@@ -0,0 +1,292 @@
1++++
2+title = "Azimuth’s First Contract Upgrade"
3+date = 2021-06-05
4+description = "Galactic Senate makes first concrete action"
5+[extra]
6+author = "Jonathan Paprocki and Mark"
7+ship = "~datnut-pollen and ~palfun-foslup"
8+image = "https://media.urbit.org/site/posts/essays/land3.jpg"
9++++
10+
11+<br>
12+
13+
14+
15+<br>
16+
17+Recently, the [first upgrade](https://github.com/urbit/azimuth/pull/35) to the
18+[Azimuth](@/docs/glossary/azimuth.md) smart contracts which make up Urbit ID was
19+put up to an [upgrade proposal vote](@/docs/glossary/upgrade.md) by the
20+[Galactic Senate](@/docs/glossary/senate.md). This vote is still open and will
21+last for 30 days (June 20th) or until an absolute majority is reached. We’d like
22+to take this opportunity to discuss two things. [First](#changelist), what the
23+proposed changes are, and [second](#senate), a review of how Urbit governance
24+works and where we’re at in the decentralization process.
25+
26+Before we dive into what the proposed changes are, let’s review what the Senate
27+is actually capable of changing. Urbit ID is really two sets of smart contracts:
28+Azimuth and [Ecliptic](@/docs/glossary/ecliptic.md). Azimuth is the data of the
29+public key infrastructure - roughly, this is the list of
30+[ships](@/docs/glossary/ship.md) and which Ethereum addresses own them, along
31+with other data such as networking keys and sponsorship status. The Senate has
32+no ability to touch this data directly. This is in direct contrast to all
33+existing centralized services, where your account is always at risk of being
34+taken away from you. What the Senate can change is Ecliptic, which is the
35+“business logic” that decides how you can interact with the data in Azimuth.
36+These are mechanisms such as what powers various
37+[proxies](@/docs/glossary/proxies.md) have, how stars/planets are released over
38+time, and how sponsorship works. Put another way, the data and database format
39+must remain the same, but the rules by which we interact with it may change
40+according to the governance rules we [detail below](#senate).
41+
42+## Changelist {#changelist}
43+
44+The Galactic Senate is voting on the following changes to Ecliptic:
45+
46+- Fixed ERC721 compatibility
47+- Self-modifying proxies
48+- Upgraded Claims contract
49+
50+### Fixed ERC721 compatibility
51+
52+In Ecliptic, the contract includes various functions and events
53+that make it conform to the ERC721 (non-fungible token) standard. However, two
54+events have [ever so slightly
55+non-confirming](https://github.com/urbit/azimuth/issues/8) descriptions. This
56+causes Ethereum explorers like Etherscan to incorrectly recognize Azimuth as
57+ERC20 (fungible token), rather than ERC721.
58+
59+The proposed change simply modifies the event descriptions to accurately match
60+the ERC721 definition. This does not affect any functionality within the
61+contract itself.
62+
63+### Self-modifying proxies
64+
65+Owners of Azimuth assets are allowed to configure "proxy addresses" for those
66+assets: Ethereum addresses allowed to act "as" the owner, but only for a subset
67+of operations. For example, setting the management proxy will let you change
68+your networking keys and sponsor using that address, just like your ownership
69+address can. This is useful for keeping the ownership keys in very cold storage
70+while still letting you perform lower-value operations.
71+
72+Currently, only the ownership address is allowed to change proxy addresses.
73+Fairly early on after Azimuth's deployment, we realized it might be nice for
74+proxies to be able to change themselves.
75+
76+This means that, in addition to being able to configure networking keys and
77+sponsorship, your management proxy would be able to assign a new management
78+proxy. This would allow you, or a trusted third party holding your management proxy,
79+to rotate your proxy keys without needing to take your ownership keys out of cold
80+storage.
81+
82+### Upgraded Claims contract
83+
84+[The Claims
85+contract](https://github.com/urbit/azimuth/blob/master/contracts/Claims.sol)
86+lets asset managers associate various "claims" with their identity. For
87+example, an Ethereum address to send donations to, or proving ownership of a
88+Twitter account.
89+
90+For ease of use by off-chain tools and services, the contract emits events
91+(notifications) whenever any claims are updated. However, the current version of
92+the contract has a bug where it does not emit events when all claims are removed
93+at once (clearClaims()). This "gap" in the event stream makes it much more
94+difficult to write off-chain tools around this contract. Considering Claims has
95+seen [practically no
96+use](https://etherscan.io/address/0xe7e7f69b34d7d9bd8d61fb22c33b22708947971a#events)
97+since it was first deployed, it should not be a problem to simply start over
98+fresh with a new contract that contains [the
99+fix](https://github.com/urbit/azimuth/pull/32) for the described bug.
100+
101+The reason we must do an Ecliptic upgrade to switch to a new Claims contract, is
102+that it is tied in with the logic for transferring an asset. If an asset is
103+flagged for "reset" (common when transferring to/from someone other than
104+yourself), its configured proxies, networking keys and claims are cleared during
105+transfer. As such, Ecliptic will need to know about the address of the new
106+Claims contract.
107+
108+## Urbit Governance {#senate}
109+
110+
111+
112+The ultimate goal of Urbit is to become a digital republic manifested as a peer
113+to peer network owned and controlled by its users. The goal of Tlon, then, is to
114+become one of many companies who build products for Urbit rather than being the primary
115+driving force behind its development. We’d like to take this opportunity to
116+spell out our perspective on where we’re at in that process. Here are some previous posts that are relevant, but please note that
117+some of them are several years old and as such may not accurately reflect our
118+current position, but still serve as useful historical markers. We hope to
119+revisit and refresh these documents soon.
120+
121+- [2016.5.16 - Interim
122+ Constitution](@/blog/interim-constitution.md)
123+- [2016.5.16 - The
124+ Urbit Address Space](@/blog/the-urbit-address-space.md)
125+- [2016.6.24 - The DAO as a Lesson in Decentralized
126+ Governance](@/blog/the-dao-as-a-lesson-in-decentralized-governance.md)
127+- [2019.1.11 - Governance of
128+ urbit.org](@/blog/governance-of-urbit.md)
129+
130+### Galactic Senate
131+
132+The Galactic Senate is composed of all [galaxy](@/docs/glossary/galaxy.md)
133+holders, which at present consists of more than 100 individuals and a few
134+organizations, including Tlon and the Urbit Foundation. Using the Azimuth
135+voting contract, the Senate can present and vote on two kinds of proposals:
136+[document proposals](@/docs/glossary/docvote.md) and [upgrade
137+proposals](@/docs/glossary/upgrade.md). Thus far, all matters which the Senate
138+has voted on have been document proposals. The [most recent
139+vote](https://github.com/urbit/azimuth/pull/34) declared the Urbit network as
140+(i) being secure (as confirmed by a [third party
141+audit](@/blog/security-audit.md)) and (ii) having reached continuity (as in, no
142+further [network breaches](@/docs/glossary/breach.md) are expected). Previous votes
143+were to declare that [Azimuth is live](https://github.com/urbit/azimuth/pull/25)
144+and that [Arvo is stable](https://github.com/urbit/azimuth/pull/24).
145+
146+### Address space distribution
147+
148+Perhaps the most informative measure of how decentralized Urbit is in terms of
149+how many independent parties hold address space. By the very nature of Urbit, it
150+is impossible to know this with great accuracy (a common feature of
151+decentralized projects). However, the movement of galaxies is closely watched
152+and thus we have a fairly good idea of how distributed they are.
153+
154+In the beginning, Urbit’s creator Curtis Yarvin was in possession of the entire
155+address space - all 256 galaxies, and everything underneath it. A network of one
156+is no network at all, and so over the last decade Urbit’s development has been
157+primarily driven by selling or giving away these galaxies. On [June 1,
158+2016](@/blog/the-urbit-address-space.md), the allocation was:
159+
160+> 95, to the Tlon Corporation. 50, to urbit.org, the future community
161+> foundation. 40, to Tlon employees and their family members (24 to Curtis, who
162+> started in 2002; 16 to everyone else, who started in 2014). 34, to outside
163+> investors in Tlon. 37, to 33 other individuals, who donated to the project,
164+> contributed code or services, won a contest, or were just in the right place
165+> at the right time.
166+
167+Since then, Tlon has sold a number of
168+its galaxies to fund development and others have changed hands to the point
169+that Tlon and urbit.org no longer possess a majority share of galaxies. In
170+January 2019, [Curtis gave all of his galaxies](@/blog/a-founders-farewell.md) to
171+Tlon when he left the project. In August 2020 we shared an update on the [known
172+distribution of address space](@/blog/value-of-address-space-pt3.md), where
173+Curtis’ galaxies are marked as Tlon’s “naked galaxies”. Shortly thereafter, Tlon
174+disbursed its naked galaxies among the employees that wanted one who did not
175+already possess one, thus removing Tlon and urbit.org’s controlling share of the
176+Senate. Galaxies held by current and former Tlon employees are entirely
177+independent of Tlon Corporation—they may do with them, and vote with them, as
178+they please. `~ravmel-ropdyl` plans to give more color to this decision in the
179+near future.
180+
181+Distribution of stars is much more difficult to know. There is an active market
182+for stars on [OpenSea](https://opensea.io/collection/urbit-id), so we know that
183+they are changing hands frequently, but checking the number of distinct Ethereum
184+addresses that hold stars does not tell you very much information since a single person can control multiple adresses.
185+
186+### Software and smart contracts
187+
188+As was written in [The DAO as a Lesson in Decentralized
189+Governance](https://urbit.org/blog/the-dao-as-a-lesson-in-decentralized-governance/),
190+we are keenly aware of the threat of _decentralization theater_. Urbit has
191+undergone steady progress towards decentralization, and with the developments we
192+outline below, it’s never been more clear that the project is beginning to leave
193+the cradle of Tlon. It’s also important to note that the decentralization of a
194+project is always a movement away from an initial centralized state—you cannot
195+go from A to Z without first traversing every letter in between. While Urbit was
196+centralized at the beginning, the journey towards a network owned and
197+controlled by the users is now well underway.
198+
199+In the past, nearly all Urbit software was written by Tlon. While Tlon is still
200+the only corporation actively updating Urbit’s MIT-licensed open source
201+software, namely [Vere](@/docs/glossary/vere.md) (the runtime),
202+[Arvo](@/docs/glossary/arvo.md) (the kernel),
203+[Landscape](@/docs/glossary/landscape.md) (the client), and
204+[Bridge](@/docs/glossary/bridge.md) (the ID manager), unaffiliated individuals have been making enormous contributions to Urbit over the past couple of years via the [grants program](https://grants.urbit.org/history). Recent examples include the [Bitcoin node and wallet integration](https://github.com/urbit/urbit/pull/4940), [WebRTC integration](https://grants.urbit.org/proposals/21131866-webrtc-gall-agent-and-external-app), [Port, an Urbit installer and ship manager](https://github.com/arthyn/port), and [`|fuse`, an important primitive for 3rd party software distribution](https://github.com/urbit/urbit/pull/4820).
205+
206+The only real power Tlon holds over Urbit is the ability to push [OTA
207+updates](@/docs/glossary/ota-updates.md) via `~zod`, and suggest that people
208+download our binaries. To the best of our knowledge, all extant galaxies
209+retrieve their OTA updates from `~zod`, who forward it to their stars, who
210+forward it to their planets. This software distribution route is merely a
211+convenient default setting. Ships initially retrieve OTA updates from their
212+sponsor, but they have full authority to retrieve updates from whoever they want
213+with the `|ota` command, or even to only install software updates by hand if
214+they so choose.
215+
216+In the future, one can easily imagine many organizations shipping their own
217+distributions of Urbit from their own urbit nodes, somewhat analogously to the
218+large number of Linux distributions which exist today. There is nothing we can
219+do to stop a group from forking Urbit, declaring `~sampel-palnet` the new `~zod`
220+(both for updates and for sponsorship purposes), and retrieving all OTA updates
221+via that route and building their own binaries. This is all by design, and we
222+wouldn’t want it any other way.
223+
224+The use of the Azimuth smart contracts is also somewhat optional. By changing a
225+few lines of code to point their ships at another set of PKI smart contracts,
226+they could rid themselves of hierarchical peer discovery entirely and make use
227+of some other routing strategy such as [Kademlia based DHT
228+routing](https://en.wikipedia.org/wiki/Kademlia). This would likely give rise to
229+an entirely separate network. The fact that the network is fully capable of such
230+a schism helps keep the Senate honest and accountable to the users. If they ever
231+were to vote on a contract modification that greatly angered or upset a portion
232+of the user base, they would be inviting such a schism and be entirely deserving
233+of it. In that sense, the power to control the network is already held by the
234+users, they just have not yet had a reason to make use of it.
235+
236+### Legitimacy
237+
238+The only way by which Tlon and the Senate hold any power is via legitimacy.
239+Vitalik Buterin recently wrote a [very informative
240+article](https://vitalik.ca/general/2021/03/23/legitimacy.html) on the role of
241+legitimacy in decentralized governance, and I do not know of a better source to
242+understand how Tlon and the Senate are kept in check by the users. Besides the
243+DAO split resulting in Ethereum and Ethereum Classic mentioned in the article,
244+perhaps the most prominent example of the power users have over a decentralized
245+network is the saga of [Steem and Justin
246+Sun](https://www.coindesk.com/justin-sun-bought-steemit-steem-moved-to-limit-his-power).
247+The short version of the story is that Justin Sun bought a controlling share of
248+the Steem blockchain and attempted to exert control over it, and the users
249+banded together to fork the blockchain into one called Hive, which was identical
250+to Steem except with Sun’s token balance set to zero. An analogous outcome for
251+Urbit would be that the Senate makes sweeping changes to the PKI and invites a
252+schism like that outlined above.
253+
254+For these reasons, there are strong disincentives for any one organization or
255+individual to acquire too many galaxies. If galaxy ownership becomes more centralized, individuals will be less incentivized to build on the network which will reduce the value of address space. Furthermore, such centralization might provoke a fork if such centralized powers are perceived as malicious by the users. This is in contrast to real-life republics, where there is little risk
256+for one party to accumulate as much power as they can manage since the cost to
257+the citizens to overthrow that power is enormous. Thus, only especially
258+egregious displays of power ever result in rebellion. Within the Urbit republic,
259+users need only to change the code they run to leave the Senate powerless, and
260+so the threat of rebellion is much more real. We estimate that within a digital
261+republic like Urbit, the centrifugal forces outweigh the centripetal forces, and
262+that the outcome of this is more stable than the reverse.
263+
264+### Why have governance at all?
265+
266+An important question the reader may still have lingering is: why does Urbit
267+need governance at all? The short answer is: (i) there will always be necessary
268+protocol upgrades that cannot be foreseen, and (ii) a total lack of governance
269+inevitably gives rise to a shadow government with undefined powers that is
270+almost impossible to hold accountable.
271+
272+With (ii), we see this to be the case on many early blockchain projects where
273+power is shared by the developers and the miners, but what each is capable of
274+doing has never been codified, and thus users of the blockchain can never have a
275+great deal of certainty of what changes might occur in the future. This doesn’t
276+guarantee a bad outcome, but it does create more wariness among developers when they cannot know whether they really have a say in
277+the project's direction. Recognizing this issue, many newer blockchain and
278+blockchain-adjacent projects have built-in governance mechanisms that lay out
279+exactly what an individual can expect should they join and contribute to that
280+network.
281+
282+As for (i), with Urbit being a wholly new kind of network, it would take
283+incredible luck to get the PKI exactly right on the very
284+first try without ever needing another modification. Thus, some mechanism was
285+needed to guarantee that the PKI’s logic could be altered. Leaving control of
286+Azimuth in the hands of Tlon would have just granted Tlon dictatorial power, which Tlon nor Urbit users desired. There’s certainly
287+room to argue that the Galactic Senate is not a perfect system: our interim
288+constitution did outline potential roles for stars and planets to play in
289+governance in the future, so there is ample opportunity for the system to evolve
290+in response to the will of the users. As always, it is important to keep in mind
291+the unfinished nature of the Urbit of today and the still moldable clay of the
292+Urbit of tomorrow—nothing yet is set in stone.