@@ -0,0 +1,448 @@
2+title = "Lunar Urbit and the Internet of Things"
4+description = "Potential future use cases of moons for industry and consumers"
6+author = "Jonathan Paprocki"
7+ship = "~datnut-pollen"
8+image = "https://media.urbit.org/site/posts/essays/phobos.jpeg"
13+
17+Each of the ~4B 32-or-fewer-bit or [Azimuth](@/docs/glossary/azimuth.md)
18+identities, namely [planets](@/docs/glossary/planet.md),
19+[stars](@/docs/glossary/star.md), and [galaxies](@/docs/glossary/galaxy.md), may
20+spawn ~4B 64-bit child identities known as [moons](@/docs/glossary/moon.md).
21+Moons are the undeveloped wild outback of Urbit, with a story waiting to be told
22+that promises to be as enormous in scale as the cloud personal computing story
23+told by planets, and possibly even more so.
25+Throughout this piece, we use "Earth" and "Mars" in the Urbit sense. "Earth"
26+refers to the [current computing
27+paradigm](https://en.wikipedia.org/wiki/Big_ball_of_mud). "Mars" refers to the
28+perfected computing paradigm that Urbit aspires to be, but also to the current
29+and future state of Urbit.
31+Today we will review the prehistory of moons on Earth, give a snapshot of how
32+moons are being utilized on Urbit in 2021, cover existing issues with consumer
33+IoT and how Urbit resolves them, and speculate what the lunar locus of the Urbit
34+ID address space may become in the future. To keep the futurist scope limited,
35+we primarily speculate on the usage of moons in (industrial) internet of things
36+settings, especially with respect to agriculture, and how they may manifest as
37+the workhorse collection unit of decentralized data markets.
39+For those unfamiliar, moons differ from all other
40+[ships](@/docs/glossary/ship.md) in that they are not independent identities
41+with total sovereignty over their data and keys. Instead, their cryptographic
42+keys are issued and controlled by their parent identity. The relationship
43+between the keys of a parent ship and its moons are analogous to the
44+relationship between primary keys and subkeys in a system like
45+[PGP](https://en.wikipedia.org/wiki/Pretty_Good_Privacy). The parent may revoke
46+or change its child moons' keys at any time. A typical relationship between a
47+planet and a moon may be like one of a human and their smartphone. If you lose
48+your phone, you don't want someone to pretend they are you, operating one of
49+your moons, on the network. The planet can revoke the keys, and the moon stored
50+on the phone becomes inert, no longer able to communicate with the network.
51+While planets and stars also depend on their sponsor to assist with peer
52+discovery and software updates, these relationships rely on mutual agreement,
53+since either party may choose to discontinue the relationship and establish a
54+new one elsewhere. Moons possess no such freedom.
58+
60+It may come as a surprise to you that you are already very familiar with moon
61+identities—they've just never been explained as such because the context in
62+which that terminology makes sense didn't exist before Urbit. Moons, in fact, are not
63+a new concept at all. Virtually your entire experience of the internet in the
64+modern era is the experience of someone who possesses some number of moons
65+subordinate to planets who mostly refuse to talk to one another. The feeling you
66+get of constantly moving between silos, juggling accounts, not controlling your
67+own data, etc., is a direct result of the fact that, on Earth, you only possess
70+We're speaking, of course, of the client-server relationship. From the Urbit
71+perspective, the Facebooks, Twitters, and Googles of the world are planets, and
72+accounts held with these services may be thought of as moons subordinate to
73+those planets. Your account with these megacorps is only yours for as long as
74+they please. If you happen to step on a digital landmine, such as a virus that
75+causes Google's servers to believe you are a bot, you are suddenly banned from
76+their service, often with no recourse. All your data, your connections, your
77+network—vanished. We are all Mark Zuckerberg's moons, and they're armed to the
78+teeth with surveillance equipment.
80+There are two classes of internet users: those with servers who hold all the
81+power, and clients who use those servers in the way prescribed by the owners.
82+Running a server is theoretically accessible to anyone, but practically
83+difficult: server maintenance is a technical endeavor that requires specialized
84+knowledge and substantial time investment. Other barriers exist beyond just the
85+technical: for instance, if you wish to set up your own email server, you will
86+probably be blocked by large providers because unknown email servers are almost
87+always spam. The root cause of this circumstance is that the email protocol
88+lacks [Sybil resistance](https://en.wikipedia.org/wiki/Sybil_attack). Urbit has
89+Sybil resistance built in, eliminating certain kinds of incentives for
90+gatekeeping such as this.
92+We seek to level the playing field by giving everyone a server. We accomplish
93+this by making the process of running your own server (planet) as easy as
94+running your personal computer today. We aren't quite there yet, but we've made
95+leaps and bounds over the past couple of years.
97+Of course, this analogy isn't perfect—Urbit moons are servers themselves, but as
98+they may only act in accordance with the wishes of its parent, they are
99+effectively as locked in degrees of freedom as a client is to a server. The
100+moon's keys may be revoked at any time by the parent. To distinguish these
101+prehistoric moons from Urbit moons, we will refer to them later as "primitive
104+Urbit contends that moons are not the appropriate digital exocortex for a
105+responsible adult. They are for devices, experiments, or your children. We hope
106+that the dominant server-client relationship, which is the primary weapon of the
107+surveillance-industrial complex, will meet its end in the near future.
109+### Moons in the early Martian era
111+
113+In 2021, moons are mostly unused on Urbit. There's a smattering of minor use
114+cases which we'll describe here, but they represent only a tiny fraction of
115+their ultimate potential.
117+Tlon recently launched a survey bot called [Eliza](@/blog/eliza.md), which was
118+initially a comet. We frequently got questions on whether Eliza was actually
119+Tlon's bot, because it could just as easily be a malicious actor posing as Tlon.
120+We soon plan to relaunch Eliza as a moon of `~zod`, which is the most
121+recognizable official galaxy of Tlon. This is to establish that the bot is
122+indeed official; only someone with access to `~zod` is capable of creating a
123+moon of `~zod`, and so a moon of `~zod` automatically carries with it a
124+cryptographic guarantee that you are communicating with an official digital
125+representative of Tlon. On Earth something like this would need to be
126+accomplished with certificate chains but, on Mars, this sort of authentication
127+is baked into the very fabric of the network, rather than as an additional layer
128+on top. This is a very good representative case of how moons naturally inherit
129+the reputation of their parent, even in the absence of any formal reputation
132+We see folks using moons as backup identities in case they can't or don't want
133+to access their primary planet for one reason or another. Again, since anyone
134+may verify the parent of a moon, the moon inherits the reputation of its parent.
135+These backups could be vanity identities—for instance, every `~sampel-palnet`
136+has underneath it a moon named `~master-sampel-palnet`[^0].
138+Some use moons to host group(s). Hosting a group inevitably means that that ship
139+will process more network traffic, and a heavily trafficked group may impact a
140+ship's performance. Thus one may wish to offload group hosting duties to a moon
141+to maintain a more performant planet.
143+As we currently lack a real system for 3rd party software distribution (though
144+see this recent [developer call](https://youtu.be/XwICC6Its1E) on a solution in
145+progress), one stopgap has been to download software by syncing a foreign
146+[desk](@/docs/glossary/desk.md) to your ship. This is risky, as buggy software
147+may make break your ship and make it difficult to get running properly again.
148+For this reason, testing new software on the livenet is frequently performed on
149+moons, so as not to risk the parent ship if something were to go wrong.
151+### Internet of Things
153+
155+Now we start to look towards the future by examining the problems faced by IoT
156+in the present and speculating on how Urbit might solve them.
158+The Internet of Things is much maligned by technologists as a privacy, security,
159+and maintenance nightmare. These products usually depend on phoning home to
160+perform their service, which is inevitably a funnel by which personal data is
161+harvested, an attack surface for hackers to gain access to your home network,
162+and a single point of failure which may render the device useless, all in one!
163+One need look no further than the recent [Ubiquiti
164+breach](https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-breach-catastrophic/)
165+to see all of these failure modes happening on a massive scale, and this is par
166+for the course. This sort of dynamic is completely antithetical to the Urbit
167+philosophy, so any involvement of Urbit with IoT will reject many fundamental
168+assumptions on how IoT operates today.
170+However, it's important to understand why the current IoT model works like this
171+at all. We posit that it ultimately stems from the fact that today's IoT
172+products are primitive moons for which you do not operate the parent planet.
173+Almost every IoT device operates in the Software as a Service (SaaS) paradigm
174+because most people don't have personal servers that could do all the processing
175+work actually necessary for an IoT device to operate. This is not the _only_
176+reason for this—it's also just more profitable to collect consumer data.
177+However, it's the SaaS aspects which make the whole thing such a catastrophic
180+Imagine a different world: if the server that your device reports to is your
181+own, there is no loss of control over personal data. If the device only
182+communicates on the local network, it will prevent remote hackers and disruption
183+if you internet fails. And if the manufacturer goes out of business, the device
184+will still work-it is not dependent on the manufacturer's servers.
186+The wants and needs of the individual are at odds with the wants and needs of
187+the megacorp, and that mismatch manifests as the antifeatures that plague IoT.
188+By eliminating the SaaS aspect, Urbit solves many of the largest outstanding
189+issues with IoT in a single blow. Digital personal AI assistants have long been
190+an anticipated science fiction prediction and their full realization is on the
191+horizon. But in their current manifestation, many privacy- and
192+security-conscious people would never consider using them at all, since they are
193+inevitably presented as SaaS that requires intimate knowledge of your devices
194+and their stored data. Recommendation engines such as the one used by YouTube
195+offer helpful guidance towards content you'll find appealing, but they're also
196+designed to keep you hooked to the service. These kinds of programs can be
197+useful, but they're dystopian when they come saddled with anti-consumer
198+subroutines. Since your Urbit belongs to you, it can never act against your own
199+interests without your consent. In our lunar vision, your digital personal AI
200+assistant will live on one of your moons, rather than on megacorp's cloud.
202+For web-exposed devices, Urbit offers the same security guarantees that it
203+offers for your personal computer: everything is end-to-end encrypted by
204+default, and signed with keys that one can easily verify as belonging to the
205+node sending the message.
207+[Vint Cerf](https://en.wikipedia.org/wiki/Vint_Cerf) has outlined the case for a
208+system like Urbit ID for IoT use
209+[here](https://cacm.acm.org/magazines/2018/12/232883-self-authenticating-identifiers/fulltext).
210+In brief, that the Urbit ID system allows one to match public keys with devices,
211+bestowing devices with self-authenticating identities. This allows one to trust
212+the communications received from the device to whatever degree the private key
213+is held secure. IP addresses, GPS coordinates, MAC addresses, etc., are not
214+sufficient to generate high levels of trust—they're all temporary, easily
217+> One might imagine applying this to the Internet of Things (IOT) in which the
218+> IOT device self-generates a public- and private-key pair and registers the
219+> public key. For example, with a hub or controller so the hub can confirm it
220+> has reached the right IOT device. By the same token, configuration of the IOT
221+> device into an ensemble could include incorporation of the public key of the
222+> controller into a list of valid devices that can command or obtain data from
223+> the now-configured IOT device. Both ends can verify they are talking to the
224+> originally configured devices, assuming no device has lost its private key.
226+Here, the hub or controller referred to would be your planet.
228+Urbit has many other features that make it well-suited for IoT, above and beyond
229+eliminating the SaaS model and providing self-authenticating identities. Many of
230+these additional advantages derive from the fact that Urbit is a [solid state
231+interpreter](@/docs/arvo/overview.md#solid-state-interpreter) and that
232+[Ames](@/docs/glossary/ames.md) is a network of solid-state interpreters
233+equipped with cryptographic identity. We explore this in the next section.
235+### Future lunar cosmotechnics
237+
239+We now polish off the old crystal ball and imagine future uses of Martian lunar
240+technology. Particularly, how the tech may develop over time once it becomes
241+widely exposed to the evolution-inducing forces of industry and culture. This
242+section is pure speculation, and I only aim to offer a small glimpse of a
243+potential future, rather than an exhaustive one. This picture will necessarily
244+be biased by my personal proclivities and expertise, or lack thereof.
246+Any discussion on the future of moons is incomplete without mentioning the
247+possibility of [lunar emancipation](https://urbit.org/faq/#more-planets) in
248+order to increase the number of planets. This fascinating topic sees regular
249+discussion in the Urbit Community group, but is outside the scope of this
252+In order to respect the reader's time, I'm narrowing our scope to a particular
253+topic: the agriculture industry. I'm also assuming a future with specialized and
254+increasingly small hardware to run Urbit. Right now, a 4 GB Raspberry Pi is the
255+standard for "small Urbit". If someday there are CPUs specifically designed for
256+running [Nock](@/docs/glossary/nock.md), one could imagine going much smaller.
257+Ultimately, I'm going to assume that there will someday be [solid-state
258+interpreter](#ssi) microcontrollers - so the inclusion of Urbit on a device may
259+require nothing more than a couple [surface-mount
260+devices](https://en.wikipedia.org/wiki/Surface-mount_technology) on a larger
263+Urbit is intended first and foremost as a personal computer. When I unravel its
264+potential usage in industry, I adopt the forecast of a drastic increase in the
265+manufacturing capacity for individuals and small groups. Agriculture is a great
266+microcosm of this long-standing trend; less human input is needed to produce the
267+same amount of food, whether it be crops or livestock. The modern era is
268+distinguished by the fact that small numbers of people can manage enormous farms
269+which produce food for vast populations. Thus, computation on modern automated
270+farms may be thought of as existing at the intersection of both personal and
271+industrial scale, and show how computerized and mechanized workflows add to the
272+amazing productivity of modern farms and demonstrate that individual-sized
273+inputs are able to create industrial-sized outputs. I predict that the set of
274+trades for which this dynamic holds will only increase over time.
276+Agricultural automation has been a primary engine for the growth of
277+civilization, but it has been hampered by the downsides of IoT elaborated in the
278+previous section. One bellwether of this dynamic is the right to repair one's
280+Deere](https://www.thetruthaboutcars.com/2020/03/its-payback-time-right-to-repair-movement-targets-john-deere/)
281+has long been at the center of this controversy. Farmers have lost the ability
282+to repair their own equipment due to vendor locks and a dependency on remote
283+servers. Furthermore, any suite of sensor products designed to gather important
284+data such as genomics, hydrology, soil health, weather, etc., inevitably only
285+cooperate with other products by the same vendor. It's the same story all over
286+again—you are a client of a megacorp server. Or in Urbit terms, you have a bunch
287+of primitive moons belonging to different planets held by megacorps, and no
288+planet to call your own.
290+Again, Urbit resolves these issues in the same fashion as above. One might argue
291+that using Urbit is another form of vendor lock-in—but this is evaluating Urbit
292+at the incorrect level. Since Urbit is an open source operating system, its
293+functionality may be extended and modified arbitrarily by any party. _Some_
294+computational infrastructure is necessary— that fact can never be escaped. But
295+you can escape from closed source software that does not permit you to modify,
296+to open source software that allows you to tinker at will. Thus we do not
297+consider open source software to be a form of lock-in, or at least, it's a much
298+milder form of lock-in compared to something like Apple's walled garden.
300+So let us focus on the additional meritorious aspects of Urbit (or more
301+generally, solid state interpreter networks) that make it not merely a band-aid
302+to the broken IoT system but a permanent and sound replacement.
304+#### Solid state interpreter networks {#ssi}
306+
308+Urbit is the world's first solid-state interpreter (SSI). This concept is
309+summarized in the [white paper](https://media.urbit.org/whitepaper.pdf) as
312+> Imagine it as a chip. Plug this chip into power and network; packets go in and
313+> out, sometimes changing its state. The chip never loses data and has no
314+> concept of a reboot; every packet is an ACID transaction.
318+> Briefly, an SSI is an interpreter which is also a database. In more depth, an
319+> SSI combines three properties: uniform persistence, source independent packet
320+> networking, and high-level determinism.
322+We do not wish to segue into a lengthy examination of what this really means—
323+that's what the white paper is for—but we will attempt to explain why these
324+properties are of great benefit in an industrial IoT context such as
325+agriculture. We'd also like to predict that Urbit will not be the only SSI.
326+Other sorts of SSI's specialized to various tasks may one day roam the planet,
327+and these may be better suited for particular IoT tasks than
328+[Arvo](@/docs/glossary/arvo.md). However, this article will be couched in terms
329+of SSIs communicating with an [Ames](@/docs/glossary/ames.md)-like networking
330+protocol and Urbit ID-style cryptographic identity, rather than Urbit in
333+For a SSI, losing power is less of a catastrophic event than it is for ordinary
334+computers with volatile memory. Knowing that you can never lose any state is a
335+powerful guarantee on the integrity of your data. Loss of power will always mean
336+loss of any data potentially collected while power is down, regardless of the
337+device you use, but with a SSI you at least have assurance that you will never
338+lose data that was collected before it could be transferred from the cache to
339+the disk. Of course, this is actually the sort of guarantee that [ACID
340+transactions](https://urbit.org/docs/arvo/overview/#acid-database) have—it is
341+just that this set of guarantees emerges naturally as a consequence when you
342+have a SSI. Put another way, every SSI is a database; having every device be a
343+database is a major boon in situations where enormous quantities of data are
344+being collected across a distributed network. The standard today is that data is
345+only collected at hubs, and any data that doesn't reach a hub is irretrievably
348+SSIs are also deterministic at a high level. While all computers are
349+deterministic at the CPU level, interruptions to power can result in an
350+undefined semantic state and result in the random erasure of half of its brain.
351+This determinism is what begets ease of maintainability of Urbit—problems
352+generally only need to be solved once by experts and the solution propagates to
353+the rest of the network via [OTA updates](@/docs/glossary/ota-updates.md). We
354+addressed this maintenance issue previously—we only remark now that this
355+property is derived from being a SSI, rather than something particular only to
356+Arvo or Urbit. When one has hundreds or thousands of devices to manage, the
357+guarantees on ease of maintenance provided by determinism are extraordinarily
360+Packet routing on SSI networks is source-independent, and in the context of an
361+Ames-like networking protocol, are always delivered exactly once and in a
362+precise order due to the fact that nodes on an Ames network are in a permanent
363+session. Source-independent means that the identity that originated a packet
364+does not need to be the one to deliver it—packets are _facts_, and the truth of
365+a fact does not depend on who you heard it from. This means that it is possible,
366+for instance, to send instructions to a moon before it even exists and be
367+guaranteed that that moon will receive them and perform the tasks given, even if
368+the device that originally sent the packets no longer exists. As long as
369+somebody has kept the packets on hand, they will eventually be delivered. So,
370+one could imagine transmitting directions to a crop harvesting robot into which
371+a moon will be installed before the robot has even been purchased, know that
372+once it is delivered it will automatically begin its task, and know that those
373+tasks will be completed in the correct order, without any accidental repeats.
374+Taken to the limit, one can imagine preplanning the automated tasks for an
375+entire farm before a single device is purchased, with powerful guarantees on the
376+integrity of those instructions no matter how much time elapses between sending
379+#### P2P data markets
381+
383+As was mentioned above, today's IoT devices ferry all sorts of your personal
384+data to megacorp, where they package it and sell it to the highest bidder.
385+Though personal data in aggregate is quite valuable, the value of a single
386+individual's data is quite low. On the other hand, industrial scale data such as
387+that collected on digitized farms could be quite valuable. Here we briefly
388+examine how Urbit can be utilized to populate and facilitate a market for data.
390+All data collected by your moons may be digitally signed by that moon,
391+certifying the exact origin of that data. This is one advantage of having
392+cryptographic identity baked into the core of the operating system and
393+networking protocol. One could imagine collecting large amounts of such data and
394+packaging it for exchange with other local and regional farmers. This can, of
395+course, already be done in principle with current systems. But current systems
396+do not automatically come equipped with the sort of provenance, immutability,
397+and reputation that comes for free when you make use of SSI networks.
398+Manipulated or faked data becomes easier to spot, and you'll know who it came
399+from, so supplying such data puts one's reputation at stake.
401+One major issue facing conjoining data gathered from disparate sources is simply
402+how to do it. Data arriving in random order, from different software versions,
403+running different hardware, is all very difficult to bundle into a good
404+dataset - and indeed wrangling this sort of task forms a large part of the data
405+scientist profession. As devices in SSI networks utilizing an Ames-like protocol
406+are engaged in permanent sessions, leading to properties such as exactly-once
407+delivery and well-ordered message sequences, issues about the order in which
408+data arrives are dramatically simplified. I do not wish to get mathematical
409+here, but I personally have confidence that the emerging discipline of
410+[categorical informatics](http://math.mit.edu/~dspivak/informatics/), as well as
411+the relevance of [low-dimensional topology to data
412+fusion](https://arxiv.org/abs/1409.5505), resolves many of these issues. I
413+promise to explain this in more detail in the future. For now, it suffices to
414+say that SSI networks seem well-positioned to utilize these techniques.
416+Cryptographic techniques such as [(composable) zero-knowledge
417+proofs](https://en.wikipedia.org/wiki/Zero-knowledge_proof), [secure multi-party
418+computation](https://en.wikipedia.org/wiki/Secure_multi-party_computation),
419+[ring signatures](https://en.wikipedia.org/wiki/Ring_signature), and even
420+[homomorphic encryption](https://en.wikipedia.org/wiki/Homomorphic_encryption)
421+offer a variety of ways in which data may be shared in an IoT context with
422+mathematical guarantees on what sort of privacy is maintained. This is perhaps
423+less relevant in the context of agricultural IoT, where personal private data is
424+largely absent, but we mention them here to invite further speculation from the
425+reader about the possibilities of IoT and SSI networks.
427+We end our discussion with an adaptation of a scenario borrowed from my brief
428+time working on [Ceptr](http://ceptr.org/) that begins to show how a lunar
429+IoT-connected world evokes properties of a hypothetical ["global nervous
430+system"](https://en.wikipedia.org/wiki/Global_brain). This example is
431+purposefully mundane to illustrate how deficient our Earth systems are, and
432+while it is possible to accomplish in theory, it is impractical on a wide scale
433+due to the numerous problems with IoT. Imagine that you suffer headaches from
434+low atmospheric pressure. You'd like to know when a low-pressure front is an
435+hour away from you so that you can pre-emptively take aspirin to prevent the
436+headache. Your personal digital assistant, running on Urbit, can then
437+periodically query the moons of sensors in your region for weather data to
438+predict whether or not you will soon be passing through a low pressure front.
439+This could be a free service or paid for automatically with cryptocurrency
440+microtransactions. On Mars, this task will be trivial, and is merely a stone's
441+throw away from a vast and undiscovered universe of other possibilities unlocked
445+[^0]: Of course, all moon names have four words, not three. What the fourth word
446+ needs to be for only three words to display is a matter of Urbit lore that
447+ is more fun to discover yourself than have it told to you, so we won't spoil