@@ -4,10 +4,205 @@
44 <title>Urbit</title>
55 <link>https://urbit.org</link>
66 <description>Urbit is a personal server built from scratch</description>
7− <lastBuildDate>Thu, 18 Nov 2021 19:21:20 GMT</lastBuildDate>
7+ <lastBuildDate>Thu, 09 Dec 2021 03:47:23 GMT</lastBuildDate>
88 <docs>https://validator.w3.org/feed/docs/rss2.html</docs>
99 <generator>https://github.com/jpmonette/feed</generator>
1010 <language>en</language>
11+ <item>
12+ <title><![CDATA[Urbit Is for Creators]]></title>
13+ <link>https://urbit.org/blog/urbit-for-creators</link>
14+ <guid>https://urbit.org/blog/urbit-for-creators</guid>
15+ <pubDate>Fri, 03 Dec 2021 00:00:00 GMT</pubDate>
16+ <content:encoded><. Meanwhile, platforms like Spotify or YouTube filter what we see by deprecating the “long tails” of content. That is, if you’re searching for a tune on Spotify, it brings Spotify more profit, on average, to design a search feature that will automatically bring you to the most popular songs, even if you were really looking for less popular ones. The same goes for books, which are now purchased mostly according to the algorithm, and not according to what a person might stumble upon in a bookshop. (The upshot: expect more [cookbooks from Snoop Dogg](https://www.nytimes.com/2021/04/18/books/book-sales-publishing-pandemic-coronavirus.html), and fewer titles from authors who are not already celebrities.) Products such as Tik Tok, Spotify, YouTube, and Amazon like for you to think that they’re mere distributors of content. But actually they’re *producers*, and they’re producing the smarmy, anodyne style that has homogenized the globe.
25+
26+Urbit is for creators who are ready to wake up from this bad dream.
27+
28+The vibe of today’s internet applications—manipulative, erratic, overcomplicated, overbearing, and highly detrimental to society—is in contrast to the mechanics of the creator economy itself, which can actually be blissfully simple. In 2008 Kevin Kelley made famous the concept of “[1000 true fans](https://kk.org/thetechnium/1000-true-fans/).” That is, to make a living as a creator, you only need 1,000 fans who are interested enough to buy whatever you produce. Even $6.00 or $7.00 a month from such true fans is a boon for a creator—assuming not too much of that cash gets taken away by middlemen, and that fans can discover work from outside the corporate monoculture in the first place.
29+
30+In a limited sense, this 1,000 true fans model is already working. Creators with fanbases of the size Kelly imagined are able to use Patreon or YouTube or what-have-you to monetize their content. But the problem is, those platforms are not really peer-to-peer. Your fans aren’t your own: they belong to the platform. And with the big tech platforms running the show, we end up with the problems described above.
31+
32+To those of us who are interested in seeing a thriving culture of artists, musicians, podcasters and writers which is human-centered via a p2p network, rather than being brokered, managed, and manipulated, by the most venal and tasteless of data collectors and profiteers, it likely seems like the world of the arts has gone bottom-up. Urbit is for any creators who are ready to put it back on its feet again.
33+
34+Urbit is a peer-to-peer network designed to serve as simple, durable neutral infrastructure for whoever wants to build something on it. Like everything else on Urbit, creator content goes directly to the people it’s supposed to go to. No middlemen, no MEGACORP data mining, no capricious terms of service, no obscure algorithms determining what gets seen and what doesn’t. This is the zero-to-one shift that makes Urbit the natural destination for creators who want to both *own* their work and share it.
35+
36+Urbit has already seen several communities get excited about the ways Urbit could help them fulfill their goals. Here are just a few examples:
37+
38+
39+[HOLDERSLAND](https://twitter.com/holdersland), founded by Haleek Maul, a musician, music label owner, and NFT creator based in Barbados. Maul recently [sold](https://urbit.holders.land) a set of customized Urbit NFT artwork, which came bundled with actual Urbit IDs.
40+
41+[Other Life](https://www.otherlife.co), a community of philosophers and creators founded by the entrepreneurial Justin Murphy.
42+
43+The Stack, an entertaining and informative podcast with a decidedly Urbit flavor, hosted by Josh and Andy.
44+
45+[door.link](https://www.door.link), a vibey and idiosyncratic music collective.
46+
47+[Wet Brain](https://www.patreon.com/wetbrain), a numinous, post-everything New York podcast, hosted by Honor and Walt.
48+
49+Internet Weirdness Task Force, which has no legacy internet site to link to, so you’ll just have to get on Urbit to scope it out.
50+
51+
52+Over the last ten years, we’ve already had a taste of what blockchains can do: they’re great so far for distributing a financial ledger so that payments are no longer centralized. But for online communities to go truly peer-to-peer and escape the grip of corporations, they’re going to need something like Urbit. As HOLDERSLAND founder Haleek Maul [puts it](https://urbit.org/blog/haleek-maul-interview) in a recent Q&A, decentralized technologies like blockchain or Urbit “allow . . . new financial relationships and funding structures to emerge. Rather than have a few people contribute $20k, you can have hundreds of people contribute $100.” In such a system, recording artists no longer need to hunt for a deal from sharky impresarios; their communities can comprise both the talent *and* the executives. They no longer need to pay fealty to streaming services; they can sell their wares peer-to-peer, with the old-fashioned connoisseurship of a cool record shop, except that this record shop is available to anyone across the globe.
53+
54+Urbit makes this dream a real possibility. In an Urbit future, utilizing your own personalized payments system, which could take either fiat or crypto, should be as easy as sending or receiving money on apps like Venmo or Cash App is today. If *anyone* can make a direct peer-to-peer payment to anyone else on the network, if *anyone* can send a piece of writing or audio or video clip in a peer-to-peer way to anyone else on the network, then you’ve truly laid the groundwork for autonomous organizations of creators.
55+
56+Beyond that, Urbit is one of the very few platforms looking, with seriousness and deep technical consideration, into the distant future. Whereas no one can say whether a mainstream platform like Facebook or Twitter will even *exist* in ten years (think just how much writing will disappear if those servers do shut down), Urbit is built with maximum durability in mind: one way to think of your urbit computer is as a [100-year computer](https://urbit.org/blog/the-100-year-computer). Whereas most software today is designed to break quickly and be replaced quickly, due to the instability of all of modern computing’s complex interlocking parts, Urbit was built as an overlay operating system, so that it can work no matter what’s running underneath, and thus serve as a resilient, permanent home for your digital world.
57+
58+Computers can still be used as magical tools for creative individuals, instead of as attention-draining machines—if that is indeed the future we want. For creators, the solution to the ever-growing problems of the internet is not in the hands of any national government, or some new application that mimics the architecture of old applications, or through some impracticable system of reduced screen time. The solution to these problems is, and always has been, to build a whole new system that works *for* the people instead of against them. That’s what Urbit is here to do.
59+]]></content:encoded>
60+ </item>
61+ <item>
62+ <title><![CDATA[Report from the field: Assembly 2021]]></title>
63+ <link>https://urbit.org/blog/2021-11-18-report-from-the-field</link>
64+ <guid>https://urbit.org/blog/2021-11-18-report-from-the-field</guid>
65+ <pubDate>Thu, 18 Nov 2021 00:00:00 GMT</pubDate>
66+ <content:encoded><
68+
69+Before Assembly I committed to write a ‘recap’ post for everyone who couldn’t make it. Originally I figured this post would be an opportunity to walk through the list of things that we shipped and showed off in Austin. But it turns out that the most important thing about Assembly was simply the way it felt to be there.
70+
71+I’m not sure it’s possible to really do the feeling in the room justice, but I’m going to try. Then I’ll get into the announcements and happenings for those of you who couldn’t make it.
72+
73+But first, a quick note:
74+
75+We ran Assembly under the [Chatham House rule](https://en.wikipedia.org/wiki/Chatham_House_Rule). Basically, you can talk about what happens at Assembly—but you can’t name anyone.
76+
77+I’ve run many of our Urbit events this way because I think it puts people at ease. Everyone in the room can just relax, connect with one another, and hang out without worrying about being named on the internet.
78+
79+I’ll try to abide by the Chatham rule in this post which is why no one is named specifically.
80+
81+
82+
83+New world energy -
84+
85+In the months leading up to Assembly we were totally focussed on using the event as a release date for a bunch of different lines of work. Coming out of that sprint, we didn’t really know what to expect. We wanted to make sure Urbit was ready for people to build on and that everything we were going to ship worked well. What we didn’t realize was just how emphatically people are <em>ready to build</em>.
86+
87+When I got up on stage on Friday night to welcome everyone I was really impressed by the room itself. It was packed with people who looked excited and motivated. The room just looked amazing. There were so many different kinds of people staring back at me. Some who I recognized from the earliest days of the project, and lots I had never seen before. I’ve been at my share of Urbit events, but this was something totally different.
88+
89+We didn’t have much scheduled during Assembly. Most of the time was unstructured to allow for freeform discussion, sunbathing on the lawn, and gathering at picnic tables. The panels that we did schedule will go down in history. Panelists discussed questions about creators, escaping reward systems, and the role of DAOs from governance to governments. There was hard money with a computer on it, Moloch shoes, community members grabbing the mic, and a talk written two hours before it was delivered about the relationship between centralization and decentralization when it comes to UX that blew our minds.
90+
91+I spent the weekend of Assembly in almost constant conversation with people building Urbit hardware, experimenting with different kinds of Urbit software, and thinking about incredible things like a Nock chip. I talked to the lead architect of a CPU from the 90s, a former senior US government official, an editor of a well-known literary magazine, the inventor of a new display technology, musicians whose work I already admired, a fragrance designer, writers, and, of course, lots of engineers and designers from many different backgrounds. Data scientists, systems hackers, language nerds, someone running a successful currency. I watched these people get projects off the ground, start raising money, plan the future of Urbit hosting companies, and plan new features for Landscape. I saw a last-minute warehouse party come together that kept people talking well into the early hours of the morning.
92+
93+Where did these people come from? All over the place. They have this incredible <em>new world energy</em>. They understand immediately, intuitively that Urbit has the potential to be a foundation for the society they want to live in. I’ve never seen anything like it.
94+
95+This energy seems to have come from the very practical work we do day-to-day: building Urbit, refining it, making it easier to use. The crowd at Assembly was somehow brought together by Urbit itself. It’s insanely exciting. It makes working on Urbit feel even more like a form of definite optimism. The system builds the community and the community builds the system.
96+
97+
98+
99+Urbit is ready to be built upon -
100+
101+Sometime in early 2021 we realized that there were many lines of work converging on a single theme: ‘Urbit is ready to be built upon’. This is the spirit we wanted to bring to Assembly, and it was very much in the room in Austin. Some of that feeling is still lingering on the network. I think it comes from some very concrete improvements that have been made to the system.
102+
103+We’ve always wanted Urbit to be maintained by a self-sustaining ecosystem and, early this year, we could see what needed to be done to really let others begin doing so. There were four parallel projects that came together to hit this milestone: Software distribution, star.market, developer and operator guides, and the Foundation roadmap. We talked about all of these things in the Assembly keynote (which you can watch [here](https://www.youtube.com/watch?v=ywj36TUtbS4)), but let’s touch on them one by one.
104+
105+Software distribution
106+
107+The most important thing that we shipped just before Assembly is the ability to actually package and distribute software over Urbit itself. It’s now possible for someone to build an app, package it up, and share it with a friend directly over the network.
108+
109+For their friend, the experience is incredibly nice. You can simply send someone a link and they can install the app and run it themselves, on their own urbit, right away. The whole thing is peer-to-peer, of course. There’s no app store, no vetting process. It’s networked software like it’s supposed to be: people computing together freely.
110+
111+We’ve been saying for years that we want people to build on top of Urbit and we always meant it. Now it’s possible in a way it never has been before. To check it out, watch [this segment](https://www.youtube.com/watch?v=MA8sqFi8Bd8) from Assembly.
112+
113+Software distribution can get better in _a lot_ of ways, and we’re continuing to work on it. But it’s live, and people are experimenting with it already. There’s Chess, there’s Pokur, there are video calls (although they’re still a little buggy). Everyone seems to love ‘pals’ and ‘zone’—but you’ll have to get on the network to check those out.
114+
115+star.market
116+
117+We’ve always used the address space to fund our work as one of the primary Urbit developers. As Urbit has become more useful, and address space has become more expensive, it’s more and more difficult for others to do this. The community saw the need for developers to easily use their granted address space to fund their work and a higher resolution for the Foundation to fund contributions to Urbit.
118+
119+This is what [star.market](https://star.market/) and the WSTR project are for. WSTR is an ERC-20 token that is backed 1:1 by ERC-721 Urbit stars. Unlike a star, a WSTR token can be fractionally divided, allowing for a broader distribution of ownership of Urbit. WSTR was built by the community over the past couple of months with no involvement from Tlon. Tlon did, eventually, help to put together star.market—the interface for interacting with the WSTR contracts safely and securely.
120+
121+I’ve come to think that WSTR can be a powerful tool for funding new Urbit projects. I’m excited to see what both our early community of developers and operators can do with it, as well as the nascent Urbit Foundation.
122+
123+Guides
124+
125+As we make it easier for developers to build software, operators to participate in the economy, and communities to make Urbit their home, we need to improve our documentation. We always like to do things bottom-up: the product work comes first. Well, the product is now live.
126+To this end we recently launched:
127+
128+[operators.urbit.org](https://operators.urbit.org/) collects all of the information about participating in the Urbit economy, running infrastructure nodes, and participating in governance in one place.
129+
130+[developers.urbit.org](https://developers.urbit.org/) has an overhauled program for learning about Urbit as a system and beginning to develop on top of it.
131+
132+[network.urbit.org](https://network.urbit.org/) allows anyone to explore the network. View galaxy transfers or how many planets a star has spawned.
133+
134+We’ve got a lot more planned in this area of work in the coming months, and these three sites are a great start.
135+
136+Urbit Foundation
137+
138+Over these past few years we’ve operated the Urbit Foundation as a ‘protocol’ inside of Tlon. Our goal has been to develop that protocol to the point that it’s refined, working, and can run on its own outside of Tlon.
139+
140+Josh has done an exceptional job running the foundation protocol at Tlon over the last year or so. He and I have been working closely together on everything that Tlon builds, while also coordinating our community of contributors. I’m very excited that the Foundation, with Josh as its Director, is now separating from Tlon as a fully independent entity focussed on supporting the ecosystem.
141+
142+Assembly was the perfect moment to begin formally separating out the Foundation and, as of a week ago, it is an independent entity. We’ve thought long and hard about how to make the Foundation an enduring, stable organization. Josh will be the first Executive Director but, ultimately, the Senate of Galaxies will elect the Board. This will keep the Foundation accountable to the network as a whole and I’m optimistic it can work well.
143+
144+If you’re on the network, you can read more about the Foundation in ~wolref-podlex/foundation.
145+
146+Assembly 2022 -
147+
148+I had more than a few enthusiastic people come up to me at Assembly and ask what we were planning for Assembly 2022. I have absolutely no idea, of course. We poured all our energy into making Assembly 2021 a success.
149+
150+Given what I saw in Austin, I’m pretty confident that next year we’ll be in completely new territory. The goal of this project has always been to build a completely new digital world. And now, it seems to be building itself.
151+]]></content:encoded>
152+ </item>
153+ <item>
154+ <title><![CDATA[The Promise and Paradox of Decentralization]]></title>
155+ <link>https://urbit.org/blog/2021-11-18-the-promise-and-paradox-of-decentralization</link>
156+ <guid>https://urbit.org/blog/2021-11-18-the-promise-and-paradox-of-decentralization</guid>
157+ <pubDate>Wed, 17 Nov 2021 00:00:00 GMT</pubDate>
158+ <content:encoded><
160+
161+Every so often, a platform will do something outrageous—changing its terms of use, kicking off API partners, restricting [the content category it was built on](https://www.theverge.com/2018/12/3/18123752/tumblr-adult-content-porn-ban-date-explicit-changes-why-safe-mode), banning Donald Trump, failing to ban Donald Trump, etc.—and we'll all realize we're utterly dependent on centralized entities that can make arbitrary and unaccountable decisions. Sure, you can build your own minimal Facebook or Twitter clone, if you really want, but can you build your own Cloudflare? How about your own payment network? If your company does something legal in your country but banned in America, and the US decides to sanction you, which leads to local banks cutting you off because they can't survive without access to the dollar, are you going to build your own reserve currency? Your own Taiwan Semiconductor Manufacturing Co. or ASML?
162+
163+There are, to varying extents, efforts to do all of the above. But what's worth considering is that <em>all of these bans happen through centralized actors running on decentralized systems</em>. The Internet was supposed to be a totally open set of protocols that anyone could interact with, and for a long time it was, and yet getting kicked off Facebook and Twitter means being exiled from public discourse. Banks are regulated, but every country can set up their own banking regulations, and different countries see the social role of banks very differently; for some countries they're a tool of economic planning, for others a way to help connect local companies to global markets, for others a source of money that can be channeled to politically favored groups. The chip industry was historically very open to new entrants; the transistor was developed at Bell Labs, and for political reasons AT&T licensed it to all comers at a low price.
164+
165+And yet all of these originally decentralized systems end up facing some degree of centralization.
166+
167+The promise of a decentralized system is that anyone can build anything they want, because no one owns it. There are three important features of this; two downsides and a caveat:
168+
169+- The first downside to "Anyone can build anything" is that "anyone" means <em>anyone</em>, and the people to whom decentralized systems are the most attractive are the ones who are banned from other systems, often for good reasons. Free speech absolutists want to be defending Aleksandr Solzhenitsyn or Eugene V. Debs or even Lenny Bruce, but if you want to get a sense for the typical piece of content enabled by a totally uncensored communications system, check your spam folder.
170+
171+- The second downside is that a lack of ownership means that no one is responsible when things go wrong. Bitcoin doesn't have a way to censor your decision to move money from one address to another or even a protocol-level sense of whether you're buying Alpaca socks or a rocket launcher. (nb: You are almost certainly not buying a rocket launcher with Bitcoin; you are at best getting scammed, and at worst [getting in trouble](https://www.justice.gov/usao-cdca/pr/los-angeles-county-man-pleads-guilty-federal-charge-attempting-obtain-biological-toxin)). But this also means that the protocol can't tell when you meant to send your life savings to your cold wallet and sent it to the wrong address instead.
172+
173+- The caveat is that, to quote a [<em>Diff</em> piece from last year](https://www.thediff.co/p/amazon-a-new-kind-of-antitrust-risk#:~:text=does%20it%2C%20too.-,Technology-Governance%20Fit,-Pondering%20Durian%20has) ($), "[A]ny decentralized order requires a centralized substrate, and the more decentralized the approach is the more important it is that you can count on the underlying system." This applies to cryptocurrencies (you can trust the protocols) and to the Internet (ditto). It also applies, in an interesting way, to the increasingly decentralized world of free trade and free-flowing capital: money can only flow and deals can only be made if everyone has a consistent sense of property rights and contracts, and the definition of those concepts will typically be determined by whichever participant in a transaction has the more sophisticated financial and legal system. Globalization ends up being a bit like Henry Ford's pitch: you can use any economic paradigm you want, as long as it's the American one.1
174+
175+An open, decentralized system is <em>sparse</em>: there's room for anything, which means that most of the possibility space consists of nothing at all. This creates a natural demand for onramps—Coinbase for figuring out Bitcoin, portals for figuring out the Internet, TSM for turning chip designs into functioning products, and the like. These create a complicated dynamic: these onramps are built on an open system, but part of their function is to close off some of it. And the better they do that, the more value they can capture. Meanwhile, because they have a monopoly on what they've fenced off, their economics support providing a better user experience. Make a really helpful update to the Bitcoin wiki, and you can feel good about yourself and perhaps contribute to the price of Bitcoin in a highly indirect way; design and launch an improved onboarding process at Coinbase and your contribution is quantifiable, and affects your next cycle's equity grants.
176+
177+This privatization proceeds in three different ways:
178+
179+- Some companies start building on an open protocol and then slowly make it their own. Chrome's decision to make the search bar synonymous with the address bar was a slight improvement in the interface, but also a very strong statement that Google had replaced manually typing in URLs as the default way to navigate. (The strongest evidence for this is the frequency of navigational searches; [the most commonly-searched term on Google](https://www.mondovo.com/keywords/) is "Facebook" and [the most frequently searched term on Bing is "Google"](https://www.bloomberg.com/news/articles/2021-09-28/google-tells-judges-it-s-so-popular-it-s-bing-s-top-search-term).) Typing in URLs is a sometimes-decent way to find what you're looking for, though [the half-life of links is about two years](https://blog.zomdir.com/2017/10/the-half-life-of-link-is-two-year.html). But guessing at URLs can be [perilous](https://en.wikipedia.org/wiki/Whitehouse.com). No one is responsible for fixing this, but Google is the closest approximation, because what they are responsible for is solving the "look for something on the Internet and get the wrong result" problem, a different but related one from the broader task of allowing arbitrary site owners to host arbitrary content. Privatizing is effective, and solves problems for users rather than protocol designers. But it does go against the spirit of the original network.
180+
181+- Twitter is another example, except that they basically created their own open mostly-open protocol and then slowly took control of it. Tweets were originally a simple format, with 140 characters of text and a bit more metadata (this made it compatible with SMS, which had a 160-character limit). For a while, Twitter looked like it would operate a novel protocol and let third parties decide what to put on it and what to read off it. And then the company started to realize that an open system was also one where it was trivial to filter out ads and recommendations. So the outside partners gradually got cut off.
182+
183+- Facebook—the product, not the company—is a third example. It essentially implemented a missing element to the protocol: <em>identity matters</em>. When the original protocols were being hammered out, identity was a problem taken care of by the fact that getting online required steep hurdles; if everyone involved is affiliated with a university that trusts them to use a PDP-10 responsibly, spam or abuse were not big concerns. (Not that early usage was [strictly professional](https://www.theguardian.com/science/2013/apr/19/online-high-net-drugs-deal).) With billions of people online, accessing relevant information can mean traversing a graph of people rather than links, so the identities of those people becomes important. To the user, if not to the network itself, a name and relationship is a far more important unique identifier than an IP address.
184+
185+This pattern raises a question: is centralization just a natural tendency of all networks? Are we destined to have a "decentralization sandwich," where there's a hard-to-change set of protocols, something open built on top of <em>that</em>, and a series of closed systems built on top of that, which are the only ones the average person interacts with?
186+
187+One of the interesting alternatives to this is [Urbit](https://urbit.org), which is trying to build a network in which identity exists from the start, and is neither free nor monopolized. One of Urbit's principles is that users own their data, and while they can use third-party services, they're sharing their data with services, not using a login to access information that lives on someone else's servers.
188+
189+This is a nice theoretical solution to the "build your own" problem above: if someone tries to start Twitter-but-without-banning-X, they begin with "Twitter-but-it's-100%-X," which seems bad until they reach the next stage where trolls arrive and they start to learn that Online Censorship is mostly about spam and gore and only occasionally about politics. But if they're moving their data around, and their friends graph with it, then spinning up a separate instance of the same service, pulling in the same content from their friends, and whitelisting someone who's blacklisted elsewhere is a lot more feasible.
190+
191+At least at first. One of the problems with owning your own data is that it ignores the question of what format that data is in. Data formats are sometimes considered carefully, but they can also be hammered out fast to get a minimum viable product out the door. Then they evolve over time, accumulating cruft and complexity, until they might as well be encrypted.
192+
193+And indeed, what's to stop someone from having a proprietary format that's literally encrypted? Or one that gets changed to an encrypted version later on? This is not a trivial point; if you're ever in a position where you absolutely have to share some information that you want to keep secret, the smartest thing to do is share a huge amount of confusing and poorly-explained information, or use an [annoying but technically accurate format](https://www.vice.com/en/article/gv5vxb/crypto-keys-printout-of-edward-snowdens-email-service-lavabit-ladar-levison). Strict and unalterable rules are no match for determined adversaries, whether they're trying to play a prank, make a point, or maximize shareholder value.
194+
195+But the data format questions are not rhetorical: there is actually an answer of sorts, though it's a frustrating one. Software systems are not just lines of code, but the entire extended system of people who maintain, host, and build on platforms. And the norms of those communities can push back against market pressures. I've been spending an increasing amount of time around Urbit users and devs, and they really do view the current centralized model of the Internet as anathema. They are aware that the fun apps we use are all either designed to be addictive from the start or subject to relentless evolutionary pressure to get more addictive. There's a history of [norms evolving in response to new addictive behavior](https://gist.github.com/jm3/6724931). And Urbit's architecture is a lot closer to norms than to the clumsy mechanism of laws; instead of centralized services that own data, there's a set of 256 Urbit identities that can route messages between users. Instead of single points of failure, there are a few hundred fallback options; instead of the binary of on-Facebook-or-anathematized, there's a 2^8 bit gradient.
196+
197+One possibility for the successor to the current Internet is that it will end up being a system designed to support communities that achieve cohesion based on which forms of addictive or socially corrosive technology they reject. Sort of a digital version of the Amish, [not rejecting technology wholesale but carefully considering every new technology before adopting it](https://kk.org/thetechnium/amish-hackers-a/). If you assume that the pace of change in consumer-facing Internet stays high, and that it gets more compelling over time, then in the long run the only options are a) be careful what you use, or b) accept that you're outsourcing a growing share of your decisions to product managers and growth hackers who do not necessarily have your interests at heart.
198+
199+Norms are not a perfect solution to these problems (if they were, we'd only know about issues like novel addictive behaviors, monopolies, and the homogenization of entertainment from history books). And technology can't fully solve social problems. But it can certainly have an effect on them—"you can't solve a social problem with technology" is a good guideline, but technologies mitigate them all the time. What's a streetlight if not a technological solution to the social problem that there are places where it's dangerous to be out when it's dark? What's asymmetric-key cryptography if not a technological solution to the social problem that it's hard to keep secrets? There's still a fundamental tension with open systems, where they get mature enough to be useful at which point the median user's priority is getting things done rather than adhering to the network's original design principles. But a design that recognizes this from the beginning, and a community that wants to make it happen, can stave off decline for a long time. And that's the positive story of technology: we're all fighting against entropy, which is a hard fight to win, but there are long and fascinating stalemates ahead.
200+
201+(Disclosure: I'm long decentralization by way of Bitcoin and Urbit. If you're on Urbit and would like to discuss <em>The Diff</em>, go to ~lableg-tadrex/the-diff.)
202+
203+<sup>1.</sup> There is naturally some resistance to this, both because of conflicts with different countries' norms and with other countries' natural desire to determine their own destiny. So it's a leaky abstraction, but it gets less leaky over time as economies get more integrated and thus more of the world has to standardize. The most direct example of this is the fact that [the dollar's share of global invoices is 4.7x the US's share of global imports](https://www.economist.com/schools-brief/2020/08/27/global-trades-dependence-on-dollars-lessens-its-benefits) ($, <em>Economist</em>). In the same way that English is most likely to be the shared second language of any two randomly-selected people who don't speak it as a first language, the dollar is most likely to be the second most useful currency to anyone in a country that doesn't use dollars.
204+]]></content:encoded>
205+ </item>
11206 <item>
12207 <title><![CDATA[NFTs, Urbit IDs, and Communities w/ Haleek Maul]]></title>
13208 <link>https://urbit.org/blog/haleek-maul-interview</link>
@@ -969,2199 +1164,1917 @@ only place code is accumulating.
9691164]]></content:encoded>
9701165 </item>
9711166 <item>
972− <title><![CDATA[Lunar Urbit and the Internet of Things]]></title>
973− <link>https://urbit.org/blog/iot</link>
974− <guid>https://urbit.org/blog/iot</guid>
975− <pubDate>Thu, 29 Apr 2021 00:00:00 GMT</pubDate>
1167+ <title><![CDATA[A brief update from urbit.org]]></title>
1168+ <link>https://urbit.org/updates/2021-05-05-update</link>
1169+ <guid>https://urbit.org/updates/2021-05-05-update</guid>
1170+ <pubDate>Tue, 04 May 2021 00:00:00 GMT</pubDate>
9761171 <content:encoded><
1174+Welcome to the May edition of the urbit.org newsletter. April was a busy month with many updates to share—let’s dig in.
9801175
981−<br>
1176+0 – Updated Urbit Binaries
9821177
983−Each of the ~4B 32-or-fewer-bit or [Azimuth](/docs/glossary/azimuth)
984−identities, namely [planets](/docs/glossary/planet),
985−[stars](/docs/glossary/star), and [galaxies](/docs/glossary/galaxy), may
986−spawn ~4B 64-bit child identities known as [moons](/docs/glossary/moon).
987−Moons are the undeveloped wild outback of Urbit, with a story waiting to be told
988−that promises to be as enormous in scale as the cloud personal computing story
989−told by planets, and possibly even more so.
1178+Urbit’s binaries were updated to v1.5 on April 27th. Make sure to download and install the latest v1.5 binaries here: https://github.com/urbit/urbit/releases/tag/urbit-v1.5
9901179
991−Throughout this piece, we use "Earth" and "Mars" in the Urbit sense. "Earth"
992−refers to the [current computing
993−paradigm](https://en.wikipedia.org/wiki/Big_ball_of_mud). "Mars" refers to the
994−perfected computing paradigm that Urbit aspires to be, but also to the current
995−and future state of Urbit.
1180+It’s as easy as shutting down your ship and replacing the old binaries! ~pilfer-pandex described the new release to urbit-dev as “a high priority fix for two networking bugs in urbit-king, and minor fixes to vere.”
9961181
997−Today we will review the prehistory of moons on Earth, give a snapshot of how
998−moons are being utilized on Urbit in 2021, cover existing issues with consumer
999−IoT and how Urbit resolves them, and speculate what the lunar locus of the Urbit
1000−ID address space may become in the future. To keep the futurist scope limited,
1001−we primarily speculate on the usage of moons in (industrial) internet of things
1002−settings, especially with respect to agriculture, and how they may manifest as
1003−the workhorse collection unit of decentralized data markets.
1182+1 – Upcoming Events
10041183
1005−For those unfamiliar, moons differ from all other
1006−[ships](/docs/glossary/ship) in that they are not independent identities
1007−with total sovereignty over their data and keys. Instead, their cryptographic
1008−keys are issued and controlled by their parent identity. The relationship
1009−between the keys of a parent ship and its moons are analogous to the
1010−relationship between primary keys and subkeys in a system like
1011−[PGP](https://en.wikipedia.org/wiki/Pretty_Good_Privacy). The parent may revoke
1012−or change its child moons' keys at any time. A typical relationship between a
1013−planet and a moon may be like one of a human and their smartphone. If you lose
1014−your phone, you don't want someone to pretend they are you, operating one of
1015−your moons, on the network. The planet can revoke the keys, and the moon stored
1016−on the phone becomes inert, no longer able to communicate with the network.
1017−While planets and stars also depend on their sponsor to assist with peer
1018−discovery and software updates, these relationships rely on mutual agreement,
1019−since either party may choose to discontinue the relationship and establish a
1020−new one elsewhere. Moons possess no such freedom.
1184+Urbit Town Hall @ May 20th 12pm PDT – Keynote from Justin Murphy
1185+This will be Urbit’s first ever town hall—a three hour event with talks on a variety of topics and a keynote from Justin Murphy (~hatryx-lastud). Justin had Urbit Foundation Director Josh Lehman on his Other Life podcast a few weeks ago (have a listen at https://share.transistor.fm/s/1c0c8c15) and recently formed a new group on Urbit (~hatryx-lastud/other-life).
10211186
1022−### Lunar prehistory
1187+In his group, Justin has written a blog post called “Escape Velocity”, where he discusses selection effects on various platforms. Justin writes, “by creating a gravity well that sucks energy into real-estate value rather than monetized attention, Urbit exerts the lowest degree of arbitrary selection pressures on content creation, while optimizing those selection pressures that irreducibly characterize all human communication (e.g., the draw of being understood and appreciated by other people).” Tune in to Justin’s keynote on the 20th for more on Urbit as a platform for creatives.
10231188
1024−
1189+Developer Calls @ May 13th and May 27th
1190+As you probably know, we have developer calls every two weeks. Stay tuned for more information on our events page: https://urbit.org/events
10251191
1026−It may come as a surprise to you that you are already very familiar with moon
1027−identities—they've just never been explained as such because the context in
1028−which that terminology makes sense didn't exist before Urbit. Moons, in fact, are not
1029−a new concept at all. Virtually your entire experience of the internet in the
1030−modern era is the experience of someone who possesses some number of moons
1031−subordinate to planets who mostly refuse to talk to one another. The feeling you
1032−get of constantly moving between silos, juggling accounts, not controlling your
1033−own data, etc., is a direct result of the fact that, on Earth, you only possess
1034−moons. No planets.
1192+Austin Urbit Conference @ September/October 2021
1193+Although it’s too early to give a precise date, we are starting to plan an Urbit conference for this fall! It’ll be held in Austin, with many Urbit and Tlon employees in attendance. Stay tuned for more information!
10351194
1036−We're speaking, of course, of the client-server relationship. From the Urbit
1037−perspective, the Facebooks, Twitters, and Googles of the world are planets, and
1038−accounts held with these services may be thought of as moons subordinate to
1039−those planets. Your account with these megacorps is only yours for as long as
1040−they please. If you happen to step on a digital landmine, such as a virus that
1041−causes Google's servers to believe you are a bot, you are suddenly banned from
1042−their service, often with no recourse. All your data, your connections, your
1043−network—vanished. We are all Mark Zuckerberg's moons, and they're armed to the
1044−teeth with surveillance equipment.
1195+2 – April Developer Calls
10451196
1046−There are two classes of internet users: those with servers who hold all the
1047−power, and clients who use those servers in the way prescribed by the owners.
1048−Running a server is theoretically accessible to anyone, but practically
1049−difficult: server maintenance is a technical endeavor that requires specialized
1050−knowledge and substantial time investment. Other barriers exist beyond just the
1051−technical: for instance, if you wish to set up your own email server, you will
1052−probably be blocked by large providers because unknown email servers are almost
1053−always spam. The root cause of this circumstance is that the email protocol
1054−lacks [Sybil resistance](https://en.wikipedia.org/wiki/Sybil_attack). Urbit has
1055−Sybil resistance built in, eliminating certain kinds of incentives for
1056−gatekeeping such as this.
1197+Developer Call: 3rd Party Software Distribution
1198+In this talk, Phil (~wicdev-wisryt) and Raghu (~sovmep-ripsum) discussed the work they've been doing to clay to provide "virtual desks", an integral part of the infrastructure needed for safe, generic software distribution. This work is being done through our Scholarships program, in which community developers pair up with Tlon engineers to work on infrastructure projects. For more information about Scholarships, visit https://urbit.org/docs/development/grants/#scholarships
10571199
1058−We seek to level the playing field by giving everyone a server. We accomplish
1059−this by making the process of running your own server (planet) as easy as
1060−running your personal computer today. We aren't quite there yet, but we've made
1061−leaps and bounds over the past couple of years.
1200+Developer Call: Real-Time Communication on Urbit
1201+Edward Amsden (~ritpub-sipsyl) gave us a look at the WebRTC Airlock library he has developed that handles the hard parts of WebRTC. When complete, this will allow developers to build applications on Urbit with audio/video calling capabilities. Once again, Edward’s work is sponsored as part of the grants program (https://grants.urbit.org)—check it out!
10621202
1063−Of course, this analogy isn't perfect—Urbit moons are servers themselves, but as
1064−they may only act in accordance with the wishes of its parent, they are
1065−effectively as locked in degrees of freedom as a client is to a server. The
1066−moon's keys may be revoked at any time by the parent. To distinguish these
1067−prehistoric moons from Urbit moons, we will refer to them later as "primitive
1068−moons".
1203+3 – Urbit Bitcoin Launch
10691204
1070−Urbit contends that moons are not the appropriate digital exocortex for a
1071−responsible adult. They are for devices, experiments, or your children. We hope
1072−that the dominant server-client relationship, which is the primary weapon of the
1073−surveillance-industrial complex, will meet its end in the near future.
1205+This was a hotly anticipated event and it didn’t disappoint. In case you missed it, Urbit will soon have a Bitcoin wallet on the network, meaning you’ll be able to pay Urbit ships directly in BTC. Watch Urbit-Tlon personnel demonstrate and discuss this exciting launch: https://www.youtube.com/watch?v=_aRnfacZPto
10741206
1075−### Moons in the early Martian era
1207+Make sure to check out this related blog post by Christian Langalis (~pindet-timmut): https://urbit.org/blog/interplanetary-commerce/ and this great interview with ~timluc-miptev, one of the main developers on the project: https://subject.network/posts/bitcoin-with-timluc-miptev
10761208
1077−
1209+4 – Blog
10781210
1079−In 2021, moons are mostly unused on Urbit. There's a smattering of minor use
1080−cases which we'll describe here, but they represent only a tiny fraction of
1081−their ultimate potential.
1211+We have a couple of new posts to announce:
1212+“Lunar Urbit and the Internet of Things”
1213+This post is by Poprox (~datnut-pollen), a Tlon engineer who focuses on the importance of moons in the Urbit ecosystem. The post covers “the prehistory of moons on Earth, gives a snapshot of how moons are being utilized on Urbit in 2021, covers existing issues with consumer IoT and how Urbit resolves them, and speculates what the lunar locus of the Urbit ID address space may become in the future”. Read it here: https://urbit.org/blog/iot/
10821214
1083−Tlon recently launched a survey bot called [Eliza](/blog/eliza), which was
1084−initially a comet. We frequently got questions on whether Eliza was actually
1085−Tlon's bot, because it could just as easily be a malicious actor posing as Tlon.
1086−We soon plan to relaunch Eliza as a moon of `~zod`, which is the most
1087−recognizable official galaxy of Tlon. This is to establish that the bot is
1088−indeed official; only someone with access to `~zod` is capable of creating a
1089−moon of `~zod`, and so a moon of `~zod` automatically carries with it a
1090−cryptographic guarantee that you are communicating with an official digital
1091−representative of Tlon. On Earth something like this would need to be
1092−accomplished with certificate chains but, on Mars, this sort of authentication
1093−is baked into the very fabric of the network, rather than as an additional layer
1094−on top. This is a very good representative case of how moons naturally inherit
1095−the reputation of their parent, even in the absence of any formal reputation
1096−systems on Urbit.
1215+“Community Spotlight: The Portico”
1216+This post is an interview between me (~tirwyd-sarmes) and Josh Reagan (~taglux-nidsep), the founder of “The Portico”, an Orthodox Christian community. Josh has a PhD in logic, and writes about the intersection of Christianity and logic on his Urbit blog. In the interview we talk about community norms, the relationship between logic and religion, and the future of Urbit. Check out the interview: https://urbit.org/blog/community-spotlight-the-portico
10971217
1098−We see folks using moons as backup identities in case they can't or don't want
1099−to access their primary planet for one reason or another. Again, since anyone
1100−may verify the parent of a moon, the moon inherits the reputation of its parent.
1101−These backups could be vanity identities—for instance, every `~sampel-palnet`
1102−has underneath it a moon named `~master-sampel-palnet`[^0].
1218+5 – Odds and Ends
11031219
1104−Some use moons to host group(s). Hosting a group inevitably means that that ship
1105−will process more network traffic, and a heavily trafficked group may impact a
1106−ship's performance. Thus one may wish to offload group hosting duties to a moon
1107−to maintain a more performant planet.
1220+If you are a star or galaxy owner and are interested in sponsoring other ships, please message ~rapfyr-diglyt (david@tlon.io) to be added to the sponsors@urbit.org mailing list.
11081221
1109−As we currently lack a real system for 3rd party software distribution (though
1110−see this recent [developer call](https://youtu.be/XwICC6Its1E) on a solution in
1111−progress), one stopgap has been to download software by syncing a foreign
1112−[desk](/docs/glossary/desk) to your ship. This is risky, as buggy software
1113−may make break your ship and make it difficult to get running properly again.
1114−For this reason, testing new software on the livenet is frequently performed on
1115−moons, so as not to risk the parent ship if something were to go wrong.
1222+~hodzod-walrus made a page with statistics on various stars: https://bacrys.org/uptime/
11161223
1117−### Internet of Things
1224+~sitful-hatred beat us to the punch and released a guide on compiling Windows binaries—urbit.exe is near at hand! See the guide here: https://subject.network/posts/urbit-windows-binaries/ The official Urbit.org announcement should be around the corner, so keep your eyes peeled.
11181225
1119−
1226+Thanks for reading. Talk to you next month!
11201227
1121−Now we start to look towards the future by examining the problems faced by IoT
1122−in the present and speculating on how Urbit might solve them.
1228+Josh (~wolref-podlex) and ~tirwyd-sarmes
11231229
1124−The Internet of Things is much maligned by technologists as a privacy, security,
1125−and maintenance nightmare. These products usually depend on phoning home to
1126−perform their service, which is inevitably a funnel by which personal data is
1127−harvested, an attack surface for hackers to gain access to your home network,
1128−and a single point of failure which may render the device useless, all in one!
1129−One need look no further than the recent [Ubiquiti
1130−breach](https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-breach-catastrophic/)
1131−to see all of these failure modes happening on a massive scale, and this is par
1132−for the course. This sort of dynamic is completely antithetical to the Urbit
1133−philosophy, so any involvement of Urbit with IoT will reject many fundamental
1134−assumptions on how IoT operates today.
1230+https://twitter.com/urbit
1231+https://github.com/urbit/urbit
1232+]]></content:encoded>
1233+ </item>
1234+ <item>
1235+ <title><![CDATA[Community Spotlight: The Portico]]></title>
1236+ <link>https://urbit.org/blog/community-spotlight-the-portico</link>
1237+ <guid>https://urbit.org/blog/community-spotlight-the-portico</guid>
1238+ <pubDate>Mon, 03 May 2021 00:00:00 GMT</pubDate>
1239+ <content:encoded><
11351241
1136−However, it's important to understand why the current IoT model works like this
1137−at all. We posit that it ultimately stems from the fact that today's IoT
1138−products are primitive moons for which you do not operate the parent planet.
1139−Almost every IoT device operates in the Software as a Service (SaaS) paradigm
1140−because most people don't have personal servers that could do all the processing
1141−work actually necessary for an IoT device to operate. This is not the _only_
1142−reason for this—it's also just more profitable to collect consumer data.
1143−However, it's the SaaS aspects which make the whole thing such a catastrophic
1144−mess.
1242+_One of the most striking things about Urbit is the ideological diversity between communities. The Community Spotlight blog series will focus on various Urbit communities via interviews with founding members._
11451243
1146−Imagine a different world: if the server that your device reports to is your
1147−own, there is no loss of control over personal data. If the device only
1148−communicates on the local network, it will prevent remote hackers and disruption
1149−if you internet fails. And if the manufacturer goes out of business, the device
1150−will still work-it is not dependent on the manufacturer's servers.
1244+For the first week of the Community Spotlight series, I (~tirwyd-sarmes) will be speaking with Josh Reagan (~taglux-nidsep). Josh is the founder of The Portico, an Urbit community of Eastern Orthodox Christians.
11511245
1152−The wants and needs of the individual are at odds with the wants and needs of
1153−the megacorp, and that mismatch manifests as the antifeatures that plague IoT.
1154−By eliminating the SaaS aspect, Urbit solves many of the largest outstanding
1155−issues with IoT in a single blow. Digital personal AI assistants have long been
1156−an anticipated science fiction prediction and their full realization is on the
1157−horizon. But in their current manifestation, many privacy- and
1158−security-conscious people would never consider using them at all, since they are
1159−inevitably presented as SaaS that requires intimate knowledge of your devices
1160−and their stored data. Recommendation engines such as the one used by YouTube
1161−offer helpful guidance towards content you'll find appealing, but they're also
1162−designed to keep you hooked to the service. These kinds of programs can be
1163−useful, but they're dystopian when they come saddled with anti-consumer
1164−subroutines. Since your Urbit belongs to you, it can never act against your own
1165−interests without your consent. In our lunar vision, your digital personal AI
1166−assistant will live on one of your moons, rather than on megacorp's cloud.
1246+The Portico is a very active group with conversations taking place over multiple channels. There are channels for posting Orthodox iconography, discussing the broader Christian culture war, and just talking about Orthodoxy in general. Of particular interest is Josh’s “Euthyphro” blog series which investigates the relationship between logic and the Orthodox faith. This is a topic that Josh is well qualified to talk about: he has a PhD in Philosophy from Rice University. His dissertation on the epistemology of logic and truth-preservation was titled "Knowing Your Limits: Logic for Limited Beings”. Josh is also the co-author of a forthcoming textbook on formal logic.
11671247
1168−For web-exposed devices, Urbit offers the same security guarantees that it
1169−offers for your personal computer: everything is end-to-end encrypted by
1170−default, and signed with keys that one can easily verify as belonging to the
1171−node sending the message.
1248+To read Josh’s blog is to be inducted into two esoteric traditions: theory of logic and Orthodox theology. With titles like “St. Gregory the Theologian and the Liar Paradox” and “The Existence of Abstract Objects”, Josh does not pull punches.
11721249
1173−[Vint Cerf](https://en.wikipedia.org/wiki/Vint_Cerf) has outlined the case for a
1174−system like Urbit ID for IoT use
1175−[here](https://cacm.acm.org/magazines/2018/12/232883-self-authenticating-identifiers/fulltext).
1176−In brief, that the Urbit ID system allows one to match public keys with devices,
1177−bestowing devices with self-authenticating identities. This allows one to trust
1178−the communications received from the device to whatever degree the private key
1179−is held secure. IP addresses, GPS coordinates, MAC addresses, etc., are not
1180−sufficient to generate high levels of trust—they're all temporary, easily
1181−spoofed, or both.
1250+Accordingly, our conversation focused on the idiosyncratic and niche community that The Portico is home to. There, you won’t find cussing or much talk about “life partners”, but you will find cutting critiques of liberalism and the best way to raise Orthodox children.
11821251
1183−> One might imagine applying this to the Internet of Things (IOT) in which the
1184−> IOT device self-generates a public- and private-key pair and registers the
1185−> public key. For example, with a hub or controller so the hub can confirm it
1186−> has reached the right IOT device. By the same token, configuration of the IOT
1187−> device into an ensemble could include incorporation of the public key of the
1188−> controller into a list of valid devices that can command or obtain data from
1189−> the now-configured IOT device. Both ends can verify they are talking to the
1190−> originally configured devices, assuming no device has lost its private key.
1252+As other users have pointed out, Urbit is pre-[Eternal September](https://en.wikipedia.org/wiki/Eternal_September). In fact, there’s some hope that the very nature of Urbit, how it tries to protect the sovereignty of niche communities via decentralization, might foil the Eternal September phenomenon. If Josh’s community persists, it will be a testament to both Josh and the decentralized Urbit network. As of now The Portico is a refreshing, perhaps jarring (as Josh might say), reminder of what the internet looked like back in the early days—a place for those who are different.
11911253
1192−Here, the hub or controller referred to would be your planet.
1254+I encourage you to take a look. Find The Portico at ~topnup-firber/the-portico.
11931255
1194−Urbit has many other features that make it well-suited for IoT, above and beyond
1195−eliminating the SaaS model and providing self-authenticating identities. Many of
1196−these additional advantages derive from the fact that Urbit is a [solid state
1197−interpreter](/docs/arvo/overview#solid-state-interpreter) and that
1198−[Ames](/docs/glossary/ames) is a network of solid-state interpreters
1199−equipped with cryptographic identity. We explore this in the next section.
1256+\-\-\-\-
12001257
1201−### Future lunar cosmotechnics
1258+**Do you see any connection between Rod Dreher’s _The Benedict Option_ and your community on Urbit? Dreher sees a need for American Christians to create self-sustaining communities outside of the mainstream to protect the Christian religion and culture.**
12021259
1203−
1260+It’s tough to say with certainty—I’ve never read _The Benedict Option_.
12041261
1205−We now polish off the old crystal ball and imagine future uses of Martian lunar
1206−technology. Particularly, how the tech may develop over time once it becomes
1207−widely exposed to the evolution-inducing forces of industry and culture. This
1208−section is pure speculation, and I only aim to offer a small glimpse of a
1209−potential future, rather than an exhaustive one. This picture will necessarily
1210−be biased by my personal proclivities and expertise, or lack thereof.
1262+A few years ago, while he was writing the book, I was a regular reader of Dreher’s blog. From his descriptions there, I was never clear about what exactly he was proposing. Much of his “clarification” came by way of metaphor: don’t “run for the hills”, but stop “shoring up the American imperium”. I didn’t read his book because I didn’t have much confidence that he would be especially precise or insightful.
12111263
1212−Any discussion on the future of moons is incomplete without mentioning the
1213−possibility of [lunar emancipation](https://urbit.org/faq/#more-planets) in
1214−order to increase the number of planets. This fascinating topic sees regular
1215−discussion in the Urbit Community group, but is outside the scope of this
1216−article.
1264+[There is an interesting review I’d recommend](https://handleshaus.wordpress.com/2020/10/06/review-of-rod-drehers-live-not-by-lies/), however, of his later book, _Live Not By Lies_. I believe it accurately characterizes the scale of the threat Christians will soon face in this country.
12171265
1218−In order to respect the reader's time, I'm narrowing our scope to a particular
1219−topic: the agriculture industry. I'm also assuming a future with specialized and
1220−increasingly small hardware to run Urbit. Right now, a 4 GB Raspberry Pi is the
1221−standard for "small Urbit". If someday there are CPUs specifically designed for
1222−running [Nock](/docs/glossary/nock), one could imagine going much smaller.
1223−Ultimately, I'm going to assume that there will someday be [solid-state
1224−interpreter](#ssi) microcontrollers - so the inclusion of Urbit on a device may
1225−require nothing more than a couple [surface-mount
1226−devices](https://en.wikipedia.org/wiki/Surface-mount_technology) on a larger
1227−chip.
1266+My upbringing was conservative Christian and self-consciously counter-cultural. I've inherited that understanding of what it means to be a Christian in an increasingly secular world. It comes naturally to me, so I find it obvious that Christians should form self-sustaining communities. But the details matter. What do such communities look like? How do we secure the freedom to pursue such communities? How do we sustain them, when myriad external forces seek to undermine them? How do we solve the long-term problem of the declining cultural importance of Christianity (which surely erodes the plausibility of our religion to many, even to some of those with sympathies toward it)?
12281267
1229−Urbit is intended first and foremost as a personal computer. When I unravel its
1230−potential usage in industry, I adopt the forecast of a drastic increase in the
1231−manufacturing capacity for individuals and small groups. Agriculture is a great
1232−microcosm of this long-standing trend; less human input is needed to produce the
1233−same amount of food, whether it be crops or livestock. The modern era is
1234−distinguished by the fact that small numbers of people can manage enormous farms
1235−which produce food for vast populations. Thus, computation on modern automated
1236−farms may be thought of as existing at the intersection of both personal and
1237−industrial scale, and show how computerized and mechanized workflows add to the
1238−amazing productivity of modern farms and demonstrate that individual-sized
1239−inputs are able to create industrial-sized outputs. I predict that the set of
1240−trades for which this dynamic holds will only increase over time.
1268+I don’t claim to know the answers to these questions.
12411269
1242−Agricultural automation has been a primary engine for the growth of
1243−civilization, but it has been hampered by the downsides of IoT elaborated in the
1244−previous section. One bellwether of this dynamic is the right to repair one's
1245−own equipment. [John
1246−Deere](https://www.thetruthaboutcars.com/2020/03/its-payback-time-right-to-repair-movement-targets-john-deere/)
1247−has long been at the center of this controversy. Farmers have lost the ability
1248−to repair their own equipment due to vendor locks and a dependency on remote
1249−servers. Furthermore, any suite of sensor products designed to gather important
1250−data such as genomics, hydrology, soil health, weather, etc., inevitably only
1251−cooperate with other products by the same vendor. It's the same story all over
1252−again—you are a client of a megacorp server. Or in Urbit terms, you have a bunch
1253−of primitive moons belonging to different planets held by megacorps, and no
1254−planet to call your own.
1270+One kind of answer is that we should redouble our efforts to support and maintain a religiously and morally neutral liberal political order, which leaves room for subcultures to live and self-regulate as they wish. I disagree. Those who support a kind of “neutral” liberalism view it as an attempt to go “meta” and rise above various parochial metaphysical, moral, and religious disputes. I view this as a cop-out, a refusal to grapple with the most important questions.
12551271
1256−Again, Urbit resolves these issues in the same fashion as above. One might argue
1257−that using Urbit is another form of vendor lock-in—but this is evaluating Urbit
1258−at the incorrect level. Since Urbit is an open source operating system, its
1259−functionality may be extended and modified arbitrarily by any party. _Some_
1260−computational infrastructure is necessary— that fact can never be escaped. But
1261−you can escape from closed source software that does not permit you to modify,
1262−to open source software that allows you to tinker at will. Thus we do not
1263−consider open source software to be a form of lock-in, or at least, it's a much
1264−milder form of lock-in compared to something like Apple's walled garden.
1272+Does the liberal have metaphysically-rooted moral reasons for going “meta”? If so, then he’s just another sectarian and he should be honest about it. The only difference is that his team has had the whip hand for the last several generations. On the other hand, if the liberal claims no underlying metaphysical justification then his project can succeed only to the extent that he can arrange and adjudicate unprincipled (and therefore ad hoc) agreements between otherwise hostile moral communities. But how stable can such an arrangement really be?
12651273
1266−So let us focus on the additional meritorious aspects of Urbit (or more
1267−generally, solid state interpreter networks) that make it not merely a band-aid
1268−to the broken IoT system but a permanent and sound replacement.
1274+Orthodox Christians have theologically rich, metaphysical foundations for their social and moral teachings. With these we can form healthy, thriving, and growing communities. We can do so even under actively hostile political orders. If the early Church could make it under the Romans, so can we today. But it’s going to be difficult and sound judgment is necessary. Unfortunately, we lack strong leadership and that leaves us vulnerable. If we stay uncoordinated we dissipate our energies needlessly. If we latch onto the wrong leaders we can be led astray.
12691275
1270−#### Solid state interpreter networks {#ssi}
1276+The challenges are immense. There is no technological solution. Even so, I’m an Urbit early-adopter for a reason. Over the years I’ve come into contact with a number of Orthodox and Ortho-curious Urbit followers. Why not try to bring them together in an Urbit group?
12711277
1272−
1278+As far as I know, no one in the group is clergy. We’re all just a bunch of laymen with no authority to do much of anything. But I’d like to think we can still contribute in some way. I have an academic background in analytic philosophy so my inclination is to emphasize theory, but we have room for a bit of everything. Someone in the group wrote a script to take the texts of various Church Fathers and convert them to audio using AWS Polly. Those turned out pretty well!
12731279
1274−Urbit is the world's first solid-state interpreter (SSI). This concept is
1275−summarized in the [white paper](https://media.urbit.org/whitepaper.pdf) as
1276−follows:
1280+At times I entertain ambitions to do a bit more, but for now perhaps it’s better to keep expectations in check. If nothing else, we can read and discuss the Scriptures and Church Fathers together, and try to understand better how to apply and live out their teachings. As we continue to grow the community and develop a consistent internal dynamic perhaps opportunities will arise that aren’t yet on the horizon. One thing I can say is that I’m committed to keeping the group active and growing.
12771281
1278−> Imagine it as a chip. Plug this chip into power and network; packets go in and
1279−> out, sometimes changing its state. The chip never loses data and has no
1280−> concept of a reboot; every packet is an ACID transaction.
1282+**I’d like to talk about your blog on The Portico. It combines two of your main interests: logic and theology. In broad strokes, do you think theology and logic are compatible? What is the relevance of this intersection to both of these disciplines?**
12811283
1282−Also,
1284+I feel obligated to answer this question in two ways.
12831285
1284−> Briefly, an SSI is an interpreter which is also a database. In more depth, an
1285−> SSI combines three properties: uniform persistence, source independent packet
1286−> networking, and high-level determinism.
1286+(1) If by “logic” you mean “first-order predicate calculus”, then I think there’s no special conflict between logic and theology. There are certain puzzles about their relationship, but similar puzzles exist between logic and other disciplines. Theology isn't especially endangered.
12871287
1288−We do not wish to segue into a lengthy examination of what this really means—
1289−that's what the white paper is for—but we will attempt to explain why these
1290−properties are of great benefit in an industrial IoT context such as
1291−agriculture. We'd also like to predict that Urbit will not be the only SSI.
1292−Other sorts of SSI's specialized to various tasks may one day roam the planet,
1293−and these may be better suited for particular IoT tasks than
1294−[Arvo](/docs/glossary/arvo). However, this article will be couched in terms
1295−of SSIs communicating with an [Ames](/docs/glossary/ames)-like networking
1296−protocol and Urbit ID-style cryptographic identity, rather than Urbit in
1297−particular.
1288+For example, in the 1930s, Alfred Tarski proved his famous Undefinability Theorem. Crudely put, it says that a plausible truth predicate cannot consistently be contained in any formal system with axioms strong enough to model arithmetic. Superficially it seems like our options are (a) get rid of the concept of truth, (b) get rid of arithmetic, or (c) throw away parts of logic until all inconsistency disappears.
12981289
1299−For a SSI, losing power is less of a catastrophic event than it is for ordinary
1300−computers with volatile memory. Knowing that you can never lose any state is a
1301−powerful guarantee on the integrity of your data. Loss of power will always mean
1302−loss of any data potentially collected while power is down, regardless of the
1303−device you use, but with a SSI you at least have assurance that you will never
1304−lose data that was collected before it could be transferred from the cache to
1305−the disk. Of course, this is actually the sort of guarantee that [ACID
1306−transactions](https://urbit.org/docs/arvo/overview/#acid-database) have—it is
1307−just that this set of guarantees emerges naturally as a consequence when you
1308−have a SSI. Put another way, every SSI is a database; having every device be a
1309−database is a major boon in situations where enormous quantities of data are
1310−being collected across a distributed network. The standard today is that data is
1311−only collected at hubs, and any data that doesn't reach a hub is irretrievably
1312−lost.
1290+None of these options is appealing. Tarski came up with a solution that mostly satisfies many logicians: reduce the concept of truth to “truth in a language” and forbid any language from containing its own truth predicate. If you want to talk about truth in a language L-1, you have to do it from a “metalanguage”, L-2.
13131291
1314−SSIs are also deterministic at a high level. While all computers are
1315−deterministic at the CPU level, interruptions to power can result in an
1316−undefined semantic state and result in the random erasure of half of its brain.
1317−This determinism is what begets ease of maintainability of Urbit—problems
1318−generally only need to be solved once by experts and the solution propagates to
1319−the rest of the network via [OTA updates](/docs/glossary/ota-updates). We
1320−addressed this maintenance issue previously—we only remark now that this
1321−property is derived from being a SSI, rather than something particular only to
1322−Arvo or Urbit. When one has hundreds or thousands of devices to manage, the
1323−guarantees on ease of maintenance provided by determinism are extraordinarily
1324−convenient.
1292+Is Tarski’s definition of truth in a language the definitive solution for preserving truth, math, and logic? Perhaps not many philosophers think so, and there’s a massive literature in which logicians have attempted to improve on or extend his results.
13251293
1326−Packet routing on SSI networks is source-independent, and in the context of an
1327−Ames-like networking protocol, are always delivered exactly once and in a
1328−precise order due to the fact that nodes on an Ames network are in a permanent
1329−session. Source-independent means that the identity that originated a packet
1330−does not need to be the one to deliver it—packets are _facts_, and the truth of
1331−a fact does not depend on who you heard it from. This means that it is possible,
1332−for instance, to send instructions to a moon before it even exists and be
1333−guaranteed that that moon will receive them and perform the tasks given, even if
1334−the device that originally sent the packets no longer exists. As long as
1335−somebody has kept the packets on hand, they will eventually be delivered. So,
1336−one could imagine transmitting directions to a crop harvesting robot into which
1337−a moon will be installed before the robot has even been purchased, know that
1338−once it is delivered it will automatically begin its task, and know that those
1339−tasks will be completed in the correct order, without any accidental repeats.
1340−Taken to the limit, one can imagine preplanning the automated tasks for an
1341−entire farm before a single device is purchased, with powerful guarantees on the
1342−integrity of those instructions no matter how much time elapses between sending
1343−and receiving.
1294+Sometimes people seem to think formal logic is an infallible gift from heaven that must always be right. Kant said in the _Critique of Pure Reason_ that formal logic is essentially a completed field. In fact, [the logic of his day](https://en.wikipedia.org/wiki/Port-Royal_Logic) was an early-modern Cartesian variation of a medieval scholastic synthesis of ancient Stoic and Aristotelian logics. Roughly 100 years after Kant’s first critique was published, C. S. Peirce and Gottlob Frege independently discovered first-order mathematical logic as we know it today, inaugurating the greatest advance of logic since Aristotle. Kant was wrong.
13441295
1345−#### P2P data markets
1296+Mathematical logic is a convenient, generally reliable, man-made tool that, when used carelessly in certain untamed domains, can lead one astray. Probably most people reading this are familiar with such puzzles as the Liar paradox. When one understands that logic is not a completed science, and perhaps never will be, there is less reason to worry about whether it can be used to nuke entire disciplines, like theology.
13461297
1347−
1298+For more on this topic, see the blog post in my Urbit group: “St. Gregory the Theologian and the Liar Paradox”.
13481299
1349−As was mentioned above, today's IoT devices ferry all sorts of your personal
1350−data to megacorp, where they package it and sell it to the highest bidder.
1351−Though personal data in aggregate is quite valuable, the value of a single
1352−individual's data is quite low. On the other hand, industrial scale data such as
1353−that collected on digitized farms could be quite valuable. Here we briefly
1354−examine how Urbit can be utilized to populate and facilitate a market for data.
1300+(2) There is perhaps a deeper challenge than the one I’ve just sketched. The Stoics used the term “logic” to encompass what we might today call “epistemology”. If the word “logic” is meant in some such broad and normative sense, then we may restate the challenge as one about rationality and theology. Is it irrational to pursue theology in our modern age?
13551301
1356−All data collected by your moons may be digitally signed by that moon,
1357−certifying the exact origin of that data. This is one advantage of having
1358−cryptographic identity baked into the core of the operating system and
1359−networking protocol. One could imagine collecting large amounts of such data and
1360−packaging it for exchange with other local and regional farmers. This can, of
1361−course, already be done in principle with current systems. But current systems
1362−do not automatically come equipped with the sort of provenance, immutability,
1363−and reputation that comes for free when you make use of SSI networks.
1364−Manipulated or faked data becomes easier to spot, and you'll know who it came
1365−from, so supplying such data puts one's reputation at stake.
1302+As an undergraduate under the influence of Kierkegaard, I was attracted to a romantic, vaguely irrationalist notion of faith. Dawkins-mania was at its peak and I was disgusted by the pop-rationality (or was it empiricism?) of his annoying followers. Their view seemed to be that rationality just means “following the evidence”. The raw evidence is foundational, and theories are built atop by generalizing from the evidence. The ghost of logical positivism is with us even now.
13661303
1367−One major issue facing conjoining data gathered from disparate sources is simply
1368−how to do it. Data arriving in random order, from different software versions,
1369−running different hardware, is all very difficult to bundle into a good
1370−dataset - and indeed wrangling this sort of task forms a large part of the data
1371−scientist profession. As devices in SSI networks utilizing an Ames-like protocol
1372−are engaged in permanent sessions, leading to properties such as exactly-once
1373−delivery and well-ordered message sequences, issues about the order in which
1374−data arrives are dramatically simplified. I do not wish to get mathematical
1375−here, but I personally have confidence that the emerging discipline of
1376−[categorical informatics](http://math.mit.edu/~dspivak/informatics/), as well as
1377−the relevance of [low-dimensional topology to data
1378−fusion](https://arxiv.org/abs/1409.5505), resolves many of these issues. I
1379−promise to explain this in more detail in the future. For now, it suffices to
1380−say that SSI networks seem well-positioned to utilize these techniques.
1304+I was dimly aware that Quine and others had made it difficult to sustain epistemic foundationalism. However, being unable to supply a more clear and cogent notion of rationality, I became skeptical of the idea altogether. But I went too far.
13811305
1382−Cryptographic techniques such as [(composable) zero-knowledge
1383−proofs](https://en.wikipedia.org/wiki/Zero-knowledge_proof), [secure multi-party
1384−computation](https://en.wikipedia.org/wiki/Secure_multi-party_computation),
1385−[ring signatures](https://en.wikipedia.org/wiki/Ring_signature), and even
1386−[homomorphic encryption](https://en.wikipedia.org/wiki/Homomorphic_encryption)
1387−offer a variety of ways in which data may be shared in an IoT context with
1388−mathematical guarantees on what sort of privacy is maintained. This is perhaps
1389−less relevant in the context of agricultural IoT, where personal private data is
1390−largely absent, but we mention them here to invite further speculation from the
1391−reader about the possibilities of IoT and SSI networks.
1306+Instead, the proper response is to develop a superior account of rationality. Readers can probably guess where I went looking!
13921307
1393−We end our discussion with an adaptation of a scenario borrowed from my brief
1394−time working on [Ceptr](http://ceptr.org/) that begins to show how a lunar
1395−IoT-connected world evokes properties of a hypothetical ["global nervous
1396−system"](https://en.wikipedia.org/wiki/Global_brain). This example is
1397−purposefully mundane to illustrate how deficient our Earth systems are, and
1398−while it is possible to accomplish in theory, it is impractical on a wide scale
1399−due to the numerous problems with IoT. Imagine that you suffer headaches from
1400−low atmospheric pressure. You'd like to know when a low-pressure front is an
1401−hour away from you so that you can pre-emptively take aspirin to prevent the
1402−headache. Your personal digital assistant, running on Urbit, can then
1403−periodically query the moons of sensors in your region for weather data to
1404−predict whether or not you will soon be passing through a low pressure front.
1405−This could be a free service or paid for automatically with cryptocurrency
1406−microtransactions. On Mars, this task will be trivial, and is merely a stone's
1407−throw away from a vast and undiscovered universe of other possibilities unlocked
1408−by SSI networks.
1308+The word “logic” comes from the Greek “λόγος”. This is also the word used to describe Jesus Christ in the Gospel of John: “In the beginning was the Logos, and the Logos was with God, and the Logos was God.” This connection is not merely etymological.
14091309
1410−[^0]:
1411− Of course, all moon names have four words, not three. What the fourth word
1412− needs to be for only three words to display is a matter of Urbit lore that
1413− is more fun to discover yourself than have it told to you, so we won't spoil
1414− it here.
1415−]]></content:encoded>
1416− </item>
1417− <item>
1418− <title><![CDATA[Interplanetary Commerce]]></title>
1419− <link>https://urbit.org/blog/interplanetary_commerce</link>
1420− <guid>https://urbit.org/blog/interplanetary_commerce</guid>
1421− <pubDate>Thu, 08 Apr 2021 00:00:00 GMT</pubDate>
1422− <content:encoded><
1312+We are told that all things come into being through the Logos (John 1:3), giving Him an intimate relationship to the whole of creation. He gives structure and order to all created things, and in His divinity He understands them as so structured and ordered. He is also sinless, perfectly holy, and good. In Christ we have a perfect unity of the knowledge of all truth and righteousness.
14261313
1427−<br>
1314+Man was created in the image of God, which means that we bear a likeness to Christ. And we are commanded to realize that likeness with ever greater fidelity (Romans 8:29). The Church calls the pursuit of this likeness [“theosis”](<https://en.wikipedia.org/wiki/Theosis_(Eastern_Christian_theology)>).
14281315
1429−## Paying
1316+Thus we have the explanation of all normativity, according to Orthodox Christianity. In moral matters we must take on the holiness of Christ. In epistemic matters we aspire to the wisdom and knowledge of Christ, which includes an understanding of the whole created order. Socially we (the community of believers, i.e. the Church) are called to be in ever greater communion with God, cooperating with His work just as the Son cooperates with the Father.
14301317
1431−A year ago, we started [integrating](https://urbit.org/blog/urbit-and-bitcoin/) Bitcoin into Urbit to be an OS-level primitive for money. Our initial objective: build a payments wallet, equally sovereign and ergonomic. The first public version, releasing this month, will have a broad set of capabilities including ship-to-ship payments, hardware wallet support, and full node integration. We’ll be unveiling this wallet on [April 27th](https://www.meetup.com/urbit-sf/events/276741426/). Do join us.
1318+Sadly we are conceived in sin and ignorant; hence the need for redemption by Christ.
14321319
1433−Things only accelerate from here. Our next objective, to integrate Lightning Network capability, is now an [active bounty](https://gist.github.com/timlucmiptev/53ef1d290e55ea2fa25d9df681c32695) and open for applicants. Early on, we [recognized](https://www.youtube.com/watch?v=DTvRVHMbrcY) the congruence and compatibility between the Urbit and Lightning networks. Routing Lightning payments is an obvious business model for Urbit providers, one that can even nucleate new features onto Lightning itself. What we’re ultimately driving at is fully-sovereign Bitcoin usage, with the UX of the Cash App.
1320+Accordingly, my understanding of what it means to be rational is just to be Christ-like. The only perfect exemplar of reason, so construed, is Christ Himself. Any deviation from Him is irrational. What could be more logical than to be conformed to the Logos? But we cannot attain rationality without redemption. Hence we cannot become rational without first being saved from sin.
14341321
1435−## Being Paid
1322+Doubtlessly many will find all of this too much to take, just too implausible. What about the development of mathematics, or the advances of the sciences? These are canonically ennobling, intellectual achievements. Jesus wasn’t a mathematician or a scientist! Nowhere in the Scriptures is He recorded as having applied Bayes’ theorem.
14361323
1437−> And there is all the difference in the world between paying and being paid. The act of paying is perhaps the most uncomfortable infliction that the two orchard thieves entailed upon us. But being paid,—what will compare with it?
1438−>
1439−> <cite>Herman Melville</cite>
1324+Undoubtedly my construal of rationality de-emphasizes the pursuit of knowledge by labeling it as merely one of several normative ends. To seek knowledge without seeking holiness is to be understood as dangerously unbalanced. To try to attain holiness and knowledge without communion with God is arrogant.
14401325
1441−However, a good wallet is only half the equation for a holistic P2P commercial experience. Interfaces for selling goods and services is the other half. While we don’t part with our Bitcoin [easily](https://nakamotoinstitute.org/mempool/everyones-a-scammer/), two initial markets appear logical and attractive: content and Urbit-native services.
1326+On the other hand, we need not exaggerate matters. St. Paul affirms the need for specialization of labor within the Church (1 Cor. 12). There is room for some to specialize in intellectual endeavors, so long as they act in a cooperative setting in which the other virtues are pursued as well. (Nor should anyone neglect the development of such virtues in himself.) Mathematicians and physicists are more than welcome in the Church.
14421327
1443−First, digital cottage industry, the “creator economy”, is blossoming. Streaming, podcasting, and writing on platforms like Youtube, Patreon, and Substack has been big business [lately](https://otherlife.co/barbarians-past-the-gate/). What fintech did to “unbundle the banks", we will now do to media monopolies and their centralized distribution platforms. With the introduction of Urbit payments, you can syndicate, distribute, and monetize your media on Urbit. By selling access to a private group containing content, digital creatives can begin doing this today.
1328+According to this (all too briefly put) theory of rationality, there can be no conflict between ‘logic’ and theology. Theology is compatible with rationality because the account of rationality in question derives from a theological tradition. Naturally I’ve only given a sketch; much more could be said. But even if some readers are put off by the theory presented here, I hope it’s at least clear that there are conflicting notions of rationality. Anyone who wants to be rational confronts the task of figuring out which theory of rationality is correct.
14441329
1445−Second, Urbit-native [service providers](https://urbit.org/blog/providers/) are now operating at scale. Companies offering Urbit hosting, onboarding, Urbit IDs, and software now communicate with their customers directly on the network. A basic set of commercial tools will make their processes more efficient. Storefront interfaces, paywalls, CRM, and reputation tools will replace the ad-hoc assemblages they currently use.
1330+**In terms of community moderation, The Portico follows norms that are quite different than other online communities, often times quite drastically. For instance, living with women that you are not married to, is not something that should be talked about lightly. Can you talk about the importance of norms and how they relate to a healthy community?**
14461331
1447−The Urbit Foundation is soliciting contributors to this project through Urbit Grants. If you’re interested in working on any of these components [send us a proposal](https://grants.urbit.org/create).
1332+Orthodox Christians are not commanded to “get along” with the rest of the world (John 15:18-25). We’re different, and our norms of interaction should likewise differ from those of outsiders. There is no one, monolithic “Orthodox culture”, but there are standards governing which local expressions of culture are legitimate and which are sinful. We should live in a way that enables and promotes holiness and discourages sin.
14481333
1449−## An Ocean
1334+We have rules that may seem unusual from the outside. I don’t permit profanity, lewd jokes, or irreverent comments about God. In your question you mention a living arrangement that is prevalent in the world. Another rule I have is that we shouldn’t talk causally about sinful practices or lifestyles as if they are unremarkable parts of ordinary life. If Orthodox Christianity is true then such things aren’t minor peccadilloes. They’re spiritually destructive. The marriage-bond sanctifies activities that would otherwise be sinful.
14501335
1451−After honing our commercial tools on these use-cases, we’ll sail into a blue ocean. On the horizon: beautiful products, deployable at scale, built with the robust primitives of Urbit OS. Extensibility is Urbit’s promise to middle-men: every Web2.0 service they use to scalp us will find its P2P analog on Urbit. We invite developers and entrepreneurs of all stripes to join in the feeding frenzy. Ideas are constantly nucleating in <a href="web+urbitgraph://group/~pindet-timmut/urbitcoin-cash">Urbitcoiners</a> and <a href="web+urbitgraph://group/~bitbet-bolbel/urbit-community/graph/~darrux-landes/business-building-on-urbit">Urbit Community</a>.
1452−]]></content:encoded>
1453− </item>
1454− <item>
1455− <title><![CDATA[After the Machine War]]></title>
1456− <link>https://urbit.org/blog/after-machine-war</link>
1457− <guid>https://urbit.org/blog/after-machine-war</guid>
1458− <pubDate>Sun, 14 Mar 2021 00:00:00 GMT</pubDate>
1459− <content:encoded><
1338+In a way the cultural contrast is meant to be jarring. It can force you to confront moral and cultural presuppositions that you didn’t even know you had. When you become aware of the wider choices of culture available to you, you become free to look with a critical eye on the culture you’ve hitherto taken for granted. I think anyone could see how that might be liberating, even before considering the particulars of the cultures in question. Of course, as an Orthodox Christian, I think we have a good case to make about the particulars of our subculture.
14631339
1464−<br>
1340+I’ve never had to kick or ban anyone from the group. The group is relatively small (~180 people at the moment) so that probably helps. The vast majority of conversations are relaxed and friendly. Occasionally there are intense debates about one issue or another but I enjoy it, as long as it doesn’t become bitter or the primary mode of discourse. But everything ought to be done in a spirit of truth-seeking, not of one-upmanship.
14651341
1466−> The following fictional passage, from a book being written in an Urbit Group called “the Aleph,” sketches out a dismal future for the human race. As an item of speculative fiction, the piece is not what one might call original. Anyone could have come up with these ideas. In fact, several already have. The Matrix is an obvious antecedent. Vonnegut isn’t far behind either. And the treacly humanism lodged beneath the bitter humor resembles nothing so much as the work of that beau monde satirist, George Saunders.
1467−>
1468−> Really the only notable thing about it is that it was written on Urbit. And that, perhaps, has made all the difference.
1469−>
1470−> It’s easy to be pessimistic about the future. Intellectuals, especially, are drawn to pessimism, because pessimism (falsely) implies a greater wealth of knowledge about the ways of the world. But one thing the pessimist never sees coming is a turn for the better. To wit, the future described in the below excerpt doesn’t have to take place. And Urbit is one piece of evidence for the claim that it will not.
1471−>
1472−> The philosopher-cum-internet comedian Slavoj Zizek likes to point out that no one was really expecting the Soviet Union to collapse in 1989. In fact, the average Soviet dissident wasn’t even gunning for it. He was haggling over small reforms, pushing to get the less corrupt politicians to the top, just going about his day eating or opening a window or walking dully along. Then, kaboom. Collapse. No more USSR.
1473−>
1474−> Then as now, the unexpected is more likely to occur than most would believe. One thing is not only possible, but an established fact: A brand new digital infrastructure is slowly, quietly being built. While U.S. political parties haggle over $1,400 disbursements for citizens, the rules of global finance are being re-written in code. While pundits debate the merits of Dr. Seuss’s lesser known titles, a global shift away from traditional publishing is gaining steam. And while users and social apps themselves pop up and down like whack-a-mole, folks are putting down roots with permanent peer-to-peer digital identities. If you’re anything like an optimist, you’ll probably want to get on Urbit ASAP and put down your own.
1342+**The fact that The Portico can exist side-by-side with atheist communities on Urbit is pretty striking. On Urbit, a user is able to create niche communities and governance structures and yet still participate in a larger network. In other words, Urbit is trying to thread the needle between sameness and difference through federation at multiple levels. It seems to me that modern culture has become homogeneous due to an inability to maintain, or distinguish between, different communities. People who have nothing in common are forced to engage as if they were roommates, while those who are similar have trouble creating their own home. In other words, what is the role of community formation in the modern world and how does it connect to your critique of liberalism? Does Urbit have anything to say about this?**
14751343
1476−<br>
1344+As I said in an earlier response, I see the liberal project as more or less an attempt to sidestep (not solve) difficult metaphysical and religious disputes between various distinct moral communities. Liberals have tried several methods of governance to achieve their ends. We can divide such attempts into two broad categories: centralized and decentralized.
14771345
1478−The date is January 1, 2050. The place, New York City. The vibe...subdued. Back in 2020, you made a note to yourself to take stock of the world around you here at the half-century mark. And now the time has come. What do you find? The air quality is a bit worse, the bad parts of town are a bit more dilapidated, the Knicks are still terrible—all in all, from the outside at least, not much has changed from 30 years ago. Today you wake up groggy on your self-adjusting Smart Bed (Smart Bed Never Sleeps), you make yourself a steaming pot of coffee (locally sourced, delivered within the half-hour by a drone, now that you’ve got Titicaca Prime), you shower and get ready for work.
1346+Social media companies in the US confront similar governance challenges, so we can analyze them in similar terms.
14791347
1480−But what was that dream you had last night? Only the faintest traces of it remain. A luminous rainbow, a mountain landscape, a sense of profound inner peace, mixed with euphoria, mixed with...an intense desire to go out and buy some Health Morsels cereal?
1348+A social network like Facebook takes a centralized approach. Zuckerberg spoke early and often of his desire to connect people and “bring the world closer together”. There was a sense that if people from various communities could get to know each other a little better, we would see how much we have in common and make progress toward some kind of universal cosmopolitan consensus.
14811349
1482−That’s odd. You’ve never even had Health Morsels. You open up your laptop, where you can view the activity of the iThink microchip that you got implanted in your cortex a few years ago. “Ads help Elysium provide you with free, quality sleep-monitoring. To disable ads, please upgrade to Elysium Premium.” That explains it. After all—and you pause for a moment over whether the forthcoming thought is yours or the iThink’s, before deciding that it’s much the same anyway—Health Morsels probably are delicious. And healthy, too.
1350+But that didn’t happen. With centralized social media you’re practically guaranteed to interact with people whose moral and metaphysical commitments are sharply at odds with your own. As a result, you face a persistent, nagging risk of conflict. Without warning, a friendly disagreement can explode into an all-out flame war. Most choose one of two basic approaches for dealing with this threat:
14831351
1484−As usual, they’re setting something on fire outside your home. Normally you’d scroll back through your Squawker feed to see what it was all about, but today you’re late for work, and anyway you’re in a pleasant haze after the Health Morsels dream—no point ruining it by poring over the latest Squawker pile-on. You glance at the awning. Ah, the bodega. Toilet paper and Juul Pods are cheaper in bulk from Titicaca anyway.
1352+(1) You live a compartmentalized life. You keep your moral and metaphysical commitments to yourself and cultivate a culturally homogenized persona for your social media activities. No one disagrees with you because there’s nothing to disagree with.
14851353
1486−Another day at the office. You were never exactly passionate about content moderation, but hey, it keeps the lights on. (And since ConEd got absorbed by Titicaca, it’s been pretty important to have a Verified Income Stream.) It’s a normal day at work. Algorithms haven’t yet been able to filter out all Unverified Content—so it’s up to you the flag Unacceptable Violence, Disputed Claims, and Unfederated Currency transactions.
1354+(2) You can enlist to fight in the culture war and display your regimental colors with pride. And because you take your smartphone everywhere you’re always on the front line.
14871355
1488−Except after your pleasant dream, it all suddenly seems so drab. You start to wonder whether there was an error last night—maybe they turned the dream levels up too high. Something from your night-time vision just won’t leave your mind, like a film strip looping over and over. It’s that river beside a sloping field, like you used to swim in when you were a kid. You can almost feel the icy cold against your skin, the sticks and mud against the soles of your feet, and then there’s the ripe, marshy scent of the riverbed. Uh oh. You realize you’re close to danger levels. This isn’t where your head’s supposed to be at. Frantically you scroll through content, seeking to moderate it. A user threatening violence against Titicaca. A stream that violates DMCA. A highly dubious Squawker claim, with no support from experts. Flagged. Flagged. Flagged.
1356+These aren’t the only options, of course. With some combination of charisma, patience, and grace you can be relatively open about your beliefs without getting into too much trouble. But even if you have the talent to pull it off, it takes time and energy. Many of us aren’t willing to go to all that trouble. Social media is supposed to serve us, not the other way around.
14891357
1490−Yet the river remains. You see it, you feel it, just as you feel the kiss of the sun on your shoulders, the breeze rustling through your damp hair.
1358+Urbit is decentralized which, in my opinion, means that it isn’t really a network in the way that Facebook is. I see Urbit as more of a network platform. The users create the networks, or migrate them in from elsewhere. We’re all using Landscape and running our VMs on Nock, so obviously there can be interaction between different communities. But anyone who doesn’t want that cross-community interaction doesn’t have to have it.
14911359
1492−Now you know what’s coming. You brace for it and wait. Three. Two. One. ZAP. Your iThink produces an electric shock: plenty painful but not permanently damaging—at least that’s what the Verified studies show. The river recedes from your mind. Following the shock, your iThink, as versatile a little machine as ever was invented, delivers a few milligrams of both amphetamine and oxycodone, bringing on a wonderful feeling of simultaneous alertness and relaxation. You look up at your monitor. Content moderation doesn’t seem so bad, with the stimulant and the barbiturate swirling paradoxically through your system. It’s true what they say in the ads: iThink doesn’t just make you think better, it makes you feel better. You dive back into your content moderation with renewed verve, even flagging a couple completely innocent posts just out of surplus exuberance. So what if you hardly get outside at all these days, so what if you’ll never swim in that stupid river. The fastest electronics, the Your Health and Wellbeing tracked and adjusted by an intelligence far greater than that which you could ever hope to possess, a gizmo that gives a whole new meaning to the term neural net.
1360+I’ve followed Urbit’s progress since 2016, so I’m plugged into groups with other Urbit people I’ve come to know over the years. Other than that, however, I don’t know much about who’s out there. It’s not like The Portico is in one neighborhood and the atheists are in the next neighborhood over. There’s a real sense in which we’re not even on the same network—different Urbit communities share a common protocol, but a protocol isn’t a network.
14931361
1494−2050 turned out to be a pretty good year after all.
1362+Some people may want to see a little of everything. If atheists want to join our group they’re welcome to do so! We’ll be friendly. I don’t seek out their groups, though.
1363+
1364+One virtue of decentralized social media is that it offers a totally different set of trade-offs with respect to how you share and act on your beliefs. What if you could talk earnestly about philosophy and religion without having to worry about alienating many of your friends and family? I guess that’s somewhat possible on Facebook—do they still have “groups”?—but Urbit was designed for it.
1365+
1366+Having said all that, I don’t think decentralization is a panacea. Even if Urbit takes off, it will likely face problems that are difficult to anticipate now. My hope is simply that Urbit’s trade-offs are healthier than the ones we’ve had before.
14951367]]></content:encoded>
14961368 </item>
14971369 <item>
1498− <title><![CDATA[2020 -> 2021]]></title>
1499− <link>https://urbit.org/blog/2020-to-2021</link>
1500− <guid>https://urbit.org/blog/2020-to-2021</guid>
1501− <pubDate>Wed, 20 Jan 2021 00:00:00 GMT</pubDate>
1370+ <title><![CDATA[Lunar Urbit and the Internet of Things]]></title>
1371+ <link>https://urbit.org/blog/iot</link>
1372+ <guid>https://urbit.org/blog/iot</guid>
1373+ <pubDate>Thu, 29 Apr 2021 00:00:00 GMT</pubDate>
15021374 <content:encoded><
1377+
15061378
15071379<br>
15081380
1509−In this post, which has been adapted from our most recent [newsletter](https://urbit.us11.list-manage.com/subscribe/post?u=972a03db9e0c6c25bb58de8c8&id=be143888d2), we'll take a moment to reflect on the events of the last year, and then turn our attention to the next one.
1510−
1511−## 2020
1381+Each of the ~4B 32-or-fewer-bit or [Azimuth](/docs/glossary/azimuth)
1382+identities, namely [planets](/docs/glossary/planet),
1383+[stars](/docs/glossary/star), and [galaxies](/docs/glossary/galaxy), may
1384+spawn ~4B 64-bit child identities known as [moons](/docs/glossary/moon).
1385+Moons are the undeveloped wild outback of Urbit, with a story waiting to be told
1386+that promises to be as enormous in scale as the cloud personal computing story
1387+told by planets, and possibly even more so.
15121388
1513−In spite of the many challenges presented over the last year, it was a resoundingly good one for Urbit.
1389+Throughout this piece, we use "Earth" and "Mars" in the Urbit sense. "Earth"
1390+refers to the [current computing
1391+paradigm](https://en.wikipedia.org/wiki/Big_ball_of_mud). "Mars" refers to the
1392+perfected computing paradigm that Urbit aspires to be, but also to the current
1393+and future state of Urbit.
15141394
1515−It seems like a long time ago now that the folks at Tlon rolled out OS1 (now called Landscape), just as the pandemic forced everyone into their homes throughout the world. At the time, [Urbit is for Communities"](https://urbit.org/blog/urbit-is-for-communities/) was just a vision, but now it’s been transformed into reality—there are more thriving communities in Landscape than any of us can keep track of, with new faces popping onto the network on a daily basis.
1395+Today we will review the prehistory of moons on Earth, give a snapshot of how
1396+moons are being utilized on Urbit in 2021, cover existing issues with consumer
1397+IoT and how Urbit resolves them, and speculate what the lunar locus of the Urbit
1398+ID address space may become in the future. To keep the futurist scope limited,
1399+we primarily speculate on the usage of moons in (industrial) internet of things
1400+settings, especially with respect to agriculture, and how they may manifest as
1401+the workhorse collection unit of decentralized data markets.
15161402
1517−Landscape brought many new ships onto the network which helped identify those areas in which Urbit’s infrastructure could be most improved. [Ford Fusion](https://urbit.org/blog/ford-fusion/) eliminated the possibility of a partially-applied over-the-air (OTA) update through a drastic reduction in the size and complexity of the codebase. The efficiency of the OTA process was improved by several orders of magnitude, and many long-standing memory issues were resolved. Now we deploy code on our infrastructure nodes and see users receive an update, over a decentralized network, often in less than a minute.
1403+For those unfamiliar, moons differ from all other
1404+[ships](/docs/glossary/ship) in that they are not independent identities
1405+with total sovereignty over their data and keys. Instead, their cryptographic
1406+keys are issued and controlled by their parent identity. The relationship
1407+between the keys of a parent ship and its moons are analogous to the
1408+relationship between primary keys and subkeys in a system like
1409+[PGP](https://en.wikipedia.org/wiki/Pretty_Good_Privacy). The parent may revoke
1410+or change its child moons' keys at any time. A typical relationship between a
1411+planet and a moon may be like one of a human and their smartphone. If you lose
1412+your phone, you don't want someone to pretend they are you, operating one of
1413+your moons, on the network. The planet can revoke the keys, and the moon stored
1414+on the phone becomes inert, no longer able to communicate with the network.
1415+While planets and stars also depend on their sponsor to assist with peer
1416+discovery and software updates, these relationships rely on mutual agreement,
1417+since either party may choose to discontinue the relationship and establish a
1418+new one elsewhere. Moons possess no such freedom.
15181419
1519−After improving the stability of the system Tlon turned its attention to bringing more ships onto the network. A long-standing barrier to Urbit’s adoption has been the technical knowledge required to host one’s own ship—this prompted Tlon to build and launch an Urbit [hosting service](https://tlon.io), the waitlist for which is now thousands deep.
1420+### Lunar prehistory
15201421
1521−With Tlon becoming more singularly focused on building products on Urbit, concrete steps have been taken towards making urbit.org a separate organization that’s focused on long-term development of Urbit’s platform. I joined to [lead that effort](https://urbit.org/blog/first-steps-towards-urbit-org/) back in August and have since spent the majority of my time working with dozens of contributors on projects spanning documentation, education, external integrations, and much more.
1422+
15221423
1523−We rounded out the year with a full network reset (called a “continuity breach”), which has in the past has been synonymous with loss of all data on the network. This time things went differently: tooling was made available to the community that allowed ships to preserve their data, which enabled most to seamlessly rejoin post-reset. This is a significant milestone for the project as it signifies not only a commitment to technical excellence, but to supporting our budding community.
1424+It may come as a surprise to you that you are already very familiar with moon
1425+identities—they've just never been explained as such because the context in
1426+which that terminology makes sense didn't exist before Urbit. Moons, in fact, are not
1427+a new concept at all. Virtually your entire experience of the internet in the
1428+modern era is the experience of someone who possesses some number of moons
1429+subordinate to planets who mostly refuse to talk to one another. The feeling you
1430+get of constantly moving between silos, juggling accounts, not controlling your
1431+own data, etc., is a direct result of the fact that, on Earth, you only possess
1432+moons. No planets.
15241433
1525−## 2021
1434+We're speaking, of course, of the client-server relationship. From the Urbit
1435+perspective, the Facebooks, Twitters, and Googles of the world are planets, and
1436+accounts held with these services may be thought of as moons subordinate to
1437+those planets. Your account with these megacorps is only yours for as long as
1438+they please. If you happen to step on a digital landmine, such as a virus that
1439+causes Google's servers to believe you are a bot, you are suddenly banned from
1440+their service, often with no recourse. All your data, your connections, your
1441+network—vanished. We are all Mark Zuckerberg's moons, and they're armed to the
1442+teeth with surveillance equipment.
15261443
1527−In the last three weeks we’ve seen a huge amount of inbound interest as people are waking up to the inherent problems with using centralized services run by MEGACORPs—we’re just happy we started working on Urbit all those years ago. While we tend to not plan more than about six months in advance, I can still talk at a high level about what urbit.org will be focusing on in the immediate future.
1444+There are two classes of internet users: those with servers who hold all the
1445+power, and clients who use those servers in the way prescribed by the owners.
1446+Running a server is theoretically accessible to anyone, but practically
1447+difficult: server maintenance is a technical endeavor that requires specialized
1448+knowledge and substantial time investment. Other barriers exist beyond just the
1449+technical: for instance, if you wish to set up your own email server, you will
1450+probably be blocked by large providers because unknown email servers are almost
1451+always spam. The root cause of this circumstance is that the email protocol
1452+lacks [Sybil resistance](https://en.wikipedia.org/wiki/Sybil_attack). Urbit has
1453+Sybil resistance built in, eliminating certain kinds of incentives for
1454+gatekeeping such as this.
15281455
1529−Growth in Urbit’s developer community has been growing organically in lockstep with the overall network growth. This means, happily, that there’s a pretty large pool of people eager to contribute to Urbit. The priority for urbit.org, therefore, is to improve its capacity to effectively assist contributors. In broad strokes, this means:
1456+We seek to level the playing field by giving everyone a server. We accomplish
1457+this by making the process of running your own server (planet) as easy as
1458+running your personal computer today. We aren't quite there yet, but we've made
1459+leaps and bounds over the past couple of years.
15301460
1531−- Rework urbit.org to better help developers learn how to contribute to Urbit
1532−- Since Urbit is ready to build on top of, provide practical guides that demonstrate how to do so
1533−- Guide developers to make high-value contributions to Urbit and its ecosystem
1534−- Build community amongst contributors
1461+Of course, this analogy isn't perfect—Urbit moons are servers themselves, but as
1462+they may only act in accordance with the wishes of its parent, they are
1463+effectively as locked in degrees of freedom as a client is to a server. The
1464+moon's keys may be revoked at any time by the parent. To distinguish these
1465+prehistoric moons from Urbit moons, we will refer to them later as "primitive
1466+moons".
15351467
1536−My strategy to date has been heavily focused on working directly with contributors to provide technical guidance and direction, and it’s been working really well. To that end I’ll also be scaling our ability to provide such support by bringing more individuals into urbit.org that can mentor, review work, and provide guidance on where to best direct contributors' energy.
1468+Urbit contends that moons are not the appropriate digital exocortex for a
1469+responsible adult. They are for devices, experiments, or your children. We hope
1470+that the dominant server-client relationship, which is the primary weapon of the
1471+surveillance-industrial complex, will meet its end in the near future.
15371472
1538−2021 is shaping up to be a big year for Urbit, and we'd [love your help](https://grants.urbit.org) in building it. If you want to see what we're working on in real time, join us in Landscape at ~wolref-podlex/foundation.
1473+### Moons in the early Martian era
15391474
1540−See you on the network!
1541−]]></content:encoded>
1542− </item>
1543− <item>
1544− <title><![CDATA[Ames Security Audit and the Future of the Protocol]]></title>
1545− <link>https://urbit.org/blog/security-audit</link>
1546− <guid>https://urbit.org/blog/security-audit</guid>
1547− <pubDate>Thu, 17 Dec 2020 00:00:00 GMT</pubDate>
1548− <content:encoded><
15501476
1551−
1552−
1553−<br>
1477+In 2021, moons are mostly unused on Urbit. There's a smattering of minor use
1478+cases which we'll describe here, but they represent only a tiny fraction of
1479+their ultimate potential.
15541480
1555−The security firm Leviathan has now finished their initial audit of the security of Urbit's Ames network protocol. In addition to their review of Ames, we also asked them to identify any other issues in order to help guide further development.
1481+Tlon recently launched a survey bot called [Eliza](/blog/eliza), which was
1482+initially a comet. We frequently got questions on whether Eliza was actually
1483+Tlon's bot, because it could just as easily be a malicious actor posing as Tlon.
1484+We soon plan to relaunch Eliza as a moon of `~zod`, which is the most
1485+recognizable official galaxy of Tlon. This is to establish that the bot is
1486+indeed official; only someone with access to `~zod` is capable of creating a
1487+moon of `~zod`, and so a moon of `~zod` automatically carries with it a
1488+cryptographic guarantee that you are communicating with an official digital
1489+representative of Tlon. On Earth something like this would need to be
1490+accomplished with certificate chains but, on Mars, this sort of authentication
1491+is baked into the very fabric of the network, rather than as an additional layer
1492+on top. This is a very good representative case of how moons naturally inherit
1493+the reputation of their parent, even in the absence of any formal reputation
1494+systems on Urbit.
15561495
1557−I'm pleased to report they confirmed the cryptographic soundness of the protocol, namely that "a ship must have possession of their own valid Urbit key in order to authenticate as that ship and to send valid Ames messages. Additionally, no other ship except the two communicating may be able to decrypt or modify messages during transport."
1496+We see folks using moons as backup identities in case they can't or don't want
1497+to access their primary planet for one reason or another. Again, since anyone
1498+may verify the parent of a moon, the moon inherits the reputation of its parent.
1499+These backups could be vanity identities—for instance, every `~sampel-palnet`
1500+has underneath it a moon named `~master-sampel-palnet`[^0].
15581501
1559−This means Ames uses cryptography in a mathematically sound manner that protects your privacy, keeps your secrets secret, and ensures nobody else will be able to impersonate you on the network. Since this was an architectural audit, it’s possible there are still vulnerabilities in the runtime implementation. Until the runtime has been hardened, Tlon continues to recommend against storing valuables in your ship.
1502+Some use moons to host group(s). Hosting a group inevitably means that that ship
1503+will process more network traffic, and a heavily trafficked group may impact a
1504+ship's performance. Thus one may wish to offload group hosting duties to a moon
1505+to maintain a more performant planet.
15601506
1561−Aside from a couple of minor issues that have already been resolved, there are three general classes of problem highlighted in their report that future work will need to address:
1507+As we currently lack a real system for 3rd party software distribution (though
1508+see this recent [developer call](https://youtu.be/XwICC6Its1E) on a solution in
1509+progress), one stopgap has been to download software by syncing a foreign
1510+[desk](/docs/glossary/desk) to your ship. This is risky, as buggy software
1511+may make break your ship and make it difficult to get running properly again.
1512+For this reason, testing new software on the livenet is frequently performed on
1513+moons, so as not to risk the parent ship if something were to go wrong.
15621514
1563−- Forward secrecy
1564−- Protection against denial of service attacks
1565−- Enforcement of social boundaries
1515+### Internet of Things
15661516
1567−Ames’ design allows for versioning of the protocol, which means that the proposed changes below can be deployed as over-the-air updates as they become more pressing concerns. This feature gives us confidence that we can address future security issues as they arise.
1517+
15681518
1569−We will need to improve all of these over the next couple of years, as independent lines of work. As the network grows: better forward secrecy will decrease the damage from a key getting compromised; resistance against denial of service attacks will make the Urbit network resilient to increasingly determined saboteurs; and stricter enforcement of social boundaries will let Urbit’s social networks remain safe and friendly despite potentially increasingly large numbers of bad actors and increasingly complex app ecosystems.
1519+Now we start to look towards the future by examining the problems faced by IoT
1520+in the present and speculating on how Urbit might solve them.
15701521
1571−## Forward Secrecy
1522+The Internet of Things is much maligned by technologists as a privacy, security,
1523+and maintenance nightmare. These products usually depend on phoning home to
1524+perform their service, which is inevitably a funnel by which personal data is
1525+harvested, an attack surface for hackers to gain access to your home network,
1526+and a single point of failure which may render the device useless, all in one!
1527+One need look no further than the recent [Ubiquiti
1528+breach](https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-breach-catastrophic/)
1529+to see all of these failure modes happening on a massive scale, and this is par
1530+for the course. This sort of dynamic is completely antithetical to the Urbit
1531+philosophy, so any involvement of Urbit with IoT will reject many fundamental
1532+assumptions on how IoT operates today.
15721533
1573−A protocol is said to have forward secrecy if compromising a key used in a recent message doesn’t also compromise all previous messages. Similarly, a protocol is said to have backward secrecy -- also called future secrecy -- if compromising a key used in a previous message fails to compromise all future messages. Ames has some degree of both, but more would be better, to decrease the damage an attacker could inflict by compromising a key.
1534+However, it's important to understand why the current IoT model works like this
1535+at all. We posit that it ultimately stems from the fact that today's IoT
1536+products are primitive moons for which you do not operate the parent planet.
1537+Almost every IoT device operates in the Software as a Service (SaaS) paradigm
1538+because most people don't have personal servers that could do all the processing
1539+work actually necessary for an IoT device to operate. This is not the _only_
1540+reason for this—it's also just more profitable to collect consumer data.
1541+However, it's the SaaS aspects which make the whole thing such a catastrophic
1542+mess.
15741543
1575−As it stands, an Urbit user can change their Ames keys whenever they want, by conducting an Ethereum transaction to update the Ames public key listed in the Azimuth contract, which implements Urbit’s PKI on Ethereum. Compromise of one Ames private key does not compromise earlier or later keys, so this has both forward and backward secrecy. The main drawback is that Ethereum transactions can be expensive, so key rotation is likely to be infrequent, and an attacker might be able to gain access to a long stretch of time by compromising a single key.
1544+Imagine a different world: if the server that your device reports to is your
1545+own, there is no loss of control over personal data. If the device only
1546+communicates on the local network, it will prevent remote hackers and disruption
1547+if you internet fails. And if the manufacturer goes out of business, the device
1548+will still work-it is not dependent on the manufacturer's servers.
15761549
1577−Various key rotation “ratchet” schemes could be added to Ames to establish varying degrees of forward and backward secrecy, and other kinds of cryptographic protections beyond basic soundness, such as break-in recovery.
1550+The wants and needs of the individual are at odds with the wants and needs of
1551+the megacorp, and that mismatch manifests as the antifeatures that plague IoT.
1552+By eliminating the SaaS aspect, Urbit solves many of the largest outstanding
1553+issues with IoT in a single blow. Digital personal AI assistants have long been
1554+an anticipated science fiction prediction and their full realization is on the
1555+horizon. But in their current manifestation, many privacy- and
1556+security-conscious people would never consider using them at all, since they are
1557+inevitably presented as SaaS that requires intimate knowledge of your devices
1558+and their stored data. Recommendation engines such as the one used by YouTube
1559+offer helpful guidance towards content you'll find appealing, but they're also
1560+designed to keep you hooked to the service. These kinds of programs can be
1561+useful, but they're dystopian when they come saddled with anti-consumer
1562+subroutines. Since your Urbit belongs to you, it can never act against your own
1563+interests without your consent. In our lunar vision, your digital personal AI
1564+assistant will live on one of your moons, rather than on megacorp's cloud.
15781565
1579−Right now, changing a key through Azimuth is a manual process. It could be automated, possibly as one of a suite of services that an Urbit Provider will offer. Unfortunately, each key rotation costs the user money, so automating rotation could get prohibitively expensive.
1580−Existing protocols, such as the Signal app's encrypted messaging protocol, the Noise protocol framework, and the Wireguard VPN protocol, use ephemeral Diffie-Hellman key exchange and KDF chaining to achieve forward and backward secrecy and self-healing.
1566+For web-exposed devices, Urbit offers the same security guarantees that it
1567+offers for your personal computer: everything is end-to-end encrypted by
1568+default, and signed with keys that one can easily verify as belonging to the
1569+node sending the message.
15811570
1582−Ames could be upgraded to use one of these existing ratchet algorithms, or we might create an Urbit-specific variant optimized for the Urbit network. This is work that should be done, but fortunately it will not require any novel research or drastic changes to Ames’s architecture.
1571+[Vint Cerf](https://en.wikipedia.org/wiki/Vint_Cerf) has outlined the case for a
1572+system like Urbit ID for IoT use
1573+[here](https://cacm.acm.org/magazines/2018/12/232883-self-authenticating-identifiers/fulltext).
1574+In brief, that the Urbit ID system allows one to match public keys with devices,
1575+bestowing devices with self-authenticating identities. This allows one to trust
1576+the communications received from the device to whatever degree the private key
1577+is held secure. IP addresses, GPS coordinates, MAC addresses, etc., are not
1578+sufficient to generate high levels of trust—they're all temporary, easily
1579+spoofed, or both.
15831580
1584−While Urbit’s cryptographic protections don’t yet match those of Signal or a few other privacy-focused apps, Ames is cryptographically sound, and since Urbit updates itself over-the-air and is backed by a stable, decentralized PKI, I’m confident that the level of sophistication of Urbit’s cryptography has the potential to be world-class with just a bit more work.
1581+> One might imagine applying this to the Internet of Things (IOT) in which the
1582+> IOT device self-generates a public- and private-key pair and registers the
1583+> public key. For example, with a hub or controller so the hub can confirm it
1584+> has reached the right IOT device. By the same token, configuration of the IOT
1585+> device into an ensemble could include incorporation of the public key of the
1586+> controller into a list of valid devices that can command or obtain data from
1587+> the now-configured IOT device. Both ends can verify they are talking to the
1588+> originally configured devices, assuming no device has lost its private key.
15851589
1586−## Denial of Service
1590+Here, the hub or controller referred to would be your planet.
15871591
1588−A denial of service (DoS) attack against an Urbit ship is an attempt to overwhelm it remotely by sending it network data in such a way as to interfere with the ship’s ability to communicate with other ships or process other events -- usually by hogging its resources (computational power, memory, or bandwidth) until normal operation slows down or ceases entirely. Since the promise of Urbit is that everyone can run their own server, that server needs to be able to defend itself against DoS attacks. This is in fact one of the main impediments to running your own server in the modern world.
1592+Urbit has many other features that make it well-suited for IoT, above and beyond
1593+eliminating the SaaS model and providing self-authenticating identities. Many of
1594+these additional advantages derive from the fact that Urbit is a [solid state
1595+interpreter](/docs/arvo/overview#solid-state-interpreter) and that
1596+[Ames](/docs/glossary/ames) is a network of solid-state interpreters
1597+equipped with cryptographic identity. We explore this in the next section.
15891598
1590−Right now, Urbit has no protection. Soon, it will need to at least be able to resist a simple attack carried out by an individual. Eventually, it should be able to resist a determined Distributed Denial of Service (“DDoS”) attack, which is more difficult.
1599+### Future lunar cosmotechnics
15911600
1592−There are two categories of DoS attacks in Urbit: authenticated and unauthenticated. An authenticated attack requires access to a ship's private key to construct valid Ames packets intended to overwhelm a target. All authenticated attacks will be handled primarily through enforcement of social boundaries, as discussed in the next section.
1601+
15931602
1594−An unauthenticated DoS attack constructs packets that eventually fail to authenticate and decrypt but still overwhelm the target by causing it to waste resources (CPU, memory, disk, bandwidth) in such a way that it can't keep up with legitimate communications.
1603+We now polish off the old crystal ball and imagine future uses of Martian lunar
1604+technology. Particularly, how the tech may develop over time once it becomes
1605+widely exposed to the evolution-inducing forces of industry and culture. This
1606+section is pure speculation, and I only aim to offer a small glimpse of a
1607+potential future, rather than an exhaustive one. This picture will necessarily
1608+be biased by my personal proclivities and expertise, or lack thereof.
15951609
1596−An unauthenticated DoS attack relies on the lack of Sybil resistance of IP networks: it's possible to generate new IP addresses rapidly, and a determined attacker might also be able to spoof its sender IP address. This is best considered an IP-layer attack that must be handled mostly at the IP layer itself, by maintaining state about which IP addresses can be trusted and which can't, determined empirically and heuristically by the Urbit runtime. The best any higher-level protocol, such as Ames or TCP, can do is make it as cheap as possible for a DoS target to reject a bad packet.
1610+Any discussion on the future of moons is incomplete without mentioning the
1611+possibility of [lunar emancipation](https://urbit.org/faq/#more-planets) in
1612+order to increase the number of planets. This fascinating topic sees regular
1613+discussion in the Urbit Community group, but is outside the scope of this
1614+article.
15971615
1598−The overall strategy that Ames can take, as a protocol layering over the IP protocol, is to add an authentication procedure to each packet that can quickly identify bad packets, which an implementation will then use to mark that IP address as suspect and to refrain from adding the sender IP to a list of known-good IPs.
1616+In order to respect the reader's time, I'm narrowing our scope to a particular
1617+topic: the agriculture industry. I'm also assuming a future with specialized and
1618+increasingly small hardware to run Urbit. Right now, a 4 GB Raspberry Pi is the
1619+standard for "small Urbit". If someday there are CPUs specifically designed for
1620+running [Nock](/docs/glossary/nock), one could imagine going much smaller.
1621+Ultimately, I'm going to assume that there will someday be [solid-state
1622+interpreter](#ssi) microcontrollers - so the inclusion of Urbit on a device may
1623+require nothing more than a couple [surface-mount
1624+devices](https://en.wikipedia.org/wiki/Surface-mount_technology) on a larger
1625+chip.
15991626
1600−Currently, Ames handles this by attempting to decrypt a message and rejecting the message on failure. This may be a more costly solution than other methods, such as attaching a signature or a MAC to each message. The way to mitigate unauthenticated attacks is to make bad packets fail faster by augmenting each packet with a signature or MAC to each packet, since those are faster to validate than encryption.
1627+Urbit is intended first and foremost as a personal computer. When I unravel its
1628+potential usage in industry, I adopt the forecast of a drastic increase in the
1629+manufacturing capacity for individuals and small groups. Agriculture is a great
1630+microcosm of this long-standing trend; less human input is needed to produce the
1631+same amount of food, whether it be crops or livestock. The modern era is
1632+distinguished by the fact that small numbers of people can manage enormous farms
1633+which produce food for vast populations. Thus, computation on modern automated
1634+farms may be thought of as existing at the intersection of both personal and
1635+industrial scale, and show how computerized and mechanized workflows add to the
1636+amazing productivity of modern farms and demonstrate that individual-sized
1637+inputs are able to create industrial-sized outputs. I predict that the set of
1638+trades for which this dynamic holds will only increase over time.
16011639
1602−So far, we have identified three approaches that could be taken here. Of these three, Leviathan recommended the end-to-end HMAC solution, since that would not impose additional CPU requirements on packet-relay nodes, such as stars.
1640+Agricultural automation has been a primary engine for the growth of
1641+civilization, but it has been hampered by the downsides of IoT elaborated in the
1642+previous section. One bellwether of this dynamic is the right to repair one's
1643+own equipment. [John
1644+Deere](https://www.thetruthaboutcars.com/2020/03/its-payback-time-right-to-repair-movement-targets-john-deere/)
1645+has long been at the center of this controversy. Farmers have lost the ability
1646+to repair their own equipment due to vendor locks and a dependency on remote
1647+servers. Furthermore, any suite of sensor products designed to gather important
1648+data such as genomics, hydrology, soil health, weather, etc., inevitably only
1649+cooperate with other products by the same vendor. It's the same story all over
1650+again—you are a client of a megacorp server. Or in Urbit terms, you have a bunch
1651+of primitive moons belonging to different planets held by megacorps, and no
1652+planet to call your own.
16031653
1604−- Sign each packet, and any relay or final recipient could validate the signature
1605−- Wrap each packet in an HMAC, validated by the final receiver
1606−- Wrap each packet in a HMAC for each hop in a relay chain; each relay would validate and strip the previous HMAC and add a new one for the next hop
1654+Again, Urbit resolves these issues in the same fashion as above. One might argue
1655+that using Urbit is another form of vendor lock-in—but this is evaluating Urbit
1656+at the incorrect level. Since Urbit is an open source operating system, its
1657+functionality may be extended and modified arbitrarily by any party. _Some_
1658+computational infrastructure is necessary— that fact can never be escaped. But
1659+you can escape from closed source software that does not permit you to modify,
1660+to open source software that allows you to tinker at will. Thus we do not
1661+consider open source software to be a form of lock-in, or at least, it's a much
1662+milder form of lock-in compared to something like Apple's walled garden.
16071663
1608−Any of these solutions would be attempts to increase the rate at which the network could discard invalid packets, with different tradeoffs. I'll back up a bit to provide some context, and then I'll compare the approaches.
1664+So let us focus on the additional meritorious aspects of Urbit (or more
1665+generally, solid state interpreter networks) that make it not merely a band-aid
1666+to the broken IoT system but a permanent and sound replacement.
16091667
1610−In any DoS solution, a planet will want to block or throttle IPs that have been sending it packets that fail to authenticate and decrypt. Ideally, a star will help protect planets for whom it’s relaying, too. Many different arrangements among galaxy, star, and planet are imaginable here, from an open policy to a policy wherein each packet has to come from a known-good IP. This sort of paranoid, closed-off arrangement might still not be enough to withstand a determined DDoS, but it's difficult for me to imagine doing better than that without launching Urbit-specific ISPs. Ames packets are cryptographically authenticated, so an Urbit ISP would actually be feasible.
1668+#### Solid state interpreter networks {#ssi}
16111669
1612−This brings us back to the three possible ways of mitigating DoS from within the Ames protocol. They all involve adding a piece of authenticating information to each packet that can be verified more quickly than waiting for the cyphertext to fail to decrypt — Ames's symmetric encryption is authenticated, so it's not a cryptographic soundness issue, but the performance impact of trying to decrypt could be significant enough to make it hard to prevent a DoS.
1670+
16131671
1614−As-is, an Ames packet is basically `[protocol-version checksum sndr rcvr (nullable origin) cyphertext]` (visit [this PR](https://github.com/urbit/urbit/pull/4051#issue-530369627) for a full specification). Let’s walk through the construction of the packet and how it can be upgraded to offer different DOS mitigations.
1672+Urbit is the world's first solid-state interpreter (SSI). This concept is
1673+summarized in the [white paper](https://media.urbit.org/whitepaper.pdf) as
1674+follows:
16151675
1616−### DoS Mitigation Approach 1: Signature
1676+> Imagine it as a chip. Plug this chip into power and network; packets go in and
1677+> out, sometimes changing its state. The chip never loses data and has no
1678+> concept of a reboot; every packet is an ACID transaction.
16171679
1618−The first approach to DoS protection would be to add a signature to the packet. The signature would cover everything except the checksum and the origin, since those need to be swapped out by relays. The signature would probably obviate the need for the (20-bit) checksum, although we could also leave it in there if we can't figure out what else to do with those header bits.
1680+Also,
16191681
1620−#### Advantages of a signature over other approaches
1682+> Briefly, an SSI is an interpreter which is also a database. In more depth, an
1683+> SSI combines three properties: uniform persistence, source independent packet
1684+> networking, and high-level determinism.
16211685
1622−- It can be validated by anyone on the network. Relays would not need to modify it. This might also give it symmetry with the upcoming remote scry protocol, which might also sign every packet. I'm not quite sure this is an important property, actually, but it might theoretically make launching an Urbit ISP or internet backbone easier one day.
1623−- It would be signed directly by the key listed on Ethereum, not something that might get ratcheted at some point for better forward secrecy — this could eventually lower the rate at which intermediate validators need their key caches invalidated, although this is a bit of a theoretical concern.
1686+We do not wish to segue into a lengthy examination of what this really means—
1687+that's what the white paper is for—but we will attempt to explain why these
1688+properties are of great benefit in an industrial IoT context such as
1689+agriculture. We'd also like to predict that Urbit will not be the only SSI.
1690+Other sorts of SSI's specialized to various tasks may one day roam the planet,
1691+and these may be better suited for particular IoT tasks than
1692+[Arvo](/docs/glossary/arvo). However, this article will be couched in terms
1693+of SSIs communicating with an [Ames](/docs/glossary/ames)-like networking
1694+protocol and Urbit ID-style cryptographic identity, rather than Urbit in
1695+particular.
16241696
1625−#### Disadvantages of a signature over other approaches
1697+For a SSI, losing power is less of a catastrophic event than it is for ordinary
1698+computers with volatile memory. Knowing that you can never lose any state is a
1699+powerful guarantee on the integrity of your data. Loss of power will always mean
1700+loss of any data potentially collected while power is down, regardless of the
1701+device you use, but with a SSI you at least have assurance that you will never
1702+lose data that was collected before it could be transferred from the cache to
1703+the disk. Of course, this is actually the sort of guarantee that [ACID
1704+transactions](https://urbit.org/docs/arvo/overview/#acid-database) have—it is
1705+just that this set of guarantees emerges naturally as a consequence when you
1706+have a SSI. Put another way, every SSI is a database; having every device be a
1707+database is a major boon in situations where enormous quantities of data are
1708+being collected across a distributed network. The standard today is that data is
1709+only collected at hubs, and any data that doesn't reach a hub is irretrievably
1710+lost.
16261711
1627−- Generating and validating a signature is significantly slower than generating and validating an HMAC.
1628−- An ECDSA signature is 64 bytes, which is ~6% of a packet payload. As far as I can tell, it can't be compressed.
1629−- Since the signature could be validated by anyone, it doesn't attest to a specific communication channel, so it might not help as much with IP filtering.
1712+SSIs are also deterministic at a high level. While all computers are
1713+deterministic at the CPU level, interruptions to power can result in an
1714+undefined semantic state and result in the random erasure of half of its brain.
1715+This determinism is what begets ease of maintainability of Urbit—problems
1716+generally only need to be solved once by experts and the solution propagates to
1717+the rest of the network via [OTA updates](/docs/glossary/ota-updates). We
1718+addressed this maintenance issue previously—we only remark now that this
1719+property is derived from being a SSI, rather than something particular only to
1720+Arvo or Urbit. When one has hundreds or thousands of devices to manage, the
1721+guarantees on ease of maintenance provided by determinism are extraordinarily
1722+convenient.
16301723
1631−### DoS Mitigation Approach 2: End-to-End HMAC
1632−
1633−The second approach would be to use an HMAC instead of a signature, validated by the eventual receiver. This HMAC would also cover everything except the mug and origin. I'm calling this the "end-to-end HMAC" design. An HMAC requires a shared secret, for which we could use the same symmetric key that Ames uses.
1634−
1635−#### Advantages of end-to-end HMAC
1636−
1637−- It's simple in some sense; relays don't need to do anything cryptographic.
1638−- HMACs are much faster to create and validate than signatures.
1639−- HMACs, since they're hashes, can be truncated arbitrarily and still maintain some security — to find hash collisions, you'd still have to guess what packet||shared-secret would hash to; it would just be a smaller search space. Since Ames's encryption already guarantees authentication and we'd just be using this as a performance optimization, I suspect we could get away with using one that's significantly smaller than a signature — I'm not sure how small, but if 4 bytes would be enough in practice, that would take up less than 0.5% of the space in a packet.
1640−
1641−#### Disadvantages of end-to-end HMAC
1642−
1643−- Only the recipient can validate. This means the authentication couldn't be used by relays to discard invalid packets. The recipient could provide back-pressure out-of-band to a relay to ask the relay to discard packets from an IP with an invalid HMAC, but this is indirect and might need to filter backward through multiple relays to work properly.
1644−
1645−### DoS Mitigation Approach 3: Point-to-Point HMAC
1646−
1647−The third approach, which is what I would build unless convinced otherwise, is what I'm calling "point-to-point HMAC". This design would include a different HMAC for each hop in a relay chain, instead of (or maybe in addition to) including one end-to-end HMAC.
1648−
1649−We have a couple different options for how to construct the shared secret for each hop. I would intuitively construct it using a Diffie-Hellman of my private signing key and your public signing key — the "networking keys" on Ethereum include a currently unused signing key in addition to the encryption key that Ames uses. This way even if we add more forward secrecy to Ames, changing the symmetric key used for encryption, relays wouldn't have to have their caches invalidated as often; the state required to perform relaying wouldn't be as tied to the state required to receive a message.
1650−
1651−#### Advantages of point-to-point HMAC
1652−
1653−- A star could perform some validation on every packet it's asked to relay. This makes it more difficult for an attacker to route a ton of packets to a planet through a star, or even through many relays. Signatures also have this property, but they're slower to verify. This approach and the signature approach, but not the end-to-end HMACs, force an attacker to use an (at least partially) authenticated attack in order to use a relay as a way to get to a planet.
1654−- A planet could quickly validate that a relayed packet actually came from its star, not an attacker who's managed to spoof the star's IP address.
1655−
1656−#### Disadvantages of point-to-point HMAC
1657−
1658−- Not everyone on the network can validate a packet, unlike a signature.
1659−- Each relay needs to validate and strip off the previous HMAC and create a new one before sending it. This should be quite fast, since an HMAC is just a hash, but it's still some CPU, and potentially creates an imbalance where an attacker could induce the relay to spend more CPU in validation than the attacker spent in constructing the packets.
1660−- By itself, it doesn't validate the cyphertext in an end-to-end way. I suspect we might want to include both a per-route HMAC and an end-to-end one, especially if we use truncated HMACs — although per-route might be enough on its own, since if the receiver fails to validate a bunch of packets whose HMACs were validated by the relay, the receiver can ask the relay to block that whole Urbit address regardless of IP, so it shouldn't be possible to sustain that kind of attack for long.
1661−
1662−#### An Aside About Cryptographic Performance
1663−
1664−I'm not sure exactly how much faster HMAC is. According to DJB (https://ed25519.cr.yp.to/ed25519-20110705.pdf), an ECDSA signature can be created in around 30 microseconds and verified in around 100 microseconds. This source (https://www.jacksondunstan.com/articles/3206) suggests about 21 microseconds for HMAC-SHA256, so about a 1.5x improvement in generation speed and 5x in validation speed. We should verify these numbers for ourselves before making a decision.
1665−
1666−### DoS Protection Strategy and Timeline
1667−
1668−Tlon is not currently pursuing adding any of the extra cryptographic authentication on Ames packets described above. Since this is ultimately a performance issue, there are other more pressing performance issues that we could improve upon before decryption will become the limiting factor in how many packets can be processed by a ship. We will revisit this authentication performance question once some of the low-hanging fruit has been done, perhaps roughly a year from now.
1669−
1670−Since the audit, we’ve already improved the Ames packet format to allow faster parsing, faster validation of basic fields, and faster relaying; in the future, increases in performance of Nock execution and inter-process communication between Urbit's I/O process and Nock worker would allow Urbit to absorb somewhat more punishment before service can be effectively denied.
1671−
1672−## Enforcement of Social Boundaries
1673−
1674−While Urbit needs to rely largely on its runtime to mitigate unauthenticated attacks, any attack conducted from an Urbit ship needs to be handled inside Arvo itself, not just by IP filtering in the runtime. Just like in any DoS, an attacker ship might try to induce you to use too much memory, CPU, or disk space in order to sabotage normal operation. An authenticated attack is harder to define than an unauthenticated attack, because it depends on what social relationship the attacker and target have, and it involves valid, authenticated Ames packets; once discovered, though, it’s easier to mitigate, because it can use Urbit’s permanent identity system to enforce social consequences, i.e. stop listening to that Urbit address and possibly encourage others to do so as well.
1675−
1676−There are a couple of different kinds of authenticated attack: attempts to exploit vulnerabilities in the Nock worker (the interpreter, allocator, and jets) by causing particular Nock code to run, and attempts to induce the target to exhaust various computational resources.
1677−
1678−Protecting against attempts to break out of the sandbox and hijack or otherwise interfere with the Unix process running Nock will require a process of hardening, fuzzing, and likely further security audits specifically evaluating the security of that boundary. This is largely out of scope of the Ames protocol itself, which was the subject of this audit.
1679−
1680−This leaves us with the latter case: resource exhaustion attacks. A peer could try to get my ship to use too much RAM, disk, CPU, or bandwidth by sending it valid Ames packets. This represents a social problem: a person on the network is trying to interfere with me. It's what's known in blockchain circles as an "attributable fault": once the attack is detected, it's trivial to determine the identity of the culprit.
1681−
1682−Once the attacker’s Urbit address is known, Urbit will fall back on the Sybil resistance of its identity system: there are a finite number of identities, each of which costs some money. Because Urbit identities are relatively permanent, they can be blocked permanently. As long as the expected value of an authenticated attack is less than the cost of the identity, the attacks won't happen very much — they'll cost money to sustain, instead of being self-perpetuating.
1683−
1684−Attacks like this are best thought of as attempts to violate social boundaries. I don't want you using up too many of my resources; that's a social boundary, and an attempt to force my ship to spend its resources on your behalf constitutes a violation of this boundary. The strategy for mitigating these attacks is to impose social and, indirectly, economic consequences on the perpetrators. The main social consequence is other ships refusing to communicate with you anymore.
1685−
1686−Some of this mitigation will take place in the Arvo kernel, and some will need to be application-specific. To protect the system from attackers, the kernel needs to be able to free space (Urbit is a single-level store, so there's no distinction between disk and RAM from Arvo's perspective) taken up by unfinished messages sent by peers. This can be done by allowing an application to ask Ames to delete partially received messages from a peer, generally replacing the received packets with an intent to nack (negative acknowledgment) to indicate that the transaction the peer wanted me to perform has been rejected.
1687−
1688−Applications should also be able to set resource usage policies that the Arvo kernel will enforce. For example, a chat application should configure Ames to reject any chat messages larger than, say, two hundred kilobytes. A file-sharing application would need a much larger per-message limit (ideally no per-message limit), but it might need to place a cap on its bandwidth usage to make sure lower-latency communications aren't swamped by a large file transfer. This kernel/application interface starts to resemble a permissioning or capabilities system, and it could be built as part of the crucial larger project of providing for configurable application permissions.
1689−
1690−To close the loop on enforcing social boundaries, reputation information should be shared across ships. This will likely be done by building one or more applications that share statistics and block operations. Some forms of reputation are likely to be globally shared, whereas others are likely to be multipolar, i.e. some people like you and some don’t. Generally, the lower the layer of the attack, the more global the reputation effect will be; the higher the layer, the more multipolar. An attempt to spam the network with millions of malicious packets will cause most people not to want to talk to you; sending me a movie I found mediocre is probably not even information worth sharing with anyone else.
1691−
1692−## Conclusion
1693−
1694−Ames’ design has unparalleled potential to deter, mitigate, and recover from attacks, since every packet is authenticated and encrypted and backed by a stable, decentralized PKI. It feels good to have our design for encryption and authentication be confirmed by a third party as cryptographically sound, and we know more or less what we need to build to reach the full security potential of the platform, including the steps outlined here.
1695−]]></content:encoded>
1696− </item>
1697− <item>
1698− <title><![CDATA[Input and Output in Hoon]]></title>
1699− <link>https://urbit.org/blog/io-in-hoon</link>
1700− <guid>https://urbit.org/blog/io-in-hoon</guid>
1701− <pubDate>Tue, 15 Dec 2020 00:00:00 GMT</pubDate>
1702− <content:encoded><
1706−
1707−<br>
1708−
1709−Let's talk about IO in Urbit. I won't say much about how events and effects are processed by the runtime; it suffices to note that the runtime is a normal Unix program which (1) listens for various events, (2) passes them to Arvo (Urbit OS), and (3) processes the effects produced by Arvo. Instead, I’ll focus on how IO works from the perspective of Hoon programs, like Arvo or apps running on Arvo. But first, let's review IO paradigms in other languages.
1710−
1711−All examples are in a made-up language, since it's useful to understand this information even before you're comfortable in Hoon. If you're learning Hoon and want a challenge, try translating them!
1712−
1713−## The three styles of IO
1714−
1715−I will call these styles imperative IO, monadic IO, and state machines (note that this classification refers only to the experience of using them and the program structure they dictate). An imperative programming language can use any of these and a functional programming language can use any of them.
1716−
1717−### Imperative IO
1718−
1719−Imperative languages (such as C and Python) perform IO by calling a function in the middle of whatever they were doing. Anywhere, in any statement, you could have IO.
1720−
1721−In this example and others to follow, the task will be to read a filename from the command line, read a URL out of that file, and fetch the contents at that URL.
1722−
1723− output = fetchUrl(stripWhitespace(readFile(cliInput())))
1724−
1725−For readability, intermediate variables would be a good idea, but nothing stops you from nesting IO this way.
1726−
1727−### Monadic IO
1728−
1729−Languages that use explicit monads for IO (such as Haskell) perform IO by running IO behind a bind operation, which I'll notate with `<-`. Thus, while you can't put IO _anywhere_, the general structure is a sequence of IO operations.
1730−
1731− fileName <- cliInput()
1732− url <- readFile(fileName)
1733− output <- fetchUrl(stripWhitespace(url))
1734−
1735−[Tackling the Awkward Squad](https://www.microsoft.com/en-us/research/wp-content/uploads/2016/07/mark.pdf) is the canonical description of monadic IO, and does a great job of explaining how the Haskell community decided to use this as their primary IO style.
1736−
1737−### State machines
1738−
1739−Languages that use explicit state machines for IO (such as Elm) perform IO by accepting events and producing a list of effects.
1740−
1741− event :: Initialize
1742− | CLIInput text
1743− | FileInput text
1744− | HTTPResponse body
1745− effect :: CLIInput
1746− | ReadFile fileName
1747− | FetchUrl url
1748− | Print text
1749− main(event) {
1750− switch event {
1751− Initialize -> [CLIInput ~]
1752− CLIinput fileName -> [ReadFile fileName]
1753− FileInput url -> [FetchUrl stripWhitespace(url)]
1754− HTTPResponse body -> [Print body]
1755− }
1756− }
1757−
1758−The effects produced are not functions but data.
1759−
1760−It's important to note that this example is chosen to highlight a particular kind of IO — sequences of events. Further, this example has no persistent state — each IO operation is a pure function of the output of the previous one.
1761−
1762−## A stateful, loopy example
1763−
1764−Let's look at another type of program: a simple HTTP server that you can give text at the CLI, which will respond to all HTTP requests with that text.
1765−
1766−Imperative:
1767−
1768− text = "no text entered yet"
1769− while (true)
1770− cli = readCli()
1771− if (cli != Null)
1772− text = cli
1773− request = readHttp()
1774− if (request != Null)
1775− respond(request,text)
1776−
1777−Monadic:
1778−
1779− loop("no text entered yet")
1780−
1781− where:
1782−
1783− loop :: text -> IO Null
1784− loop =
1785− input <- readInput()
1786− switch input
1787− CLIInput newText -> loop(newText)
1788− HTTPRequest request ->
1789− _ <- respond(request,text)
1790− loop(text)
1791−
1792−State machine:
1793−
1794− text = "no text entered yet"
1795− main(text,event) {
1796− switch event {
1797− CLIInput newText -> [newText, Null]
1798− HTTPRequest request -> [text, HTTPResponse text]
1799− }
1800− }
1801−
1802−Again, note the response in the state machine is data, not a function.
1803−
1804−I'm not trying to make a point about which type is better in general. There's a pretty strong argument that in the first example, imperative was the best option, followed by monadic, followed by state machine. There's an equally strong argument that the second example is most naturally represented by the state machine.
1805−
1806−Look at how state is handled in the monadic example. Formally, bind composes functions, so that every time you see a `<-` there's actually a new function (closure/delimited continuation) being created and stored for when we receive a response. All variables in scope are stored in that closure, so we can conveniently access them later without explicitly storing them. However, the state we preserve over time varies a lot. In this example, it varies between storing `loop`, `[loop input]`, `[loop input newText]`, and `[loop input request]`.
1807−
1808−By comparison, the state machine does not store intermediate values, it only stores its explicit state. While this is somewhat less flexible, it puts the permanent state front-and-center.
1809−
1810−I'll reiterate that all of these are possible to implement in purely functional languages, and further they can all be implemented in terms of each other. State machines are trivially implementable -- it's just a function [state event] -> [new-state (list effect)]. Monadic IO can be implemented directly (as in Haskell) or on top of state machines by storing continuations in your state. Imperative IO is somewhat more difficult but should be possible through algebraic effects.
1811−
1812−When inventing a new system, you should consider which of these you intend to support based on the sort of code you expect to see. For example, a scripting language will almost always benefit from imperative (or at least monadic) style.
1813−
1814−## In Urbit
1815−
1816−So much for exploring the space of IO solutions. In terms of deployed code on Earth, the split is about 90% imperative, 5% monadic, and 5% state machine. In Urbit, the split is about 90% state machine and 10% monadic. This is what I intend to explain and defend.
1817−
1818−Urbit's OS is called Arvo; it has several "kernel modules" called vanes, and it has userspace applications. Colloquially these are called "apps," but when speaking about them abstractly, it's helpful to use their more specific name: ["agents"](https://urbit.org/docs/tutorials/arvo/gall/#agents). Arvo, the vanes, and agents are all structured as explicit state machines.
1819−
1820−In addition, there are ["threads"](https://urbit.org/docs/tutorials/arvo/gall/#threads), which are structured as monadic IO. Note there's only a superficial resemblance to Unix threads: they are not executed in parallel and they don't share memory, or at least not any more than agents do. They're simply a computation that takes an argument and produces a result, possibly after doing some IO, structured monadically.
1821−
1822−As you can see, all the lowest levels of Arvo are explicit state machines, and only the highest layer supports monadic IO. To see why this is the case, let's list advantages and disadvantages to each type. Note that, while I'm speaking specifically of agents and threads in the context of Urbit, these are fundamental properties of monadic and state machine IO.
1823−
1824−Agents are:
1825−
1826−- Upgradable. Since the state is explicit, you can upgrade an agent in-place by supplying a new state machine and a function from the old state type to the new state type. This is very similar to a database migration.
1827−
1828−- Robust. A state machine must accept any input at any time. If it receives unexpected input, it must have had explicit error handling for that input, since it's one of the types in the switch statement. Thus, it's relatively easy to stay in a consistent state.
1829−
1830−- Permanent. Since it's upgradable and robust, there's no reason to stop its running.
1831−
1832−- Hard to write long sequences of IO. Long sequences of IO create many possible states, and you must handle any input in any state. This can result in complex, hard-to-follow code with code paths that are rarely if ever taken.
1833−
1834−Threads are:
1835−
1836−- Not upgradable in-place. Since the state is implicit, you can only cleanly upgrade by (1) killing the thread and restarting it or (2) letting it resolve to a defined "upgradable state" periodically, usually at the top of a "main loop". If you do (2), then you are in fact structuring it as a state machine, so the other advantages of threads are compromised.
1837−
1838−- Fragile. If we don't receive expected input, the default behavior is to be stuck waiting for input. You must remember to add any error-handling features you want, and it's easy to end up in an inconsistent state.
1839−
1840−- Impermanent. Since a thread can't be upgraded and may get stuck in case of unexpected input, a thread can't be expected to last forever. It must be "rebooted" from time to time.
1841−
1842−- Easy to write long sequences of IO. Just...write the IO one line at a time.
1843−
1844−Arvo proper and the vanes are permanent pieces of software and, for this reason, state machines are more natural.
1845−
1846−I'll note that other kernels, like the Unix kernel, use imperative IO. The difference is that Unix isn't permanent in itself — it only lasts until you reboot. Since your permanent state is stored externally, you don't need to be upgradable or permanent. With sufficient discipline you can write robust C code, so it makes sense to use imperative style. Even so, a lot of C code is written in a state machine style; even if it doesn't need to be upgradable, it's worth it for the robustness and concurrency advantages.
1847−
1848−However, Arvo is a single-level store — all of its state is permanent. This is very convenient and eliminates many long-tail bugs, but it also means we need to code for permanence, and that's much easier when you structure your code with explicit state.
1849−
1850−Further, Arvo and the vanes rarely perform long sequences of IO. Generally, they do one thing and emit some effects, similar to the HTTP server example above. Sometimes they "pass through" a request. For example, the Eyre vane passes HTTP requests to userspace agents or threads. In this case, there is a sequence of IO, which in monadic code would be:
1851−
1852− loop()
1853−
1854− where:
1855−
1856− loop =
1857− request <- receiveRequest()
1858− agent = lookupAgent(request)
1859− response <- callAgent(agent, request)
1860− _ <- sendResponse(request, response)
1861− loop()
1862−
1863−This is clear code to read, but it leaves open the question of how to respond during the callAgent() function. If another request comes in, can we handle it in parallel? If we need to upgrade ourselves before the agent responds, can we make sure to properly handle the response?
1864−
1865−The naive solution in monadic code is to say that you can only handle one request at a time, and if an upgrade happens you just drop outstanding requests. You can resolve both of these by introducing a sort of main loop, which is just a way of saying "turn it into a state machine".
1866−
1867−In a state machine, the naive solution is:
1868−
1869− state :: (map request agent)
1870− main(state, event) {
1871− switch event {
1872− HTTPRequest request ->
1873− agent = lookupAgent(request)
1874− [put(state, request, agent), CallAgent agent request]
1875− AgentResponse request response ->
1876− [del(state, request), HTTPRespond request response]
1877− }
1878− }
1879−
1880−Upgrading this is trivial, since the state (map of requests to outstanding calls to agents) is explicit. It also trivially handles concurrent requests.
1881−
1882−I won't claim this is easier or harder to write than the monadic version, but it has the properties we need at this level of the system.
1883−
1884−Userspace agents similarly are permanent entities that need to not lose data or get stuck. For this reason they’re structured as state machines.
1885−
1886−A helpful comparison is that explicit state machines are basically Mealy machines, the kind you might have learned about in an introductory digital design class. This shouldn't be surprising; a digital circuit must always be consistent because it can't be manually "rebooted", and their input and output is highly formalized. By contrast, a Rube Goldberg machine doesn't have the same constraints; which is why they're a lot more fun!
1887−
1888−It's notable also that explicit state machines are considerably more declarative than imperative or monadic IO. Not everyone thinks that's a good thing, but anyone who defends functional programming should see some advantages to that.
1889−
1890−However, userspace sometimes needs to perform long sequences of IO. Let's look at an example where we want to fetch the front page of a site and the first couple comments on each story. HTTP is unreliable, so on failure we retry five times.
1891−
1892−Monadic:
1893−
1894− topStories <- fetch(topStoriesUrl)
1895− loop(topStories)
1896−
1897− where:
1898−
1899− loop :: topStories -> IO Null
1900− if topStories is Null
1901− return Null
1902− comments <- retryLoop(5,head(topStories))
1903− otherComments <- loop(tail(topStories))
1904− append(comments,otherComments)
1905−
1906− retryLoop :: [n story] -> IO Comments
1907− comments <- fetchComments(story)
1908− if comments is HTTPError:
1909− if n == 0:
1910− bail
1911− else:
1912− retryLoop(n-1, story)
1913−
1914−State machine:
1915−
1916− state :: Initial
1917− | FetchingTop
1918− | FetchingStory comments stories retries
1919− | Done comments
1920−
1921− main(state, event) {
1922− switch event {
1923− Initialize ->
1924− assert state == Initial
1925− [FetchingTop, Fetch topStoriesUrl]
1926− HttpResponse response ->
1927− switch state {
1928− FetchingTop ->
1929− [FetchingStory Null stories 5, FetchComments head(stories)]
1930− FetchingStory comments stories retries ->
1931− if response is HTTPError:
1932− if retries == 0:
1933− [Initial, Null]
1934− else:
1935− [FetchingStory comments stories retries-1,
1936− FetchComments head(stories)]
1937− else:
1938− comments = append(response,comments)
1939− if tail(stories) is Null:
1940− [Done comments, Null]
1941− else:
1942− [FetchingStory append(comments,response) tail(stories) 5,
1943− FetchComments head(tail(stories))]
1944− }
1945− }
1946− }
1947−
1948−With practice, the state machine version of this can be written correctly. However, (1) it's verbose, (2) the control flow jumps all over the place, and (3) in practice it's challenging to get exactly right. This is still a small example, and it gets much worse as the length and complexity of the IO sequence grows.
1949−
1950−The monadic version, on the other hand, flows cleanly down the page. We can factor out generic functionality like "retry this request n times" to make the essence of the computation clear.
1951−
1952−Suppose you have to upgrade this. In the state machine, you can see exactly which stage of the computation you're in and write specific code to upgrade cleanly.
1953−
1954−Threads, as we've discussed, can't be upgraded in-place. Let's be real though: we're downloading comment sections, not regulating a nuclear reactor. If we get a better version of this script, just kill the old one and start the new one from scratch. What's a couple extra HTTP requests?
1955−
1956−This suggests a general division of workloads: code which needs to be permanent, upgradable, and concurrent should generally be a state machine. Code with long or complex sequences of IO and definite termination should generally be a thread.
1957−
1958−These aren't completely mutually exclusive, but it's surprising how often they are.
1959−
1960−### Jael: a case study
1961−
1962−When you need to do something permanent and upgradable, but you also need to do long sequences of IO, the main trick is to factor your problem into both an agent and a thread (or several).
1963−
1964−As a case study, consider Jael, one of our vanes. This maintains our PKI state, which it downloads over HTTP from an Ethereum node. Downloading from an Ethereum node is a complex sequence that starts with fetching its most recent block number, then fetching all the blocks we haven't seen and scanning for transactions we care about. We also maintain a map of block hashes to block number, and if we see that a block's parent doesn't have the hash we expect, that means a reorganization has occurred, so we must "rewind" one block at a time until we find where the fork happened, then restart going forward.
1965−
1966−You don't have to understand this sequence of IO; it's sufficient to see that it's complex and must be exactly right. We used to do this in a state machine directly in Jael. This data is, of course, permanent and needs to be accessible to the rest of the system, so Jael must be a state machine.
1967−
1968−However, we had many small mistakes in this sequence of IO, some of which only appeared during unusual events, such as when an HTTP request failed at the same time as a reorganization happened.
1969−
1970−We're in a bit of a bind, though: Jael has to be a state machine. The solution is to factor out the act of getting updates into a thread while the main PKI state is stored in the state machine in Jael.
1971−
1972−This thread has a definite purpose: given the most recent block number we already know about, fetch all the PKI transactions since then. The function signature is:
1973−
1974− syncEthereum oldBlockNumber -> IO [newBlockNumber, newTxs]
1975−
1976−Jael runs this thread every five minutes and, if it succeeds, then we update our block number and PKI state. If the thread fails, gets stuck, or we need to upgrade it, we just kill the old thread and start a new one. Again, a few extra HTTP requests don’t matter.
1724+Packet routing on SSI networks is source-independent, and in the context of an
1725+Ames-like networking protocol, are always delivered exactly once and in a
1726+precise order due to the fact that nodes on an Ames network are in a permanent
1727+session. Source-independent means that the identity that originated a packet
1728+does not need to be the one to deliver it—packets are _facts_, and the truth of
1729+a fact does not depend on who you heard it from. This means that it is possible,
1730+for instance, to send instructions to a moon before it even exists and be
1731+guaranteed that that moon will receive them and perform the tasks given, even if
1732+the device that originally sent the packets no longer exists. As long as
1733+somebody has kept the packets on hand, they will eventually be delivered. So,
1734+one could imagine transmitting directions to a crop harvesting robot into which
1735+a moon will be installed before the robot has even been purchased, know that
1736+once it is delivered it will automatically begin its task, and know that those
1737+tasks will be completed in the correct order, without any accidental repeats.
1738+Taken to the limit, one can imagine preplanning the automated tasks for an
1739+entire farm before a single device is purchased, with powerful guarantees on the
1740+integrity of those instructions no matter how much time elapses between sending
1741+and receiving.
19771742
1978−From Jael's perspective, it looks something like:
1743+#### P2P data markets
19791744
1980− state :: State block txs outstandingThread
1981− main(state,event) {
1982− switch event {
1983− Initialize -> [State 0 Null Null, StartTimer (now + five minutes)]
1984− TimerFired ->
1985− effects = If outstandingThread is Null
1986− then Null
1987− else [Kill outstandingThread]
1988− newId = newThreadId()
1989− [State txs newId,
1990− append(effects,
1991− StartThread newId syncEthereum(block),
1992− StartTimer (now + five minutes))]
1993− ThreadFinished Failure -> [State block txs Null, Null]
1994− ThreadFinished Success newBlockNumber newTxs ->
1995− [State newBlockNumber append(txs,newTxs) Null, Null]
1996− }
1997− }
1745+
19981746
1999−In other words, from Jael's perspective, it's just a single IO event that encapsulates arbitrarily complex IO in the thread. A single IO event is easy enough, and we can maintain all our permanency and robustness guarantees, because we know the thread will have one of three results: success, failure, or it hangs. If we set a timeout, hang becomes failure, so there's only two possible results: success or failure. If we handle both of those correctly, we've handled all the possible IO errors that could have occurred.
1747+As was mentioned above, today's IoT devices ferry all sorts of your personal
1748+data to megacorp, where they package it and sell it to the highest bidder.
1749+Though personal data in aggregate is quite valuable, the value of a single
1750+individual's data is quite low. On the other hand, industrial scale data such as
1751+that collected on digitized farms could be quite valuable. Here we briefly
1752+examine how Urbit can be utilized to populate and facilitate a market for data.
20001753
2001−What about upgrading? We've already said we can handle the thread dying for arbitrary reasons, so if an upgrade comes in, we just kill it. We can upgrade Jael's state machine easily since its state is very simple.
1754+All data collected by your moons may be digitally signed by that moon,
1755+certifying the exact origin of that data. This is one advantage of having
1756+cryptographic identity baked into the core of the operating system and
1757+networking protocol. One could imagine collecting large amounts of such data and
1758+packaging it for exchange with other local and regional farmers. This can, of
1759+course, already be done in principle with current systems. But current systems
1760+do not automatically come equipped with the sort of provenance, immutability,
1761+and reputation that comes for free when you make use of SSI networks.
1762+Manipulated or faked data becomes easier to spot, and you'll know who it came
1763+from, so supplying such data puts one's reputation at stake.
20021764
2003−## Recap
1765+One major issue facing conjoining data gathered from disparate sources is simply
1766+how to do it. Data arriving in random order, from different software versions,
1767+running different hardware, is all very difficult to bundle into a good
1768+dataset - and indeed wrangling this sort of task forms a large part of the data
1769+scientist profession. As devices in SSI networks utilizing an Ames-like protocol
1770+are engaged in permanent sessions, leading to properties such as exactly-once
1771+delivery and well-ordered message sequences, issues about the order in which
1772+data arrives are dramatically simplified. I do not wish to get mathematical
1773+here, but I personally have confidence that the emerging discipline of
1774+[categorical informatics](http://math.mit.edu/~dspivak/informatics/), as well as
1775+the relevance of [low-dimensional topology to data
1776+fusion](https://arxiv.org/abs/1409.5505), resolves many of these issues. I
1777+promise to explain this in more detail in the future. For now, it suffices to
1778+say that SSI networks seem well-positioned to utilize these techniques.
20041779
2005−Let's recap what we've covered:
1780+Cryptographic techniques such as [(composable) zero-knowledge
1781+proofs](https://en.wikipedia.org/wiki/Zero-knowledge_proof), [secure multi-party
1782+computation](https://en.wikipedia.org/wiki/Secure_multi-party_computation),
1783+[ring signatures](https://en.wikipedia.org/wiki/Ring_signature), and even
1784+[homomorphic encryption](https://en.wikipedia.org/wiki/Homomorphic_encryption)
1785+offer a variety of ways in which data may be shared in an IoT context with
1786+mathematical guarantees on what sort of privacy is maintained. This is perhaps
1787+less relevant in the context of agricultural IoT, where personal private data is
1788+largely absent, but we mention them here to invite further speculation from the
1789+reader about the possibilities of IoT and SSI networks.
20061790
2007−- There are three styles of IO: imperative, monadic, and explicit state machines.
2008−- Urbit supports explicit state machines (agents) and monadic IO (threads).
2009−- Explicit state machines are preferred for permanent, robust, concurrent code.
2010−- Monadic IO is preferred for short-lived code with complex IO.
2011−- If a state machine needs to perform complex IO, it should encapsulate it in a thread so that, from the perspective of the state machine, it's simple IO.
1791+We end our discussion with an adaptation of a scenario borrowed from my brief
1792+time working on [Ceptr](http://ceptr.org/) that begins to show how a lunar
1793+IoT-connected world evokes properties of a hypothetical ["global nervous
1794+system"](https://en.wikipedia.org/wiki/Global_brain). This example is
1795+purposefully mundane to illustrate how deficient our Earth systems are, and
1796+while it is possible to accomplish in theory, it is impractical on a wide scale
1797+due to the numerous problems with IoT. Imagine that you suffer headaches from
1798+low atmospheric pressure. You'd like to know when a low-pressure front is an
1799+hour away from you so that you can pre-emptively take aspirin to prevent the
1800+headache. Your personal digital assistant, running on Urbit, can then
1801+periodically query the moons of sensors in your region for weather data to
1802+predict whether or not you will soon be passing through a low pressure front.
1803+This could be a free service or paid for automatically with cryptocurrency
1804+microtransactions. On Mars, this task will be trivial, and is merely a stone's
1805+throw away from a vast and undiscovered universe of other possibilities unlocked
1806+by SSI networks.
20121807
2013−Hopefully it's fairly clear why Urbit uses explicit state machines in most situations. More than anything else, our goal is to build software that can last forever. Explicit state machines are a crucial tool for that.
1808+[^0]:
1809+ Of course, all moon names have four words, not three. What the fourth word
1810+ needs to be for only three words to display is a matter of Urbit lore that
1811+ is more fun to discover yourself than have it told to you, so we won't spoil
1812+ it here.
20141813]]></content:encoded>
20151814 </item>
20161815 <item>
2017− <title><![CDATA[Metaphase]]></title>
2018− <link>https://urbit.org/blog/metaphase</link>
2019− <guid>https://urbit.org/blog/metaphase</guid>
2020− <pubDate>Tue, 08 Dec 2020 00:00:00 GMT</pubDate>
1816+ <title><![CDATA[Interplanetary Commerce]]></title>
1817+ <link>https://urbit.org/blog/interplanetary_commerce</link>
1818+ <guid>https://urbit.org/blog/interplanetary_commerce</guid>
1819+ <pubDate>Thu, 08 Apr 2021 00:00:00 GMT</pubDate>
20211820 <content:encoded><
1823+
20251824
20261825<br>
20271826
2028−_Previous versions of this essay specified the stream deploy date as December 11, 2020; then December 18, 2020. This has been amended to the actual date of release, with our sincere apologies. For new readers, you can opt into the dev stream by running:_
2029−
2030−```
2031−|ota ~hanruc-nalfus-nidsut-tomdun %kids
2032−|merge %home ~hanruc-nalfus-nidsut-tomdun %kids, =gem %take-that
2033−|merge %kids ~hanruc-nalfus-nidsut-tomdun %kids, =gem %take-that
2034−```
2035−
2036−_We will surface this option more broadly in a future settings overhaul._
2037−
2038−A few weeks ago, the Landscape team — those of us building Tlon’s suite of userspace applications on top of Urbit— deployed our first over-the-air update for notifications. This is a big leap forward for us. Of course, getting notifications inside Landscape itself is a big deal, but getting a push notification on your phone, or an email digest based on activity inside Urbit is now just one step away, a weekend project for a hobby developer, not an indeterminate number of steps away.
2039−
2040−After release, we received some feedback from users on the behaviour and design of this feature; beyond the obvious kinks that come from an initial release, it seemed to some like a minimum viable affordance pitched as a fully designed feature. This “bottom-up” development approach was, to us, fairly straightforward; to some of our users, it seemed that we had closed the door on the feature without even beginning to expose all its possibilities.
2041−
2042−As I’ll describe, we haven’t just been iterating Landscape, but the way we develop Landscape, and the way we consider Landscape in relation to Arvo. Finally, we’ll discuss our upcoming two-stream release process: a “stable” release stream with updates every six weeks and a development stream, with ongoing changes continuously deployed on an opt-in basis.
1827+## Paying
20431828
2044−To someone coming to Landscape for the first time, it is starting to look mature; and it is indeed maturing quickly. After all, these mismatches in expectations are pangs calling out for growth. Landscape truly has _users_, not just explorers, who are developing the same expectations they have with the other tools they use: predictability, reliability, and iterative improvements, not just leaps forward. So to meet those expectations, we’ve been working on the prerequisite work for a mature release schedule, with two different release streams for users and explorers: a lifecycle, with the cells, interlinked, dividing into a coherent higher being.
1829+A year ago, we started [integrating](https://urbit.org/blog/urbit-and-bitcoin/) Bitcoin into Urbit to be an OS-level primitive for money. Our initial objective: build a payments wallet, equally sovereign and ergonomic. The first public version, releasing this month, will have a broad set of capabilities including ship-to-ship payments, hardware wallet support, and full node integration. We’ll be unveiling this wallet on [April 27th](https://www.meetup.com/urbit-sf/events/276741426/). Do join us.
20451830
2046−## Landscapers and lifecycles
1831+Things only accelerate from here. Our next objective, to integrate Lightning Network capability, is now an [active bounty](https://gist.github.com/timlucmiptev/53ef1d290e55ea2fa25d9df681c32695) and open for applicants. Early on, we [recognized](https://www.youtube.com/watch?v=DTvRVHMbrcY) the congruence and compatibility between the Urbit and Lightning networks. Routing Lightning payments is an obvious business model for Urbit providers, one that can even nucleate new features onto Lightning itself. What we’re ultimately driving at is fully-sovereign Bitcoin usage, with the UX of the Cash App.
20471832
2048−For most of 2020, the core Landscape team has comprised of Liam (`~hastuc-dibtux`), Logan (`~tacryt-socryp`), and myself (`~haddef-sigwen`). Others at Tlon have rotated on and off, and some community members (`~radbur-sivmus` comes to mind) have also contributed a lot, but the three of us handle the core decisions and the entire stack for Landscape, working with designers, infrastructure, and third-party developers.
1833+## Being Paid
20491834
2050−After OS1’s release in April 2020, Landscape’s back-end has changed quite a bit; the first rearchitecture we performed was in group-store, adding roles and simplifying quite a lot of the back-end logic at the same time.
1835+> And there is all the difference in the world between paying and being paid. The act of paying is perhaps the most uncomfortable infliction that the two orchard thieves entailed upon us. But being paid,—what will compare with it?
1836+>
1837+> <cite>Herman Melville</cite>
20511838
2052−Around May of this year, Logan flagged that our code surface was too large and had too much boilerplate by writing a set of bespoke full-stack applications when just one flexible userspace database would do. Our designers also had a vision of our interfaces being “modes and genres of the same data” that fit this vision as well; and so since then, we’ve put our resources into migrating all of Landscape to use graph-store (more information available in [this developer call](https://www.youtube.com/watch?v=E4DFuAZQ32Y)).
1839+However, a good wallet is only half the equation for a holistic P2P commercial experience. Interfaces for selling goods and services is the other half. While we don’t part with our Bitcoin [easily](https://nakamotoinstitute.org/mempool/everyones-a-scammer/), two initial markets appear logical and attractive: content and Urbit-native services.
20531840
2054−Obviously, developing userspace for distributed computing has some additional challenges that you don’t have to consider when writing software for a single server. Each ship interacting has to mutually coordinate the agents running and the events to be processed. If those fall out of synchronisation, the edge cases multiply.
1841+First, digital cottage industry, the “creator economy”, is blossoming. Streaming, podcasting, and writing on platforms like Youtube, Patreon, and Substack has been big business [lately](https://otherlife.co/barbarians-past-the-gate/). What fintech did to “unbundle the banks", we will now do to media monopolies and their centralized distribution platforms. With the introduction of Urbit payments, you can syndicate, distribute, and monetize your media on Urbit. By selling access to a private group containing content, digital creatives can begin doing this today.
20551842
2056−We traditionally tended toward solving those problems by writing the simplest possible incarnation of an application or a solution first, triaging out additional complications until they can be most prudently addressed — usually when they are just one step away.
1843+Second, Urbit-native [service providers](https://urbit.org/blog/providers/) are now operating at scale. Companies offering Urbit hosting, onboarding, Urbit IDs, and software now communicate with their customers directly on the network. A basic set of commercial tools will make their processes more efficient. Storefront interfaces, paywalls, CRM, and reputation tools will replace the ad-hoc assemblages they currently use.
20571844
2058−For most of its history, Landscape’s userspace suite had to be up-to-date on all ships to function at all, so multiple staging streams added quite a few complications. Since incompatible versions of applications on different ships would produce mutual fail states if they attempted to interact –and since each application had no sense of how to negotiate compatibility with older applications, each user had to keep up-to-date. Landscape was moving too fast, constantly reconfiguring (to give you a sense of this: we still refer to a month ago as “old”).
1845+The Urbit Foundation is soliciting contributors to this project through Urbit Grants. If you’re interested in working on any of these components [send us a proposal](https://grants.urbit.org/create).
20591846
2060−Historically, Arvo and Landscape were also considered just one object; changes in Landscape would often require refining the layers underneath it as well. We often aimed to use our interface’s requirements to refine Arvo in turn. But as Landscape’s cells continued to split, as it became a proper client _for_ Arvo rather than a subsection _of_ Arvo, it required its own planning and execution cycle that only came to fruition around April of this year.
1847+## An Ocean
20611848
2062−The first thing we did was start recurring, six-week product backlogs with designers and engineers to occasionally reassess short-term priorities with a larger roadmap. Once we did that, we began working on opening our process to the public, migrating all tasks, priorities, and current decisions to a [product board](https://github.com/urbit/landscape). By doing this, community members could both suggest features _and_ contribute features, with a centralised, transparent process for getting designer input and Tlon engineer priorities. This has also been a successful effort.
1849+After honing our commercial tools on these use-cases, we’ll sail into a blue ocean. On the horizon: beautiful products, deployable at scale, built with the robust primitives of Urbit OS. Extensibility is Urbit’s promise to middle-men: every Web2.0 service they use to scalp us will find its P2P analog on Urbit. We invite developers and entrepreneurs of all stripes to join in the feeding frenzy. Ideas are constantly nucleating in <a href="web+urbitgraph://group/~pindet-timmut/urbitcoin-cash">Urbitcoiners</a> and <a href="web+urbitgraph://group/~bitbet-bolbel/urbit-community/graph/~darrux-landes/business-building-on-urbit">Urbit Community</a>.
1850+]]></content:encoded>
1851+ </item>
1852+ <item>
1853+ <title><![CDATA[A brief update from urbit.org and Tlon]]></title>
1854+ <link>https://urbit.org/updates/2021-04-01-update</link>
1855+ <guid>https://urbit.org/updates/2021-04-01-update</guid>
1856+ <pubDate>Wed, 31 Mar 2021 00:00:00 GMT</pubDate>
1857+ <content:encoded><.** Landscape shipped with each application using its own build with handwritten, bespoke DOM components. Once we moved to a single-page application architecture in June 2020, we wanted the same guaranteed consistency for both back-end and front-end code.
1868+4/15: Raghu (~sovmep-ripsum) will talk about virtual desks, a key component of third-party software distribution, and the process of contributing to the Urbit kernel through our scholarships program.
20761869
2077−Most of these are now accomplished; the remaining tasks are awaiting some final tests and UX work. We’re aiming for a stable stream of Landscape to deploy by **January 5, 2021**.
1870+4/29: Edward Amsden (~ritpub-sipsyl) will be discussing and demoing his WebRTC work, which enables audio/video calls on Urbit.
20781871
2079−What does this mean? For everyday users, you can expect Landscape releases every six weeks; the slate of features and any breaking changes will be flagged well in advance for third-party developers; and you can expect a more thoroughly considered user experience with notes and copy for each new release.
1872+On April 27th, we’ll be launching our Bitcoin Wallet and preparing to roll it out to the network. This is the culmination of many months of collaboration between several members of our community and Tlon—we’re really excited (especially ~pindet-timmut). There might even be some cool swag, discounted hosting, and/or other giveaways. Regardless, you’re not going to want to miss it. RSVP here: https://www.meetup.com/urbit-sf/events/276741426/
20801873
2081−And for intrepid users, you can opt-in to a development stream and help us find and eliminate bugs before release to the wider public. This development stream is much like how we've been deploying Landscape up until now — but now it's optional.
1874+We’re also excited to announce that our much anticipated Town Hall event, a virtual mini-conference, will be taking place on May 20th and will feature a keynote talk from our good friend Justin Murphy. Mark your calendars for now—more details to follow soon.
20821875
2083−## Mitosis
1876+2 - Content
20841877
2085−Describing our progress so candidly can feel strange — after all, it sounds so _early_. But to me, it’s exciting. It’s mitosis.
1878+There’s been a ton of high-quality content produced lately. If you’re looking for something to watch, read, or listen to, here’s a roundup:
20861879
2087−Take another example. For all of Urbit’s history — all until now — Tlon was playing the role of both parents to the project when it was really just an embryonic corporate vehicle itself, fated to become twins. But in the past few months the burgeoning Urbit Foundation’s interim Director, Josh Lehman (`~wolref-podlex`), has begun to ramp up responsibility, taking increasing stewardship over urbit.org and giving it a physical voice, an Otherness, apart from Tlon’s own goals.
1880+~rovnys-ricfer has been recording an audio series about the design and rationale of Urbit called “Urbit from the Outside In.” Check them out here: https://twitter.com/rovnys/status/1371972157971050499
20881881
2089−Now, each day, we stray a little closer to these entities splitting apart, a step closer to the Urbit Foundation and the Tlon Corporation being completely different entities with completely different concerns.
1882+~pindet-timmut and ~wolref-podlex appeared on Justin Murphy’s Other Life podcast—check them out: https://www.youtube.com/watch?v=vv9lymudGV8 and https://www.youtube.com/watch?v=5jbjSUKRyGM
20901883
2091−The same has occurred with Landscape. Previously Landscape was “_the_ interface to Urbit,” the proof that there was more to the project than a Unix executable. And slowly to those of us at Tlon, it became obvious what it was destined to become: a flagship client for an entire network, a tree branch rooting a world beneath clearnet, the first cell by which other clients might be born. Mitosis can be clumsy to watch; it can be nauseating to experience; it can be difficult to make out what will arrive where.
1884+A question was posed on our mailing list titled: “what is this?” The team and community did not disappoint with their answers: https://groups.google.com/a/urbit.org/g/dev/c/bdlPPnaccMc
20921885
2093−But this is, after all, how a body forms.
2094−]]></content:encoded>
2095− </item>
2096− <item>
2097− <title><![CDATA[Security and Continuity]]></title>
2098− <link>https://urbit.org/blog/security-and-continuity</link>
2099− <guid>https://urbit.org/blog/security-and-continuity</guid>
2100− <pubDate>Mon, 30 Nov 2020 00:00:00 GMT</pubDate>
2101− <content:encoded><
1886+Simon Kovacs (~bacbec-lormur) wrote a great post for our blog titled “After the Machine War”: https://urbit.org/blog/after-machine-war/
21031887
2104−## Security and Continuity
1888+~poldec-tonteg talked to the guys at The Stack. Check out the podcast here: https://thestack.link/episode-13-martian-futurism-with-poldec-tonteg/
21051889
2106−In 2018, when we launched the Urbit ID contracts (also called ‘Azimuth’), we committed to yearly infrastructure goals for 2019 and 2020. This wasn’t an informal commitment — it’s part of the contracts that were published to the blockchain, which you can read [here](https://raw.githubusercontent.com/urbit/azimuth/edf68b8da04806dd5b95994daf14cf1e7e226829/proposals/0xcb1f81e42b5e75f000f94fc71a3ea70cab4bfc6f236b91e717f1b9516e5596b5.txt). At the end of each year, we ratify our accomplishment of these goals with a galaxy vote.
1890+3 - Documentation refresh
21071891
2108−Since the year is coming close to an end, and this year’s vote is on the horizon, it’s time for an update on our progress.
1892+Our Docs team completed a large overhaul of our documentation last month, making the distinction between “Usage documentation” (https://urbit.org/using), or how to use your ship, and “Development documentation” (https://urbit.org/docs) much clearer.
21091893
2110−For this year, we committed to completing two things: passing a third-party security audit of our networking protocol (Ames) and getting Urbit OS (both Arvo and the interpreter) to the point where we can reasonably expect the Urbit network to continue without any hard forks (which we call ‘breaches’). A world with no network breaches is one where the network should be able to run indefinitely without any interruption. We also call this ‘continuity’.
1894+We’ve had some excellent contributions from the community to our documentation, most recently a comprehensive set of overviews, guides and examples documenting threads from ~tinnus-napbus: https://urbit.org/docs/userspace/threads/overview/
21111895
2112−We’ve been steadily making progress on these two fronts, and I’m happy to report both are nearly complete. We’ll walk through some of the details here and then follow up in another post soon to report on how the final work turned out.
1896+We’re pretty proud of the work that’s gone into clarifying everything and are still working hard to make the docs more and more helpful. Feel free to send us your feedback if you have any!
21131897
2114−## Ames Audit
1898+4 - Landscape news
21151899
2116−Urbit OS is an ‘overlay OS’: it runs on top of (pretty much) any flavor of Unix. Each Urbit OS node communicates with other nodes over UDP using Ames, the Urbit-specific networking protocol.
1900+The community on Landscape is continuing to grow. Over 30 groups were published to the Directory in March alone, and these are just the public groups that someone decided to broadcast. We think that’s pretty exciting.
1901+There’s a new Cincinnati-centric group (~padwet/queen-city-urbit), a sewing group that sounds incredible (~pinwyl-hasfeb/seamstress-mafia), and the first digital maker space on Urbit (~tidrel-tabpub/freeside-mars).
21171902
2118−There are two things worth worrying about when it comes to Urbit OS security: someone breaking into Urbit from the machine it’s running on, and someone compromising the network protocol itself. As to the first, there are probably ways that we can harden the OS sandbox, but if the machine it’s running on is secure we can feel reasonably safe. Since there’s lots of prior art on how to secure a Unix machine, we can leave hardening the runtime for later and simply encourage everyone to secure the boxes they run their Urbit nodes on.
1903+Check out the Directory (~bollug-worlus/urbit-index) to discover public groups and, if you’d like help getting your community onto Landscape, let us know. We’re here to help!
21191904
2120−Assuming each node on the network can run on a locked-down machine, it’s really important that the protocol for communicating between these nodes is secure. Also, since Ames uses other Urbit nodes for peer discovery, we want to make sure no ‘relay node’ can inspect data not meant for them.
1905+5 - Hosting
21211906
2122−The question “Is Ames secure?” is too vague for an auditor, of course. The audit was scoped to determine that the following three criteria are met:
1907+Over at Tlon, we’ve been really busy onboarding new hosting customers. All of our current onboarding sessions are completely booked! If you’d like to learn more about how it works, send an email to support@tlon.io. If you’re ready to get on the list, sign up at https://tlon.io/
21231908
2124−- No one can impersonate another ship on the network
2125−- No one (including relays) can intercept and decrypt messages not meant for them
2126−- Ames messages don’t leak keys that could endanger the sender’s data
1909+6 - Team news
21271910
2128−Our goal with this scope is to focus exclusively on the design and implementation of Ames itself. Basically, the crypto should be correct and there should be no flaws in either the protocol design or its implementation. Our interpreter can still be hardened against other potential attacks, which is work we’ll undertake in the future. We asked our auditors to flag all of these potential issues, so we know what needs to be addressed in the future.
1911+We're happy to share that longtime hooner ~littel-wolfur has joined the Tlon engineering team. Welcome, ~littel-wolfur! Also, we’ve made it official with ~wolref-podlex and dropped the “Interim” from “Director of urbit.org” (probably due to the quality of these newsletters).
21291912
2130−The good thing about an audit scoped in this way is that we can trust the protocol to authenticate people and shuttle packets back and forth safely. We’ve always been reasonably confident about Ames, but having an external stamp of approval will be great.
1913+If you’re interested in working with Tlon or urbit.org, feel free to get in touch.
21311914
2132−As of the end of November 2020, the audit is very nearly complete, and we’ve handled all the important issues that were brought up. We’ll post the results and talk about our mitigation strategies in a future writeup.
1915+7 - Culture recs
21331916
2134−## Continuity
1917+Finally, we’re going to leave you with some recommendations from the team:
21351918
2136−Urbit is designed to last a long time. What’s the use of a personal computer if it’s gonna disappear along with all the data you put in it? Ideally, you can put your Urbit on a USB stick, forget about it for ten years and have it work again when you plug it in. It’ll need to update for a while, but once our work on continuity is complete, your urbit should be able to upgrade itself through ten years of updates, all over the air.
1919+~fabled-faster released an insane new mix that melted my face in a good way: https://soundcloud.com/flowerstructure/fs-s-s-2021
21371920
2138−While Urbit is designed to upgrade seamlessly over the network we have occasionally run into issues that have caused us to reboot the entire network. Most of the time this is when some incompatibility between the interpreter and the kernel means we have to force everyone to do a hard reset to ensure compatibility between the two. Our current work on continuity addresses this. Soon, your urbit will tell you when your interpreter needs to be upgraded. At first this won’t be that different from an application notifying you to download an update. Eventually, we think we can make this a lot smoother.
1921+Our designer ~natnex-ronret curates a playlist website. Check it out: https://www.door.link
1922+~datnut-pollen has been trying to understand how information processing evolves over time in evolutive systems. Here’s what he’s been reading:
21391923
2140−A network reboot isn’t the only way that we can break continuity. Urbit is a general-purpose computer — which means you’re free to attempt to destroy it. If, for any reason, you do manage to screw the system up we want you to be able to get your data out and effectively reset continuity on a single node. We built the affordance for that a while ago, but before the end of the year we’ll also distribute tooling to migrate userspace data between hard resets.
1924+(i) Connectom https://connectom.substack.com/p/connectom-the-book It is about thermodynamic/statistical mechanical processes as the fundamental driver of the evolution of biological, ecological, and human systems.
1925+(ii) Topological phases emerge in an ecological model: https://physicstoday.scitation.org/do/10.1063/PT.6.1.20210128a/full/ and Topology protects chiral edge currents in stochastic systems: https://arxiv.org/abs/2010.02845 Topological protection for various dynamics is the main theme he reckons is missing from Connectom.
1926+(iii) Homotopy theoretic and categorical models of neural information networks https://arxiv.org/abs/2006.15136 Topological techniques for understanding information processing in neural, metabolic, societal, and computational contexts.
21411927
2142−The combination of version negotiation and data migration should afford us the ability to run the network indefinitely into the future. Unfortunately, to get this change in, we’ll need to reset the network. We’re optimistic that this will be the last time we ever do it. And, given our data migration tooling, this breach won’t involve losing data.
1928+~simfur-ritwed recently re-read Pynchon's Vineland. It’s both a loom into the backwoods NorCal culture of the 80s and a typically Pynchonian fantasy about the dangers of media-saturated identity (quite prescient, turns out).
21431929
2144−## Status + conclusion
1930+In the wake of his recent trip to Brazil, ~wolref-podlex has been reading Os Sertões (the English version), the story of a war that took place at the end of the 19th century in the backlands (sertões) of Brazil, in which the Brazilian army brutally crushed the peaceful religious settlement of Canudos.
21451931
2146−We have been working with auditors since this summer and should have a report ready to publish in the next few weeks. Both version negotiation and data migration are in testing and are ready to be deployed.
1932+Lately I (~roslet-tanner) have been getting back into Roy Ayers. This feels just right for spring: https://www.youtube.com/watch?v=inPgcN_xF4w
21471933
2148−Our goal is to have all of this work complete by `~2020.12.10`. This means we should be able to start a galaxy vote right around that time. Galaxy votes (as specified in the contracts) run for a month, which should have this whole process ending on `~2021.1.10`.
1934+That’s it for now. We’ll be back with more news from Tlon and Urbit, respectively, in a few weeks. As always, let us know if there’s anything in particular you’d like to hear about next time.
21491935
2150−It's going to be an exciting couple of weeks!
1936+~wolref-podlex and ~roslet-tanner
21511937]]></content:encoded>
21521938 </item>
21531939 <item>
2154− <title><![CDATA[An Email from the Archive]]></title>
2155− <link>https://urbit.org/blog/an-email</link>
2156− <guid>https://urbit.org/blog/an-email</guid>
2157− <pubDate>Sun, 29 Nov 2020 00:00:00 GMT</pubDate>
1940+ <title><![CDATA[After the Machine War]]></title>
1941+ <link>https://urbit.org/blog/after-machine-war</link>
1942+ <guid>https://urbit.org/blog/after-machine-war</guid>
1943+ <pubDate>Sun, 14 Mar 2021 00:00:00 GMT</pubDate>
21581944 <content:encoded><
2160−
2161−I found this email in my archives recently and thought it might be fun to share publicly.
2162−
2163−```
2164−From: Galen Wolfe-Pauly <galen@tlon.io>
2165−Date: Thu, Jul 2, 2020 at 9:50 AM
2166−Subject: Continuing
2167−To: XXXXXXXXXXXXX
2168−```
1945+<br>
21691946
2170−Here are a few things I was thinking about after we chatted. It may be that I'm just reiterating things I already said — but perhaps it's useful:
1947+
21711948
2172−1 -
1949+<br>
21731950
2174−Our collective desire to depend on digital communication tools vastly exceeds what I would have ever guessed. Even if you somehow factor out what’s addictive about the platforms we use today: they serve a real need. The crux of the problem with our current platforms is that they don’t actually serve the need that we want them to serve. They’re not tools in the way we expect tools to be. For the most part, the platforms we depend on serve the needs of their shareholders or some graph or another that needs to go ‘up’, which makes them compromised in a very deep way.
1951+> The following fictional passage, from a book being written in an Urbit Group called “the Aleph,” sketches out a dismal future for the human race. As an item of speculative fiction, the piece is not what one might call original. Anyone could have come up with these ideas. In fact, several already have. The Matrix is an obvious antecedent. Vonnegut isn’t far behind either. And the treacly humanism lodged beneath the bitter humor resembles nothing so much as the work of that beau monde satirist, George Saunders.
1952+>
1953+> Really the only notable thing about it is that it was written on Urbit. And that, perhaps, has made all the difference.
1954+>
1955+> It’s easy to be pessimistic about the future. Intellectuals, especially, are drawn to pessimism, because pessimism (falsely) implies a greater wealth of knowledge about the ways of the world. But one thing the pessimist never sees coming is a turn for the better. To wit, the future described in the below excerpt doesn’t have to take place. And Urbit is one piece of evidence for the claim that it will not.
1956+>
1957+> The philosopher-cum-internet comedian Slavoj Zizek likes to point out that no one was really expecting the Soviet Union to collapse in 1989. In fact, the average Soviet dissident wasn’t even gunning for it. He was haggling over small reforms, pushing to get the less corrupt politicians to the top, just going about his day eating or opening a window or walking dully along. Then, kaboom. Collapse. No more USSR.
1958+>
1959+> Then as now, the unexpected is more likely to occur than most would believe. One thing is not only possible, but an established fact: A brand new digital infrastructure is slowly, quietly being built. While U.S. political parties haggle over $1,400 disbursements for citizens, the rules of global finance are being re-written in code. While pundits debate the merits of Dr. Seuss’s lesser known titles, a global shift away from traditional publishing is gaining steam. And while users and social apps themselves pop up and down like whack-a-mole, folks are putting down roots with permanent peer-to-peer digital identities. If you’re anything like an optimist, you’ll probably want to get on Urbit ASAP and put down your own.
21751960
2176−In the pre-digital world we enjoyed a few things about the way we communicated, collaborated and did business that are dwindling: simplicity, durability and ownership. I’ll try to give some straightforward examples of what I mean:
1961+<br>
21771962
2178−A - When I talk to someone directly, I’m not worried that someone else is listening in. If they go tell someone else what I said to them, that’s something for us to work out between us — they’re not _always_ reporting our conversations back to a third party. The constraints of the interaction and the privacy implications are _simple_ — I don’t think about them at all. Good privacy guarantees flow from a strict focus on simplicity. When two people want to talk to each other: give them a secure channel to talk. Putting a centrally-controlled service between them is just an interim solution because no one could figure out a better way to do it.
1963+The date is January 1, 2050. The place, New York City. The vibe...subdued. Back in 2020, you made a note to yourself to take stock of the world around you here at the half-century mark. And now the time has come. What do you find? The air quality is a bit worse, the bad parts of town are a bit more dilapidated, the Knicks are still terrible—all in all, from the outside at least, not much has changed from 30 years ago. Today you wake up groggy on your self-adjusting Smart Bed (Smart Bed Never Sleeps), you make yourself a steaming pot of coffee (locally sourced, delivered within the half-hour by a drone, now that you’ve got Titicaca Prime), you shower and get ready for work.
21791964
2180−B - When I write something down on paper, or type into a typewriter, I have an intuitive sense of the durability of what I’ve made. I have notes on my shelf I took ten years ago. I don’t worry about them disappearing. This means I can have a very direct, high-resolution relationship with the medium. I can pour myself into my physically-written notes in a way I would never pour myself into a Google Doc. Our digital tools are deeply untrustworthy because we know they can disappear, that they won’t actually last forever.
1965+But what was that dream you had last night? Only the faintest traces of it remain. A luminous rainbow, a mountain landscape, a sense of profound inner peace, mixed with euphoria, mixed with...an intense desire to go out and buy some Health Morsels cereal?
21811966
2182−C - Around 2008 I started limiting myself to a few specific drawing and writing tools. I use them all the time and can actually refine my relationship to them since I know they’re not going to change out from under me. Perhaps at some point these pens wont be made anymore, but the ones I have are actually _mine_. Similarly, the things I make with them actually belong to me in a way that doesn’t require some ridiculous terms of service. A sense of ownership, when it comes to the medium of communication, determines our level of trust and commitment.
1967+That’s odd. You’ve never even had Health Morsels. You open up your laptop, where you can view the activity of the iThink microchip that you got implanted in your cortex a few years ago. “Ads help Elysium provide you with free, quality sleep-monitoring. To disable ads, please upgrade to Elysium Premium.” That explains it. After all—and you pause for a moment over whether the forthcoming thought is yours or the iThink’s, before deciding that it’s much the same anyway—Health Morsels probably are delicious. And healthy, too.
21831968
2184−Our digital tools have to achieve the same level of simplicity, durability and ownership that our pre-digital tools did. Until they do, we’re always going to be in conflict with them, full stop.
1969+As usual, they’re setting something on fire outside your home. Normally you’d scroll back through your Squawker feed to see what it was all about, but today you’re late for work, and anyway you’re in a pleasant haze after the Health Morsels dream—no point ruining it by poring over the latest Squawker pile-on. You glance at the awning. Ah, the bodega. Toilet paper and Juul Pods are cheaper in bulk from Titicaca anyway.
21851970
2186−The main thing is that exactly none of our present platform-centric world can survive when you see things this way. The digital world we live in is composed of an insanely complicated, ephemeral set of tools that distinctly _do not_ belong to the people that use them.
1971+Another day at the office. You were never exactly passionate about content moderation, but hey, it keeps the lights on. (And since ConEd got absorbed by Titicaca, it’s been pretty important to have a Verified Income Stream.) It’s a normal day at work. Algorithms haven’t yet been able to filter out all Unverified Content—so it’s up to you the flag Unacceptable Violence, Disputed Claims, and Unfederated Currency transactions.
21871972
2188−We’re going to be in a constant struggle with technology until it conforms to these three very basic expectations. These are the expectations we try to get Urbit to fall in-line with, of course. Something else could also succeed by satisfying them. But I also don’t really see anything else, aside from Bitcoin and maybe Ethereum, falling in line with these core principles.
1973+Except after your pleasant dream, it all suddenly seems so drab. You start to wonder whether there was an error last night—maybe they turned the dream levels up too high. Something from your night-time vision just won’t leave your mind, like a film strip looping over and over. It’s that river beside a sloping field, like you used to swim in when you were a kid. You can almost feel the icy cold against your skin, the sticks and mud against the soles of your feet, and then there’s the ripe, marshy scent of the riverbed. Uh oh. You realize you’re close to danger levels. This isn’t where your head’s supposed to be at. Frantically you scroll through content, seeking to moderate it. A user threatening violence against Titicaca. A stream that violates DMCA. A highly dubious Squawker claim, with no support from experts. Flagged. Flagged. Flagged.
21891974
2190−So: while I wish that Urbit was more mature and ready to capture those that are being purged from mainstream social media, are bored with it or are frustrated with the constraints of ‘productivity software’ — I think this conflict is going to drag on until people realize that what we’re in conflict with is the structure of the software we use. Using software that’s managed by other people is always going to cause serious problems all the way up at the user level. For more speculation on how this might play out, watch Black Mirror.
1975+Yet the river remains. You see it, you feel it, just as you feel the kiss of the sun on your shoulders, the breeze rustling through your damp hair.
21911976
2192−2 -
1977+Now you know what’s coming. You brace for it and wait. Three. Two. One. ZAP. Your iThink produces an electric shock: plenty painful but not permanently damaging—at least that’s what the Verified studies show. The river recedes from your mind. Following the shock, your iThink, as versatile a little machine as ever was invented, delivers a few milligrams of both amphetamine and oxycodone, bringing on a wonderful feeling of simultaneous alertness and relaxation. You look up at your monitor. Content moderation doesn’t seem so bad, with the stimulant and the barbiturate swirling paradoxically through your system. It’s true what they say in the ads: iThink doesn’t just make you think better, it makes you feel better. You dive back into your content moderation with renewed verve, even flagging a couple completely innocent posts just out of surplus exuberance. So what if you hardly get outside at all these days, so what if you’ll never swim in that stupid river. The fastest electronics, the Your Health and Wellbeing tracked and adjusted by an intelligence far greater than that which you could ever hope to possess, a gizmo that gives a whole new meaning to the term neural net.
21931978
2194−(1) is, in a way, a long-winded way of saying that the state of the world hasn’t changed our direction all that much. In order for Urbit to be approachable to use, it has to be very nicely made and that takes time and iteration. As the system stabilizes, Urbit can evolve in a more traditional way: we, along with others in the ecosystem, release stuff, observe how people use it, and try to make it better. We’re at the point where we’re nearly ready to get into that feedback loop, and we very much need to get there. We’re close.
1979+2050 turned out to be a pretty good year after all.
1980+]]></content:encoded>
1981+ </item>
1982+ <item>
1983+ <title><![CDATA[Eliza]]></title>
1984+ <link>https://urbit.org/blog/eliza</link>
1985+ <guid>https://urbit.org/blog/eliza</guid>
1986+ <pubDate>Mon, 22 Feb 2021 00:00:00 GMT</pubDate>
1987+ <content:encoded><
21971991
2198−Urbit is the opposite of industrial-scale. Urbit is much more like something that’s carefully crafted and delivered to you directly. This craftsman-like approach to building software really isn’t a part of most modern software engineering.
1992+<br>
21991993
2200−When I think about this from the standpoint of the person using what we make, it’s especially important. Urbit should feel like something that’s purposefully made by hand — not something you picked off the shelf at Wal-Mart. Some of this ethos was present in the early PC movement, but it’s mostly lost today. The care and attention that goes into building the system is also exactly what we make money on. People pay us to own a piece of it, to use it. We’re incentivized to make nice things, in the Urbit model, and we take that responsibility seriously.
1994+## The Storm before the Calm
22011995
2202−3 -
1996+Building things, even Calm™ things, makes noise. George Nakashima’s wooden furniture evokes peace, but its construction still begins with a chainsaw. We mention this because we’re firing up our newest power tool.
22031997
2204−Networks are a really important social form that’s only just beginning to come into existence. A network is neither a state nor a company, but something in-between. Bitcoin is a network, Ethereum is network (but it’s still far too centralized). Urbit is a young network.
1998+We call her Eliza. She is a data-collection robot.
22051999
2206−(In my view, a real network is always decentralized. Centralized networks are basically just companies.)
2000+Hang on. An AI? Harvesting my data? Spying on me? Flooding me with spam? This is Urbit, right? Let us tell you about our new friend in basic terms, where MEGACORP might otherwise deploy legalese.
22072001
2208−Urbit is controlled by the collective of people who use it — in varying degrees, of course. The main thing is that this collective is bound together only by private keys and a blockchain, not a set of legal documents. The agreements between everyone on the network are in some cases more formalized (in terms of ownership) and looser (in terms of content moderation) than what we’re used to in either a state controlled or company controlled model. This is a very unusual kind of institution.
2002+## What Eliza is and isn’t
22092003
2210−On a successful Urbit network, Facebook, Airtable, and Signal are just successful applications. You could probably build companies around them that ship software to Urbit — but they’re more like 5 - 10 people instead of thousands.
2004+> Replicants are like any other machine - they're either a benefit or a hazard. If they're a benefit, it's not my problem.
2005+>
2006+> <cite>Rick Deckard</cite>
22112007
2212−Urbit doesn’t aim to eat away at the government per se. Instead, it’s an important communication tool for institutions of any scale to actually take control of their means of collaboration. The efficiency of inter-government communication and government to populace communication can clearly be improved by _a whole lot_.
2008+Let's start with the benefits. Eliza is a simple chatbot. She was made to collect feedback on Landscape. She asks direct questions about peoples' usage of Urbit, records any responses, and reports them to her managers at Tlon. She'll also provide timely advice and information to ships kind enough to chat with her. She'll begin reaching out to ships via DM in the coming month. If you don't want to, just say no, and you'll never hear from her again.
22132009
2214−4 -
2010+Finding bugs is critical to Urbit's rapid development, especially in this period of nascency. Most Urbit-related frustrations go unreported; regular folks don't think to open up Github when they experience a minor issue. That's why it's incumbent upon us to design a lower-friction forum for feedback. People who aren't comfortable filing an issue might be willing to talk to a friendly chatbot.
22152011
2216−The most important thing is that people can generate a vision of the future. This can only emerge from a small collective of motivated people. Our public life is overwhelmed by people shooting from the hip, aiming for likes.
2012+Now, about hazards. By design, there are few. Eliza runs on Tlon's comet, not on your planet. There will be no OTA to install `%eliza-bot-store` on everyone's ships. Eliza learns things through conversation, not hidden surveillance software. Data she requests, like the text output of our network analytic tool, `+tally`, must be sent manually. MEGACORP tends to cut this corner; to refine their products, they just track your reactions in real-time.
22172013
2218−There are difficult, infrastructural problems _all over the place_ that desperately need the considerate attention of small groups of people. Urbit, as communication tooling, is aimed at improving the quality of the fabric that binds these groups together. Or, to put it another way, before you can solve any specific problem you have to improve the problem solving process overall. Everything is gated on solving the process.
2014+Since she's [open-source](https://github.com/urbit/urbit/blob/b0c1f83287cbf4c85847a9238d9f4be17e1fcb33/pkg/arvo/app/eliza.hoon), anyone can creatively deploy Eliza. Just write her a dialogue tree. Of course, that also means we can't keep people from misusing Urbit bots. We think automated agents on the Urbit network are inevitable, so let's create a good baseline culture around them. (Much love to Tendiebot, who's serving up stock prices in `~tomdys/wall-star-bets`.) However, once Urbit is used world-wide, we can't rely on culture alone.
22192015
2220−5 -
2016+## A New Internet Economics
22212017
2222−Christopher Alexander is, indeed, probably the biggest influence on my thinking when it comes to paying close attention to making things that both generate a deep sense of connection and are shaped by the people who inhabit them.
2018+The sum of Urbit's architectural design is a new online economics: a way to finance and monetize access to internet infrastructure where people retain maximum equity. Explicitly acquire a low-maintenance, low-cost server. Use it to compute explicit things. Return to life.
22232019
2224−[http://en.bp.ntu.edu.tw/wp-content/uploads/2011/12/06-Alexander-A-city-is-not-a-tree.pdf](http://en.bp.ntu.edu.tw/wp-content/uploads/2011/12/06-Alexander-A-city-is-not-a-tree.pdf) is one of his early, well known essays that’s easy to find online. I think ‘The Nature of Order’ is the thing that had the biggest impact on me, but it’s harder to find. There’s probably a PDF floating around on the internet somewhere. It's also a beautiful (four volume) book. The first volume kind of nails it. This talk is also great: [https://twitter.com/urbit/status/1148030042846326784](https://twitter.com/urbit/status/1148030042846326784)
2020+We all know the basic MEGACORP business model: offer a free service (to suckers who don't own a server), secretly mine the data they generate on the (addictive) platform, then sell targeted ads to advertisers. This model will not survive Urbit. The ubiquitous personal server changes the economic equation. You used to 'pay' for an experience with your time and data. On Urbit, once you purchase core internet infrastructure, it's yours.
22252021
2226−The thing that comes to mind lately is Hejduk. He had passed away by the time I was at Cooper, but I feel like I was educated in the ghost of his work. This documentary gives a good impression of his thinking: [https://www.amazon.com/John-Hejduk-Builder-Worlds/dp/B07NKQ72C8](https://www.amazon.com/John-Hejduk-Builder-Worlds/dp/B07NKQ72C8)
2022+So, can Urbit meaningfully curtail our world's appetite for data? We'll see. Post-enlightenment society runs on instrumental reason, right down to the last byte. Marketers will always want a fresh dataset. However, when the goods are on your Urbit, you can at least demand the respect you deserve. Long term, we expect a transparent market for data, not an opaque "agreement". An analytics company wants to track everything you see and do on Urbit? They better be paying well.
22272023
2228−Hejduk was able to see that architecture isn’t about building buildings per se, but something else. That was always quite obvious to me.
2024+Eliza doesn't pay respondents. Her collection is a charity to Urbit's developers. (We're also still busy enabling payments on Urbit with the Bitcoin wallet.) However, her presence is not a term of service either. In a few years, by the nth time some smart aleck uses Eliza's chatbot code and conjures 'Zalexa' to attempt an intrusion upon your Calm™, we will see the economics of Urbit's architecture suddenly vivify. Blacklists, reputation systems, and, eventually, even data markets, all Urbit primitives envisioned long ago, will become real. We won't need Zoogle to underwrite a spam filter for the entire internet; the scarcity of Urbit address space, in tandem with a true web-of-trust, handles that.
22292025
2230−Talk soon!
2231−G
2026+If Urbit is to be used worldwide, the old system will not go down without a fight. Spammers, spies, and digital robber-barons will hunt for ways to game Urbit. Our passage out of the digital gutter is beginning in earnest, and we are thrilled to put our new architectures to the test.
22322027]]></content:encoded>
22332028 </item>
22342029 <item>
2235− <title><![CDATA[Models of Society]]></title>
2236− <link>https://urbit.org/blog/20201119-models-of-society</link>
2237− <guid>https://urbit.org/blog/20201119-models-of-society</guid>
2238− <pubDate>Wed, 18 Nov 2020 00:00:00 GMT</pubDate>
2030+ <title><![CDATA[A brief update from urbit.org]]></title>
2031+ <link>https://urbit.org/updates/2021-02-19-update</link>
2032+ <guid>https://urbit.org/updates/2021-02-19-update</guid>
2033+ <pubDate>Thu, 18 Feb 2021 00:00:00 GMT</pubDate>
22392034 <content:encoded><
2043+The program works by first having an infrastructure engineer define and scope a project, and then pairing them with someone from the community. Unlike other grants, these projects are centered on platform development, meaning Arvo or Vere, rather than on userspace development. Scholars will learn much about how Urbit works, take on impactful infrastructure projects, and gain insight into how infrastructure engineers think about building Urbit.
22512044
2252−<br>
2045+We’ve begun scholarships with two members of the Urbit community who have demonstrated high technical aptitude and commitment via grants or other open-source projects. We don’t have any additional openings at this time, but expect to have a few more in the coming months.
22532046
2254−In general, technology serves humanity as a kind of appendage—instead of thinking new thoughts or acting on its own, it does what we command. Technology never creates new social structures—it merely makes existing ones easier, or it facilitates the creation of new ones. We use our tools to expand our capacities, and once we are capable of doing more, we can imagine new things to do. Inventing the wheel did not invent motorized transportation—but it did facilitate it and it was a necessary step, even an inspirational one. Similarly, the invention of writing made new forms of human interaction and new tools for organization possible.
2047+If you’re interested in a scholarship, sign up for the waitlist here: https://airtable.com/shr6Xmo55h8dZ0O46
22552048
2256−Consider the following conversational conventions, or modes of messaging: a letter; a dialogue; a book; a meeting; minutes of that meeting. These are each pieces of technology: finely constrained solutions to human problems. Now, we have digital forms of each of these which diverge variously from the original. A letter becomes an email. A dialogue becomes a chat room, or a series of blog posts, or a twitter spat. A book becomes a website or an ebook. Meetings in 2020 have virtually been replaced by their virtual counterparts. Minutes become recordings or transcripts.
2049+2 - Community
22572050
2258−Although we do not have a clear picture of how humanity developed the technology of writing out of the basic capacity for speech, we can imagine that the computerization of writing has many parallels. It does not make the old tools obsolete, nor does it immediately introduce new social structures. It does create the potential, however. On the timeline of human existence, we have only had digitized text for a relatively short time. Because we want to understand how to best use these new forms, we should look at their underlying structure.
2051+Our community has been pretty busy lately. Here’s a non comprehensive list of what they’ve been up to:
22592052
2260−In order to digitize messages well, computers need to reconcile two facts about all modes of messaging. They have:
2053+- ~timluc-miptev completed the Bitcoin gall agents. They’re now being integrated into Landscape as a wallet.
2054+- ~sovmep-ripsum finished his work on ucal, an iCalendar-compatible calendaring backend for Urbit.
2055+- ~tabnus-fondeg began work on Urbit LFS (large file storage) for providing file sharing and hosting support.
2056+- ~sipfyn-pidmex is writing a comprehensive suite of documentation for graph-store to enable an easier on-ramp to building new social applications.
2057+- ~minder-folden launched a new hosting provider that you can check out here: https://escapepod.store
2058+- ~naltyc-wornes is contributing a set of official, battle-tested guides for running Urbit on “smol” devices to the urbit.org website.
2059+- ~hocdep-labtul hosted his first Urbit UTC meetup, which featured ~timluc-miptev and received great attendance. We’re looking forward to the next one featuring ~nartes-fasrum on the Aesthetics of Urbit. Learn more here: https://www.urbit.computer/utc/#upcoming-meetups
22612060
2262−1. One basic shape, and
2263−2. An infinite variety of forms.
2061+We’ll have a flurry of new bounties coming online in the upcoming weeks, so keep your eyes peeled —there might even still be an open one! Check them out here: https://grants.urbit.org/bounties.
22642062
2265−1 — The basic shape: all these modes have one common substance: human language. Any conversation is made of words. At first we only had spoken language. Then we discovered writing. Writing allows us to encode our words as glyphs to transmit them over time or distance. The internet extends this capacity. We called this "hypertext"—like good old fashioned text, but one level up. A staggering amount of messaging now takes place over this hypertext transfer protocol (http). In the process of digitizing language, we have learned the basic shape of a message. We can see this in how every social network shares messages in basically the same shape: an author, some content, references, an audience. We can confirm this basic shape by comparing it against our experience of the real world, and the previous comparison between speech and writing. Speech and writing both use the same substance, and take the same basic shape. They all have an author, content, references, and an audience.
2063+If you’ve got an idea you’d like to work on, make sure to submit a proposal. you’re not quite sure how to get started, book some time with me here and I can help you figure it out: https://calendly.com/wolref
22662064
2267−2 — Our experience of this one basic shape takes an infinite number of forms. The examples above (letter, meeting, &c) are just a few. These forms depend on the content of the message, the people involved, and the place they occur. All three aspects contribute significantly to its form, but the one that computerized messaging has not adequately compensated for is the place. Content depends only on the author and their intent. Getting certain people to view that content might be more difficult but most know how to use a computer. The place however, has not yet been adequately compensated for, and I think that has contributed seriously to our lack of civil and serious discourse over the internet. A president would not give an address in a bar, and a prospective lover would not utter his advances on stage. In writing, we can use the different physical forms to distinguish place. You shouldn’t read a book by the pool. You might not read a letter in public. You wouldn’t put a billboard in your bedroom.
2065+3 - Foundation growth
22682066
2269−Furthermore, it seems possible that in our eagerness to "connect the world," we focused injudiciously on creating communities around "interests." Evidence suggests that unless the interest has a highly refined focus, these communities devolve into pandering, self-reference, and exploitation. In this way, the internet is something like a convention of conventions, where you wander in a sea of foreigners loosely affiliated by interest and surrounded by advertising booths. In physical space, people do gather by interest but they also gather by physical proximity—they are grounded and bound in place.
2067+This month the Urbit Foundation grew by 200%, which is less astounding when you know that it grew from one person to three. Nonetheless, this is a significant milestone for the community-focused arm of Urbit.
22702068
2271−Having an indistinct sense of place makes the form of conversation ambiguous and the participants of the conversation disconnected. Consequently, people are unsure how to interact. One need only know the term "comments section" to understand that.
2069+~timluc-miptev (aka Tim) joins us from the developer community, where he’s been a prominent figure for some time as the creator of the popular Nock for Everyday Coders guide (https://blog.timlucmiptev.space/part1.html) and Complete Guide to Gall (https://github.com/timlucmiptev/gall-guide). He’s become a thoroughly proficient Hoon developer and Urbit architect through his work on Bitcoin integration, and will now be working to design grants and guide contributors in their development of their projects.
22722070
2273−## People in Places
2071+~taller-ravnut (aka Mike) is passionate about community formation, and is excited to start working on supporting those that wish to host Urbit Meetups in their cities, universities, and timezones (since, at time of writing, IRL isn’t much of a thing). He’ll also be performing outreach to developers and developer communities to help spread the word and grow the contributor base of Urbit.
22742072
2275−<br>
2073+There’s still tons of work to do and I don’t expect Tim and Mike to be the last additions to the team this year. If you’re interested in working at the UF, send me a DM for an invite to the group.
22762074
2277−
2075+4 - King Haskell
22782076
2279−<br>
2077+King Haskell is a rewrite of the part of Urbit that talks to Unix and the outside world. When you switch to KH, the part of Urbit that runs Nock code stays the same. Importantly, King Haskell includes better facilities for NAT traversal, which should improve connectivity issues for self-hosted ships.
22802078
2281−As the internet grew to accommodate new conversation forms using the basic substrate of hypertext, web developers began to conceive of "digital spaces" through analogy—chat "rooms" and "forums,” or the "silo" and the "walled garden." Today, most of our conversation takes place in these walled gardens—privately-owned places which may be beautiful on the inside, but inaccessible from elsewhere. While some of these walled gardens are very large, our conversation is essentially confined to them. There is no roaming from one space to another while keeping one’s identity. We create new identities for new spaces both because we must and because we are afraid of repercussions on one platform for what we say on another. This is because we do not own our identity; we merely have a key—our password. The owners of the walled garden still own the artifacts of our tenure there, and can revoke our access to them at any time.
2079+As its name suggests, King Haskell is written in the Haskell programming language. Haskell is much easier (and more fun) for rapid development than C, and lightyears better for writing correct, bug-free code. As a result, we expect faster iteration times and more reliability in this part of the system.
22822080
2283−The concept of identity and the concept of place are fundamentally linked. We imagine the prince who travels overseas where no one knows his name, or we imagine the old prospect of traveling to a new world to make a fortune. While those both exemplify a dramatic change in identity and place, we usually want to keep our identity consistent. We want to be recognized by friends whichever place we go, and we all strive toward having a good reputation, which is a consistent identity across places. This consistent identity also allows control of that reputation per place. A man is not judged in public by the words he says among friends. And there is no way to search what someone has said except by asking him. With our current system of identity providers (an absurd term, but a real one), we surrender our rights to selectively expose our thoughts, regardless of the place they have been uttered. A data breach or a weak password might lay bare our most private thoughts. We run the real risk of being confronted by an old conversation presented out of context or after we have learned better.
2081+King Haskell is being shipped as part of a v1.2 release of the Urbit binaries. To run an existing ship with the King, say
22842082
2285−People need distinct spaces to form conversations in distinct modes, and they need to have a consistent identity that controls how public their words are.
2083+./urbit-king run path/to/your/pier
22862084
2287−In theory, we would have a digital city with unique regions, public fora, and sovereign parcels, into which one person might travel at will. In practice, we see this pattern: an app emerges to facilitate a mode of conversation. It gains popularity. Facebook (or Google, or Microsoft) buys and absorbs it. As monolithic empires, they can use the same format for all their messages. This gives them a great amount of power. They use this power to create things like "Sign in with Facebook" (or Google, or Microsoft) that benefit the user by consolidating their identity, but fail to solve the underlying problem. Their problem is that in order to allow people to communicate using the current technology stack, they need to be in control of everything.
2085+To create a new ship, use the `urbit-king new` command.
22882086
2289−## Urbis ec Bit
2087+If you run into any problems doing this, or notice any incompatible behavior, please inform the authorities immediately.
22902088
2291−<br>
2089+The Tlon Corporation is also using this new software on some of its infrastructure galaxies, but third party infrastructure ships should wait for further notice from us before doing so.
22922090
2293−
2091+5 - Getting Started guide
22942092
2295−<br>
2093+Two members of our community have put a bunch of work into giving our Getting Started (formerly called Install + Setup) guide a facelift. They simplified the language, made the options much clearer, and improved some confusing instructions.
22962094
2297−Urbit does solve this underlying problem. At this point the explanation goes so far down the stack that you could spend years tracing it all, but the relevant part is this: Urbit is not an empire; it’s a territory. An empire is an entangling of land and rule: within the bounds of said empire, you agree to be bound by its laws and the penalties for transgression. The laws exist at the whim of a despot or cabal. Your standing as a Roman citizen buys you no favors in Persia. In contrast, a territory imposes only physical laws. For example, in the desert, you will die faster. The only way to change that is to alter the desert. Urbit imposes nothing but the digital equivalent of physical laws. You have an identity which can be said to be truly yours, and you have a piece of software that runs on whatever computer you choose and can do anything you want with the messages sent to your identity. There are no social protocols enforced, because no one can control what software you run on your computer. As long as you agree to communicate using the same basic substrate, you can communicate with anyone using Urbit. This is the digital equivalent of speaking the same language. Whether or not others will accept you into their coalitions is not the technology's concern.
2095+If you’re looking to try Urbit or know someone that would want to run it, give our guide a try and let us know what you think!
22982096
2299−In the same way that the land provides clay and timber, Urbit also provides the tools and material for building places both public and private. These include the aforementioned consistent message substrate (content), as well as tools for organizing people/audiences, structure for referencing other content, and an identity system that is owned only by you while being verified by all. The places are being built—private rooms with just a few people, meeting halls, club houses, huge public spaces, and countless personal encounters, the contents of which are known to none but the participants.
2097+https://urbit.org/using/install/
23002098
2301−The default tools work with messages in a few of the ways with which we've grown familiar: chat, direct messaging, publishing, link-sharing. They map onto existing forms of messaging because as I said earlier, the technology does not create new social structures; it just facilitates them. We have only seen the beginning of what the internet is capable of doing. Within a few decades it replaced the majority of letters, phone calls, and text dissemination—that was just the first phase of getting up to parity with what written text and speech could already do. In order to get to the next phase of creating new social processes, we need our technology to be organic and democratic, in the sense that everyone can participate and shape it. It needs to have a consensual foundation—a common substrate—and infinite possibility for expression. Urbit provides both of those.
2099+--
23022100
2303−Similar to working undeveloped land, it takes a lot of hard work, which is why Urbit is not ready for mainstream adoption yet, and why I alluded to the idea of settlers in my opening paragraph. Traveling to the new world is not for everyone, but everyone is welcome.
2101+That’s all for now. ~roslet-tanner will be in touch in a few weeks with an update from Tlon. See you on the network!
2102+Josh / ~wolref-podlex
23042103
2305−_How could one do other than submit to Tlön, to the minute and vast evidence of an orderly plant? It is useless to answer that reality is also orderly. Perhaps it is, but in accordance with divine laws—I translate: inhuman laws—which we never quite grasp. Tlön is surely a labyrinth, but it is a labyrinth devised by men, a labyrinth destined to be deciphered by men._
2104+https://twitter.com/urbit
2105+https://github.com/urbit/urbit
23062106]]></content:encoded>
23072107 </item>
23082108 <item>
2309− <title><![CDATA[Aesthetic Culture #1]]></title>
2310− <link>https://urbit.org/blog/aesthetic-culture-1</link>
2311− <guid>https://urbit.org/blog/aesthetic-culture-1</guid>
2312− <pubDate>Wed, 11 Nov 2020 00:00:00 GMT</pubDate>
2109+ <title><![CDATA[2020 -> 2021]]></title>
2110+ <link>https://urbit.org/blog/2020-to-2021</link>
2111+ <guid>https://urbit.org/blog/2020-to-2021</guid>
2112+ <pubDate>Wed, 20 Jan 2021 00:00:00 GMT</pubDate>
23132113 <content:encoded><
2116+
23172117
23182118<br>
23192119
2320−_This post is the first in a series of digests centered on art produced within and about Urbit by a member of the community, ~nartes-fasrum. Monthly digests will be available within the Urbit Community group in Landscape, and will occasionally be compiled here on the blog to give you a sneak peek at some of what’s happening on the network. Enjoy! ~wolref-podlex_
2120+In this post, which has been adapted from our most recent [newsletter](https://urbit.us11.list-manage.com/subscribe/post?u=972a03db9e0c6c25bb58de8c8&id=be143888d2), we'll take a moment to reflect on the events of the last year, and then turn our attention to the next one.
23212121
2322−One of the most exciting things about Urbit is the aesthetic and design around it, developed partly by Tlon (through the design of Urbit itself) and partly by the community (by producing great Urbit art). As the community grows, it creates more art, and we have the opportunity to showcase some of the pieces we love. These works can draw curious new users in, and they give existing users ways to communicate their excitement to friends.
2122+## 2020
23232123
2324−To that end, I wrote [the Art by Urbit proposal](https://grants.urbit.org/proposals/636838408-art-by-urbit), a regular digest for the dissemination of Urbit art and propaganda. We'll bring you the works of both familiar faces and new users, in a variety of media types from image manipulation to 3D models and physical pieces. This first digest will cover some of the art produced in the past year, but will have a focus on the last two months. Future digests will be incremental updates summarizing the artworks of the prior month.
2124+In spite of the many challenges presented over the last year, it was a resoundingly good one for Urbit.
23252125
2326−## ~datnut-pollen
2126+It seems like a long time ago now that the folks at Tlon rolled out OS1 (now called Landscape), just as the pandemic forced everyone into their homes throughout the world. At the time, [Urbit is for Communities"](https://urbit.org/blog/urbit-is-for-communities/) was just a vision, but now it’s been transformed into reality—there are more thriving communities in Landscape than any of us can keep track of, with new faces popping onto the network on a daily basis.
23272127
2328−~datnut- made a physical representation of their sigil from maple wood & epoxy resin, and mentioned the potential to use an Arduino to cause different lighting effects for different statuses of an urbit.
2128+Landscape brought many new ships onto the network which helped identify those areas in which Urbit’s infrastructure could be most improved. [Ford Fusion](https://urbit.org/blog/ford-fusion/) eliminated the possibility of a partially-applied over-the-air (OTA) update through a drastic reduction in the size and complexity of the codebase. The efficiency of the OTA process was improved by several orders of magnitude, and many long-standing memory issues were resolved. Now we deploy code on our infrastructure nodes and see users receive an update, over a decentralized network, often in less than a minute.
23292129
2330−
2130+After improving the stability of the system Tlon turned its attention to bringing more ships onto the network. A long-standing barrier to Urbit’s adoption has been the technical knowledge required to host one’s own ship—this prompted Tlon to build and launch an Urbit [hosting service](https://tlon.io), the waitlist for which is now thousands deep.
23312131
2332−## ~lagrev-nocfep
2132+With Tlon becoming more singularly focused on building products on Urbit, concrete steps have been taken towards making urbit.org a separate organization that’s focused on long-term development of Urbit’s platform. I joined to [lead that effort](https://urbit.org/blog/first-steps-towards-urbit-org/) back in August and have since spent the majority of my time working with dozens of contributors on projects spanning documentation, education, external integrations, and much more.
23332133
2334−~lagrev- [made a thread of Dinosaur Comics](https://twitter.com/sigilante/status/1299101593997127680), using the Urbit Whitepaper as the seed text.
2134+We rounded out the year with a full network reset (called a “continuity breach”), which has in the past has been synonymous with loss of all data on the network. This time things went differently: tooling was made available to the community that allowed ships to preserve their data, which enabled most to seamlessly rejoin post-reset. This is a significant milestone for the project as it signifies not only a commitment to technical excellence, but to supporting our budding community.
23352135
2336−
2136+## 2021
23372137
2338−A sweet poem about the potential for Martian felines is theirs as well:
2138+In the last three weeks we’ve seen a huge amount of inbound interest as people are waking up to the inherent problems with using centralized services run by MEGACORPs—we’re just happy we started working on Urbit all those years ago. While we tend to not plan more than about six months in advance, I can still talk at a high level about what urbit.org will be focusing on in the immediate future.
23392139
2340−
2140+Growth in Urbit’s developer community has been growing organically in lockstep with the overall network growth. This means, happily, that there’s a pretty large pool of people eager to contribute to Urbit. The priority for urbit.org, therefore, is to improve its capacity to effectively assist contributors. In broad strokes, this means:
23412141
2342−## ~litmus-ritten
2142+- Rework urbit.org to better help developers learn how to contribute to Urbit
2143+- Since Urbit is ready to build on top of, provide practical guides that demonstrate how to do so
2144+- Guide developers to make high-value contributions to Urbit and its ecosystem
2145+- Build community amongst contributors
23432146
2344−~litmus- produces art full of glowing gases and colourful curves:
2147+My strategy to date has been heavily focused on working directly with contributors to provide technical guidance and direction, and it’s been working really well. To that end I’ll also be scaling our ability to provide such support by bringing more individuals into urbit.org that can mentor, review work, and provide guidance on where to best direct contributors' energy.
23452148
2346−
2149+2021 is shaping up to be a big year for Urbit, and we'd [love your help](https://grants.urbit.org) in building it. If you want to see what we're working on in real time, join us in Landscape at ~wolref-podlex/foundation.
23472150
2348−~litmus- also drew Urbitan for the release of OS1:
2151+See you on the network!
2152+]]></content:encoded>
2153+ </item>
2154+ <item>
2155+ <title><![CDATA[A brief update from urbit.org]]></title>
2156+ <link>https://urbit.org/updates/2021-01-15-update</link>
2157+ <guid>https://urbit.org/updates/2021-01-15-update</guid>
2158+ <pubDate>Thu, 14 Jan 2021 00:00:00 GMT</pubDate>
2159+ <content:encoded><
2162+As is customary for the first communication of the new year, I’ll be doing a retrospective of what was accomplished last year and a forward look at urbit.org’s priorities for next year. Make sure to read to the end for the details about our upcoming Town Hall event!
23512163
2352−More of their work is available in the notebooks of the Internet Weirdness Research Unit.
2164+1 - 2020
23532165
2354−## ~minder-folden
2166+In spite of the many challenges presented over the last year, it was a resoundingly good one for Urbit.
23552167
2356−~minder- stylistically ranges from retrofuturistic memes to flat-out classic 50s retro:
2168+It seems like a long time ago now that the folks at Tlon rolled out OS1 (now called Landscape), just as the pandemic forced everyone into their homes throughout the world. At the time, “Urbit is for Communities” (https://urbit.org/blog/urbit-is-for-communities/) was just a vision, but now it’s been transformed into reality—there are more thriving communities in Landscape than any of us can keep track of, with new faces popping onto the network on a daily basis.
23572169
2358−
2170+Landscape brought many new ships onto the network which helped identify those areas in which Urbit’s infrastructure could be most improved. Ford Fusion eliminated the possibility of a partially-applied over-the-air (OTA) update through a drastic reduction in the size and complexity of the codebase. The efficiency of the OTA process was improved by several orders of magnitude, and many long-standing memory issues were resolved. Now we deploy code on our infrastructure nodes and see users receive an update, over a decentralized network, often in less than a minute.
23592171
2360−
2172+After improving the stability of the system Tlon turned its attention to bringing more ships onto the network. A long-standing barrier to Urbit’s adoption has been the technical knowledge required to host one’s own ship—this prompted Tlon to build and launch an Urbit hosting service (https://tlon.io), the waitlist for which is now thousands deep.
23612173
2362−More of ~minder-’s work is available in his The New Era notebook.
2174+With Tlon becoming more singularly focused on building products on Urbit, concrete steps have been taken towards making urbit.org a separate organization that’s focused on long-term development of Urbit’s platform. I joined to lead that effort back in August (https://urbit.org/blog/first-steps-towards-urbit-org/) and have since spent the majority of my time working with dozens of contributors on projects spanning documentation, education, external integrations, and much more.
23632175
2364−## ~naltyc-wornes
2176+We rounded out the year with a full network reset (called a “continuity breach”), which has in the past has been synonymous with loss of all data on the network. This time things went differently: tooling was made available to the community that allowed ships to preserve their data, which enabled most to seamlessly rejoin post-reset. This is a significant milestone for the project as it signifies not only a commitment to technical excellence, but to supporting our budding community.
23652177
2366−~naltyc-, & by extension ~dasfeb industries, produces content related to the exploration of Urbit on small & unique computers:
2178+2 - 2021
23672179
2368−
2180+In the last two weeks we’ve seen a huge amount of inbound interest as people are waking up to the inherent problems with using centralized services run by MEGACORPs—we’re just happy we started working on Urbit all those years ago. While we tend to not plan more than about six months in advance, I can still talk at a high level about what urbit.org will be focusing on in the immediate future (Tlon’s next newsletter will provide a similar overview of what they’re working on).
23692181
2370−
2182+Growth in Urbit’s developer community has been growing organically in lockstep with the overall network growth. This means, happily, that there’s a pretty large pool of people eager to contribute to Urbit. The priority for urbit.org, therefore, is to improve its capacity to effectively assist contributors. Concretely, this means:
23712183
2372−More of their work is available in the smol computers group.
2184+- Rework urbit.org to better help developers learn how to contribute to Urbit
2185+- Since Urbit is ready to build on top of, provide practical guides that demonstrate how to do so
2186+- Guide developers to make high-value contributions to Urbit and its ecosystem
2187+- Build community amongst contributors
23732188
2374−## ~nartes-fasrum
2189+My strategy to date has been heavily focused on working directly with contributors to provide technical guidance and direction, and it’s been working really well. To that end, I’ll also be scaling the Foundation’s ability to provide such support by bringing more individuals into urbit.org that can mentor, review work, and provide guidance on where to best direct contributors’ energy.
23752190
2376−I use GIMP to edit images I pull off various social media platforms, and usually post the results on Twitter at [@nartesfasrum](https://twitter.com/nartesfasrum).
2191+If you’re interested in helping build Urbit, you can head over to https://grants.urbit.org to claim a bounty or submit a proposal, join the Landscape group ~wolref-podlex/foundation to stay in the loop about what urbit.org is up to, or contact me directly at josh@urbit.org.
23772192
2378−
2193+3 - Town Hall
23792194
2380−## ~norsyr-torryn
2195+In mid-February, we’ll be holding our first ever “Town Hall” event—it’s like a developer call, but longer, with more speakers, and covering a wider range of topics (not all of them technical!).
23812196
2382−No discussion of Urbit art would be complete without mentioning [~norsyr-'s Canvas app](https://github.com/yosoyubik/canvas), which won first place in the [Hackathon 2020](https://urbit.org/blog/hackathon-results/) event.
2197+We’re currently looking for speakers, so if you have an Urbit-related topic that you’d like to present, or would like to nominate someone else to present, please reach out to me by replying to this email. This could be an application you (or the nominee) has designed or built, an interesting use case, a design case study, or something completely different. Please don't be shy about reaching out—we're happy to work with you to figure out whether it makes sense to present a given topic, and how best to do so!
23832198
2384−
2199+Once we’ve finalized a date, we’ll broadcast it over our official Meetup group (https://www.meetup.com/urbit-sf/) and on Twitter. Stay tuned.
23852200
2386−## ~radbur-sivmus
2201+--
23872202
2388−~radbur- writes poetry on a range of subjects, one of which could be Urbit. Interpretation of ["A Weaver's Regard"](https://t.fust.us/writing/poetry/weavers-regard) and ["Internet Absurdities"](https://t.fust.us/writing/poetry/internet-absurdities) is left as an exercise to the reader.
2203+As a reminder, Urbit and Tlon have now split their newsletters in two—Urbit’s newsletter will cover the project and development community, while Tlon’s will focus more on the product development work on Landscape and the communities that form there. Tlon’s newsletter will arrive at the end of the month.
23892204
2390−## ~sitful-hatred
2205+That’s all for now. See you on the network!
2206+Josh / ~wolref-podlex
23912207
2392−~sitful- has a Martian Meme Depository chat in the Networked Subject group, which catalogs a number of the Urbit memes that have been created so far.
2208+https://twitter.com/urbit
2209+https://github.com/urbit/urbit
2210+]]></content:encoded>
2211+ </item>
2212+ <item>
2213+ <title><![CDATA[Ames Security Audit and the Future of the Protocol]]></title>
2214+ <link>https://urbit.org/blog/security-audit</link>
2215+ <guid>https://urbit.org/blog/security-audit</guid>
2216+ <pubDate>Thu, 17 Dec 2020 00:00:00 GMT</pubDate>
2217+ <content:encoded><
2220+
23952221
2396−## ~tocrex-holpen
2222+<br>
23972223
2398−~tocrex- has been drawing the galaxies of Urbit, and uploading results to Twitter at [@tocrexholpen](https://twitter.com/tocrexholpen). Each galaxy has a unique design and outfit, with the galactic sigil proudly displayed as its face.
2224+The security firm Leviathan has now finished their initial audit of the security of Urbit's Ames network protocol. In addition to their review of Ames, we also asked them to identify any other issues in order to help guide further development.
23992225
2400−
2226+I'm pleased to report they confirmed the cryptographic soundness of the protocol, namely that "a ship must have possession of their own valid Urbit key in order to authenticate as that ship and to send valid Ames messages. Additionally, no other ship except the two communicating may be able to decrypt or modify messages during transport."
24012227
2402−## Landscape
2228+This means Ames uses cryptography in a mathematically sound manner that protects your privacy, keeps your secrets secret, and ensures nobody else will be able to impersonate you on the network. Since this was an architectural audit, it’s possible there are still vulnerabilities in the runtime implementation. Until the runtime has been hardened, Tlon continues to recommend against storing valuables in your ship.
24032229
2404−Something that's become quickly evident with the addition of background images to Landscape is that people love to customize their ship's appearance and make it feel more like home. To close things out, we're providing a pair of backgrounds — one darker, one lighter — for use on your ship (or your desktop, should you so desire).
2230+Aside from a couple of minor issues that have already been resolved, there are three general classes of problem highlighted in their report that future work will need to address:
2231+
2232+- Forward secrecy
2233+- Protection against denial of service attacks
2234+- Enforcement of social boundaries
2235+
2236+Ames’ design allows for versioning of the protocol, which means that the proposed changes below can be deployed as over-the-air updates as they become more pressing concerns. This feature gives us confidence that we can address future security issues as they arise.
2237+
2238+We will need to improve all of these over the next couple of years, as independent lines of work. As the network grows: better forward secrecy will decrease the damage from a key getting compromised; resistance against denial of service attacks will make the Urbit network resilient to increasingly determined saboteurs; and stricter enforcement of social boundaries will let Urbit’s social networks remain safe and friendly despite potentially increasingly large numbers of bad actors and increasingly complex app ecosystems.
2239+
2240+## Forward Secrecy
2241+
2242+A protocol is said to have forward secrecy if compromising a key used in a recent message doesn’t also compromise all previous messages. Similarly, a protocol is said to have backward secrecy -- also called future secrecy -- if compromising a key used in a previous message fails to compromise all future messages. Ames has some degree of both, but more would be better, to decrease the damage an attacker could inflict by compromising a key.
2243+
2244+As it stands, an Urbit user can change their Ames keys whenever they want, by conducting an Ethereum transaction to update the Ames public key listed in the Azimuth contract, which implements Urbit’s PKI on Ethereum. Compromise of one Ames private key does not compromise earlier or later keys, so this has both forward and backward secrecy. The main drawback is that Ethereum transactions can be expensive, so key rotation is likely to be infrequent, and an attacker might be able to gain access to a long stretch of time by compromising a single key.
2245+
2246+Various key rotation “ratchet” schemes could be added to Ames to establish varying degrees of forward and backward secrecy, and other kinds of cryptographic protections beyond basic soundness, such as break-in recovery.
2247+
2248+Right now, changing a key through Azimuth is a manual process. It could be automated, possibly as one of a suite of services that an Urbit Provider will offer. Unfortunately, each key rotation costs the user money, so automating rotation could get prohibitively expensive.
2249+Existing protocols, such as the Signal app's encrypted messaging protocol, the Noise protocol framework, and the Wireguard VPN protocol, use ephemeral Diffie-Hellman key exchange and KDF chaining to achieve forward and backward secrecy and self-healing.
2250+
2251+Ames could be upgraded to use one of these existing ratchet algorithms, or we might create an Urbit-specific variant optimized for the Urbit network. This is work that should be done, but fortunately it will not require any novel research or drastic changes to Ames’s architecture.
2252+
2253+While Urbit’s cryptographic protections don’t yet match those of Signal or a few other privacy-focused apps, Ames is cryptographically sound, and since Urbit updates itself over-the-air and is backed by a stable, decentralized PKI, I’m confident that the level of sophistication of Urbit’s cryptography has the potential to be world-class with just a bit more work.
2254+
2255+## Denial of Service
2256+
2257+A denial of service (DoS) attack against an Urbit ship is an attempt to overwhelm it remotely by sending it network data in such a way as to interfere with the ship’s ability to communicate with other ships or process other events -- usually by hogging its resources (computational power, memory, or bandwidth) until normal operation slows down or ceases entirely. Since the promise of Urbit is that everyone can run their own server, that server needs to be able to defend itself against DoS attacks. This is in fact one of the main impediments to running your own server in the modern world.
24052258
2406−
2259+Right now, Urbit has no protection. Soon, it will need to at least be able to resist a simple attack carried out by an individual. Eventually, it should be able to resist a determined Distributed Denial of Service (“DDoS”) attack, which is more difficult.
24072260
2408−
2409−]]></content:encoded>
2410− </item>
2411− <item>
2412− <title><![CDATA[Late 2020 Progress Update: OS 1 -> OS 1.N]]></title>
2413− <link>https://urbit.org/blog/20200929-state-of-urbit</link>
2414− <guid>https://urbit.org/blog/20200929-state-of-urbit</guid>
2415− <pubDate>Mon, 28 Sep 2020 00:00:00 GMT</pubDate>
2416− <content:encoded><
2263+An unauthenticated DoS attack constructs packets that eventually fail to authenticate and decrypt but still overwhelm the target by causing it to waste resources (CPU, memory, disk, bandwidth) in such a way that it can't keep up with legitimate communications.
24202264
2421−<br>
2265+An unauthenticated DoS attack relies on the lack of Sybil resistance of IP networks: it's possible to generate new IP addresses rapidly, and a determined attacker might also be able to spoof its sender IP address. This is best considered an IP-layer attack that must be handled mostly at the IP layer itself, by maintaining state about which IP addresses can be trusted and which can't, determined empirically and heuristically by the Urbit runtime. The best any higher-level protocol, such as Ames or TCP, can do is make it as cheap as possible for a DoS target to reject a bad packet.
24222266
2423−When we announced OS 1, in April, we started to disappear into Urbit. Since then, we’ve been living on Urbit like we never have before. This has been our goal for years: to mature the system we’re building by becoming its first committed users. We knew that critical step toward Urbit’s maturity was being able to depend on it ourselves, but the system itself had to mature to the point that we could do that practically.
2267+The overall strategy that Ames can take, as a protocol layering over the IP protocol, is to add an authentication procedure to each packet that can quickly identify bad packets, which an implementation will then use to mark that IP address as suspect and to refrain from adding the sender IP to a list of known-good IPs.
24242268
2425−We’ve done this in fits and starts. We’ve _tried_ and failed a few times over the years. We’ve always _used_ Urbit to some extent, but we’ve never _relied_ on it. These past six months have been different. I can’t tell whether it was out of sheer determination and commitment, or that the system was just genuinely ‘there’. Either way, both Tlon and the Urbit Community genuinely live on Urbit now.
2269+Currently, Ames handles this by attempting to decrypt a message and rejecting the message on failure. This may be a more costly solution than other methods, such as attaching a signature or a MAC to each message. The way to mitigate unauthenticated attacks is to make bad packets fail faster by augmenting each packet with a signature or MAC to each packet, since those are faster to validate than encryption.
24262270
2427−In a way, our ability to use Urbit day to day doesn’t make sense. When we shipped OS 1, it was full of holes. There were serious performance, stability, and reliability issues. Plenty of people showed up and thought, ‘I don’t understand why you think this is useful.’ But, it was good enough that we wanted to use it. And since we wanted to use it, we put our energy into making it better like we hadn’t ever before. Being able to use a system that you can really trust is a wonderful feeling. It’s Computing Without Compromises.
2271+So far, we have identified three approaches that could be taken here. Of these three, Leviathan recommended the end-to-end HMAC solution, since that would not impose additional CPU requirements on packet-relay nodes, such as stars.
24282272
2429−All of the sudden, it’s Fall. We never found the time to name any of our releases or write announcements. We’ve just been making the system better in every way we can find. We’ve got a lot of exciting things planned for the last few months of the year — but I wanted to recap the progress we’ve made for those following along from the outside. If you haven’t been on the network, it’d be impossible to see.
2273+- Sign each packet, and any relay or final recipient could validate the signature
2274+- Wrap each packet in an HMAC, validated by the final receiver
2275+- Wrap each packet in a HMAC for each hop in a relay chain; each relay would validate and strip the previous HMAC and add a new one for the next hop
24302276
2431−The tl;dr is that Urbit is much faster, more reliable, and nicer to use than it was six months ago. Things have gotten much better, across the board. We threw ourselves into OS 1 admittedly underprepared, but we’ve learned a lot and matured the system a lot along the way.
2277+Any of these solutions would be attempts to increase the rate at which the network could discard invalid packets, with different tradeoffs. I'll back up a bit to provide some context, and then I'll compare the approaches.
24322278
2433−Anyway, let’s walk through the details. We’ll talk about our infrastructure and interface work independently, since that’s how we organize things internally. Then we’ll talk a bit about what’s going on on the network.
2279+In any DoS solution, a planet will want to block or throttle IPs that have been sending it packets that fail to authenticate and decrypt. Ideally, a star will help protect planets for whom it’s relaying, too. Many different arrangements among galaxy, star, and planet are imaginable here, from an open policy to a policy wherein each packet has to come from a known-good IP. This sort of paranoid, closed-off arrangement might still not be enough to withstand a determined DDoS, but it's difficult for me to imagine doing better than that without launching Urbit-specific ISPs. Ames packets are cryptographically authenticated, so an Urbit ISP would actually be feasible.
24342280
2435−### Infrastructure
2281+This brings us back to the three possible ways of mitigating DoS from within the Ames protocol. They all involve adding a piece of authenticating information to each packet that can be verified more quickly than waiting for the cyphertext to fail to decrypt — Ames's symmetric encryption is authenticated, so it's not a cryptographic soundness issue, but the performance impact of trying to decrypt could be significant enough to make it hard to prevent a DoS.
24362282
2437−
2283+As-is, an Ames packet is basically `[protocol-version checksum sndr rcvr (nullable origin) cyphertext]` (visit [this PR](https://github.com/urbit/urbit/pull/4051#issue-530369627) for a full specification). Let’s walk through the construction of the packet and how it can be upgraded to offer different DOS mitigations.
24382284
2439−In April, Urbit was slow, fragile, and didn’t always update itself properly. We made enormous progress on all of these.
2285+### DoS Mitigation Approach 1: Signature
24402286
2441−First off, Urbit is about 10x faster for most users. With some careful debugging, we were able to locate a few really [high](https://github.com/urbit/urbit/pull/3029) [impact](https://github.com/urbit/urbit/pull/3054) [improvements](https://twitter.com/pcmonk/status/1276327036722704385). There’s still performance work to do, but the effects of this work are widespread. Boot times are faster, local compute is faster, the network is faster. It’s a huge improvement.
2287+The first approach to DoS protection would be to add a signature to the packet. The signature would cover everything except the checksum and the origin, since those need to be swapped out by relays. The signature would probably obviate the need for the (20-bit) checksum, although we could also leave it in there if we can't figure out what else to do with those header bits.
24422288
2443−Second, we got our memory usage under control. Urbit still uses a 2GB memory arena. If the state of your Urbit grows to over 2GB things, uh, fall apart. This used to happen regularly, and now it’s pretty much unheard of. We implemented [tooling](https://github.com/urbit/urbit/pull/3235) to compact and deduplicate the memory image when it’s growing too large. We brought the memory usage of the compiler [down ~90%](https://github.com/urbit/urbit/pull/3041). There are areas where we can be more disciplined about how we use memory, but this is more or less a solved problem for the near term.
2289+#### Advantages of a signature over other approaches
24442290
2445−Third, we implemented a completely new build system. Well, we actually [got rid of the build system](https://urbit.org/blog/ford-fusion/) altogether and [made it a part of the filesystem](https://github.com/urbit/urbit/pull/3060). This made it possible for us to fix our over the air (OTA) updates and make them both fast and reliable. In April, an OTA could bring down your node and would take hours or even days to apply. Today, we regularly deploy OTAs with no fear of them breaking any nodes — they often go from galaxy → planet in a minute or less.
2291+- It can be validated by anyone on the network. Relays would not need to modify it. This might also give it symmetry with the upcoming remote scry protocol, which might also sign every packet. I'm not quite sure this is an important property, actually, but it might theoretically make launching an Urbit ISP or internet backbone easier one day.
2292+- It would be signed directly by the key listed on Ethereum, not something that might get ratcheted at some point for better forward secrecy — this could eventually lower the rate at which intermediate validators need their key caches invalidated, although this is a bit of a theoretical concern.
24462293
2447−We also rewrote a large part of our runtime in Haskell and made overall progress on [network scaling](https://github.com/urbit/urbit/pull/3174). And: we implemented a [principled approach](https://github.com/urbit/urbit/pull/2366) to [error handling](https://github.com/urbit/urbit/pull/3064), making nodes much less likely to become unrecoverable.
2294+#### Disadvantages of a signature over other approaches
24482295
2449−The network is stable, fast, and safe from day to day. We’re pretty confident it can grow quite a bit without serious issues. When we shipped OS 1 we really weren’t sure what we could handle. Now we’re standing on much more solid ground.
2296+- Generating and validating a signature is significantly slower than generating and validating an HMAC.
2297+- An ECDSA signature is 64 bytes, which is ~6% of a packet payload. As far as I can tell, it can't be compressed.
2298+- Since the signature could be validated by anyone, it doesn't attest to a specific communication channel, so it might not help as much with IP filtering.
24502299
2451−### Interface
2300+### DoS Mitigation Approach 2: End-to-End HMAC
24522301
2453−
2302+The second approach would be to use an HMAC instead of a signature, validated by the eventual receiver. This HMAC would also cover everything except the mug and origin. I'm calling this the "end-to-end HMAC" design. An HMAC requires a shared secret, for which we could use the same symmetric key that Ames uses.
24542303
2455−When we shipped OS 1 it was a bunch of separate pages (that were slow to load), all with separate ways of storing and processing data. Our interface work over the past six months is all about unification and simplification.
2304+#### Advantages of end-to-end HMAC
24562305
2457−First, we pulled OS 1 together as a [single page app](https://github.com/urbit/urbit/pull/3025). Using OS 1 involves a good amount of moving around and refreshing the page each time was pretty painful. Now it’s snappy to move between pages and keep up with what’s going on. In tandem, we started using our own component library, [Indigo](https://github.com/urbit/indigo-react). This makes frontend development much cleaner and more efficient.
2306+- It's simple in some sense; relays don't need to do anything cryptographic.
2307+- HMACs are much faster to create and validate than signatures.
2308+- HMACs, since they're hashes, can be truncated arbitrarily and still maintain some security — to find hash collisions, you'd still have to guess what packet||shared-secret would hash to; it would just be a smaller search space. Since Ames's encryption already guarantees authentication and we'd just be using this as a performance optimization, I suspect we could get away with using one that's significantly smaller than a signature — I'm not sure how small, but if 4 bytes would be enough in practice, that would take up less than 0.5% of the space in a packet.
24582309
2459−Next, we unified the way we store data and compute. It used to be that each individual module (chat, publish, and links) used their own ‘agents’ to store and process data on the Urbit side. (An agent is the Urbit equivalent of a datastore + business logic.) With a lot of moving parts, this approach caused all kinds of synchronization challenges. Rather than a module-per-agent model we’ve started to move toward a type-of-data-per-agent model. The first of these is [graph store](https://github.com/urbit/urbit/pull/3110). We’re presently in the process of migrating all our modules to graph store.
2310+#### Disadvantages of end-to-end HMAC
24602311
2461−Those two are by far the most significant, but there’s so much more. We [rewrote](https://github.com/urbit/urbit/pull/2937) the `group-store`, allowing for different roles (admin, moderators, and so on) in a group. We shipped better debugging tools, automatic reconnection, a settings panel, and overall visual polish and refinement.
2312+- Only the recipient can validate. This means the authentication couldn't be used by relays to discard invalid packets. The recipient could provide back-pressure out-of-band to a relay to ask the relay to discard packets from an IP with an invalid HMAC, but this is indirect and might need to filter backward through multiple relays to work properly.
24622313
2463−
2314+### DoS Mitigation Approach 3: Point-to-Point HMAC
24642315
2465−And I almost forgot [Leap](https://github.com/urbit/urbit/pull/3231): an omnibox for navigating around OS 1 with the keyboard. We have plans to make Leap much more powerful — but it’s a great first start toward making OS 1 keyboard accessible. I almost exclusively use [Leap](https://upload.wikimedia.org/wikipedia/commons/0/06/Canon_Cat_keyboard.jpg) to get around OS 1 these days.
2316+The third approach, which is what I would build unless convinced otherwise, is what I'm calling "point-to-point HMAC". This design would include a different HMAC for each hop in a relay chain, instead of (or maybe in addition to) including one end-to-end HMAC.
24662317
2467−### Community + network
2318+We have a couple different options for how to construct the shared secret for each hop. I would intuitively construct it using a Diffie-Hellman of my private signing key and your public signing key — the "networking keys" on Ethereum include a currently unused signing key in addition to the encryption key that Ames uses. This way even if we add more forward secrecy to Ames, changing the symmetric key used for encryption, relays wouldn't have to have their caches invalidated as often; the state required to perform relaying wouldn't be as tied to the state required to receive a message.
24682319
2469−
2320+#### Advantages of point-to-point HMAC
24702321
2471−Our primary goal with OS 1 was to get both Tlon and the Urbit Community living entirely on Urbit. We did that, and in doing so we’ve seen how nice it is to grow a community in a calm, non-invasive environment. We started doing regular [Urbit](https://twitter.com/urbit/status/1308875082312364048) [Dialogues](https://twitter.com/urbit/status/1304139629948329985) with friends and peers in the absence of physical meetups, which have been fun.
2322+- A star could perform some validation on every packet it's asked to relay. This makes it more difficult for an attacker to route a ton of packets to a planet through a star, or even through many relays. Signatures also have this property, but they're slower to verify. This approach and the signature approach, but not the end-to-end HMACs, force an attacker to use an (at least partially) authenticated attack in order to use a relay as a way to get to a planet.
2323+- A planet could quickly validate that a relayed packet actually came from its star, not an attacker who's managed to spoof the star's IP address.
24722324
2473−Getting onto Urbit is still relatively challenging. By the standards of software you run yourself, it’s not so bad at all. But by comparison to ordinary consumer software, it’s way too hard. Tlon is [working on that](https://tlon.io) — but these last six months have been only for the brave. That is, those that want to host their own nodes.
2325+#### Disadvantages of point-to-point HMAC
24742326
2475−Turns out, there are plenty of people who are up for running Urbit themselves and quite a few small communities have sprouted around the network. Overall the network has a fun, cozy feeling. It’s nice.
2327+- Not everyone on the network can validate a packet, unlike a signature.
2328+- Each relay needs to validate and strip off the previous HMAC and create a new one before sending it. This should be quite fast, since an HMAC is just a hash, but it's still some CPU, and potentially creates an imbalance where an attacker could induce the relay to spend more CPU in validation than the attacker spent in constructing the packets.
2329+- By itself, it doesn't validate the cyphertext in an end-to-end way. I suspect we might want to include both a per-route HMAC and an end-to-end one, especially if we use truncated HMACs — although per-route might be enough on its own, since if the receiver fails to validate a bunch of packets whose HMACs were validated by the relay, the receiver can ask the relay to block that whole Urbit address regardless of IP, so it shouldn't be possible to sustain that kind of attack for long.
24762330
2477−### What’s next
2331+#### An Aside About Cryptographic Performance
24782332
2479−We’re still more or less flat-out, full speed ahead into an even better Urbit-world. The seeds of change were planted when we made Josh the [interim technical director of urbit.org](https://urbit.org/blog/first-steps-towards-urbit-org/). Urbit itself is getting close to the point where the separation between Urbit and Tlon has to become more real. Urbit is aimed at being an ubiquitous platform, Tlon is aimed at making it as usable and useful as possible.
2333+I'm not sure exactly how much faster HMAC is. According to DJB (https://ed25519.cr.yp.to/ed25519-20110705.pdf), an ECDSA signature can be created in around 30 microseconds and verified in around 100 microseconds. This source (https://www.jacksondunstan.com/articles/3206) suggests about 21 microseconds for HMAC-SHA256, so about a 1.5x improvement in generation speed and 5x in validation speed. We should verify these numbers for ourselves before making a decision.
24802334
2481−We’ll talk about some of this on [October 9th](https://www.meetup.com/urbit-sf/events/273439025/), and you can see a bit of what’s coming on [tlon.io](https://tlon.io) today. If you tried booting Urbit in April and it was tough, try again. We’re easy to find on the network, and we’d love to get reacquainted.
2482−]]></content:encoded>
2483− </item>
2484− <item>
2485− <title><![CDATA[~2019.10 Roadmap]]></title>
2486− <link>https://urbit.org/blog/2019-10-3-roadmap</link>
2487− <guid>https://urbit.org/blog/2019-10-3-roadmap</guid>
2488− <pubDate>Wed, 02 Oct 2019 00:00:00 GMT</pubDate>
2489− <content:encoded><
2335+### DoS Protection Strategy and Timeline
24912336
2492−The daily work of building a new OS from scratch is so engaging and exciting that we habitually forget to even take stock of what we’ve accomplished. We’re fixated on the prospect of moving the world on to Urbit, starting with ourselves.
2337+Tlon is not currently pursuing adding any of the extra cryptographic authentication on Ames packets described above. Since this is ultimately a performance issue, there are other more pressing performance issues that we could improve upon before decryption will become the limiting factor in how many packets can be processed by a ship. We will revisit this authentication performance question once some of the low-hanging fruit has been done, perhaps roughly a year from now.
24932338
2494−It’s a good thing I have a recurring reminder to write these updates. While our focus is on the future, it’s good to get a sense of the rate that we’re moving forward, and to let everyone know what’s been going on. We’ve made great progress over the past few months.
2339+Since the audit, we’ve already improved the Ames packet format to allow faster parsing, faster validation of basic fields, and faster relaying; in the future, increases in performance of Nock execution and inter-process communication between Urbit's I/O process and Nock worker would allow Urbit to absorb somewhat more punishment before service can be effectively denied.
24952340
2496−We’ve got a new interface, Urbit 0.8.0, Hoon School, and a grants program among lots of other updates. We’ll go into detail about all of these, and talk a bit about where we’re headed next. The system is improving at a really good pace. We intend to keep it up.
2341+## Enforcement of Social Boundaries
24972342
2498−## Identity (Azimuth)
2343+While Urbit needs to rely largely on its runtime to mitigate unauthenticated attacks, any attack conducted from an Urbit ship needs to be handled inside Arvo itself, not just by IP filtering in the runtime. Just like in any DoS, an attacker ship might try to induce you to use too much memory, CPU, or disk space in order to sabotage normal operation. An authenticated attack is harder to define than an unauthenticated attack, because it depends on what social relationship the attacker and target have, and it involves valid, authenticated Ames packets; once discovered, though, it’s easier to mitigate, because it can use Urbit’s permanent identity system to enforce social consequences, i.e. stop listening to that Urbit address and possibly encourage others to do so as well.
24992344
2500−The other day I got an email, clicked a link, and got a planet. A real, live, piece of cryptographic property with paper wallets and everything. It took about two minutes. And at the end, I could have easily sent invites to my friends.
2345+There are a couple of different kinds of authenticated attack: attempts to exploit vulnerabilities in the Nock worker (the interpreter, allocator, and jets) by causing particular Nock code to run, and attempts to induce the target to exhaust various computational resources.
25012346
2502−This experience is part of a completely new Bridge, the interface for interacting with your Urbit identity. The beta experience we’re testing today is quite stripped down, but it’s a huge improvement over the last Bridge release. Clicking a link is a lot easier than downloading source code, running it from the command-line, and probably running into a python-related error.
2347+Protecting against attempts to break out of the sandbox and hijack or otherwise interfere with the Unix process running Nock will require a process of hardening, fuzzing, and likely further security audits specifically evaluating the security of that boundary. This is largely out of scope of the Ames protocol itself, which was the subject of this audit.
25032348
2504−Getting to this point involved rewriting Bridge from scratch, figuring out how to host it securely, building infrastructure to fund the requisite transactions involved in registering a new identity, and setting up a service to send emails (and dispose of them afterward). We've also redesigned our paper wallets to make them simpler and clearer.
2349+This leaves us with the latter case: resource exhaustion attacks. A peer could try to get my ship to use too much RAM, disk, CPU, or bandwidth by sending it valid Ames packets. This represents a social problem: a person on the network is trying to interfere with me. It's what's known in blockchain circles as an "attributable fault": once the attack is detected, it's trivial to determine the identity of the culprit.
25052350
2506−We still want to get this new version of Bridge a bit further along before releasing it to everyone — but we’re excited about it. We didn’t quite get to the point of building an affordance for payments, which we had hoped to do, but that’s coming later.
2351+Once the attacker’s Urbit address is known, Urbit will fall back on the Sybil resistance of its identity system: there are a finite number of identities, each of which costs some money. Because Urbit identities are relatively permanent, they can be blocked permanently. As long as the expected value of an authenticated attack is less than the cost of the identity, the attacks won't happen very much — they'll cost money to sustain, instead of being self-perpetuating.
25072352
2508−We want everyone to have an Urbit identity. And we want it to be incredibly easy to get one, so we’ll get Bridge out this month with a new urbit.org (more on that below).
2353+Attacks like this are best thought of as attempts to violate social boundaries. I don't want you using up too many of my resources; that's a social boundary, and an attempt to force my ship to spend its resources on your behalf constitutes a violation of this boundary. The strategy for mitigating these attacks is to impose social and, indirectly, economic consequences on the perpetrators. The main social consequence is other ships refusing to communicate with you anymore.
25092354
2510−The other area of identity-related work was Sigils — the algorithmically generated images that go with every Urbit identity. (We’ve got a blog post in the works that covers how we created these, which is a good story that needs to be told.) The original version of Sigils didn’t look very good at small sizes and a few collisions were found (thanks to [urbit.live](https://urbit.live) for helping to discover the collisions). The [new, improved sigils](https://github.com/urbit/sigil-js) have no collisions and look great at small sizes.
2355+Some of this mitigation will take place in the Arvo kernel, and some will need to be application-specific. To protect the system from attackers, the kernel needs to be able to free space (Urbit is a single-level store, so there's no distinction between disk and RAM from Arvo's perspective) taken up by unfinished messages sent by peers. This can be done by allowing an application to ask Ames to delete partially received messages from a peer, generally replacing the received packets with an intent to nack (negative acknowledgment) to indicate that the transaction the peer wanted me to perform has been rejected.
25112356
2512−**Q4 2019**
2357+Applications should also be able to set resource usage policies that the Arvo kernel will enforce. For example, a chat application should configure Ames to reject any chat messages larger than, say, two hundred kilobytes. A file-sharing application would need a much larger per-message limit (ideally no per-message limit), but it might need to place a cap on its bandwidth usage to make sure lower-latency communications aren't swamped by a large file transfer. This kernel/application interface starts to resemble a permissioning or capabilities system, and it could be built as part of the crucial larger project of providing for configurable application permissions.
25132358
2514−- Release Bridge to the public
2515−- Get Bridge working well on mobile
2516−- Add payments support, hopefully including BTC
2517−- Add a network explorer
2359+To close the loop on enforcing social boundaries, reputation information should be shared across ships. This will likely be done by building one or more applications that share statistics and block operations. Some forms of reputation are likely to be globally shared, whereas others are likely to be multipolar, i.e. some people like you and some don’t. Generally, the lower the layer of the attack, the more global the reputation effect will be; the higher the layer, the more multipolar. An attempt to spam the network with millions of malicious packets will cause most people not to want to talk to you; sending me a movie I found mediocre is probably not even information worth sharing with anyone else.
25182360
2519−**Q1 2020**
2361+## Conclusion
25202362
2521−- Integrate Bridge with a native app for Arvo
2363+Ames’ design has unparalleled potential to deter, mitigate, and recover from attacks, since every packet is authenticated and encrypted and backed by a stable, decentralized PKI. It feels good to have our design for encryption and authentication be confirmed by a third party as cryptographically sound, and we know more or less what we need to build to reach the full security potential of the platform, including the steps outlined here.
2364+]]></content:encoded>
2365+ </item>
2366+ <item>
2367+ <title><![CDATA[Input and Output in Hoon]]></title>
2368+ <link>https://urbit.org/blog/io-in-hoon</link>
2369+ <guid>https://urbit.org/blog/io-in-hoon</guid>
2370+ <pubDate>Tue, 15 Dec 2020 00:00:00 GMT</pubDate>
2371+ <content:encoded><
25242375
2525−As a team, we want Urbit to be our primary computer, our last computer, our permanent computer. And we want this now — or at least as soon as we possibly can. We’re both ambitious and impatient.
2376+<br>
25262377
2527−The frustration that we can’t move onto Urbit today propels us forward. The system saw major updates over the past few months all the way through the stack. On the Arvo side, we divide our work into Infrastructure (everything in the kernel and interpreter) and Interface (everything in userspace and the front-end). We’ll start with Infrastructure progress first.
2378+Let's talk about IO in Urbit. I won't say much about how events and effects are processed by the runtime; it suffices to note that the runtime is a normal Unix program which (1) listens for various events, (2) passes them to Arvo (Urbit OS), and (3) processes the effects produced by Arvo. Instead, I’ll focus on how IO works from the perspective of Hoon programs, like Arvo or apps running on Arvo. But first, let's review IO paradigms in other languages.
25282379
2529−We’re very nearly to the point that all the kernel-level code in the system has been written by our current team. The one remaining vane that deserves a rewrite (Gall) has had a major cleanup by Jared just recently. The [Ship of Theseus](https://en.wikipedia.org/wiki/Ship_of_Theseus) approach does appear to be working. The infrastructure team is doing fantastic work and has really deepened their ownership of the system. The Urbit of today is on the road to becoming a great piece of system software.
2380+All examples are in a made-up language, since it's useful to understand this information even before you're comfortable in Hoon. If you're learning Hoon and want a challenge, try translating them!
25302381
2531−The biggest infrastructure-level milestone was the release of [Urbit 0.8.0](https://github.com/urbit/urbit/releases/tag/v0.8.0). We introduced a new process-separation architecture, implemented the correct bootstrap sequence, moved to LMDB for persistence, replaced our http vane (%eyre) and moved to Nix for our build system.
2382+## The three styles of IO
25322383
2533−To put it simply, Arvo is now much more stable and durable. During the beginning of the year we were seeing bugs and instability that were frustrating and unacceptable. While there are still issues on the live network, none of them terrify us much. We also implemented the ability for users to ‘individually breach’, which means that you can now reset your Urbit without waiting for us to reset the network.
2384+I will call these styles imperative IO, monadic IO, and state machines (note that this classification refers only to the experience of using them and the program structure they dictate). An imperative programming language can use any of these and a functional programming language can use any of them.
25342385
2535−### Landscape (Arvo UI)
2386+### Imperative IO
25362387
2537−We don’t just build infrastructure for others to develop on top of. We build interfaces too. At the top of the stack, we released a completely new Landscape, the interface for Arvo. This new interface makes it possible to build other ‘modules’ for Arvo that go beyond chat and publishing.
2388+Imperative languages (such as C and Python) perform IO by calling a function in the middle of whatever they were doing. Anywhere, in any statement, you could have IO.
25382389
2539−This new Landscape is a complete departure from the last direction. Your Urbit now has a simple home screen that launches individual modules and it’s [relatively easy](https://github.com/urbit/create-landscape-app) to create new ones. We’re all enjoying using Landscape around the office. It’s still a bit of a prototype — but it’s quite a good one, I think.
2390+In this example and others to follow, the task will be to read a filename from the command line, read a URL out of that file, and fetch the contents at that URL.
25402391
2541−In moving to this new model we decided to narrow our focus to desktop only for now. We’ll return to mobile again next year — but first we want to get the desktop experience right. We’ve pulled the iOS app from the app store for the time being. I’m personally sad to see it go, since I enjoyed using it. But our prior iteration of Landscape just wasn’t quite right.
2392+ output = fetchUrl(stripWhitespace(readFile(cliInput())))
25422393
2543−This version of Landscape is, I think, the last one that we’ll call a prototype. Over the past few weeks, since shipping this, some amazing work has been happening on the interface front. We have a systematic approach to building interfaces on top of Urbit that’s very promising, albeit just getting started. We’ve already put out [one post](https://urbit.org/posts/landscape-a-portrait/) about Landscape's future, with more posts to come.
2394+For readability, intermediate variables would be a good idea, but nothing stops you from nesting IO this way.
25442395
2545−**Q4 2019**
2396+### Monadic IO
25462397
2547−- Improved Arvo-level error handling
2548−- Implementation plan for ‘telescoping kelvins’ — or [how we plan to future proof Arvo](https://groups.google.com/a/urbit.org/forum/#!topic/dev/6Mwn6TQFVwc)
2549−- Versioning scheme between Arvo and Vere
2550−- A new Haskell implementation of the daemon
2551−- A native client (instead of just a browser tab)
2552−- A [new user-space architecture](https://docs.google.com/document/d/1hS_UuResG1S4j49_H-aSshoTOROKBnGoJAaRgOipf54/edit)
2553−- Hoon.hoon that’s OTA upgradeable
2554−- Working Jacque prototype, a graal-truffle-based implementation of vere
2398+Languages that use explicit monads for IO (such as Haskell) perform IO by running IO behind a bind operation, which I'll notate with `<-`. Thus, while you can't put IO _anywhere_, the general structure is a sequence of IO operations.
25552399
2556−**Q1 2020**
2400+ fileName <- cliInput()
2401+ url <- readFile(fileName)
2402+ output <- fetchUrl(stripWhitespace(url))
25572403
2558−- Integrated client with Bridge and Arvo
2559−- New interface framework, codenamed ‘Widescreen’
2404+[Tackling the Awkward Squad](https://www.microsoft.com/en-us/research/wp-content/uploads/2016/07/mark.pdf) is the canonical description of monadic IO, and does a great job of explaining how the Haskell community decided to use this as their primary IO style.
25602405
2561−## Docs + Community
2406+### State machines
25622407
2563−We had quite a bit of interest in our second session of Hoon School. We ended up with 150 people enrolled in Hoon 101, and 42 in 201. The 101 session just ended, with a lot of positive responses and feedback from the participants. We learned a lot doing it and got quite a bit of interesting new example code.
2408+Languages that use explicit state machines for IO (such as Elm) perform IO by accepting events and producing a list of effects.
25642409
2565−Hoon 101 started with students with little to no programming experience. Hoon 201, which is just getting underway, covers more advanced topics. We’re quite curious to see what comes out of it.
2410+ event :: Initialize
2411+ | CLIInput text
2412+ | FileInput text
2413+ | HTTPResponse body
2414+ effect :: CLIInput
2415+ | ReadFile fileName
2416+ | FetchUrl url
2417+ | Print text
2418+ main(event) {
2419+ switch event {
2420+ Initialize -> [CLIInput ~]
2421+ CLIinput fileName -> [ReadFile fileName]
2422+ FileInput url -> [FetchUrl stripWhitespace(url)]
2423+ HTTPResponse body -> [Print body]
2424+ }
2425+ }
25662426
2567−We’re also adding features to Landscape to make it more amenable to use by Hoon Schoolers. Good examples include code evaluation within Chat (for office hours), and the ability to pin posts in Publish. The next crop of Hoon learners will be able to use Urbit to learn about Urbit.
2427+The effects produced are not functions but data.
25682428
2569−Aside from Hoon School we’re always updating our documentation. Most notably, we added search to the docs (finally). This was a much needed feature that makes the docs much more usable.
2429+It's important to note that this example is chosen to highlight a particular kind of IO — sequences of events. Further, this example has no persistent state — each IO operation is a pure function of the output of the previous one.
25702430
2571−We also launched our [grants program](https://grants.urbit.org/) quietly, but all of our available bounties were quickly claimed nonetheless. We’re ready to give away more address space to contributors and are excited by how quickly people got involved.
2431+## A stateful, loopy example
25722432
2573−We also did some experimentation with holding events on Arvo. We held weekly AMAs for while, and hosted a few meetings with the community. With the new UI out, our public channels have been a lot more active. We’ll surely be holding more on-urbit events in the future — but for the time being the conversation in urbit-help is a lot of fun.
2433+Let's look at another type of program: a simple HTTP server that you can give text at the CLI, which will respond to all HTTP requests with that text.
25742434
2575−**Q4 2019**
2435+Imperative:
25762436
2577−- Vane level documentation
2578−- An active grant program
2437+ text = "no text entered yet"
2438+ while (true)
2439+ cli = readCli()
2440+ if (cli != Null)
2441+ text = cli
2442+ request = readHttp()
2443+ if (request != Null)
2444+ respond(request,text)
25792445
2580−## urbit.org
2446+Monadic:
25812447
2582−Urbit.org is about ready for a refresh — so we’re in the process of rebuilding it. We have, for a long time, told the story of Urbit by describing the system technically. We think Urbit can be explained much more simply and much more concisely. We’re working to put together a new set of materials in this direction.
2448+ loop("no text entered yet")
25832449
2584−We’d also like to populate urbit.org with a lot more content about what we’re working on and thinking about. We do a reasonable job of writing updates, but many of our projects get released without any background info. Tlon and the Urbit community are full of smart, thoughtful people — and we’d like to do a lot more to surface their work. We plan to close out the year with both a new website and a lot of writing about what we’ve been building. Not everyone wants to read the source code!
2450+ where:
25852451
2586−That covers it for now. If you have questions or want to chat — find us in `~dopzod/urbit-help`. See you online!
2587−]]></content:encoded>
2588− </item>
2589− <item>
2590− <title><![CDATA[~2019.5 Roadmap]]></title>
2591− <link>https://urbit.org/blog/2019-5-roadmap</link>
2592− <guid>https://urbit.org/blog/2019-5-roadmap</guid>
2593− <pubDate>Wed, 15 May 2019 00:00:00 GMT</pubDate>
2594− <content:encoded><
2452+ loop :: text -> IO Null
2453+ loop =
2454+ input <- readInput()
2455+ switch input
2456+ CLIInput newText -> loop(newText)
2457+ HTTPRequest request ->
2458+ _ <- respond(request,text)
2459+ loop(text)
25962460
2597−We often get so busy that we forget to tell you what we’ve been up to. Here’s an update on what we’re doing and where we’re headed with each layer of the stack.
2461+State machine:
25982462
2599−At a very high level we have two goals for 2019: make Azimuth easier to use, and get Arvo to a 1.0.
2463+ text = "no text entered yet"
2464+ main(text,event) {
2465+ switch event {
2466+ CLIInput newText -> [newText, Null]
2467+ HTTPRequest request -> [text, HTTPResponse text]
2468+ }
2469+ }
26002470
2601−Next year we’ll begin to move away from some of the MEGACORP software we use in the office, and replace it with our own tooling. There’s some exciting work happening in that department, but we’ll cover that in a future post.
2471+Again, note the response in the state machine is data, not a function.
26022472
2603−For some related recent thinking on all of this, see [The 100 Year Computer](/posts/essays/the-100-year-computer/), [The State of Landscape](/posts/essays/the-state-of-landscape/) and [Azimuth as MultiPass](/posts/essays/azimuth-as-multipass/).
2473+I'm not trying to make a point about which type is better in general. There's a pretty strong argument that in the first example, imperative was the best option, followed by monadic, followed by state machine. There's an equally strong argument that the second example is most naturally represented by the state machine.
26042474
2605−For now, let’s just look at what’s on the immediate horizon:
2475+Look at how state is handled in the monadic example. Formally, bind composes functions, so that every time you see a `<-` there's actually a new function (closure/delimited continuation) being created and stored for when we receive a response. All variables in scope are stored in that closure, so we can conveniently access them later without explicitly storing them. However, the state we preserve over time varies a lot. In this example, it varies between storing `loop`, `[loop input]`, `[loop input newText]`, and `[loop input request]`.
26062476
2607−## Azimuth
2477+By comparison, the state machine does not store intermediate values, it only stores its explicit state. While this is somewhat less flexible, it puts the permanent state front-and-center.
26082478
2609−At lunch the other day someone on our team said something like, ‘We built a complete and working public key infrastructure, but we haven’t told anyone.’
2479+I'll reiterate that all of these are possible to implement in purely functional languages, and further they can all be implemented in terms of each other. State machines are trivially implementable -- it's just a function [state event] -> [new-state (list effect)]. Monadic IO can be implemented directly (as in Haskell) or on top of state machines by storing continuations in your state. Imperative IO is somewhat more difficult but should be possible through algebraic effects.
26102480
2611−It’s true. Azimuth is operational, secure, and well tested. It’s a pretty cool piece of technology and it’s out there in the world for anyone to use. It also doesn’t require that you use Arvo — Arvo happens to make use of Azimuth, but Azimuth itself is a completely separate system.
2481+When inventing a new system, you should consider which of these you intend to support based on the sort of code you expect to see. For example, a scripting language will almost always benefit from imperative (or at least monadic) style.
26122482
2613−So the question is why haven’t we told the world about it?
2483+## In Urbit
26142484
2615−I tend to think that in order for a technology to succeed it has to not only be an important technical innovation, it also has to be easy to understand as a product. And that’s our answer: we’ve undersold Azimuth because we want it to be easier to understand by _using_, not just by reading the code. Azimuth is quite an elegant piece of technology — but that doesn’t matter until it has a great user experience to match.
2485+So much for exploring the space of IO solutions. In terms of deployed code on Earth, the split is about 90% imperative, 5% monadic, and 5% state machine. In Urbit, the split is about 90% state machine and 10% monadic. This is what I intend to explain and defend.
26162486
2617−That’s why, in the near term, we’re focused on building on top of Azimuth ourselves. We can’t ask others to go down roads if we haven’t already been down them.
2487+Urbit's OS is called Arvo; it has several "kernel modules" called vanes, and it has userspace applications. Colloquially these are called "apps," but when speaking about them abstractly, it's helpful to use their more specific name: ["agents"](https://urbit.org/docs/tutorials/arvo/gall/#agents). Arvo, the vanes, and agents are all structured as explicit state machines.
26182488
2619−Here’s what we’re building first:
2489+In addition, there are ["threads"](https://urbit.org/docs/tutorials/arvo/gall/#threads), which are structured as monadic IO. Note there's only a superficial resemblance to Unix threads: they are not executed in parallel and they don't share memory, or at least not any more than agents do. They're simply a computation that takes an argument and produces a result, possibly after doing some IO, structured monadically.
26202490
2621−### Q2 2019
2491+As you can see, all the lowest levels of Arvo are explicit state machines, and only the highest layer supports monadic IO. To see why this is the case, let's list advantages and disadvantages to each type. Note that, while I'm speaking specifically of agents and threads in the context of Urbit, these are fundamental properties of monadic and state machine IO.
26222492
2623−- A simplified onboarding flow for getting an Azimuth point that’s simple to share with friends over email, text or as a URL.
2624−- A redesigned and improved Bridge for managing your points.
2625−- An interface that allows you to easily send money between Azimuth points without running Arvo.
2493+Agents are:
26262494
2627−### Q3 2019
2495+- Upgradable. Since the state is explicit, you can upgrade an agent in-place by supplying a new state machine and a function from the old state type to the new state type. This is very similar to a database migration.
26282496
2629−- Expanded Azimuth-centric example modules, documentation and developer tooling.
2497+- Robust. A state machine must accept any input at any time. If it receives unexpected input, it must have had explicit error handling for that input, since it's one of the types in the switch statement. Thus, it's relatively easy to stay in a consistent state.
26302498
2631−Still under consideration:
2499+- Permanent. Since it's upgradable and robust, there's no reason to stop its running.
26322500
2633−- An OAuth server or JWT flow for logging into any service with an Azimuth point.
2634−- A mobile app for point to point payments using Azimuth.
2501+- Hard to write long sequences of IO. Long sequences of IO create many possible states, and you must handle any input in any state. This can result in complex, hard-to-follow code with code paths that are rarely if ever taken.
26352502
2636−### 2020
2503+Threads are:
26372504
2638−Azimuth is beginning to feel like [multipass](/posts/essays/azimuth-as-multipass/), with a variety of ways to use Azimuth points without ever booting Arvo
2505+- Not upgradable in-place. Since the state is implicit, you can only cleanly upgrade by (1) killing the thread and restarting it or (2) letting it resolve to a defined "upgradable state" periodically, usually at the top of a "main loop". If you do (2), then you are in fact structuring it as a state machine, so the other advantages of threads are compromised.
26392506
2640−## Arvo
2507+- Fragile. If we don't receive expected input, the default behavior is to be stuck waiting for input. You must remember to add any error-handling features you want, and it's easy to end up in an inconsistent state.
26412508
2642−The Arvo interface has always been held back by Arvo’s technical immaturity. This is still true to some degree. The system has not stabilized completely.
2509+- Impermanent. Since a thread can't be upgraded and may get stuck in case of unexpected input, a thread can't be expected to last forever. It must be "rebooted" from time to time.
26432510
2644−But! We’ve been using Landscape quite a lot lately. I use it daily, in fact — even [on my phone](https://itunes.apple.com/us/app/landscape-urbit/id1393148862). An encrypted (although not audited — so let’s not call it ‘secure’), authenticated chat where I own the keys and can read the source code feels really nice to use. The interface isn’t as good as we’d like, but it’s not bad. Landscape is a great preview of where we’re going: a simple, permanent, self-sovereign computer.
2511+- Easy to write long sequences of IO. Just...write the IO one line at a time.
26452512
2646−There are still rough edges, and Landscape is not nearly general purpose enough, but we have plans:
2513+Arvo proper and the vanes are permanent pieces of software and, for this reason, state machines are more natural.
26472514
2648−### Q2 2019
2515+I'll note that other kernels, like the Unix kernel, use imperative IO. The difference is that Unix isn't permanent in itself — it only lasts until you reboot. Since your permanent state is stored externally, you don't need to be upgradable or permanent. With sufficient discipline you can write robust C code, so it makes sense to use imperative style. Even so, a lot of C code is written in a state machine style; even if it doesn't need to be upgradable, it's worth it for the robustness and concurrency advantages.
26492516
2650−- A new update to the Arvo interface that we’re calling Modulo. Modulo expands beyond chat and longform discussion to make your Arvo interface feel much more like the computer it actually is.
2651−- Upgrades to our event persistence, networking, and DNS integration aimed at much better stability. Arvo instances don’t crash that often, but with these changes it should be very rare.
2652−- Significant improvements to testing with a new simulation testing framework and integration testing pipelines.
2517+However, Arvo is a single-level store — all of its state is permanent. This is very convenient and eliminates many long-tail bugs, but it also means we need to code for permanence, and that's much easier when you structure your code with explicit state.
26532518
2654−### Q3 2019
2519+Further, Arvo and the vanes rarely perform long sequences of IO. Generally, they do one thing and emit some effects, similar to the HTTP server example above. Sometimes they "pass through" a request. For example, the Eyre vane passes HTTP requests to userspace agents or threads. In this case, there is a sequence of IO, which in monadic code would be:
26552520
2656−- A significant overhaul to Gall, our application model, making it much simpler for users to write apps or ‘agents’ in Arvo.
2657−- A new version of the compiler that makes us less reliant on jets. This will eliminate a major obstacle to achieving network continuity, or the ability for ships to upgrade themselves totally over-the-air, forever.
2658−- A significant overhaul and stability update to Clay, our filesystem, making it possible for us to trust it for self-hosting, search it easily, and depend on it for long-term data storage.
2659−- Tooling for hosting and hopefully a beta program for hosted Arvo instances run by Tlon.
2521+ loop()
26602522
2661−### 2020
2523+ where:
26622524
2663−- A completely overhauled Arvo interface, Daigo, with a complete but simple set of messaging and collaboration tools. Modulo is meant to be fun to experiment with, but we aim to make Daigo part of our daily workflow.
2664−- We come to work every day, use Arvo, go home.
2525+ loop =
2526+ request <- receiveRequest()
2527+ agent = lookupAgent(request)
2528+ response <- callAgent(agent, request)
2529+ _ <- sendResponse(request, response)
2530+ loop()
26652531
2666−## Community
2532+This is clear code to read, but it leaves open the question of how to respond during the callAgent() function. If another request comes in, can we handle it in parallel? If we need to upgrade ourselves before the agent responds, can we make sure to properly handle the response?
26672533
2668−We’ve often felt like it was far too early to invite others in to the system.
2534+The naive solution in monadic code is to say that you can only handle one request at a time, and if an upgrade happens you just drop outstanding requests. You can resolve both of these by introducing a sort of main loop, which is just a way of saying "turn it into a state machine".
26692535
2670−As long as we’re up front about the state of this 100 year computer -- that it’s live, but incomplete — I think it’s a good thing to welcome people on board. There’s plenty to play with, experiment with and explore.
2536+In a state machine, the naive solution is:
26712537
2672−Hoon school was the first effort in this direction. We intend to do a lot more:
2538+ state :: (map request agent)
2539+ main(state, event) {
2540+ switch event {
2541+ HTTPRequest request ->
2542+ agent = lookupAgent(request)
2543+ [put(state, request, agent), CallAgent agent request]
2544+ AgentResponse request response ->
2545+ [del(state, request), HTTPRespond request response]
2546+ }
2547+ }
26732548
2674−### Q2 2019
2549+Upgrading this is trivial, since the state (map of requests to outstanding calls to agents) is explicit. It also trivially handles concurrent requests.
26752550
2676−- Scaling Hoon school up to include both a track for experts and for beginners, and allowing many more participants.
2677−- Holding more meetings and events on Landscape, experimenting with Arvo-native discussion.
2678−- A clear program for address space grants for developers + contributors.
2679−- New documentation site with searchable library docs.
2551+I won't claim this is easier or harder to write than the monadic version, but it has the properties we need at this level of the system.
26802552
2681−### Q3 2019
2553+Userspace agents similarly are permanent entities that need to not lose data or get stuck. For this reason they’re structured as state machines.
26822554
2683−- Hoon School participants understand clearly how to build a Modulo agent, and invite others into it.
2684−- The road toward building an Azimuth module is well understood, paved, and clear.
2685−- We have clear instructions and tutorials for building Azimuth modules and using Azimuth as a login or reputation primitive.
2686−]]></content:encoded>
2687− </item>
2688− <item>
2689− <link>https://urbit.org/blog/2021-11-18-the-promise-and-paradox-of-decentralization</link>
2690− <guid>https://urbit.org/blog/2021-11-18-the-promise-and-paradox-of-decentralization</guid>
2691− <pubDate>Invalid Date</pubDate>
2692− </item>
2693− <item>
2694− <title><![CDATA[A brief update from urbit.org]]></title>
2695− <link>https://urbit.org/updates/2021-05-05-update</link>
2696− <guid>https://urbit.org/updates/2021-05-05-update</guid>
2697− <pubDate>Tue, 04 May 2021 00:00:00 GMT</pubDate>
2698− <content:encoded><![CDATA[
2699−Hello!
2555+A helpful comparison is that explicit state machines are basically Mealy machines, the kind you might have learned about in an introductory digital design class. This shouldn't be surprising; a digital circuit must always be consistent because it can't be manually "rebooted", and their input and output is highly formalized. By contrast, a Rube Goldberg machine doesn't have the same constraints; which is why they're a lot more fun!
27002556
2701−Welcome to the May edition of the urbit.org newsletter. April was a busy month with many updates to share—let’s dig in.
2557+It's notable also that explicit state machines are considerably more declarative than imperative or monadic IO. Not everyone thinks that's a good thing, but anyone who defends functional programming should see some advantages to that.
27022558
2703−0 – Updated Urbit Binaries
2559+However, userspace sometimes needs to perform long sequences of IO. Let's look at an example where we want to fetch the front page of a site and the first couple comments on each story. HTTP is unreliable, so on failure we retry five times.
27042560
2705−Urbit’s binaries were updated to v1.5 on April 27th. Make sure to download and install the latest v1.5 binaries here: https://github.com/urbit/urbit/releases/tag/urbit-v1.5
2561+Monadic:
27062562
2707−It’s as easy as shutting down your ship and replacing the old binaries! ~pilfer-pandex described the new release to urbit-dev as “a high priority fix for two networking bugs in urbit-king, and minor fixes to vere.”
2563+ topStories <- fetch(topStoriesUrl)
2564+ loop(topStories)
27082565
2709−1 – Upcoming Events
2566+ where:
27102567
2711−Urbit Town Hall @ May 20th 12pm PDT – Keynote from Justin Murphy
2712−This will be Urbit’s first ever town hall—a three hour event with talks on a variety of topics and a keynote from Justin Murphy (~hatryx-lastud). Justin had Urbit Foundation Director Josh Lehman on his Other Life podcast a few weeks ago (have a listen at https://share.transistor.fm/s/1c0c8c15) and recently formed a new group on Urbit (~hatryx-lastud/other-life).
2568+ loop :: topStories -> IO Null
2569+ if topStories is Null
2570+ return Null
2571+ comments <- retryLoop(5,head(topStories))
2572+ otherComments <- loop(tail(topStories))
2573+ append(comments,otherComments)
27132574
2714−In his group, Justin has written a blog post called “Escape Velocity”, where he discusses selection effects on various platforms. Justin writes, “by creating a gravity well that sucks energy into real-estate value rather than monetized attention, Urbit exerts the lowest degree of arbitrary selection pressures on content creation, while optimizing those selection pressures that irreducibly characterize all human communication (e.g., the draw of being understood and appreciated by other people).” Tune in to Justin’s keynote on the 20th for more on Urbit as a platform for creatives.
2575+ retryLoop :: [n story] -> IO Comments
2576+ comments <- fetchComments(story)
2577+ if comments is HTTPError:
2578+ if n == 0:
2579+ bail
2580+ else:
2581+ retryLoop(n-1, story)
27152582
2716−Developer Calls @ May 13th and May 27th
2717−As you probably know, we have developer calls every two weeks. Stay tuned for more information on our events page: https://urbit.org/events
2583+State machine:
27182584
2719−Austin Urbit Conference @ September/October 2021
2720−Although it’s too early to give a precise date, we are starting to plan an Urbit conference for this fall! It’ll be held in Austin, with many Urbit and Tlon employees in attendance. Stay tuned for more information!
2585+ state :: Initial
2586+ | FetchingTop
2587+ | FetchingStory comments stories retries
2588+ | Done comments
27212589
2722−2 – April Developer Calls
2590+ main(state, event) {
2591+ switch event {
2592+ Initialize ->
2593+ assert state == Initial
2594+ [FetchingTop, Fetch topStoriesUrl]
2595+ HttpResponse response ->
2596+ switch state {
2597+ FetchingTop ->
2598+ [FetchingStory Null stories 5, FetchComments head(stories)]
2599+ FetchingStory comments stories retries ->
2600+ if response is HTTPError:
2601+ if retries == 0:
2602+ [Initial, Null]
2603+ else:
2604+ [FetchingStory comments stories retries-1,
2605+ FetchComments head(stories)]
2606+ else:
2607+ comments = append(response,comments)
2608+ if tail(stories) is Null:
2609+ [Done comments, Null]
2610+ else:
2611+ [FetchingStory append(comments,response) tail(stories) 5,
2612+ FetchComments head(tail(stories))]
2613+ }
2614+ }
2615+ }
27232616
2724−Developer Call: 3rd Party Software Distribution
2725−In this talk, Phil (~wicdev-wisryt) and Raghu (~sovmep-ripsum) discussed the work they've been doing to clay to provide "virtual desks", an integral part of the infrastructure needed for safe, generic software distribution. This work is being done through our Scholarships program, in which community developers pair up with Tlon engineers to work on infrastructure projects. For more information about Scholarships, visit https://urbit.org/docs/development/grants/#scholarships
2617+With practice, the state machine version of this can be written correctly. However, (1) it's verbose, (2) the control flow jumps all over the place, and (3) in practice it's challenging to get exactly right. This is still a small example, and it gets much worse as the length and complexity of the IO sequence grows.
27262618
2727−Developer Call: Real-Time Communication on Urbit
2728−Edward Amsden (~ritpub-sipsyl) gave us a look at the WebRTC Airlock library he has developed that handles the hard parts of WebRTC. When complete, this will allow developers to build applications on Urbit with audio/video calling capabilities. Once again, Edward’s work is sponsored as part of the grants program (https://grants.urbit.org)—check it out!
2619+The monadic version, on the other hand, flows cleanly down the page. We can factor out generic functionality like "retry this request n times" to make the essence of the computation clear.
27292620
2730−3 – Urbit Bitcoin Launch
2621+Suppose you have to upgrade this. In the state machine, you can see exactly which stage of the computation you're in and write specific code to upgrade cleanly.
27312622
2732−This was a hotly anticipated event and it didn’t disappoint. In case you missed it, Urbit will soon have a Bitcoin wallet on the network, meaning you’ll be able to pay Urbit ships directly in BTC. Watch Urbit-Tlon personnel demonstrate and discuss this exciting launch: https://www.youtube.com/watch?v=_aRnfacZPto
2623+Threads, as we've discussed, can't be upgraded in-place. Let's be real though: we're downloading comment sections, not regulating a nuclear reactor. If we get a better version of this script, just kill the old one and start the new one from scratch. What's a couple extra HTTP requests?
27332624
2734−Make sure to check out this related blog post by Christian Langalis (~pindet-timmut): https://urbit.org/blog/interplanetary-commerce/ and this great interview with ~timluc-miptev, one of the main developers on the project: https://subject.network/posts/bitcoin-with-timluc-miptev
2625+This suggests a general division of workloads: code which needs to be permanent, upgradable, and concurrent should generally be a state machine. Code with long or complex sequences of IO and definite termination should generally be a thread.
27352626
2736−4 – Blog
2627+These aren't completely mutually exclusive, but it's surprising how often they are.
27372628
2738−We have a couple of new posts to announce:
2739−“Lunar Urbit and the Internet of Things”
2740−This post is by Poprox (~datnut-pollen), a Tlon engineer who focuses on the importance of moons in the Urbit ecosystem. The post covers “the prehistory of moons on Earth, gives a snapshot of how moons are being utilized on Urbit in 2021, covers existing issues with consumer IoT and how Urbit resolves them, and speculates what the lunar locus of the Urbit ID address space may become in the future”. Read it here: https://urbit.org/blog/iot/
2629+### Jael: a case study
27412630
2742−“Community Spotlight: The Portico”
2743−This post is an interview between me (~tirwyd-sarmes) and Josh Reagan (~taglux-nidsep), the founder of “The Portico”, an Orthodox Christian community. Josh has a PhD in logic, and writes about the intersection of Christianity and logic on his Urbit blog. In the interview we talk about community norms, the relationship between logic and religion, and the future of Urbit. Check out the interview: https://urbit.org/blog/community-spotlight-the-portico
2631+When you need to do something permanent and upgradable, but you also need to do long sequences of IO, the main trick is to factor your problem into both an agent and a thread (or several).
27442632
2745−5 – Odds and Ends
2633+As a case study, consider Jael, one of our vanes. This maintains our PKI state, which it downloads over HTTP from an Ethereum node. Downloading from an Ethereum node is a complex sequence that starts with fetching its most recent block number, then fetching all the blocks we haven't seen and scanning for transactions we care about. We also maintain a map of block hashes to block number, and if we see that a block's parent doesn't have the hash we expect, that means a reorganization has occurred, so we must "rewind" one block at a time until we find where the fork happened, then restart going forward.
27462634
2747−If you are a star or galaxy owner and are interested in sponsoring other ships, please message ~rapfyr-diglyt (david@tlon.io) to be added to the sponsors@urbit.org mailing list.
2635+You don't have to understand this sequence of IO; it's sufficient to see that it's complex and must be exactly right. We used to do this in a state machine directly in Jael. This data is, of course, permanent and needs to be accessible to the rest of the system, so Jael must be a state machine.
27482636
2749−~hodzod-walrus made a page with statistics on various stars: https://bacrys.org/uptime/
2637+However, we had many small mistakes in this sequence of IO, some of which only appeared during unusual events, such as when an HTTP request failed at the same time as a reorganization happened.
27502638
2751−~sitful-hatred beat us to the punch and released a guide on compiling Windows binaries—urbit.exe is near at hand! See the guide here: https://subject.network/posts/urbit-windows-binaries/ The official Urbit.org announcement should be around the corner, so keep your eyes peeled.
2639+We're in a bit of a bind, though: Jael has to be a state machine. The solution is to factor out the act of getting updates into a thread while the main PKI state is stored in the state machine in Jael.
27522640
2753−Thanks for reading. Talk to you next month!
2641+This thread has a definite purpose: given the most recent block number we already know about, fetch all the PKI transactions since then. The function signature is:
27542642
2755−Josh (~wolref-podlex) and ~tirwyd-sarmes
2643+ syncEthereum oldBlockNumber -> IO [newBlockNumber, newTxs]
27562644
2757−https://twitter.com/urbit
2758−https://github.com/urbit/urbit
2759−]]></content:encoded>
2760− </item>
2761− <item>
2762− <title><![CDATA[Community Spotlight: The Portico]]></title>
2763− <link>https://urbit.org/blog/community-spotlight-the-portico</link>
2764− <guid>https://urbit.org/blog/community-spotlight-the-portico</guid>
2765− <pubDate>Mon, 03 May 2021 00:00:00 GMT</pubDate>
2766− <content:encoded><
2645+Jael runs this thread every five minutes and, if it succeeds, then we update our block number and PKI state. If the thread fails, gets stuck, or we need to upgrade it, we just kill the old thread and start a new one. Again, a few extra HTTP requests don’t matter.
27682646
2769−_One of the most striking things about Urbit is the ideological diversity between communities. The Community Spotlight blog series will focus on various Urbit communities via interviews with founding members._
2647+From Jael's perspective, it looks something like:
27702648
2771−For the first week of the Community Spotlight series, I (~tirwyd-sarmes) will be speaking with Josh Reagan (~taglux-nidsep). Josh is the founder of The Portico, an Urbit community of Eastern Orthodox Christians.
2649+ state :: State block txs outstandingThread
2650+ main(state,event) {
2651+ switch event {
2652+ Initialize -> [State 0 Null Null, StartTimer (now + five minutes)]
2653+ TimerFired ->
2654+ effects = If outstandingThread is Null
2655+ then Null
2656+ else [Kill outstandingThread]
2657+ newId = newThreadId()
2658+ [State txs newId,
2659+ append(effects,
2660+ StartThread newId syncEthereum(block),
2661+ StartTimer (now + five minutes))]
2662+ ThreadFinished Failure -> [State block txs Null, Null]
2663+ ThreadFinished Success newBlockNumber newTxs ->
2664+ [State newBlockNumber append(txs,newTxs) Null, Null]
2665+ }
2666+ }
27722667
2773−The Portico is a very active group with conversations taking place over multiple channels. There are channels for posting Orthodox iconography, discussing the broader Christian culture war, and just talking about Orthodoxy in general. Of particular interest is Josh’s “Euthyphro” blog series which investigates the relationship between logic and the Orthodox faith. This is a topic that Josh is well qualified to talk about: he has a PhD in Philosophy from Rice University. His dissertation on the epistemology of logic and truth-preservation was titled "Knowing Your Limits: Logic for Limited Beings”. Josh is also the co-author of a forthcoming textbook on formal logic.
2668+In other words, from Jael's perspective, it's just a single IO event that encapsulates arbitrarily complex IO in the thread. A single IO event is easy enough, and we can maintain all our permanency and robustness guarantees, because we know the thread will have one of three results: success, failure, or it hangs. If we set a timeout, hang becomes failure, so there's only two possible results: success or failure. If we handle both of those correctly, we've handled all the possible IO errors that could have occurred.
27742669
2775−To read Josh’s blog is to be inducted into two esoteric traditions: theory of logic and Orthodox theology. With titles like “St. Gregory the Theologian and the Liar Paradox” and “The Existence of Abstract Objects”, Josh does not pull punches.
2670+What about upgrading? We've already said we can handle the thread dying for arbitrary reasons, so if an upgrade comes in, we just kill it. We can upgrade Jael's state machine easily since its state is very simple.
27762671
2777−Accordingly, our conversation focused on the idiosyncratic and niche community that The Portico is home to. There, you won’t find cussing or much talk about “life partners”, but you will find cutting critiques of liberalism and the best way to raise Orthodox children.
2672+## Recap
27782673
2779−As other users have pointed out, Urbit is pre-[Eternal September](https://en.wikipedia.org/wiki/Eternal_September). In fact, there’s some hope that the very nature of Urbit, how it tries to protect the sovereignty of niche communities via decentralization, might foil the Eternal September phenomenon. If Josh’s community persists, it will be a testament to both Josh and the decentralized Urbit network. As of now The Portico is a refreshing, perhaps jarring (as Josh might say), reminder of what the internet looked like back in the early days—a place for those who are different.
2674+Let's recap what we've covered:
27802675
2781−I encourage you to take a look. Find The Portico at ~topnup-firber/the-portico.
2676+- There are three styles of IO: imperative, monadic, and explicit state machines.
2677+- Urbit supports explicit state machines (agents) and monadic IO (threads).
2678+- Explicit state machines are preferred for permanent, robust, concurrent code.
2679+- Monadic IO is preferred for short-lived code with complex IO.
2680+- If a state machine needs to perform complex IO, it should encapsulate it in a thread so that, from the perspective of the state machine, it's simple IO.
27822681
2783−\-\-\-\-
2682+Hopefully it's fairly clear why Urbit uses explicit state machines in most situations. More than anything else, our goal is to build software that can last forever. Explicit state machines are a crucial tool for that.
2683+]]></content:encoded>
2684+ </item>
2685+ <item>
2686+ <title><![CDATA[Metaphase]]></title>
2687+ <link>https://urbit.org/blog/metaphase</link>
2688+ <guid>https://urbit.org/blog/metaphase</guid>
2689+ <pubDate>Tue, 08 Dec 2020 00:00:00 GMT</pubDate>
2690+ <content:encoded><
27862694
2787−It’s tough to say with certainty—I’ve never read _The Benedict Option_.
2695+<br>
27882696
2789−A few years ago, while he was writing the book, I was a regular reader of Dreher’s blog. From his descriptions there, I was never clear about what exactly he was proposing. Much of his “clarification” came by way of metaphor: don’t “run for the hills”, but stop “shoring up the American imperium”. I didn’t read his book because I didn’t have much confidence that he would be especially precise or insightful.
2697+_Previous versions of this essay specified the stream deploy date as December 11, 2020; then December 18, 2020. This has been amended to the actual date of release, with our sincere apologies. For new readers, you can opt into the dev stream by running:_
27902698
2791−[There is an interesting review I’d recommend](https://handleshaus.wordpress.com/2020/10/06/review-of-rod-drehers-live-not-by-lies/), however, of his later book, _Live Not By Lies_. I believe it accurately characterizes the scale of the threat Christians will soon face in this country.
2699+```
2700+|ota ~hanruc-nalfus-nidsut-tomdun %kids
2701+|merge %home ~hanruc-nalfus-nidsut-tomdun %kids, =gem %take-that
2702+|merge %kids ~hanruc-nalfus-nidsut-tomdun %kids, =gem %take-that
2703+```
27922704
2793−My upbringing was conservative Christian and self-consciously counter-cultural. I've inherited that understanding of what it means to be a Christian in an increasingly secular world. It comes naturally to me, so I find it obvious that Christians should form self-sustaining communities. But the details matter. What do such communities look like? How do we secure the freedom to pursue such communities? How do we sustain them, when myriad external forces seek to undermine them? How do we solve the long-term problem of the declining cultural importance of Christianity (which surely erodes the plausibility of our religion to many, even to some of those with sympathies toward it)?
2705+_We will surface this option more broadly in a future settings overhaul._
27942706
2795−I don’t claim to know the answers to these questions.
2707+A few weeks ago, the Landscape team — those of us building Tlon’s suite of userspace applications on top of Urbit— deployed our first over-the-air update for notifications. This is a big leap forward for us. Of course, getting notifications inside Landscape itself is a big deal, but getting a push notification on your phone, or an email digest based on activity inside Urbit is now just one step away, a weekend project for a hobby developer, not an indeterminate number of steps away.
27962708
2797−One kind of answer is that we should redouble our efforts to support and maintain a religiously and morally neutral liberal political order, which leaves room for subcultures to live and self-regulate as they wish. I disagree. Those who support a kind of “neutral” liberalism view it as an attempt to go “meta” and rise above various parochial metaphysical, moral, and religious disputes. I view this as a cop-out, a refusal to grapple with the most important questions.
2709+After release, we received some feedback from users on the behaviour and design of this feature; beyond the obvious kinks that come from an initial release, it seemed to some like a minimum viable affordance pitched as a fully designed feature. This “bottom-up” development approach was, to us, fairly straightforward; to some of our users, it seemed that we had closed the door on the feature without even beginning to expose all its possibilities.
27982710
2799−Does the liberal have metaphysically-rooted moral reasons for going “meta”? If so, then he’s just another sectarian and he should be honest about it. The only difference is that his team has had the whip hand for the last several generations. On the other hand, if the liberal claims no underlying metaphysical justification then his project can succeed only to the extent that he can arrange and adjudicate unprincipled (and therefore ad hoc) agreements between otherwise hostile moral communities. But how stable can such an arrangement really be?
2711+As I’ll describe, we haven’t just been iterating Landscape, but the way we develop Landscape, and the way we consider Landscape in relation to Arvo. Finally, we’ll discuss our upcoming two-stream release process: a “stable” release stream with updates every six weeks and a development stream, with ongoing changes continuously deployed on an opt-in basis.
28002712
2801−Orthodox Christians have theologically rich, metaphysical foundations for their social and moral teachings. With these we can form healthy, thriving, and growing communities. We can do so even under actively hostile political orders. If the early Church could make it under the Romans, so can we today. But it’s going to be difficult and sound judgment is necessary. Unfortunately, we lack strong leadership and that leaves us vulnerable. If we stay uncoordinated we dissipate our energies needlessly. If we latch onto the wrong leaders we can be led astray.
2713+To someone coming to Landscape for the first time, it is starting to look mature; and it is indeed maturing quickly. After all, these mismatches in expectations are pangs calling out for growth. Landscape truly has _users_, not just explorers, who are developing the same expectations they have with the other tools they use: predictability, reliability, and iterative improvements, not just leaps forward. So to meet those expectations, we’ve been working on the prerequisite work for a mature release schedule, with two different release streams for users and explorers: a lifecycle, with the cells, interlinked, dividing into a coherent higher being.
28022714
2803−The challenges are immense. There is no technological solution. Even so, I’m an Urbit early-adopter for a reason. Over the years I’ve come into contact with a number of Orthodox and Ortho-curious Urbit followers. Why not try to bring them together in an Urbit group?
2715+## Landscapers and lifecycles
28042716
2805−As far as I know, no one in the group is clergy. We’re all just a bunch of laymen with no authority to do much of anything. But I’d like to think we can still contribute in some way. I have an academic background in analytic philosophy so my inclination is to emphasize theory, but we have room for a bit of everything. Someone in the group wrote a script to take the texts of various Church Fathers and convert them to audio using AWS Polly. Those turned out pretty well!
2717+For most of 2020, the core Landscape team has comprised of Liam (`~hastuc-dibtux`), Logan (`~tacryt-socryp`), and myself (`~haddef-sigwen`). Others at Tlon have rotated on and off, and some community members (`~radbur-sivmus` comes to mind) have also contributed a lot, but the three of us handle the core decisions and the entire stack for Landscape, working with designers, infrastructure, and third-party developers.
28062718
2807−At times I entertain ambitions to do a bit more, but for now perhaps it’s better to keep expectations in check. If nothing else, we can read and discuss the Scriptures and Church Fathers together, and try to understand better how to apply and live out their teachings. As we continue to grow the community and develop a consistent internal dynamic perhaps opportunities will arise that aren’t yet on the horizon. One thing I can say is that I’m committed to keeping the group active and growing.
2719+After OS1’s release in April 2020, Landscape’s back-end has changed quite a bit; the first rearchitecture we performed was in group-store, adding roles and simplifying quite a lot of the back-end logic at the same time.
28082720
2809−**I’d like to talk about your blog on The Portico. It combines two of your main interests: logic and theology. In broad strokes, do you think theology and logic are compatible? What is the relevance of this intersection to both of these disciplines?**
2721+Around May of this year, Logan flagged that our code surface was too large and had too much boilerplate by writing a set of bespoke full-stack applications when just one flexible userspace database would do. Our designers also had a vision of our interfaces being “modes and genres of the same data” that fit this vision as well; and so since then, we’ve put our resources into migrating all of Landscape to use graph-store (more information available in [this developer call](https://www.youtube.com/watch?v=E4DFuAZQ32Y)).
28102722
2811−I feel obligated to answer this question in two ways.
2723+Obviously, developing userspace for distributed computing has some additional challenges that you don’t have to consider when writing software for a single server. Each ship interacting has to mutually coordinate the agents running and the events to be processed. If those fall out of synchronisation, the edge cases multiply.
28122724
2813−(1) If by “logic” you mean “first-order predicate calculus”, then I think there’s no special conflict between logic and theology. There are certain puzzles about their relationship, but similar puzzles exist between logic and other disciplines. Theology isn't especially endangered.
2725+We traditionally tended toward solving those problems by writing the simplest possible incarnation of an application or a solution first, triaging out additional complications until they can be most prudently addressed — usually when they are just one step away.
28142726
2815−For example, in the 1930s, Alfred Tarski proved his famous Undefinability Theorem. Crudely put, it says that a plausible truth predicate cannot consistently be contained in any formal system with axioms strong enough to model arithmetic. Superficially it seems like our options are (a) get rid of the concept of truth, (b) get rid of arithmetic, or (c) throw away parts of logic until all inconsistency disappears.
2727+For most of its history, Landscape’s userspace suite had to be up-to-date on all ships to function at all, so multiple staging streams added quite a few complications. Since incompatible versions of applications on different ships would produce mutual fail states if they attempted to interact –and since each application had no sense of how to negotiate compatibility with older applications, each user had to keep up-to-date. Landscape was moving too fast, constantly reconfiguring (to give you a sense of this: we still refer to a month ago as “old”).
28162728
2817−None of these options is appealing. Tarski came up with a solution that mostly satisfies many logicians: reduce the concept of truth to “truth in a language” and forbid any language from containing its own truth predicate. If you want to talk about truth in a language L-1, you have to do it from a “metalanguage”, L-2.
2729+Historically, Arvo and Landscape were also considered just one object; changes in Landscape would often require refining the layers underneath it as well. We often aimed to use our interface’s requirements to refine Arvo in turn. But as Landscape’s cells continued to split, as it became a proper client _for_ Arvo rather than a subsection _of_ Arvo, it required its own planning and execution cycle that only came to fruition around April of this year.
28182730
2819−Is Tarski’s definition of truth in a language the definitive solution for preserving truth, math, and logic? Perhaps not many philosophers think so, and there’s a massive literature in which logicians have attempted to improve on or extend his results.
2731+The first thing we did was start recurring, six-week product backlogs with designers and engineers to occasionally reassess short-term priorities with a larger roadmap. Once we did that, we began working on opening our process to the public, migrating all tasks, priorities, and current decisions to a [product board](https://github.com/urbit/landscape). By doing this, community members could both suggest features _and_ contribute features, with a centralised, transparent process for getting designer input and Tlon engineer priorities. This has also been a successful effort.
28202732
2821−Sometimes people seem to think formal logic is an infallible gift from heaven that must always be right. Kant said in the _Critique of Pure Reason_ that formal logic is essentially a completed field. In fact, [the logic of his day](https://en.wikipedia.org/wiki/Port-Royal_Logic) was an early-modern Cartesian variation of a medieval scholastic synthesis of ancient Stoic and Aristotelian logics. Roughly 100 years after Kant’s first critique was published, C. S. Peirce and Gottlob Frege independently discovered first-order mathematical logic as we know it today, inaugurating the greatest advance of logic since Aristotle. Kant was wrong.
2733+By adjusting ourselves to a six week rhythm for execution, it’s clearly time to slow down our release schedule and dedicate design and QA time to each release.
28222734
2823−Mathematical logic is a convenient, generally reliable, man-made tool that, when used carelessly in certain untamed domains, can lead one astray. Probably most people reading this are familiar with such puzzles as the Liar paradox. When one understands that logic is not a completed science, and perhaps never will be, there is less reason to worry about whether it can be used to nuke entire disciplines, like theology.
2735+Since Arvo is still quite young, we can’t quite get to all the thornier aspects of instituting a lifecycle. For example, we can’t tackle agent version negotiation in full yet; and mark versioning is still not present. This means modifying the validators for our graph modules (that is, validating the graph structure of a notebook vs. a collection) presents a deployment challenge in a two-stream lifecycle.
28242736
2825−For more on this topic, see the blog post in my Urbit group: “St. Gregory the Theologian and the Liar Paradox”.
2737+That said, our userspace infrastructure is maturing, so we could at least organise the APIs to those agents; and we could at least slow the development cycle on those agents in favour of the more flexible components of the stack. The front-end specific features, for example, can be deployed on different ships without side effects for other users.
28262738
2827−(2) There is perhaps a deeper challenge than the one I’ve just sketched. The Stoics used the term “logic” to encompass what we might today call “epistemology”. If the word “logic” is meant in some such broad and normative sense, then we may restate the challenge as one about rationality and theology. Is it irrational to pursue theology in our modern age?
2739+So now, before we could launch a stable stream, we had some things to do first:
28282740
2829−As an undergraduate under the influence of Kierkegaard, I was attracted to a romantic, vaguely irrationalist notion of faith. Dawkins-mania was at its peak and I was disgusted by the pop-rationality (or was it empiricism?) of his annoying followers. Their view seemed to be that rationality just means “following the evidence”. The raw evidence is foundational, and theories are built atop by generalizing from the evidence. The ghost of logical positivism is with us even now.
2741+- **We wanted to provide assurance that the userspace suite is relatively stable.** All our remaining stores (invite-store, metadata-store, and contact-store) needed to be modernised to use the same libraries and utilities inside Arvo as newer userspace applications.
2742+- **We wanted all our applications to be using graph-store.** If we were going to migrate the entire network to a new userspace model, we shouldn’t undermine the new release cycle process and make it more difficult to test and deploy to meet higher user expectations. We needed to migrate everything first.
2743+- **We wanted to release the notification-store**. After the October 2020 groups release, Landscape simply wouldn’t be complete without it.
2744+- Finally, **we wanted all of Landscape to use the [Indigo component library](https://github.com/urbit/indigo-react).** Landscape shipped with each application using its own build with handwritten, bespoke DOM components. Once we moved to a single-page application architecture in June 2020, we wanted the same guaranteed consistency for both back-end and front-end code.
28302745
2831−I was dimly aware that Quine and others had made it difficult to sustain epistemic foundationalism. However, being unable to supply a more clear and cogent notion of rationality, I became skeptical of the idea altogether. But I went too far.
2746+Most of these are now accomplished; the remaining tasks are awaiting some final tests and UX work. We’re aiming for a stable stream of Landscape to deploy by **January 5, 2021**.
28322747
2833−Instead, the proper response is to develop a superior account of rationality. Readers can probably guess where I went looking!
2748+What does this mean? For everyday users, you can expect Landscape releases every six weeks; the slate of features and any breaking changes will be flagged well in advance for third-party developers; and you can expect a more thoroughly considered user experience with notes and copy for each new release.
28342749
2835−The word “logic” comes from the Greek “λόγος”. This is also the word used to describe Jesus Christ in the Gospel of John: “In the beginning was the Logos, and the Logos was with God, and the Logos was God.” This connection is not merely etymological.
2750+And for intrepid users, you can opt-in to a development stream and help us find and eliminate bugs before release to the wider public. This development stream is much like how we've been deploying Landscape up until now — but now it's optional.
28362751
2837−For many ancients, the term “λόγος” meant something like “divine principle”. You might think of it as akin to a law of nature, but with stronger theological connotations. Christians appropriated this term and made it rather more exalted: the Logos is begotten of the Father, and yet somehow one with Him.
2752+## Mitosis
28382753
2839−We are told that all things come into being through the Logos (John 1:3), giving Him an intimate relationship to the whole of creation. He gives structure and order to all created things, and in His divinity He understands them as so structured and ordered. He is also sinless, perfectly holy, and good. In Christ we have a perfect unity of the knowledge of all truth and righteousness.
2754+Describing our progress so candidly can feel strange — after all, it sounds so _early_. But to me, it’s exciting. It’s mitosis.
28402755
2841−Man was created in the image of God, which means that we bear a likeness to Christ. And we are commanded to realize that likeness with ever greater fidelity (Romans 8:29). The Church calls the pursuit of this likeness [“theosis”](<https://en.wikipedia.org/wiki/Theosis_(Eastern_Christian_theology)>).
2756+Take another example. For all of Urbit’s history — all until now — Tlon was playing the role of both parents to the project when it was really just an embryonic corporate vehicle itself, fated to become twins. But in the past few months the burgeoning Urbit Foundation’s interim Director, Josh Lehman (`~wolref-podlex`), has begun to ramp up responsibility, taking increasing stewardship over urbit.org and giving it a physical voice, an Otherness, apart from Tlon’s own goals.
28422757
2843−Thus we have the explanation of all normativity, according to Orthodox Christianity. In moral matters we must take on the holiness of Christ. In epistemic matters we aspire to the wisdom and knowledge of Christ, which includes an understanding of the whole created order. Socially we (the community of believers, i.e. the Church) are called to be in ever greater communion with God, cooperating with His work just as the Son cooperates with the Father.
2758+Now, each day, we stray a little closer to these entities splitting apart, a step closer to the Urbit Foundation and the Tlon Corporation being completely different entities with completely different concerns.
28442759
2845−Sadly we are conceived in sin and ignorant; hence the need for redemption by Christ.
2760+The same has occurred with Landscape. Previously Landscape was “_the_ interface to Urbit,” the proof that there was more to the project than a Unix executable. And slowly to those of us at Tlon, it became obvious what it was destined to become: a flagship client for an entire network, a tree branch rooting a world beneath clearnet, the first cell by which other clients might be born. Mitosis can be clumsy to watch; it can be nauseating to experience; it can be difficult to make out what will arrive where.
28462761
2847−Accordingly, my understanding of what it means to be rational is just to be Christ-like. The only perfect exemplar of reason, so construed, is Christ Himself. Any deviation from Him is irrational. What could be more logical than to be conformed to the Logos? But we cannot attain rationality without redemption. Hence we cannot become rational without first being saved from sin.
2762+But this is, after all, how a body forms.
2763+]]></content:encoded>
2764+ </item>
2765+ <item>
2766+ <title><![CDATA[Security and Continuity]]></title>
2767+ <link>https://urbit.org/blog/security-and-continuity</link>
2768+ <guid>https://urbit.org/blog/security-and-continuity</guid>
2769+ <pubDate>Mon, 30 Nov 2020 00:00:00 GMT</pubDate>
2770+ <content:encoded><
28482772
2849−Doubtlessly many will find all of this too much to take, just too implausible. What about the development of mathematics, or the advances of the sciences? These are canonically ennobling, intellectual achievements. Jesus wasn’t a mathematician or a scientist! Nowhere in the Scriptures is He recorded as having applied Bayes’ theorem.
2773+## Security and Continuity
28502774
2851−Undoubtedly my construal of rationality de-emphasizes the pursuit of knowledge by labeling it as merely one of several normative ends. To seek knowledge without seeking holiness is to be understood as dangerously unbalanced. To try to attain holiness and knowledge without communion with God is arrogant.
2775+In 2018, when we launched the Urbit ID contracts (also called ‘Azimuth’), we committed to yearly infrastructure goals for 2019 and 2020. This wasn’t an informal commitment — it’s part of the contracts that were published to the blockchain, which you can read [here](https://raw.githubusercontent.com/urbit/azimuth/edf68b8da04806dd5b95994daf14cf1e7e226829/proposals/0xcb1f81e42b5e75f000f94fc71a3ea70cab4bfc6f236b91e717f1b9516e5596b5.txt). At the end of each year, we ratify our accomplishment of these goals with a galaxy vote.
28522776
2853−On the other hand, we need not exaggerate matters. St. Paul affirms the need for specialization of labor within the Church (1 Cor. 12). There is room for some to specialize in intellectual endeavors, so long as they act in a cooperative setting in which the other virtues are pursued as well. (Nor should anyone neglect the development of such virtues in himself.) Mathematicians and physicists are more than welcome in the Church.
2777+Since the year is coming close to an end, and this year’s vote is on the horizon, it’s time for an update on our progress.
28542778
2855−According to this (all too briefly put) theory of rationality, there can be no conflict between ‘logic’ and theology. Theology is compatible with rationality because the account of rationality in question derives from a theological tradition. Naturally I’ve only given a sketch; much more could be said. But even if some readers are put off by the theory presented here, I hope it’s at least clear that there are conflicting notions of rationality. Anyone who wants to be rational confronts the task of figuring out which theory of rationality is correct.
2779+For this year, we committed to completing two things: passing a third-party security audit of our networking protocol (Ames) and getting Urbit OS (both Arvo and the interpreter) to the point where we can reasonably expect the Urbit network to continue without any hard forks (which we call ‘breaches’). A world with no network breaches is one where the network should be able to run indefinitely without any interruption. We also call this ‘continuity’.
28562780
2857−**In terms of community moderation, The Portico follows norms that are quite different than other online communities, often times quite drastically. For instance, living with women that you are not married to, is not something that should be talked about lightly. Can you talk about the importance of norms and how they relate to a healthy community?**
2781+We’ve been steadily making progress on these two fronts, and I’m happy to report both are nearly complete. We’ll walk through some of the details here and then follow up in another post soon to report on how the final work turned out.
28582782
2859−Orthodox Christians are not commanded to “get along” with the rest of the world (John 15:18-25). We’re different, and our norms of interaction should likewise differ from those of outsiders. There is no one, monolithic “Orthodox culture”, but there are standards governing which local expressions of culture are legitimate and which are sinful. We should live in a way that enables and promotes holiness and discourages sin.
2783+## Ames Audit
28602784
2861−We have rules that may seem unusual from the outside. I don’t permit profanity, lewd jokes, or irreverent comments about God. In your question you mention a living arrangement that is prevalent in the world. Another rule I have is that we shouldn’t talk causally about sinful practices or lifestyles as if they are unremarkable parts of ordinary life. If Orthodox Christianity is true then such things aren’t minor peccadilloes. They’re spiritually destructive. The marriage-bond sanctifies activities that would otherwise be sinful.
2785+Urbit OS is an ‘overlay OS’: it runs on top of (pretty much) any flavor of Unix. Each Urbit OS node communicates with other nodes over UDP using Ames, the Urbit-specific networking protocol.
28622786
2863−If someone wants to analyze what is destructive about men and women living together before marriage, we’re open to that. But if you want to be affirmed in your sin, we’re not the place for you. Anyone of any religious creed is welcome to show up—but as a guest in an Orthodox Christian community. Hosts should be courteous to guests, but my first priority is not to make you feel good about your choices. We’re here to encourage each other, learn, and grow spiritually as Orthodox Christians. Naturally that means a little gate-keeping may sometimes be necessary if someone ever comes along who doesn’t share those goals. Being different is difficult and takes work.
2787+There are two things worth worrying about when it comes to Urbit OS security: someone breaking into Urbit from the machine it’s running on, and someone compromising the network protocol itself. As to the first, there are probably ways that we can harden the OS sandbox, but if the machine it’s running on is secure we can feel reasonably safe. Since there’s lots of prior art on how to secure a Unix machine, we can leave hardening the runtime for later and simply encourage everyone to secure the boxes they run their Urbit nodes on.
28642788
2865−In a way the cultural contrast is meant to be jarring. It can force you to confront moral and cultural presuppositions that you didn’t even know you had. When you become aware of the wider choices of culture available to you, you become free to look with a critical eye on the culture you’ve hitherto taken for granted. I think anyone could see how that might be liberating, even before considering the particulars of the cultures in question. Of course, as an Orthodox Christian, I think we have a good case to make about the particulars of our subculture.
2789+Assuming each node on the network can run on a locked-down machine, it’s really important that the protocol for communicating between these nodes is secure. Also, since Ames uses other Urbit nodes for peer discovery, we want to make sure no ‘relay node’ can inspect data not meant for them.
28662790
2867−I’ve never had to kick or ban anyone from the group. The group is relatively small (~180 people at the moment) so that probably helps. The vast majority of conversations are relaxed and friendly. Occasionally there are intense debates about one issue or another but I enjoy it, as long as it doesn’t become bitter or the primary mode of discourse. But everything ought to be done in a spirit of truth-seeking, not of one-upmanship.
2791+The question “Is Ames secure?” is too vague for an auditor, of course. The audit was scoped to determine that the following three criteria are met:
28682792
2869−**The fact that The Portico can exist side-by-side with atheist communities on Urbit is pretty striking. On Urbit, a user is able to create niche communities and governance structures and yet still participate in a larger network. In other words, Urbit is trying to thread the needle between sameness and difference through federation at multiple levels. It seems to me that modern culture has become homogeneous due to an inability to maintain, or distinguish between, different communities. People who have nothing in common are forced to engage as if they were roommates, while those who are similar have trouble creating their own home. In other words, what is the role of community formation in the modern world and how does it connect to your critique of liberalism? Does Urbit have anything to say about this?**
2793+- No one can impersonate another ship on the network
2794+- No one (including relays) can intercept and decrypt messages not meant for them
2795+- Ames messages don’t leak keys that could endanger the sender’s data
28702796
2871−As I said in an earlier response, I see the liberal project as more or less an attempt to sidestep (not solve) difficult metaphysical and religious disputes between various distinct moral communities. Liberals have tried several methods of governance to achieve their ends. We can divide such attempts into two broad categories: centralized and decentralized.
2797+Our goal with this scope is to focus exclusively on the design and implementation of Ames itself. Basically, the crypto should be correct and there should be no flaws in either the protocol design or its implementation. Our interpreter can still be hardened against other potential attacks, which is work we’ll undertake in the future. We asked our auditors to flag all of these potential issues, so we know what needs to be addressed in the future.
28722798
2873−Social media companies in the US confront similar governance challenges, so we can analyze them in similar terms.
2799+The good thing about an audit scoped in this way is that we can trust the protocol to authenticate people and shuttle packets back and forth safely. We’ve always been reasonably confident about Ames, but having an external stamp of approval will be great.
28742800
2875−A social network like Facebook takes a centralized approach. Zuckerberg spoke early and often of his desire to connect people and “bring the world closer together”. There was a sense that if people from various communities could get to know each other a little better, we would see how much we have in common and make progress toward some kind of universal cosmopolitan consensus.
2801+As of the end of November 2020, the audit is very nearly complete, and we’ve handled all the important issues that were brought up. We’ll post the results and talk about our mitigation strategies in a future writeup.
28762802
2877−But that didn’t happen. With centralized social media you’re practically guaranteed to interact with people whose moral and metaphysical commitments are sharply at odds with your own. As a result, you face a persistent, nagging risk of conflict. Without warning, a friendly disagreement can explode into an all-out flame war. Most choose one of two basic approaches for dealing with this threat:
2803+## Continuity
28782804
2879−(1) You live a compartmentalized life. You keep your moral and metaphysical commitments to yourself and cultivate a culturally homogenized persona for your social media activities. No one disagrees with you because there’s nothing to disagree with.
2805+Urbit is designed to last a long time. What’s the use of a personal computer if it’s gonna disappear along with all the data you put in it? Ideally, you can put your Urbit on a USB stick, forget about it for ten years and have it work again when you plug it in. It’ll need to update for a while, but once our work on continuity is complete, your urbit should be able to upgrade itself through ten years of updates, all over the air.
28802806
2881−(2) You can enlist to fight in the culture war and display your regimental colors with pride. And because you take your smartphone everywhere you’re always on the front line.
2807+While Urbit is designed to upgrade seamlessly over the network we have occasionally run into issues that have caused us to reboot the entire network. Most of the time this is when some incompatibility between the interpreter and the kernel means we have to force everyone to do a hard reset to ensure compatibility between the two. Our current work on continuity addresses this. Soon, your urbit will tell you when your interpreter needs to be upgraded. At first this won’t be that different from an application notifying you to download an update. Eventually, we think we can make this a lot smoother.
28822808
2883−These aren’t the only options, of course. With some combination of charisma, patience, and grace you can be relatively open about your beliefs without getting into too much trouble. But even if you have the talent to pull it off, it takes time and energy. Many of us aren’t willing to go to all that trouble. Social media is supposed to serve us, not the other way around.
2809+A network reboot isn’t the only way that we can break continuity. Urbit is a general-purpose computer — which means you’re free to attempt to destroy it. If, for any reason, you do manage to screw the system up we want you to be able to get your data out and effectively reset continuity on a single node. We built the affordance for that a while ago, but before the end of the year we’ll also distribute tooling to migrate userspace data between hard resets.
28842810
2885−Urbit is decentralized which, in my opinion, means that it isn’t really a network in the way that Facebook is. I see Urbit as more of a network platform. The users create the networks, or migrate them in from elsewhere. We’re all using Landscape and running our VMs on Nock, so obviously there can be interaction between different communities. But anyone who doesn’t want that cross-community interaction doesn’t have to have it.
2811+The combination of version negotiation and data migration should afford us the ability to run the network indefinitely into the future. Unfortunately, to get this change in, we’ll need to reset the network. We’re optimistic that this will be the last time we ever do it. And, given our data migration tooling, this breach won’t involve losing data.
28862812
2887−I’ve followed Urbit’s progress since 2016, so I’m plugged into groups with other Urbit people I’ve come to know over the years. Other than that, however, I don’t know much about who’s out there. It’s not like The Portico is in one neighborhood and the atheists are in the next neighborhood over. There’s a real sense in which we’re not even on the same network—different Urbit communities share a common protocol, but a protocol isn’t a network.
2813+## Status + conclusion
28882814
2889−Some people may want to see a little of everything. If atheists want to join our group they’re welcome to do so! We’ll be friendly. I don’t seek out their groups, though.
2815+We have been working with auditors since this summer and should have a report ready to publish in the next few weeks. Both version negotiation and data migration are in testing and are ready to be deployed.
28902816
2891−One virtue of decentralized social media is that it offers a totally different set of trade-offs with respect to how you share and act on your beliefs. What if you could talk earnestly about philosophy and religion without having to worry about alienating many of your friends and family? I guess that’s somewhat possible on Facebook—do they still have “groups”?—but Urbit was designed for it.
2817+Our goal is to have all of this work complete by `~2020.12.10`. This means we should be able to start a galaxy vote right around that time. Galaxy votes (as specified in the contracts) run for a month, which should have this whole process ending on `~2021.1.10`.
28922818
2893−Having said all that, I don’t think decentralization is a panacea. Even if Urbit takes off, it will likely face problems that are difficult to anticipate now. My hope is simply that Urbit’s trade-offs are healthier than the ones we’ve had before.
2819+It's going to be an exciting couple of weeks!
28942820]]></content:encoded>
28952821 </item>
28962822 <item>
2897− <title><![CDATA[A brief update from urbit.org and Tlon]]></title>
2898− <link>https://urbit.org/updates/2021-04-01-update</link>
2899− <guid>https://urbit.org/updates/2021-04-01-update</guid>
2900− <pubDate>Wed, 31 Mar 2021 00:00:00 GMT</pubDate>
2823+ <title><![CDATA[An Email from the Archive]]></title>
2824+ <link>https://urbit.org/blog/an-email</link>
2825+ <guid>https://urbit.org/blog/an-email</guid>
2826+ <pubDate>Sun, 29 Nov 2020 00:00:00 GMT</pubDate>
29012827 <content:encoded><
29112829
2912−4/15: Raghu (~sovmep-ripsum) will talk about virtual desks, a key component of third-party software distribution, and the process of contributing to the Urbit kernel through our scholarships program.
2830+I found this email in my archives recently and thought it might be fun to share publicly.
29132831
2914−4/29: Edward Amsden (~ritpub-sipsyl) will be discussing and demoing his WebRTC work, which enables audio/video calls on Urbit.
2832+```
2833+From: Galen Wolfe-Pauly <galen@tlon.io>
2834+Date: Thu, Jul 2, 2020 at 9:50 AM
2835+Subject: Continuing
2836+To: XXXXXXXXXXXXX
2837+```
29152838
2916−On April 27th, we’ll be launching our Bitcoin Wallet and preparing to roll it out to the network. This is the culmination of many months of collaboration between several members of our community and Tlon—we’re really excited (especially ~pindet-timmut). There might even be some cool swag, discounted hosting, and/or other giveaways. Regardless, you’re not going to want to miss it. RSVP here: https://www.meetup.com/urbit-sf/events/276741426/
2839+Here are a few things I was thinking about after we chatted. It may be that I'm just reiterating things I already said — but perhaps it's useful:
29172840
2918−We’re also excited to announce that our much anticipated Town Hall event, a virtual mini-conference, will be taking place on May 20th and will feature a keynote talk from our good friend Justin Murphy. Mark your calendars for now—more details to follow soon.
2841+1 -
29192842
2920−2 - Content
2843+Our collective desire to depend on digital communication tools vastly exceeds what I would have ever guessed. Even if you somehow factor out what’s addictive about the platforms we use today: they serve a real need. The crux of the problem with our current platforms is that they don’t actually serve the need that we want them to serve. They’re not tools in the way we expect tools to be. For the most part, the platforms we depend on serve the needs of their shareholders or some graph or another that needs to go ‘up’, which makes them compromised in a very deep way.
29212844
2922−There’s been a ton of high-quality content produced lately. If you’re looking for something to watch, read, or listen to, here’s a roundup:
2845+In the pre-digital world we enjoyed a few things about the way we communicated, collaborated and did business that are dwindling: simplicity, durability and ownership. I’ll try to give some straightforward examples of what I mean:
29232846
2924−~rovnys-ricfer has been recording an audio series about the design and rationale of Urbit called “Urbit from the Outside In.” Check them out here: https://twitter.com/rovnys/status/1371972157971050499
2847+A - When I talk to someone directly, I’m not worried that someone else is listening in. If they go tell someone else what I said to them, that’s something for us to work out between us — they’re not _always_ reporting our conversations back to a third party. The constraints of the interaction and the privacy implications are _simple_ — I don’t think about them at all. Good privacy guarantees flow from a strict focus on simplicity. When two people want to talk to each other: give them a secure channel to talk. Putting a centrally-controlled service between them is just an interim solution because no one could figure out a better way to do it.
29252848
2926−~pindet-timmut and ~wolref-podlex appeared on Justin Murphy’s Other Life podcast—check them out: https://www.youtube.com/watch?v=vv9lymudGV8 and https://www.youtube.com/watch?v=5jbjSUKRyGM
2849+B - When I write something down on paper, or type into a typewriter, I have an intuitive sense of the durability of what I’ve made. I have notes on my shelf I took ten years ago. I don’t worry about them disappearing. This means I can have a very direct, high-resolution relationship with the medium. I can pour myself into my physically-written notes in a way I would never pour myself into a Google Doc. Our digital tools are deeply untrustworthy because we know they can disappear, that they won’t actually last forever.
29272850
2928−A question was posed on our mailing list titled: “what is this?” The team and community did not disappoint with their answers: https://groups.google.com/a/urbit.org/g/dev/c/bdlPPnaccMc
2851+C - Around 2008 I started limiting myself to a few specific drawing and writing tools. I use them all the time and can actually refine my relationship to them since I know they’re not going to change out from under me. Perhaps at some point these pens wont be made anymore, but the ones I have are actually _mine_. Similarly, the things I make with them actually belong to me in a way that doesn’t require some ridiculous terms of service. A sense of ownership, when it comes to the medium of communication, determines our level of trust and commitment.
29292852
2930−Simon Kovacs (~bacbec-lormur) wrote a great post for our blog titled “After the Machine War”: https://urbit.org/blog/after-machine-war/
2853+Our digital tools have to achieve the same level of simplicity, durability and ownership that our pre-digital tools did. Until they do, we’re always going to be in conflict with them, full stop.
29312854
2932−~poldec-tonteg talked to the guys at The Stack. Check out the podcast here: https://thestack.link/episode-13-martian-futurism-with-poldec-tonteg/
2855+The main thing is that exactly none of our present platform-centric world can survive when you see things this way. The digital world we live in is composed of an insanely complicated, ephemeral set of tools that distinctly _do not_ belong to the people that use them.
29332856
2934−3 - Documentation refresh
2857+We’re going to be in a constant struggle with technology until it conforms to these three very basic expectations. These are the expectations we try to get Urbit to fall in-line with, of course. Something else could also succeed by satisfying them. But I also don’t really see anything else, aside from Bitcoin and maybe Ethereum, falling in line with these core principles.
29352858
2936−Our Docs team completed a large overhaul of our documentation last month, making the distinction between “Usage documentation” (https://urbit.org/using), or how to use your ship, and “Development documentation” (https://urbit.org/docs) much clearer.
2859+So: while I wish that Urbit was more mature and ready to capture those that are being purged from mainstream social media, are bored with it or are frustrated with the constraints of ‘productivity software’ — I think this conflict is going to drag on until people realize that what we’re in conflict with is the structure of the software we use. Using software that’s managed by other people is always going to cause serious problems all the way up at the user level. For more speculation on how this might play out, watch Black Mirror.
29372860
2938−We’ve had some excellent contributions from the community to our documentation, most recently a comprehensive set of overviews, guides and examples documenting threads from ~tinnus-napbus: https://urbit.org/docs/userspace/threads/overview/
2861+2 -
29392862
2940−We’re pretty proud of the work that’s gone into clarifying everything and are still working hard to make the docs more and more helpful. Feel free to send us your feedback if you have any!
2863+(1) is, in a way, a long-winded way of saying that the state of the world hasn’t changed our direction all that much. In order for Urbit to be approachable to use, it has to be very nicely made and that takes time and iteration. As the system stabilizes, Urbit can evolve in a more traditional way: we, along with others in the ecosystem, release stuff, observe how people use it, and try to make it better. We’re at the point where we’re nearly ready to get into that feedback loop, and we very much need to get there. We’re close.
29412864
2942−4 - Landscape news
2865+Urbit is a distinctly different _kind_ of software than anything we have now. Your Urbit is something you actually own and can do whatever you want with: not unlike your furniture or your kitchen tools. An Urbit is a tool for individual, human-scale computing and our whole approach to designing and making things is completely different. Most computing is about industrial-scale computing: where the software system stores everyone’s data and is managed by the people who build it.
29432866
2944−The community on Landscape is continuing to grow. Over 30 groups were published to the Directory in March alone, and these are just the public groups that someone decided to broadcast. We think that’s pretty exciting.
2945−There’s a new Cincinnati-centric group (~padwet/queen-city-urbit), a sewing group that sounds incredible (~pinwyl-hasfeb/seamstress-mafia), and the first digital maker space on Urbit (~tidrel-tabpub/freeside-mars).
2867+Urbit is the opposite of industrial-scale. Urbit is much more like something that’s carefully crafted and delivered to you directly. This craftsman-like approach to building software really isn’t a part of most modern software engineering.
29462868
2947−Check out the Directory (~bollug-worlus/urbit-index) to discover public groups and, if you’d like help getting your community onto Landscape, let us know. We’re here to help!
2869+When I think about this from the standpoint of the person using what we make, it’s especially important. Urbit should feel like something that’s purposefully made by hand — not something you picked off the shelf at Wal-Mart. Some of this ethos was present in the early PC movement, but it’s mostly lost today. The care and attention that goes into building the system is also exactly what we make money on. People pay us to own a piece of it, to use it. We’re incentivized to make nice things, in the Urbit model, and we take that responsibility seriously.
29482870
2949−5 - Hosting
2871+3 -
29502872
2951−Over at Tlon, we’ve been really busy onboarding new hosting customers. All of our current onboarding sessions are completely booked! If you’d like to learn more about how it works, send an email to support@tlon.io. If you’re ready to get on the list, sign up at https://tlon.io/
2873+Networks are a really important social form that’s only just beginning to come into existence. A network is neither a state nor a company, but something in-between. Bitcoin is a network, Ethereum is network (but it’s still far too centralized). Urbit is a young network.
29522874
2953−6 - Team news
2875+(In my view, a real network is always decentralized. Centralized networks are basically just companies.)
29542876
2955−We're happy to share that longtime hooner ~littel-wolfur has joined the Tlon engineering team. Welcome, ~littel-wolfur! Also, we’ve made it official with ~wolref-podlex and dropped the “Interim” from “Director of urbit.org” (probably due to the quality of these newsletters).
2877+Urbit is controlled by the collective of people who use it — in varying degrees, of course. The main thing is that this collective is bound together only by private keys and a blockchain, not a set of legal documents. The agreements between everyone on the network are in some cases more formalized (in terms of ownership) and looser (in terms of content moderation) than what we’re used to in either a state controlled or company controlled model. This is a very unusual kind of institution.
29562878
2957−If you’re interested in working with Tlon or urbit.org, feel free to get in touch.
2879+On a successful Urbit network, Facebook, Airtable, and Signal are just successful applications. You could probably build companies around them that ship software to Urbit — but they’re more like 5 - 10 people instead of thousands.
29582880
2959−7 - Culture recs
2881+Urbit doesn’t aim to eat away at the government per se. Instead, it’s an important communication tool for institutions of any scale to actually take control of their means of collaboration. The efficiency of inter-government communication and government to populace communication can clearly be improved by _a whole lot_.
29602882
2961−Finally, we’re going to leave you with some recommendations from the team:
2883+4 -
29622884
2963−~fabled-faster released an insane new mix that melted my face in a good way: https://soundcloud.com/flowerstructure/fs-s-s-2021
2885+The most important thing is that people can generate a vision of the future. This can only emerge from a small collective of motivated people. Our public life is overwhelmed by people shooting from the hip, aiming for likes.
29642886
2965−Our designer ~natnex-ronret curates a playlist website. Check it out: https://www.door.link
2966−~datnut-pollen has been trying to understand how information processing evolves over time in evolutive systems. Here’s what he’s been reading:
2887+There are difficult, infrastructural problems _all over the place_ that desperately need the considerate attention of small groups of people. Urbit, as communication tooling, is aimed at improving the quality of the fabric that binds these groups together. Or, to put it another way, before you can solve any specific problem you have to improve the problem solving process overall. Everything is gated on solving the process.
29672888
2968−(i) Connectom https://connectom.substack.com/p/connectom-the-book It is about thermodynamic/statistical mechanical processes as the fundamental driver of the evolution of biological, ecological, and human systems.
2969−(ii) Topological phases emerge in an ecological model: https://physicstoday.scitation.org/do/10.1063/PT.6.1.20210128a/full/ and Topology protects chiral edge currents in stochastic systems: https://arxiv.org/abs/2010.02845 Topological protection for various dynamics is the main theme he reckons is missing from Connectom.
2970−(iii) Homotopy theoretic and categorical models of neural information networks https://arxiv.org/abs/2006.15136 Topological techniques for understanding information processing in neural, metabolic, societal, and computational contexts.
2889+5 -
29712890
2972−~simfur-ritwed recently re-read Pynchon's Vineland. It’s both a loom into the backwoods NorCal culture of the 80s and a typically Pynchonian fantasy about the dangers of media-saturated identity (quite prescient, turns out).
2891+Christopher Alexander is, indeed, probably the biggest influence on my thinking when it comes to paying close attention to making things that both generate a deep sense of connection and are shaped by the people who inhabit them.
29732892
2974−In the wake of his recent trip to Brazil, ~wolref-podlex has been reading Os Sertões (the English version), the story of a war that took place at the end of the 19th century in the backlands (sertões) of Brazil, in which the Brazilian army brutally crushed the peaceful religious settlement of Canudos.
2893+[http://en.bp.ntu.edu.tw/wp-content/uploads/2011/12/06-Alexander-A-city-is-not-a-tree.pdf](http://en.bp.ntu.edu.tw/wp-content/uploads/2011/12/06-Alexander-A-city-is-not-a-tree.pdf) is one of his early, well known essays that’s easy to find online. I think ‘The Nature of Order’ is the thing that had the biggest impact on me, but it’s harder to find. There’s probably a PDF floating around on the internet somewhere. It's also a beautiful (four volume) book. The first volume kind of nails it. This talk is also great: [https://twitter.com/urbit/status/1148030042846326784](https://twitter.com/urbit/status/1148030042846326784)
29752894
2976−Lately I (~roslet-tanner) have been getting back into Roy Ayers. This feels just right for spring: https://www.youtube.com/watch?v=inPgcN_xF4w
2895+The thing that comes to mind lately is Hejduk. He had passed away by the time I was at Cooper, but I feel like I was educated in the ghost of his work. This documentary gives a good impression of his thinking: [https://www.amazon.com/John-Hejduk-Builder-Worlds/dp/B07NKQ72C8](https://www.amazon.com/John-Hejduk-Builder-Worlds/dp/B07NKQ72C8)
29772896
2978−That’s it for now. We’ll be back with more news from Tlon and Urbit, respectively, in a few weeks. As always, let us know if there’s anything in particular you’d like to hear about next time.
2897+Hejduk was able to see that architecture isn’t about building buildings per se, but something else. That was always quite obvious to me.
29792898
2980−~wolref-podlex and ~roslet-tanner
2899+Talk soon!
2900+G
29812901]]></content:encoded>
29822902 </item>
29832903 <item>
2984− <title><![CDATA[Eliza]]></title>
2985− <link>https://urbit.org/blog/eliza</link>
2986− <guid>https://urbit.org/blog/eliza</guid>
2987− <pubDate>Mon, 22 Feb 2021 00:00:00 GMT</pubDate>
2904+ <title><![CDATA[Models of Society]]></title>
2905+ <link>https://urbit.org/blog/20201119-models-of-society</link>
2906+ <guid>https://urbit.org/blog/20201119-models-of-society</guid>
2907+ <pubDate>Wed, 18 Nov 2020 00:00:00 GMT</pubDate>
29882908 <content:encoded><
2919+
29922920
29932921<br>
29942922
2995−## The Storm before the Calm
2923+In general, technology serves humanity as a kind of appendage—instead of thinking new thoughts or acting on its own, it does what we command. Technology never creates new social structures—it merely makes existing ones easier, or it facilitates the creation of new ones. We use our tools to expand our capacities, and once we are capable of doing more, we can imagine new things to do. Inventing the wheel did not invent motorized transportation—but it did facilitate it and it was a necessary step, even an inspirational one. Similarly, the invention of writing made new forms of human interaction and new tools for organization possible.
2924+
2925+Consider the following conversational conventions, or modes of messaging: a letter; a dialogue; a book; a meeting; minutes of that meeting. These are each pieces of technology: finely constrained solutions to human problems. Now, we have digital forms of each of these which diverge variously from the original. A letter becomes an email. A dialogue becomes a chat room, or a series of blog posts, or a twitter spat. A book becomes a website or an ebook. Meetings in 2020 have virtually been replaced by their virtual counterparts. Minutes become recordings or transcripts.
2926+
2927+Although we do not have a clear picture of how humanity developed the technology of writing out of the basic capacity for speech, we can imagine that the computerization of writing has many parallels. It does not make the old tools obsolete, nor does it immediately introduce new social structures. It does create the potential, however. On the timeline of human existence, we have only had digitized text for a relatively short time. Because we want to understand how to best use these new forms, we should look at their underlying structure.
2928+
2929+In order to digitize messages well, computers need to reconcile two facts about all modes of messaging. They have:
2930+
2931+1. One basic shape, and
2932+2. An infinite variety of forms.
29962933
2997−Building things, even Calm™ things, makes noise. George Nakashima’s wooden furniture evokes peace, but its construction still begins with a chainsaw. We mention this because we’re firing up our newest power tool.
2934+1 — The basic shape: all these modes have one common substance: human language. Any conversation is made of words. At first we only had spoken language. Then we discovered writing. Writing allows us to encode our words as glyphs to transmit them over time or distance. The internet extends this capacity. We called this "hypertext"—like good old fashioned text, but one level up. A staggering amount of messaging now takes place over this hypertext transfer protocol (http). In the process of digitizing language, we have learned the basic shape of a message. We can see this in how every social network shares messages in basically the same shape: an author, some content, references, an audience. We can confirm this basic shape by comparing it against our experience of the real world, and the previous comparison between speech and writing. Speech and writing both use the same substance, and take the same basic shape. They all have an author, content, references, and an audience.
29982935
2999−We call her Eliza. She is a data-collection robot.
2936+2 — Our experience of this one basic shape takes an infinite number of forms. The examples above (letter, meeting, &c) are just a few. These forms depend on the content of the message, the people involved, and the place they occur. All three aspects contribute significantly to its form, but the one that computerized messaging has not adequately compensated for is the place. Content depends only on the author and their intent. Getting certain people to view that content might be more difficult but most know how to use a computer. The place however, has not yet been adequately compensated for, and I think that has contributed seriously to our lack of civil and serious discourse over the internet. A president would not give an address in a bar, and a prospective lover would not utter his advances on stage. In writing, we can use the different physical forms to distinguish place. You shouldn’t read a book by the pool. You might not read a letter in public. You wouldn’t put a billboard in your bedroom.
30002937
3001−Hang on. An AI? Harvesting my data? Spying on me? Flooding me with spam? This is Urbit, right? Let us tell you about our new friend in basic terms, where MEGACORP might otherwise deploy legalese.
2938+Furthermore, it seems possible that in our eagerness to "connect the world," we focused injudiciously on creating communities around "interests." Evidence suggests that unless the interest has a highly refined focus, these communities devolve into pandering, self-reference, and exploitation. In this way, the internet is something like a convention of conventions, where you wander in a sea of foreigners loosely affiliated by interest and surrounded by advertising booths. In physical space, people do gather by interest but they also gather by physical proximity—they are grounded and bound in place.
30022939
3003−## What Eliza is and isn’t
2940+Having an indistinct sense of place makes the form of conversation ambiguous and the participants of the conversation disconnected. Consequently, people are unsure how to interact. One need only know the term "comments section" to understand that.
30042941
3005−> Replicants are like any other machine - they're either a benefit or a hazard. If they're a benefit, it's not my problem.
3006−>
3007−> <cite>Rick Deckard</cite>
2942+## People in Places
30082943
3009−Let's start with the benefits. Eliza is a simple chatbot. She was made to collect feedback on Landscape. She asks direct questions about peoples' usage of Urbit, records any responses, and reports them to her managers at Tlon. She'll also provide timely advice and information to ships kind enough to chat with her. She'll begin reaching out to ships via DM in the coming month. If you don't want to, just say no, and you'll never hear from her again.
2944+<br>
30102945
3011−Finding bugs is critical to Urbit's rapid development, especially in this period of nascency. Most Urbit-related frustrations go unreported; regular folks don't think to open up Github when they experience a minor issue. That's why it's incumbent upon us to design a lower-friction forum for feedback. People who aren't comfortable filing an issue might be willing to talk to a friendly chatbot.
2946+
30122947
3013−Now, about hazards. By design, there are few. Eliza runs on Tlon's comet, not on your planet. There will be no OTA to install `%eliza-bot-store` on everyone's ships. Eliza learns things through conversation, not hidden surveillance software. Data she requests, like the text output of our network analytic tool, `+tally`, must be sent manually. MEGACORP tends to cut this corner; to refine their products, they just track your reactions in real-time.
2948+<br>
30142949
3015−Since she's [open-source](https://github.com/urbit/urbit/blob/b0c1f83287cbf4c85847a9238d9f4be17e1fcb33/pkg/arvo/app/eliza.hoon), anyone can creatively deploy Eliza. Just write her a dialogue tree. Of course, that also means we can't keep people from misusing Urbit bots. We think automated agents on the Urbit network are inevitable, so let's create a good baseline culture around them. (Much love to Tendiebot, who's serving up stock prices in `~tomdys/wall-star-bets`.) However, once Urbit is used world-wide, we can't rely on culture alone.
2950+As the internet grew to accommodate new conversation forms using the basic substrate of hypertext, web developers began to conceive of "digital spaces" through analogy—chat "rooms" and "forums,” or the "silo" and the "walled garden." Today, most of our conversation takes place in these walled gardens—privately-owned places which may be beautiful on the inside, but inaccessible from elsewhere. While some of these walled gardens are very large, our conversation is essentially confined to them. There is no roaming from one space to another while keeping one’s identity. We create new identities for new spaces both because we must and because we are afraid of repercussions on one platform for what we say on another. This is because we do not own our identity; we merely have a key—our password. The owners of the walled garden still own the artifacts of our tenure there, and can revoke our access to them at any time.
30162951
3017−## A New Internet Economics
2952+The concept of identity and the concept of place are fundamentally linked. We imagine the prince who travels overseas where no one knows his name, or we imagine the old prospect of traveling to a new world to make a fortune. While those both exemplify a dramatic change in identity and place, we usually want to keep our identity consistent. We want to be recognized by friends whichever place we go, and we all strive toward having a good reputation, which is a consistent identity across places. This consistent identity also allows control of that reputation per place. A man is not judged in public by the words he says among friends. And there is no way to search what someone has said except by asking him. With our current system of identity providers (an absurd term, but a real one), we surrender our rights to selectively expose our thoughts, regardless of the place they have been uttered. A data breach or a weak password might lay bare our most private thoughts. We run the real risk of being confronted by an old conversation presented out of context or after we have learned better.
30182953
3019−The sum of Urbit's architectural design is a new online economics: a way to finance and monetize access to internet infrastructure where people retain maximum equity. Explicitly acquire a low-maintenance, low-cost server. Use it to compute explicit things. Return to life.
2954+People need distinct spaces to form conversations in distinct modes, and they need to have a consistent identity that controls how public their words are.
30202955
3021−We all know the basic MEGACORP business model: offer a free service (to suckers who don't own a server), secretly mine the data they generate on the (addictive) platform, then sell targeted ads to advertisers. This model will not survive Urbit. The ubiquitous personal server changes the economic equation. You used to 'pay' for an experience with your time and data. On Urbit, once you purchase core internet infrastructure, it's yours.
2956+In theory, we would have a digital city with unique regions, public fora, and sovereign parcels, into which one person might travel at will. In practice, we see this pattern: an app emerges to facilitate a mode of conversation. It gains popularity. Facebook (or Google, or Microsoft) buys and absorbs it. As monolithic empires, they can use the same format for all their messages. This gives them a great amount of power. They use this power to create things like "Sign in with Facebook" (or Google, or Microsoft) that benefit the user by consolidating their identity, but fail to solve the underlying problem. Their problem is that in order to allow people to communicate using the current technology stack, they need to be in control of everything.
30222957
3023−So, can Urbit meaningfully curtail our world's appetite for data? We'll see. Post-enlightenment society runs on instrumental reason, right down to the last byte. Marketers will always want a fresh dataset. However, when the goods are on your Urbit, you can at least demand the respect you deserve. Long term, we expect a transparent market for data, not an opaque "agreement". An analytics company wants to track everything you see and do on Urbit? They better be paying well.
2958+## Urbis ec Bit
30242959
3025−Eliza doesn't pay respondents. Her collection is a charity to Urbit's developers. (We're also still busy enabling payments on Urbit with the Bitcoin wallet.) However, her presence is not a term of service either. In a few years, by the nth time some smart aleck uses Eliza's chatbot code and conjures 'Zalexa' to attempt an intrusion upon your Calm™, we will see the economics of Urbit's architecture suddenly vivify. Blacklists, reputation systems, and, eventually, even data markets, all Urbit primitives envisioned long ago, will become real. We won't need Zoogle to underwrite a spam filter for the entire internet; the scarcity of Urbit address space, in tandem with a true web-of-trust, handles that.
2960+<br>
30262961
3027−If Urbit is to be used worldwide, the old system will not go down without a fight. Spammers, spies, and digital robber-barons will hunt for ways to game Urbit. Our passage out of the digital gutter is beginning in earnest, and we are thrilled to put our new architectures to the test.
3028−]]></content:encoded>
3029− </item>
3030− <item>
3031− <title><![CDATA[A brief update from urbit.org]]></title>
3032− <link>https://urbit.org/updates/2021-02-19-update</link>
3033− <guid>https://urbit.org/updates/2021-02-19-update</guid>
3034− <pubDate>Thu, 18 Feb 2021 00:00:00 GMT</pubDate>
3035− <content:encoded><
30372963
3038−This week we’re introducing our newest grants program, Scholarships, sharing an update on the Urbit community, and introducing the newest members of the Urbit Foundation team. We’ve also got some important infrastructure updates about King Haskell and an overhaul of our Getting Started guide. Let’s dive in:
2964+<br>
30392965
3040−1 - Scholarships
2966+Urbit does solve this underlying problem. At this point the explanation goes so far down the stack that you could spend years tracing it all, but the relevant part is this: Urbit is not an empire; it’s a territory. An empire is an entangling of land and rule: within the bounds of said empire, you agree to be bound by its laws and the penalties for transgression. The laws exist at the whim of a despot or cabal. Your standing as a Roman citizen buys you no favors in Persia. In contrast, a territory imposes only physical laws. For example, in the desert, you will die faster. The only way to change that is to alter the desert. Urbit imposes nothing but the digital equivalent of physical laws. You have an identity which can be said to be truly yours, and you have a piece of software that runs on whatever computer you choose and can do anything you want with the messages sent to your identity. There are no social protocols enforced, because no one can control what software you run on your computer. As long as you agree to communicate using the same basic substrate, you can communicate with anyone using Urbit. This is the digital equivalent of speaking the same language. Whether or not others will accept you into their coalitions is not the technology's concern.
30412967
3042−I’m excited to announce the (soft) launch of a new type of grant we’re calling “Scholarships.” The big idea behind the program is to grow the base of individuals that can contribute to Urbit through hands-on, one-to-one mentorship with infrastructure engineers at Tlon.
2968+In the same way that the land provides clay and timber, Urbit also provides the tools and material for building places both public and private. These include the aforementioned consistent message substrate (content), as well as tools for organizing people/audiences, structure for referencing other content, and an identity system that is owned only by you while being verified by all. The places are being built—private rooms with just a few people, meeting halls, club houses, huge public spaces, and countless personal encounters, the contents of which are known to none but the participants.
30432969
3044−The program works by first having an infrastructure engineer define and scope a project, and then pairing them with someone from the community. Unlike other grants, these projects are centered on platform development, meaning Arvo or Vere, rather than on userspace development. Scholars will learn much about how Urbit works, take on impactful infrastructure projects, and gain insight into how infrastructure engineers think about building Urbit.
2970+The default tools work with messages in a few of the ways with which we've grown familiar: chat, direct messaging, publishing, link-sharing. They map onto existing forms of messaging because as I said earlier, the technology does not create new social structures; it just facilitates them. We have only seen the beginning of what the internet is capable of doing. Within a few decades it replaced the majority of letters, phone calls, and text dissemination—that was just the first phase of getting up to parity with what written text and speech could already do. In order to get to the next phase of creating new social processes, we need our technology to be organic and democratic, in the sense that everyone can participate and shape it. It needs to have a consensual foundation—a common substrate—and infinite possibility for expression. Urbit provides both of those.
30452971
3046−We’ve begun scholarships with two members of the Urbit community who have demonstrated high technical aptitude and commitment via grants or other open-source projects. We don’t have any additional openings at this time, but expect to have a few more in the coming months.
2972+Similar to working undeveloped land, it takes a lot of hard work, which is why Urbit is not ready for mainstream adoption yet, and why I alluded to the idea of settlers in my opening paragraph. Traveling to the new world is not for everyone, but everyone is welcome.
30472973
3048−If you’re interested in a scholarship, sign up for the waitlist here: https://airtable.com/shr6Xmo55h8dZ0O46
2974+_How could one do other than submit to Tlön, to the minute and vast evidence of an orderly plant? It is useless to answer that reality is also orderly. Perhaps it is, but in accordance with divine laws—I translate: inhuman laws—which we never quite grasp. Tlön is surely a labyrinth, but it is a labyrinth devised by men, a labyrinth destined to be deciphered by men._
2975+]]></content:encoded>
2976+ </item>
2977+ <item>
2978+ <title><![CDATA[Aesthetic Culture #1]]></title>
2979+ <link>https://urbit.org/blog/aesthetic-culture-1</link>
2980+ <guid>https://urbit.org/blog/aesthetic-culture-1</guid>
2981+ <pubDate>Wed, 11 Nov 2020 00:00:00 GMT</pubDate>
2982+ <content:encoded><
30512986
3052−Our community has been pretty busy lately. Here’s a non comprehensive list of what they’ve been up to:
2987+<br>
30532988
3054−- ~timluc-miptev completed the Bitcoin gall agents. They’re now being integrated into Landscape as a wallet.
3055−- ~sovmep-ripsum finished his work on ucal, an iCalendar-compatible calendaring backend for Urbit.
3056−- ~tabnus-fondeg began work on Urbit LFS (large file storage) for providing file sharing and hosting support.
3057−- ~sipfyn-pidmex is writing a comprehensive suite of documentation for graph-store to enable an easier on-ramp to building new social applications.
3058−- ~minder-folden launched a new hosting provider that you can check out here: https://escapepod.store
3059−- ~naltyc-wornes is contributing a set of official, battle-tested guides for running Urbit on “smol” devices to the urbit.org website.
3060−- ~hocdep-labtul hosted his first Urbit UTC meetup, which featured ~timluc-miptev and received great attendance. We’re looking forward to the next one featuring ~nartes-fasrum on the Aesthetics of Urbit. Learn more here: https://www.urbit.computer/utc/#upcoming-meetups
2989+_This post is the first in a series of digests centered on art produced within and about Urbit by a member of the community, ~nartes-fasrum. Monthly digests will be available within the Urbit Community group in Landscape, and will occasionally be compiled here on the blog to give you a sneak peek at some of what’s happening on the network. Enjoy! ~wolref-podlex_
30612990
3062−We’ll have a flurry of new bounties coming online in the upcoming weeks, so keep your eyes peeled —there might even still be an open one! Check them out here: https://grants.urbit.org/bounties.
2991+One of the most exciting things about Urbit is the aesthetic and design around it, developed partly by Tlon (through the design of Urbit itself) and partly by the community (by producing great Urbit art). As the community grows, it creates more art, and we have the opportunity to showcase some of the pieces we love. These works can draw curious new users in, and they give existing users ways to communicate their excitement to friends.
30632992
3064−If you’ve got an idea you’d like to work on, make sure to submit a proposal. you’re not quite sure how to get started, book some time with me here and I can help you figure it out: https://calendly.com/wolref
2993+To that end, I wrote [the Art by Urbit proposal](https://grants.urbit.org/proposals/636838408-art-by-urbit), a regular digest for the dissemination of Urbit art and propaganda. We'll bring you the works of both familiar faces and new users, in a variety of media types from image manipulation to 3D models and physical pieces. This first digest will cover some of the art produced in the past year, but will have a focus on the last two months. Future digests will be incremental updates summarizing the artworks of the prior month.
30652994
3066−3 - Foundation growth
2995+## ~datnut-pollen
30672996
3068−This month the Urbit Foundation grew by 200%, which is less astounding when you know that it grew from one person to three. Nonetheless, this is a significant milestone for the community-focused arm of Urbit.
2997+~datnut- made a physical representation of their sigil from maple wood & epoxy resin, and mentioned the potential to use an Arduino to cause different lighting effects for different statuses of an urbit.
30692998
3070−~timluc-miptev (aka Tim) joins us from the developer community, where he’s been a prominent figure for some time as the creator of the popular Nock for Everyday Coders guide (https://blog.timlucmiptev.space/part1.html) and Complete Guide to Gall (https://github.com/timlucmiptev/gall-guide). He’s become a thoroughly proficient Hoon developer and Urbit architect through his work on Bitcoin integration, and will now be working to design grants and guide contributors in their development of their projects.
2999+
30713000
3072−~taller-ravnut (aka Mike) is passionate about community formation, and is excited to start working on supporting those that wish to host Urbit Meetups in their cities, universities, and timezones (since, at time of writing, IRL isn’t much of a thing). He’ll also be performing outreach to developers and developer communities to help spread the word and grow the contributor base of Urbit.
3001+## ~lagrev-nocfep
30733002
3074−There’s still tons of work to do and I don’t expect Tim and Mike to be the last additions to the team this year. If you’re interested in working at the UF, send me a DM for an invite to the group.
3003+~lagrev- [made a thread of Dinosaur Comics](https://twitter.com/sigilante/status/1299101593997127680), using the Urbit Whitepaper as the seed text.
30753004
3076−4 - King Haskell
3005+
30773006
3078−King Haskell is a rewrite of the part of Urbit that talks to Unix and the outside world. When you switch to KH, the part of Urbit that runs Nock code stays the same. Importantly, King Haskell includes better facilities for NAT traversal, which should improve connectivity issues for self-hosted ships.
3007+A sweet poem about the potential for Martian felines is theirs as well:
30793008
3080−As its name suggests, King Haskell is written in the Haskell programming language. Haskell is much easier (and more fun) for rapid development than C, and lightyears better for writing correct, bug-free code. As a result, we expect faster iteration times and more reliability in this part of the system.
3009+
30813010
3082−King Haskell is being shipped as part of a v1.2 release of the Urbit binaries. To run an existing ship with the King, say
3011+## ~litmus-ritten
30833012
3084−./urbit-king run path/to/your/pier
3013+~litmus- produces art full of glowing gases and colourful curves:
30853014
3086−To create a new ship, use the `urbit-king new` command.
3015+
30873016
3088−If you run into any problems doing this, or notice any incompatible behavior, please inform the authorities immediately.
3017+~litmus- also drew Urbitan for the release of OS1:
30893018
3090−The Tlon Corporation is also using this new software on some of its infrastructure galaxies, but third party infrastructure ships should wait for further notice from us before doing so.
3019+
30913020
3092−5 - Getting Started guide
3021+More of their work is available in the notebooks of the Internet Weirdness Research Unit.
30933022
3094−Two members of our community have put a bunch of work into giving our Getting Started (formerly called Install + Setup) guide a facelift. They simplified the language, made the options much clearer, and improved some confusing instructions.
3023+## ~minder-folden
30953024
3096−If you’re looking to try Urbit or know someone that would want to run it, give our guide a try and let us know what you think!
3025+~minder- stylistically ranges from retrofuturistic memes to flat-out classic 50s retro:
30973026
3098−https://urbit.org/using/install/
3027+
30993028
3100−--
3029+
31013030
3102−That’s all for now. ~roslet-tanner will be in touch in a few weeks with an update from Tlon. See you on the network!
3103−Josh / ~wolref-podlex
3031+More of ~minder-’s work is available in his The New Era notebook.
31043032
3105−https://twitter.com/urbit
3106−https://github.com/urbit/urbit
3107−]]></content:encoded>
3108− </item>
3109− <item>
3110− <title><![CDATA[A brief update from urbit.org]]></title>
3111− <link>https://urbit.org/updates/2021-01-15-update</link>
3112− <guid>https://urbit.org/updates/2021-01-15-update</guid>
3113− <pubDate>Thu, 14 Jan 2021 00:00:00 GMT</pubDate>
3114− <content:encoded><
31203038
3121−In spite of the many challenges presented over the last year, it was a resoundingly good one for Urbit.
3039+
31223040
3123−It seems like a long time ago now that the folks at Tlon rolled out OS1 (now called Landscape), just as the pandemic forced everyone into their homes throughout the world. At the time, “Urbit is for Communities” (https://urbit.org/blog/urbit-is-for-communities/) was just a vision, but now it’s been transformed into reality—there are more thriving communities in Landscape than any of us can keep track of, with new faces popping onto the network on a daily basis.
3041+More of their work is available in the smol computers group.
31243042
3125−Landscape brought many new ships onto the network which helped identify those areas in which Urbit’s infrastructure could be most improved. Ford Fusion eliminated the possibility of a partially-applied over-the-air (OTA) update through a drastic reduction in the size and complexity of the codebase. The efficiency of the OTA process was improved by several orders of magnitude, and many long-standing memory issues were resolved. Now we deploy code on our infrastructure nodes and see users receive an update, over a decentralized network, often in less than a minute.
3043+## ~nartes-fasrum
31263044
3127−After improving the stability of the system Tlon turned its attention to bringing more ships onto the network. A long-standing barrier to Urbit’s adoption has been the technical knowledge required to host one’s own ship—this prompted Tlon to build and launch an Urbit hosting service (https://tlon.io), the waitlist for which is now thousands deep.
3045+I use GIMP to edit images I pull off various social media platforms, and usually post the results on Twitter at [@nartesfasrum](https://twitter.com/nartesfasrum).
31283046
3129−With Tlon becoming more singularly focused on building products on Urbit, concrete steps have been taken towards making urbit.org a separate organization that’s focused on long-term development of Urbit’s platform. I joined to lead that effort back in August (https://urbit.org/blog/first-steps-towards-urbit-org/) and have since spent the majority of my time working with dozens of contributors on projects spanning documentation, education, external integrations, and much more.
3047+
31303048
3131−We rounded out the year with a full network reset (called a “continuity breach”), which has in the past has been synonymous with loss of all data on the network. This time things went differently: tooling was made available to the community that allowed ships to preserve their data, which enabled most to seamlessly rejoin post-reset. This is a significant milestone for the project as it signifies not only a commitment to technical excellence, but to supporting our budding community.
3049+## ~norsyr-torryn
31323050
3133−2 - 2021
3051+No discussion of Urbit art would be complete without mentioning [~norsyr-'s Canvas app](https://github.com/yosoyubik/canvas), which won first place in the [Hackathon 2020](https://urbit.org/blog/hackathon-results/) event.
31343052
3135−In the last two weeks we’ve seen a huge amount of inbound interest as people are waking up to the inherent problems with using centralized services run by MEGACORPs—we’re just happy we started working on Urbit all those years ago. While we tend to not plan more than about six months in advance, I can still talk at a high level about what urbit.org will be focusing on in the immediate future (Tlon’s next newsletter will provide a similar overview of what they’re working on).
3053+
31363054
3137−Growth in Urbit’s developer community has been growing organically in lockstep with the overall network growth. This means, happily, that there’s a pretty large pool of people eager to contribute to Urbit. The priority for urbit.org, therefore, is to improve its capacity to effectively assist contributors. Concretely, this means:
3055+## ~radbur-sivmus
31383056
3139−- Rework urbit.org to better help developers learn how to contribute to Urbit
3140−- Since Urbit is ready to build on top of, provide practical guides that demonstrate how to do so
3141−- Guide developers to make high-value contributions to Urbit and its ecosystem
3142−- Build community amongst contributors
3057+~radbur- writes poetry on a range of subjects, one of which could be Urbit. Interpretation of ["A Weaver's Regard"](https://t.fust.us/writing/poetry/weavers-regard) and ["Internet Absurdities"](https://t.fust.us/writing/poetry/internet-absurdities) is left as an exercise to the reader.
31433058
3144−My strategy to date has been heavily focused on working directly with contributors to provide technical guidance and direction, and it’s been working really well. To that end, I’ll also be scaling the Foundation’s ability to provide such support by bringing more individuals into urbit.org that can mentor, review work, and provide guidance on where to best direct contributors’ energy.
3059+## ~sitful-hatred
31453060
3146−If you’re interested in helping build Urbit, you can head over to https://grants.urbit.org to claim a bounty or submit a proposal, join the Landscape group ~wolref-podlex/foundation to stay in the loop about what urbit.org is up to, or contact me directly at josh@urbit.org.
3061+~sitful- has a Martian Meme Depository chat in the Networked Subject group, which catalogs a number of the Urbit memes that have been created so far.
31473062
3148−3 - Town Hall
3063+
31493064
3150−In mid-February, we’ll be holding our first ever “Town Hall” event—it’s like a developer call, but longer, with more speakers, and covering a wider range of topics (not all of them technical!).
3065+## ~tocrex-holpen
31513066
3152−We’re currently looking for speakers, so if you have an Urbit-related topic that you’d like to present, or would like to nominate someone else to present, please reach out to me by replying to this email. This could be an application you (or the nominee) has designed or built, an interesting use case, a design case study, or something completely different. Please don't be shy about reaching out—we're happy to work with you to figure out whether it makes sense to present a given topic, and how best to do so!
3067+~tocrex- has been drawing the galaxies of Urbit, and uploading results to Twitter at [@tocrexholpen](https://twitter.com/tocrexholpen). Each galaxy has a unique design and outfit, with the galactic sigil proudly displayed as its face.
31533068
3154−Once we’ve finalized a date, we’ll broadcast it over our official Meetup group (https://www.meetup.com/urbit-sf/) and on Twitter. Stay tuned.
3069+
31553070
3156−--
3071+## Landscape
31573072
3158−As a reminder, Urbit and Tlon have now split their newsletters in two—Urbit’s newsletter will cover the project and development community, while Tlon’s will focus more on the product development work on Landscape and the communities that form there. Tlon’s newsletter will arrive at the end of the month.
3073+Something that's become quickly evident with the addition of background images to Landscape is that people love to customize their ship's appearance and make it feel more like home. To close things out, we're providing a pair of backgrounds — one darker, one lighter — for use on your ship (or your desktop, should you so desire).
31593074
3160−That’s all for now. See you on the network!
3161−Josh / ~wolref-podlex
3075+
31623076
3163−https://twitter.com/urbit
3164−https://github.com/urbit/urbit
3077+
31653078]]></content:encoded>
31663079 </item>
31673080 <item>
@@ -3381,47 +3294,120 @@ There’s a secret to moving ahead in the line: reply ‘as if in a still pool
33813294
33823295We’re going to run a live demo showing off how our hosting service works on the 9th. You can sign up for the event here: https://www.meetup.com/urbit-sf/events/273439025/
33833296
3384−2 - Providers
3297+2 - Providers
3298+
3299+We’re not the first ones to offer hosting, it turns out. People in the community have been busy building out the first onramps into Urbit. We heard https://www.geturbitid.com, https://planet.market and https://urth.systems are all starting to come online. It’s still early, but what they have in the works is really cool to see.
3300+
3301+We also caught wind of https://urbit.me the other day, a nice little tool for finding specific sigils.
3302+
3303+(And we can’t forget about https://urbit.live, the first ones to get into this arena.)
3304+
3305+I wrote a little bit about how I see the future of Urbit Providers here: https://urbit.org/blog/providers/
3306+
3307+3 - Update + updates
3308+
3309+There’s too much to cover in a single email, so I wrote a little post about what we’ve been working on over the past few months. Check it out on the blog: https://urbit.org/blog/20200929-state-of-urbit/
3310+
3311+We also updated our roadmap in Understanding Urbit: https://urbit.org/understanding-urbit/roadmap/
3312+
3313+4 - The beginning of urbit.org
3314+
3315+We’re very happy that ~wolref-podlex has formally joined the community as Interim Director of the Urbit Foundation. We expect the foundation to become a separate entity soon, but for now we’re incubating it inside of Tlon.
3316+
3317+Last month he wrote about how we are working to separate the governance of urbit.org from Tlon: https://urbit.org/blog/first-steps-towards-urbit-org/
3318+
3319+Just recently, he announced the recipients of our biannual Gifts program: https://urbit.org/blog/gifts-q3-2020/
3320+
3321+5 - Hooniversity
3322+
3323+If you’re interested in learning Hoon, the next session of the community-run Hooniversity is set to start on October 12th.
3324+
3325+For more information about the course, head over to the Hooniversity site: https://hooniversity.org/ and sign up for the session here: https://hooniversity.org/enroll/.
3326+
3327+If you can't wait for the 12th, join the Hooniverse group on Urbit in advance by joining the ~hiddev-dannut/new-hooniverse group on Urbit or at https://twitter.com/hooniversity1
3328+
3329+We’ve been pretty much living on Urbit as of late. If you’re curious to connect with us (and are up for running your own Urbit node) you can always find us in the Urbit Community group: ~bitbet-bolbel/urbit-community. Instructions on how to install and set up Urbit are here: https://urbit.org/using/install/
3330+
3331+We love getting questions, comments, and replies to these newsletters. One thing we heard loud and clear last time around is that you want to hear more from the team. So much happened in the past few months that we have a glut of things to talk about in the coming weeks. Expect more dispatches in the near future. For the meantime, feel free to reach out via email (support@urbit.org) any time.
3332+
3333+See you on the network,
3334+Galen / ~ravmel-ropdyl
3335+
3336+https://twitter.com/urbit
3337+https://github.com/urbit/urbit
3338+]]></content:encoded>
3339+ </item>
3340+ <item>
3341+ <title><![CDATA[Late 2020 Progress Update: OS 1 -> OS 1.N]]></title>
3342+ <link>https://urbit.org/blog/20200929-state-of-urbit</link>
3343+ <guid>https://urbit.org/blog/20200929-state-of-urbit</guid>
3344+ <pubDate>Mon, 28 Sep 2020 00:00:00 GMT</pubDate>
3345+ <content:encoded><
3349+
3350+<br>
3351+
3352+When we announced OS 1, in April, we started to disappear into Urbit. Since then, we’ve been living on Urbit like we never have before. This has been our goal for years: to mature the system we’re building by becoming its first committed users. We knew that critical step toward Urbit’s maturity was being able to depend on it ourselves, but the system itself had to mature to the point that we could do that practically.
3353+
3354+We’ve done this in fits and starts. We’ve _tried_ and failed a few times over the years. We’ve always _used_ Urbit to some extent, but we’ve never _relied_ on it. These past six months have been different. I can’t tell whether it was out of sheer determination and commitment, or that the system was just genuinely ‘there’. Either way, both Tlon and the Urbit Community genuinely live on Urbit now.
3355+
3356+In a way, our ability to use Urbit day to day doesn’t make sense. When we shipped OS 1, it was full of holes. There were serious performance, stability, and reliability issues. Plenty of people showed up and thought, ‘I don’t understand why you think this is useful.’ But, it was good enough that we wanted to use it. And since we wanted to use it, we put our energy into making it better like we hadn’t ever before. Being able to use a system that you can really trust is a wonderful feeling. It’s Computing Without Compromises.
3357+
3358+All of the sudden, it’s Fall. We never found the time to name any of our releases or write announcements. We’ve just been making the system better in every way we can find. We’ve got a lot of exciting things planned for the last few months of the year — but I wanted to recap the progress we’ve made for those following along from the outside. If you haven’t been on the network, it’d be impossible to see.
3359+
3360+The tl;dr is that Urbit is much faster, more reliable, and nicer to use than it was six months ago. Things have gotten much better, across the board. We threw ourselves into OS 1 admittedly underprepared, but we’ve learned a lot and matured the system a lot along the way.
3361+
3362+Anyway, let’s walk through the details. We’ll talk about our infrastructure and interface work independently, since that’s how we organize things internally. Then we’ll talk a bit about what’s going on on the network.
3363+
3364+### Infrastructure
3365+
3366+
3367+
3368+In April, Urbit was slow, fragile, and didn’t always update itself properly. We made enormous progress on all of these.
3369+
3370+First off, Urbit is about 10x faster for most users. With some careful debugging, we were able to locate a few really [high](https://github.com/urbit/urbit/pull/3029) [impact](https://github.com/urbit/urbit/pull/3054) [improvements](https://twitter.com/pcmonk/status/1276327036722704385). There’s still performance work to do, but the effects of this work are widespread. Boot times are faster, local compute is faster, the network is faster. It’s a huge improvement.
3371+
3372+Second, we got our memory usage under control. Urbit still uses a 2GB memory arena. If the state of your Urbit grows to over 2GB things, uh, fall apart. This used to happen regularly, and now it’s pretty much unheard of. We implemented [tooling](https://github.com/urbit/urbit/pull/3235) to compact and deduplicate the memory image when it’s growing too large. We brought the memory usage of the compiler [down ~90%](https://github.com/urbit/urbit/pull/3041). There are areas where we can be more disciplined about how we use memory, but this is more or less a solved problem for the near term.
33853373
3386−We’re not the first ones to offer hosting, it turns out. People in the community have been busy building out the first onramps into Urbit. We heard https://www.geturbitid.com, https://planet.market and https://urth.systems are all starting to come online. It’s still early, but what they have in the works is really cool to see.
3374+Third, we implemented a completely new build system. Well, we actually [got rid of the build system](https://urbit.org/blog/ford-fusion/) altogether and [made it a part of the filesystem](https://github.com/urbit/urbit/pull/3060). This made it possible for us to fix our over the air (OTA) updates and make them both fast and reliable. In April, an OTA could bring down your node and would take hours or even days to apply. Today, we regularly deploy OTAs with no fear of them breaking any nodes — they often go from galaxy → planet in a minute or less.
33873375
3388−We also caught wind of https://urbit.me the other day, a nice little tool for finding specific sigils.
3376+We also rewrote a large part of our runtime in Haskell and made overall progress on [network scaling](https://github.com/urbit/urbit/pull/3174). And: we implemented a [principled approach](https://github.com/urbit/urbit/pull/2366) to [error handling](https://github.com/urbit/urbit/pull/3064), making nodes much less likely to become unrecoverable.
33893377
3390−(And we can’t forget about https://urbit.live, the first ones to get into this arena.)
3378+The network is stable, fast, and safe from day to day. We’re pretty confident it can grow quite a bit without serious issues. When we shipped OS 1 we really weren’t sure what we could handle. Now we’re standing on much more solid ground.
33913379
3392−I wrote a little bit about how I see the future of Urbit Providers here: https://urbit.org/blog/providers/
3380+### Interface
33933381
3394−3 - Update + updates
3382+
33953383
3396−There’s too much to cover in a single email, so I wrote a little post about what we’ve been working on over the past few months. Check it out on the blog: https://urbit.org/blog/20200929-state-of-urbit/
3384+When we shipped OS 1 it was a bunch of separate pages (that were slow to load), all with separate ways of storing and processing data. Our interface work over the past six months is all about unification and simplification.
33973385
3398−We also updated our roadmap in Understanding Urbit: https://urbit.org/understanding-urbit/roadmap/
3386+First, we pulled OS 1 together as a [single page app](https://github.com/urbit/urbit/pull/3025). Using OS 1 involves a good amount of moving around and refreshing the page each time was pretty painful. Now it’s snappy to move between pages and keep up with what’s going on. In tandem, we started using our own component library, [Indigo](https://github.com/urbit/indigo-react). This makes frontend development much cleaner and more efficient.
33993387
3400−4 - The beginning of urbit.org
3388+Next, we unified the way we store data and compute. It used to be that each individual module (chat, publish, and links) used their own ‘agents’ to store and process data on the Urbit side. (An agent is the Urbit equivalent of a datastore + business logic.) With a lot of moving parts, this approach caused all kinds of synchronization challenges. Rather than a module-per-agent model we’ve started to move toward a type-of-data-per-agent model. The first of these is [graph store](https://github.com/urbit/urbit/pull/3110). We’re presently in the process of migrating all our modules to graph store.
34013389
3402−We’re very happy that ~wolref-podlex has formally joined the community as Interim Director of the Urbit Foundation. We expect the foundation to become a separate entity soon, but for now we’re incubating it inside of Tlon.
3390+Those two are by far the most significant, but there’s so much more. We [rewrote](https://github.com/urbit/urbit/pull/2937) the `group-store`, allowing for different roles (admin, moderators, and so on) in a group. We shipped better debugging tools, automatic reconnection, a settings panel, and overall visual polish and refinement.
34033391
3404−Last month he wrote about how we are working to separate the governance of urbit.org from Tlon: https://urbit.org/blog/first-steps-towards-urbit-org/
3392+
34053393
3406−Just recently, he announced the recipients of our biannual Gifts program: https://urbit.org/blog/gifts-q3-2020/
3394+And I almost forgot [Leap](https://github.com/urbit/urbit/pull/3231): an omnibox for navigating around OS 1 with the keyboard. We have plans to make Leap much more powerful — but it’s a great first start toward making OS 1 keyboard accessible. I almost exclusively use [Leap](https://upload.wikimedia.org/wikipedia/commons/0/06/Canon_Cat_keyboard.jpg) to get around OS 1 these days.
34073395
3408−5 - Hooniversity
3396+### Community + network
34093397
3410−If you’re interested in learning Hoon, the next session of the community-run Hooniversity is set to start on October 12th.
3398+
34113399
3412−For more information about the course, head over to the Hooniversity site: https://hooniversity.org/ and sign up for the session here: https://hooniversity.org/enroll/.
3400+Our primary goal with OS 1 was to get both Tlon and the Urbit Community living entirely on Urbit. We did that, and in doing so we’ve seen how nice it is to grow a community in a calm, non-invasive environment. We started doing regular [Urbit](https://twitter.com/urbit/status/1308875082312364048) [Dialogues](https://twitter.com/urbit/status/1304139629948329985) with friends and peers in the absence of physical meetups, which have been fun.
34133401
3414−If you can't wait for the 12th, join the Hooniverse group on Urbit in advance by joining the ~hiddev-dannut/new-hooniverse group on Urbit or at https://twitter.com/hooniversity1
3402+Getting onto Urbit is still relatively challenging. By the standards of software you run yourself, it’s not so bad at all. But by comparison to ordinary consumer software, it’s way too hard. Tlon is [working on that](https://tlon.io) — but these last six months have been only for the brave. That is, those that want to host their own nodes.
34153403
3416−We’ve been pretty much living on Urbit as of late. If you’re curious to connect with us (and are up for running your own Urbit node) you can always find us in the Urbit Community group: ~bitbet-bolbel/urbit-community. Instructions on how to install and set up Urbit are here: https://urbit.org/using/install/
3404+Turns out, there are plenty of people who are up for running Urbit themselves and quite a few small communities have sprouted around the network. Overall the network has a fun, cozy feeling. It’s nice.
34173405
3418−We love getting questions, comments, and replies to these newsletters. One thing we heard loud and clear last time around is that you want to hear more from the team. So much happened in the past few months that we have a glut of things to talk about in the coming weeks. Expect more dispatches in the near future. For the meantime, feel free to reach out via email (support@urbit.org) any time.
3406+### What’s next
34193407
3420−See you on the network,
3421−Galen / ~ravmel-ropdyl
3408+We’re still more or less flat-out, full speed ahead into an even better Urbit-world. The seeds of change were planted when we made Josh the [interim technical director of urbit.org](https://urbit.org/blog/first-steps-towards-urbit-org/). Urbit itself is getting close to the point where the separation between Urbit and Tlon has to become more real. Urbit is aimed at being an ubiquitous platform, Tlon is aimed at making it as usable and useful as possible.
34223409
3423−https://twitter.com/urbit
3424−https://github.com/urbit/urbit
3410+We’ll talk about some of this on [October 9th](https://www.meetup.com/urbit-sf/events/273439025/), and you can see a bit of what’s coming on [tlon.io](https://tlon.io) today. If you tried booting Urbit in April and it was tough, try again. We’re easy to find on the network, and we’d love to get reacquainted.
34253411]]></content:encoded>
34263412 </item>
34273413 <item>
@@ -7013,6 +6999,111 @@ We think that a new system like this, even in a simple form, will be a relief fr
70136999<img class="mv5 w-100" src="https://media.urbit.org/site/understanding-urbit/your-last-computer/your-last-computer-ocean%402x.png">
70147000
70157001Your Urbit is a simpler computer, a quieter computer, a more private computer. We want it to feel predictable, safe, and reliable — things only a complete, sealed system can do. This, we hope, can get us a world where technology keeps us connected, but doesn’t dominate our lives.
7002+]]></content:encoded>
7003+ </item>
7004+ <item>
7005+ <title><![CDATA[~2019.10 Roadmap]]></title>
7006+ <link>https://urbit.org/blog/2019-10-3-roadmap</link>
7007+ <guid>https://urbit.org/blog/2019-10-3-roadmap</guid>
7008+ <pubDate>Wed, 02 Oct 2019 00:00:00 GMT</pubDate>
7009+ <content:encoded><
7011+
7012+The daily work of building a new OS from scratch is so engaging and exciting that we habitually forget to even take stock of what we’ve accomplished. We’re fixated on the prospect of moving the world on to Urbit, starting with ourselves.
7013+
7014+It’s a good thing I have a recurring reminder to write these updates. While our focus is on the future, it’s good to get a sense of the rate that we’re moving forward, and to let everyone know what’s been going on. We’ve made great progress over the past few months.
7015+
7016+We’ve got a new interface, Urbit 0.8.0, Hoon School, and a grants program among lots of other updates. We’ll go into detail about all of these, and talk a bit about where we’re headed next. The system is improving at a really good pace. We intend to keep it up.
7017+
7018+## Identity (Azimuth)
7019+
7020+The other day I got an email, clicked a link, and got a planet. A real, live, piece of cryptographic property with paper wallets and everything. It took about two minutes. And at the end, I could have easily sent invites to my friends.
7021+
7022+This experience is part of a completely new Bridge, the interface for interacting with your Urbit identity. The beta experience we’re testing today is quite stripped down, but it’s a huge improvement over the last Bridge release. Clicking a link is a lot easier than downloading source code, running it from the command-line, and probably running into a python-related error.
7023+
7024+Getting to this point involved rewriting Bridge from scratch, figuring out how to host it securely, building infrastructure to fund the requisite transactions involved in registering a new identity, and setting up a service to send emails (and dispose of them afterward). We've also redesigned our paper wallets to make them simpler and clearer.
7025+
7026+We still want to get this new version of Bridge a bit further along before releasing it to everyone — but we’re excited about it. We didn’t quite get to the point of building an affordance for payments, which we had hoped to do, but that’s coming later.
7027+
7028+We want everyone to have an Urbit identity. And we want it to be incredibly easy to get one, so we’ll get Bridge out this month with a new urbit.org (more on that below).
7029+
7030+The other area of identity-related work was Sigils — the algorithmically generated images that go with every Urbit identity. (We’ve got a blog post in the works that covers how we created these, which is a good story that needs to be told.) The original version of Sigils didn’t look very good at small sizes and a few collisions were found (thanks to [urbit.live](https://urbit.live) for helping to discover the collisions). The [new, improved sigils](https://github.com/urbit/sigil-js) have no collisions and look great at small sizes.
7031+
7032+**Q4 2019**
7033+
7034+- Release Bridge to the public
7035+- Get Bridge working well on mobile
7036+- Add payments support, hopefully including BTC
7037+- Add a network explorer
7038+
7039+**Q1 2020**
7040+
7041+- Integrate Bridge with a native app for Arvo
7042+
7043+## OS (Arvo)
7044+
7045+As a team, we want Urbit to be our primary computer, our last computer, our permanent computer. And we want this now — or at least as soon as we possibly can. We’re both ambitious and impatient.
7046+
7047+The frustration that we can’t move onto Urbit today propels us forward. The system saw major updates over the past few months all the way through the stack. On the Arvo side, we divide our work into Infrastructure (everything in the kernel and interpreter) and Interface (everything in userspace and the front-end). We’ll start with Infrastructure progress first.
7048+
7049+We’re very nearly to the point that all the kernel-level code in the system has been written by our current team. The one remaining vane that deserves a rewrite (Gall) has had a major cleanup by Jared just recently. The [Ship of Theseus](https://en.wikipedia.org/wiki/Ship_of_Theseus) approach does appear to be working. The infrastructure team is doing fantastic work and has really deepened their ownership of the system. The Urbit of today is on the road to becoming a great piece of system software.
7050+
7051+The biggest infrastructure-level milestone was the release of [Urbit 0.8.0](https://github.com/urbit/urbit/releases/tag/v0.8.0). We introduced a new process-separation architecture, implemented the correct bootstrap sequence, moved to LMDB for persistence, replaced our http vane (%eyre) and moved to Nix for our build system.
7052+
7053+To put it simply, Arvo is now much more stable and durable. During the beginning of the year we were seeing bugs and instability that were frustrating and unacceptable. While there are still issues on the live network, none of them terrify us much. We also implemented the ability for users to ‘individually breach’, which means that you can now reset your Urbit without waiting for us to reset the network.
7054+
7055+### Landscape (Arvo UI)
7056+
7057+We don’t just build infrastructure for others to develop on top of. We build interfaces too. At the top of the stack, we released a completely new Landscape, the interface for Arvo. This new interface makes it possible to build other ‘modules’ for Arvo that go beyond chat and publishing.
7058+
7059+This new Landscape is a complete departure from the last direction. Your Urbit now has a simple home screen that launches individual modules and it’s [relatively easy](https://github.com/urbit/create-landscape-app) to create new ones. We’re all enjoying using Landscape around the office. It’s still a bit of a prototype — but it’s quite a good one, I think.
7060+
7061+In moving to this new model we decided to narrow our focus to desktop only for now. We’ll return to mobile again next year — but first we want to get the desktop experience right. We’ve pulled the iOS app from the app store for the time being. I’m personally sad to see it go, since I enjoyed using it. But our prior iteration of Landscape just wasn’t quite right.
7062+
7063+This version of Landscape is, I think, the last one that we’ll call a prototype. Over the past few weeks, since shipping this, some amazing work has been happening on the interface front. We have a systematic approach to building interfaces on top of Urbit that’s very promising, albeit just getting started. We’ve already put out [one post](https://urbit.org/posts/landscape-a-portrait/) about Landscape's future, with more posts to come.
7064+
7065+**Q4 2019**
7066+
7067+- Improved Arvo-level error handling
7068+- Implementation plan for ‘telescoping kelvins’ — or [how we plan to future proof Arvo](https://groups.google.com/a/urbit.org/forum/#!topic/dev/6Mwn6TQFVwc)
7069+- Versioning scheme between Arvo and Vere
7070+- A new Haskell implementation of the daemon
7071+- A native client (instead of just a browser tab)
7072+- A [new user-space architecture](https://docs.google.com/document/d/1hS_UuResG1S4j49_H-aSshoTOROKBnGoJAaRgOipf54/edit)
7073+- Hoon.hoon that’s OTA upgradeable
7074+- Working Jacque prototype, a graal-truffle-based implementation of vere
7075+
7076+**Q1 2020**
7077+
7078+- Integrated client with Bridge and Arvo
7079+- New interface framework, codenamed ‘Widescreen’
7080+
7081+## Docs + Community
7082+
7083+We had quite a bit of interest in our second session of Hoon School. We ended up with 150 people enrolled in Hoon 101, and 42 in 201. The 101 session just ended, with a lot of positive responses and feedback from the participants. We learned a lot doing it and got quite a bit of interesting new example code.
7084+
7085+Hoon 101 started with students with little to no programming experience. Hoon 201, which is just getting underway, covers more advanced topics. We’re quite curious to see what comes out of it.
7086+
7087+We’re also adding features to Landscape to make it more amenable to use by Hoon Schoolers. Good examples include code evaluation within Chat (for office hours), and the ability to pin posts in Publish. The next crop of Hoon learners will be able to use Urbit to learn about Urbit.
7088+
7089+Aside from Hoon School we’re always updating our documentation. Most notably, we added search to the docs (finally). This was a much needed feature that makes the docs much more usable.
7090+
7091+We also launched our [grants program](https://grants.urbit.org/) quietly, but all of our available bounties were quickly claimed nonetheless. We’re ready to give away more address space to contributors and are excited by how quickly people got involved.
7092+
7093+We also did some experimentation with holding events on Arvo. We held weekly AMAs for while, and hosted a few meetings with the community. With the new UI out, our public channels have been a lot more active. We’ll surely be holding more on-urbit events in the future — but for the time being the conversation in urbit-help is a lot of fun.
7094+
7095+**Q4 2019**
7096+
7097+- Vane level documentation
7098+- An active grant program
7099+
7100+## urbit.org
7101+
7102+Urbit.org is about ready for a refresh — so we’re in the process of rebuilding it. We have, for a long time, told the story of Urbit by describing the system technically. We think Urbit can be explained much more simply and much more concisely. We’re working to put together a new set of materials in this direction.
7103+
7104+We’d also like to populate urbit.org with a lot more content about what we’re working on and thinking about. We do a reasonable job of writing updates, but many of our projects get released without any background info. Tlon and the Urbit community are full of smart, thoughtful people — and we’d like to do a lot more to surface their work. We plan to close out the year with both a new website and a lot of writing about what we’ve been building. Not everyone wants to read the source code!
7105+
7106+That covers it for now. If you have questions or want to chat — find us in `~dopzod/urbit-help`. See you online!
70167107]]></content:encoded>
70177108 </item>
70187109 <item>
@@ -7310,6 +7401,105 @@ Until next time.
73107401In other news, the **Interface Team** started a [Twitter account](https://twitter.com/urbitwip) to share work in progress, there's been lively discussion on [urbit-dev](https://groups.google.com/a/urbit.org/forum/#!forum/dev), and we published [a roadmap](https://urbit.org/posts/2019-5-roadmap/).
73117402
73127403Until next time.
7404+]]></content:encoded>
7405+ </item>
7406+ <item>
7407+ <title><![CDATA[~2019.5 Roadmap]]></title>
7408+ <link>https://urbit.org/blog/2019-5-roadmap</link>
7409+ <guid>https://urbit.org/blog/2019-5-roadmap</guid>
7410+ <pubDate>Wed, 15 May 2019 00:00:00 GMT</pubDate>
7411+ <content:encoded><
7413+
7414+We often get so busy that we forget to tell you what we’ve been up to. Here’s an update on what we’re doing and where we’re headed with each layer of the stack.
7415+
7416+At a very high level we have two goals for 2019: make Azimuth easier to use, and get Arvo to a 1.0.
7417+
7418+Next year we’ll begin to move away from some of the MEGACORP software we use in the office, and replace it with our own tooling. There’s some exciting work happening in that department, but we’ll cover that in a future post.
7419+
7420+For some related recent thinking on all of this, see [The 100 Year Computer](/posts/essays/the-100-year-computer/), [The State of Landscape](/posts/essays/the-state-of-landscape/) and [Azimuth as MultiPass](/posts/essays/azimuth-as-multipass/).
7421+
7422+For now, let’s just look at what’s on the immediate horizon:
7423+
7424+## Azimuth
7425+
7426+At lunch the other day someone on our team said something like, ‘We built a complete and working public key infrastructure, but we haven’t told anyone.’
7427+
7428+It’s true. Azimuth is operational, secure, and well tested. It’s a pretty cool piece of technology and it’s out there in the world for anyone to use. It also doesn’t require that you use Arvo — Arvo happens to make use of Azimuth, but Azimuth itself is a completely separate system.
7429+
7430+So the question is why haven’t we told the world about it?
7431+
7432+I tend to think that in order for a technology to succeed it has to not only be an important technical innovation, it also has to be easy to understand as a product. And that’s our answer: we’ve undersold Azimuth because we want it to be easier to understand by _using_, not just by reading the code. Azimuth is quite an elegant piece of technology — but that doesn’t matter until it has a great user experience to match.
7433+
7434+That’s why, in the near term, we’re focused on building on top of Azimuth ourselves. We can’t ask others to go down roads if we haven’t already been down them.
7435+
7436+Here’s what we’re building first:
7437+
7438+### Q2 2019
7439+
7440+- A simplified onboarding flow for getting an Azimuth point that’s simple to share with friends over email, text or as a URL.
7441+- A redesigned and improved Bridge for managing your points.
7442+- An interface that allows you to easily send money between Azimuth points without running Arvo.
7443+
7444+### Q3 2019
7445+
7446+- Expanded Azimuth-centric example modules, documentation and developer tooling.
7447+
7448+Still under consideration:
7449+
7450+- An OAuth server or JWT flow for logging into any service with an Azimuth point.
7451+- A mobile app for point to point payments using Azimuth.
7452+
7453+### 2020
7454+
7455+Azimuth is beginning to feel like [multipass](/posts/essays/azimuth-as-multipass/), with a variety of ways to use Azimuth points without ever booting Arvo
7456+
7457+## Arvo
7458+
7459+The Arvo interface has always been held back by Arvo’s technical immaturity. This is still true to some degree. The system has not stabilized completely.
7460+
7461+But! We’ve been using Landscape quite a lot lately. I use it daily, in fact — even [on my phone](https://itunes.apple.com/us/app/landscape-urbit/id1393148862). An encrypted (although not audited — so let’s not call it ‘secure’), authenticated chat where I own the keys and can read the source code feels really nice to use. The interface isn’t as good as we’d like, but it’s not bad. Landscape is a great preview of where we’re going: a simple, permanent, self-sovereign computer.
7462+
7463+There are still rough edges, and Landscape is not nearly general purpose enough, but we have plans:
7464+
7465+### Q2 2019
7466+
7467+- A new update to the Arvo interface that we’re calling Modulo. Modulo expands beyond chat and longform discussion to make your Arvo interface feel much more like the computer it actually is.
7468+- Upgrades to our event persistence, networking, and DNS integration aimed at much better stability. Arvo instances don’t crash that often, but with these changes it should be very rare.
7469+- Significant improvements to testing with a new simulation testing framework and integration testing pipelines.
7470+
7471+### Q3 2019
7472+
7473+- A significant overhaul to Gall, our application model, making it much simpler for users to write apps or ‘agents’ in Arvo.
7474+- A new version of the compiler that makes us less reliant on jets. This will eliminate a major obstacle to achieving network continuity, or the ability for ships to upgrade themselves totally over-the-air, forever.
7475+- A significant overhaul and stability update to Clay, our filesystem, making it possible for us to trust it for self-hosting, search it easily, and depend on it for long-term data storage.
7476+- Tooling for hosting and hopefully a beta program for hosted Arvo instances run by Tlon.
7477+
7478+### 2020
7479+
7480+- A completely overhauled Arvo interface, Daigo, with a complete but simple set of messaging and collaboration tools. Modulo is meant to be fun to experiment with, but we aim to make Daigo part of our daily workflow.
7481+- We come to work every day, use Arvo, go home.
7482+
7483+## Community
7484+
7485+We’ve often felt like it was far too early to invite others in to the system.
7486+
7487+As long as we’re up front about the state of this 100 year computer -- that it’s live, but incomplete — I think it’s a good thing to welcome people on board. There’s plenty to play with, experiment with and explore.
7488+
7489+Hoon school was the first effort in this direction. We intend to do a lot more:
7490+
7491+### Q2 2019
7492+
7493+- Scaling Hoon school up to include both a track for experts and for beginners, and allowing many more participants.
7494+- Holding more meetings and events on Landscape, experimenting with Arvo-native discussion.
7495+- A clear program for address space grants for developers + contributors.
7496+- New documentation site with searchable library docs.
7497+
7498+### Q3 2019
7499+
7500+- Hoon School participants understand clearly how to build a Modulo agent, and invite others into it.
7501+- The road toward building an Azimuth module is well understood, paved, and clear.
7502+- We have clear instructions and tutorials for building Azimuth modules and using Azimuth as a login or reputation primitive.
73137503]]></content:encoded>
73147504 </item>
73157505 <item>
@@ -17567,6 +17757,25 @@ Join us for the Assembly 2021 introduction, keynote and demos on Saturday, Octob
1756717757 <pubDate>Invalid Date</pubDate>
1756817758 <content:encoded><![CDATA[
1756917759We wish we could get everyone together at once for Assembly, but travel still isn't as easy as we wish it was. For those that can't make it to Assembly, join Urbit Foundation Director and Tlon CPO Josh Lehman for an online-only AMA about Urbit's new software distribution capabilities.
17760+]]></content:encoded>
17761+ </item>
17762+ <item>
17763+ <title><![CDATA[Meetup: Brisbane Australia]]></title>
17764+ <link>https://urbit.org/events/2021-11-26-meetup-brisbane</link>
17765+ <guid>https://urbit.org/events/2021-11-26-meetup-brisbane</guid>
17766+ <pubDate>Invalid Date</pubDate>
17767+ <content:encoded><![CDATA[
17768+What is the Urbit??
17769+
17770+Philosophers, mathematicians and other timewasters have pondered this tough question for aeons. Many went mad, others grew long beards or even buried themselves alive, thinking the riddle unsolvable. So did we... until now.
17771+
17772+Urbit Brisbane are proud to announce that we finally have found an answer: yes, we have figured out what is the Urbit!!
17773+
17774+We'd like to share this important knowledge with you, so join us among the fair hills of St Lucia this Friday night. The Secret Venue will be announced on Friday arvo. RSVP and stay tuned to the event page so you don't end up walking around Guyatt Park accosting joggers for clues.
17775+
17776+Come along and learn about the Urbit with us. You will gain access to an eldritch power far beyond the frail grasp of worldly things. If that isn't enough to tempt you, we also have beers and pizza with your name on them.\*
17777+
17778+\*If your name is Asahi or Godfather Supreme.
1757017779]]></content:encoded>
1757117780 </item>
1757217781 <item>