For now, let’s just look at what’s on the immediate horizon:
7373+
7374+## Azimuth
7375+
7376+At lunch the other day someone on our team said something like, ‘We built a complete and working public key infrastructure, but we haven’t told anyone.’
7377+
7378+It’s true. Azimuth is operational, secure, and well tested. It’s a pretty cool piece of technology and it’s out there in the world for anyone to use. It also doesn’t require that you use Arvo — Arvo happens to make use of Azimuth, but Azimuth itself is a completely separate system.
7379+
7380+So the question is why haven’t we told the world about it?
7381+
7382+I tend to think that in order for a technology to succeed it has to not only be an important technical innovation, it also has to be easy to understand as a product. And that’s our answer: we’ve undersold Azimuth because we want it to be easier to understand by _using_, not just by reading the code. Azimuth is quite an elegant piece of technology — but that doesn’t matter until it has a great user experience to match.
7383+
7384+That’s why, in the near term, we’re focused on building on top of Azimuth ourselves. We can’t ask others to go down roads if we haven’t already been down them.
7385+
7386+Here’s what we’re building first:
7387+
7388+### Q2 2019
7389+
7390+- A simplified onboarding flow for getting an Azimuth point that’s simple to share with friends over email, text or as a URL.
7391+- A redesigned and improved Bridge for managing your points.
7392+- An interface that allows you to easily send money between Azimuth points without running Arvo.
7393+
7394+### Q3 2019
7395+
7396+- Expanded Azimuth-centric example modules, documentation and developer tooling.
7397+
7398+Still under consideration:
7399+
7400+- An OAuth server or JWT flow for logging into any service with an Azimuth point.
7401+- A mobile app for point to point payments using Azimuth.
7402+
7403+### 2020
7404+
7405+Azimuth is beginning to feel like [multipass](/posts/essays/azimuth-as-multipass/), with a variety of ways to use Azimuth points without ever booting Arvo
7406+
7407+## Arvo
7408+
7409+The Arvo interface has always been held back by Arvo’s technical immaturity. This is still true to some degree. The system has not stabilized completely.
7410+
7411+But! We’ve been using Landscape quite a lot lately. I use it daily, in fact — even [on my phone](https://itunes.apple.com/us/app/landscape-urbit/id1393148862). An encrypted (although not audited — so let’s not call it ‘secure’), authenticated chat where I own the keys and can read the source code feels really nice to use. The interface isn’t as good as we’d like, but it’s not bad. Landscape is a great preview of where we’re going: a simple, permanent, self-sovereign computer.
7412+
7413+There are still rough edges, and Landscape is not nearly general purpose enough, but we have plans:
7414+
7415+### Q2 2019
7416+
7417+- A new update to the Arvo interface that we’re calling Modulo. Modulo expands beyond chat and longform discussion to make your Arvo interface feel much more like the computer it actually is.
7418+- Upgrades to our event persistence, networking, and DNS integration aimed at much better stability. Arvo instances don’t crash that often, but with these changes it should be very rare.
7419+- Significant improvements to testing with a new simulation testing framework and integration testing pipelines.
7420+
7421+### Q3 2019
7422+
7423+- A significant overhaul to Gall, our application model, making it much simpler for users to write apps or ‘agents’ in Arvo.
7424+- A new version of the compiler that makes us less reliant on jets. This will eliminate a major obstacle to achieving network continuity, or the ability for ships to upgrade themselves totally over-the-air, forever.
7425+- A significant overhaul and stability update to Clay, our filesystem, making it possible for us to trust it for self-hosting, search it easily, and depend on it for long-term data storage.
7426+- Tooling for hosting and hopefully a beta program for hosted Arvo instances run by Tlon.
7427+
7428+### 2020
7429+
7430+- A completely overhauled Arvo interface, Daigo, with a complete but simple set of messaging and collaboration tools. Modulo is meant to be fun to experiment with, but we aim to make Daigo part of our daily workflow.
7431+- We come to work every day, use Arvo, go home.
7432+
7433+## Community
7434+
7435+We’ve often felt like it was far too early to invite others in to the system.
7436+
7437+As long as we’re up front about the state of this 100 year computer -- that it’s live, but incomplete — I think it’s a good thing to welcome people on board. There’s plenty to play with, experiment with and explore.
7438+
7439+Hoon school was the first effort in this direction. We intend to do a lot more:
7440+
7441+### Q2 2019
7442+
7443+- Scaling Hoon school up to include both a track for experts and for beginners, and allowing many more participants.
7444+- Holding more meetings and events on Landscape, experimenting with Arvo-native discussion.
7445+- A clear program for address space grants for developers + contributors.
7446+- New documentation site with searchable library docs.
7447+
7448+### Q3 2019
7449+
7450+- Hoon School participants understand clearly how to build a Modulo agent, and invite others into it.
7451+- The road toward building an Azimuth module is well understood, paved, and clear.
7452+- We have clear instructions and tutorials for building Azimuth modules and using Azimuth as a login or reputation primitive.
73137453]]></content:encoded>
73147454 </item>
73157455 <item>
@@ -17567,6 +17707,25 @@ Join us for the Assembly 2021 introduction, keynote and demos on Saturday, Octob
1756717707 <pubDate>Invalid Date</pubDate>
1756817708 <content:encoded><![CDATA[
1756917709We wish we could get everyone together at once for Assembly, but travel still isn't as easy as we wish it was. For those that can't make it to Assembly, join Urbit Foundation Director and Tlon CPO Josh Lehman for an online-only AMA about Urbit's new software distribution capabilities.
17710+]]></content:encoded>
17711+ </item>
17712+ <item>
17713+ <title><![CDATA[Meetup: Brisbane Australia]]></title>
17714+ <link>https://urbit.org/events/2021-11-26-meetup-brisbane</link>
17715+ <guid>https://urbit.org/events/2021-11-26-meetup-brisbane</guid>
17716+ <pubDate>Invalid Date</pubDate>
17717+ <content:encoded><![CDATA[
17718+What is the Urbit??
17719+
17720+Philosophers, mathematicians and other timewasters have pondered this tough question for aeons. Many went mad, others grew long beards or even buried themselves alive, thinking the riddle unsolvable. So did we... until now.
17721+
17722+Urbit Brisbane are proud to announce that we finally have found an answer: yes, we have figured out what is the Urbit!!
17723+
17724+We'd like to share this important knowledge with you, so join us among the fair hills of St Lucia this Friday night. The Secret Venue will be announced on Friday arvo. RSVP and stay tuned to the event page so you don't end up walking around Guyatt Park accosting joggers for clues.
17725+
17726+Come along and learn about the Urbit with us. You will gain access to an eldritch power far beyond the frail grasp of worldly things. If that isn't enough to tempt you, we also have beers and pizza with your name on them.\*
17727+
17728+\*If your name is Asahi or Godfather Supreme.
1757017729]]></content:encoded>
1757117730 </item>
1757217731 <item>