@@ -0,0 +1,277 @@
1+---
2+sort: 3
3+type: post
4+title: Address space
5+author: Galen Wolfe-Pauly + Curtis Yarvin
6+image: http://urbit.s3.amazonaws.com/16-3-10/blog-3.jpg
7+preview: Urbit address space is like digital land.
8+layout: urbit,post
9+navmode: navbar
10+navdpad: false
11+navselect: blog
12+navpath: /
13+navhome: /
14+navclass: urbit
15+---
16+
17+# The Urbit identity model
18+
19+## Basics
20+
21+Urbit contains a lot of new technology. As an ordinary user, all you
22+need to understand is Urbit's identity model. If you're in a hurry,
23+just read these simplified basics.
24+
25+An Urbit identity, or "ship," is a string like `~firbyr-napbes`. It
26+means nothing, but it's easy to remember and say out loud.
27+`~firbyr-napbes` is actually just a 32-bit number, like an IP address.
28+We turn this number into a string that sounds like a name in a foreign
29+language.
30+
31+Technically, a ship is a secure digital identity that you own and
32+control with a cryptographic key, like a Bitcoin wallet. As in
33+Bitcoin, the supply of ships is mathematically limited. This keeps
34+the network friendly, by making spam and abuse expensive.
35+
36+The only way to start a ship is with permission from a ‘parent’,
37+another ship on the network with a shorter name. A 32-bit ship is
38+called a "planet." A 16-bit ship is a "star." An 8-bit ship is a
39+"galaxy.
40+
41+A planet is an identity for a human. Stars and galaxies are network
42+infrastructure. A ship is independent after it's launched, but the
43+right to launch belongs to its parent. So each star can create
44+`65.535` planets; each galaxy can create `255` stars, or (indirectly)
45+`16.776.960` planets.
46+
47+Urbit is born as a centralized network whose address space is entirely
48+owned by its creators, who own the root galaxy `~zod`. But this
49+address space is worthless until distributed. And as it becomes
50+decentralized, it becomes free and independent. The goal is a world
51+completely unlike the one we live in today, where our digital
52+identities are owned by giant corporations.
53+
54+Your Urbit ship is like a digital passport or social security number
55+for a virtual city in the cloud.
56+
57+## Details
58+
59+That should be sufficient to understand the high-level goals of the
60+address space. If you want to dive a bit deeper, keep reading.
61+
62+### Design goals
63+
64+If you know much about identity systems, you know the problem of
65+"Zooko's triangle." An identity system has three goals: a name wants
66+to be secure, human-meaningful, and decentralized. Zooko’s triangle
67+says that a practical identity system can achieve any two of these
68+goals.
69+
70+We attack an unsolvable problem of this type by making tradeoffs.
71+Urbit's goals: to be secure, human-memorable, and eventually
72+decentralized. We sacrifice meaning (Urbit is not competing with the
73+DNS), and postpone decentralization. In turn, we get a simple system
74+that can actually be built.
75+
76+### Comparison to existing identity layers
77+
78+The Internet doesn't have anything like Urbit ships, so you may need
79+to stretch your brain a little here.
80+
81+There are three levels of naming on the Internet: raw, numeric IP
82+addresses IP addresses (like `126.78.92.112`), domain names (like
83+`foobar.com`), and user identities (like `galen@tlon.io` or
84+`@galenwp`).
85+
86+Urbit (or more precisely, its Ames protocol) squashes all three of
87+these layers into one. At the network level, Urbit is a P2P overlay
88+network; your ship is your network address. It's also the name of
89+your server, and your secure digital pseudonym.
90+
91+One way to use Urbit is as an identity for the Internet, which doesn't
92+have a standard system of secure authentication. Urbit has a
93+single-signon API which lets any Web server accept Urbit logins, like
94+a normal social login -- but not captive to anyone's corporate
95+mainframe.
96+
97+### Cryptographic ownership
98+
99+You own an Urbit ship cryptographically, like a Bitcoin wallet. But
100+Urbit doesn't use a blockchain or mining.
101+
102+You transfer a ship by signing a new public key with the old private
103+key, then broadcasting the signature. Any urbit that receives this
104+new certificate will no longer trust the old key.
105+
106+Urbit is digital land, not digital money. A currency needs to support
107+high-frequency, zero-friction transfers. Real estate transfers are
108+low frequency and high friction, so the "double spend" problem (which
109+mining solves) is much less pressing.
110+
111+## Moons and comets
112+
113+In the general case, a ship is actually a 128-bit number. A full
114+table of ship classes:
115+
116+```
117+8 bits galaxy router ~syd
118+16 bits star router ~delsym
119+32 bits planet human ~mighex-forfem
120+64 bits moon device
121+~dabnev-nisseb-nomlec-sormug
122+128 bits comet bot
123+~satnet-rinsyr-silsec-navhut--bacnec-todmeb-harwen-fabtev
124+```
125+
126+Moons are for clients and connected devices: a laptop, a phone, a
127+digital thermostat. A moon is not independent; its parent planet has
128+to sign its key updates. (We don't want rogue clients floating
129+randomly around the universe.)
130+
131+A comet's address is the hash of its initial public key. Anyone can
132+launch a comet. Nothing stops you from using a comet as your
133+identity, except that the name is a mouthful and everyone will assume
134+you're a bot.
135+
136+### Scarcity, reputation, friendliness and trust
137+
138+A crucial difference between Urbit and other networks is that planets
139+are scarce. Even when the network is fully populated, there are only
140+4 billion. Early in Urbit's life, most stars and galaxies are not yet
141+operating, so far fewer are available. No one will ever be able to
142+get planets trivially and for free.
143+
144+Urbit is a *friendly network*: a network on which you can assume that
145+a stranger is nice until proven nasty. Friendliness is a direct
146+consequence of scarce, individually owned identities. We're not
147+changing human nature, just creating the right economic incentives.
148+
149+Most forms of network abuse are "Sybil attacks": they rely on an
150+infinite supply of new identities. Scarcity makes reputation work.
151+Spam is a business; if the cost of a new planet exceeds the amount of
152+money you can make by spamming from that planet until its reputation
153+is trashed, there will be no spam.
154+
155+Shady stars and galaxies that sell blocks of planets to spammers will
156+also develop reputations as "bad neighborhoods," damaging the value of
157+the whole block. Abuse at any level is designed to be
158+counterproductive and economically self-terminating.
159+
160+Urbit has no reputation system at all at the moment, simply because
161+we're so small that friendliness is automatic. The clear and rigorous
162+structure of the address space is not a reputation system; it is a
163+platform on which any number of such systems can and should be built.
164+But we can't build one until we need one.
165+
166+### Initial allocation and rationale
167+
168+In cryptocurrency terms, Urbit is "100% premined." Why? Three
169+reasons.
170+
171+One, Urbit doesn't need mining. Two, Urbit is a much more ambitious
172+software project than Bitcoin or even Ethereum. To fund its own
173+development, the project needs to capture the potential value of its
174+own real estate.
175+
176+Three, most theories of property agree that anyone whoever creates or
177+discovers new property starts out by owning it. Because galaxies are
178+premined, Urbit starts as a centralized system. But it has two strong
179+motivations to decentralize.
180+
181+One, the more decentralized Urbit is, the more Urbit is worth. Two,
182+the only way for Urbit to fund its own development is to homestead its
183+own real estate.
184+
185+Urbit was made by Curtis Yarvin, who has distributed the 256 galaxies
186+as follows (allocation as of June 1, 2016):
187+
188+95, to the [Tlon Corporation](company). 50, to urbit.org, the future
189+community foundation. 40, to Tlon employees and their family members
190+(24 to Curtis, who started in 2002; 16 to everyone else, who started
191+in 2014). 34, to outside investors in Tlon. 37, to 33 other
192+individuals, who donated to the project, contributed code, won a
193+contest, or were otherwise in the right place at the right time.
194+
195+What's important is that the whole system is unlikely to collapse back
196+into a single landlord. This is why we've intentionally scattered
197+Urbit's ownership across a diverse set of entities.
198+
199+Furthermore, we've defined informal conventions designed to motivate a
200+healthy ownership structure by punishing violators with reputation
201+cost. Address blocks should only split, never merge; galaxies and
202+stars should be owned by different parties; galaxies should be owned
203+by true individuals, not corporations. Urbit does not live up to
204+these ideals at present, but must progress toward them rather than
205+away.
206+
207+### Federated services, adoption and escape
208+
209+Urbit is a peer-to-peer network. Urbits that live behind a firewall
210+or on a home network need "supernodes" to help them route packets.
211+The supernode is the parent. So a parent's work isn't done once it's
212+launched all its children.
213+
214+There's no way to enforce this responsibility. So a star or planet
215+can be *adopted* by a new parent of the same class, letting it escape
216+from a bad default parent. If your parent stops serving you, and no
217+other parent is willing to adopt you, you're probably a bad actor.
218+
219+Supernode routing is just one example of why you need a parent. A
220+mature Urbit will naturally develop all kinds of other *federated
221+services* -- from technical standardization and update approval, to
222+certificate update broadcast, to reputation and friend lookup. All
223+these services are delivered by cooperating stars and galaxies. Bad
224+actors at this level should be rare.
225+
226+Especially when Urbit is young, the level of trust that a child places
227+in its parent is extremely high. The trust implied by automatic
228+kernel updates is essentially infinite. (Ideally we will be able to
229+freeze the Arvo kernel, like Nock, and turn off these totipotent
230+updates; but this will take years at least.)
231+
232+### Code is law: seeing like a pattern language of great cities
233+
234+Constitutional innovation is extremely dangerous. Our vision of
235+digital governance isn't ours, but is synthesized as best we can from
236+the work of four great 20th-century thinkers: the legal scholar
237+Lawrence Lessig, the political scientist James C. Scott, the urbanist
238+Jane Jacobs and the architect Christopher Alexander.
239+
240+All decentralized computation systems rely to some extent on Lessig's
241+principle: "code is law." Where law uses human interpretation to
242+determine an outcome, code uses mathematics. It is code, not law,
243+that decides who owns a Bitcoin wallet.
244+
245+But all these systems, including Bitcoin, need governance. They need
246+as little as possible, but not none. In the digital world as in the
247+real world, *laissez-faire* is always necessary, never sufficient.
248+Governance is a human universal.
249+
250+That's why we call Urbit a "virtual city." And as a city, it can't be
251+a corporate gated community. It might start as that, but it has to
252+grow up into a true city-state: a self-governing digital republic.
253+This pattern is not just blind clinging to Anglo-American tradition;
254+like every prudent constitution, it fits the actual virtues and vices
255+of its target population.
256+
257+Urbit's galactic hierarchy resembles the natural patterns we find in
258+many existing human political systems. As Alexander wrote:
259+
260+> Wherever possible, work toward the evolution of independent regions
261+in the world, each with its own natural and geographic boundaries;
262+each with its own economy; each one autonomous and self-governing;
263+each with a seat in a world government, without the intervening power
264+of larger states or countries.
265+
266+We adapt Alexander's vision to a digital republic as the pattern that
267+*authority is proportional to property*. This pattern already has a
268+name in the cryptocurrency community, which calls it *proof of stake*.
269+
270+Another governance pattern, a political cliche but no less valuable
271+for it, is the system of checks and balances. The address space of
272+Urbit is covered by three independent tiers, galaxies, stars and
273+planets; which should govern? The obvious design is a three-chambered
274+legislature balanced against itself.
275+
276+For more on Urbit's governance design, see our [beliefs and
277+principles]() and our [interim constitution]().