@@ -0,0 +1,293 @@
1++++
2+title = "Azimuth’s First Contract Upgrade"
3+date = 2021-06-05
4+description = "Galactic Senate makes first concrete action"
5+[extra]
6+author = "Jonathan Paprocki and Mark"
7+ship = "~datnut-pollen and ~palfun-foslup"
8+image = "https://media.urbit.org/site/posts/essays/land3.jpg"
9++++
10+
11+<br>
12+
13+
14+
15+<br>
16+
17+Recently, the [first upgrade](https://github.com/urbit/azimuth/pull/35) to the
18+[Azimuth](@/docs/glossary/azimuth.md) smart contracts which make up Urbit ID was
19+put up to an [upgrade proposal vote](@/docs/glossary/upgrade.md) by the
20+[Galactic Senate](@/docs/glossary/senate.md). This vote is still open and will
21+last for 30 days (June 20th) or until an absolute majority is reached. We’d like
22+to take this opportunity to discuss two things. [First](#changelist), what the
23+proposed changes are, and [second](#senate), a review of how Urbit governance
24+works and where we’re at with respect to the decentralization process.
25+
26+Before we dive into what the proposed changes are, let’s review what the Senate
27+is actually capable of changing. Urbit ID is really two sets of smart contracts:
28+Azimuth and [Ecliptic](@/docs/glossary/ecliptic.md). Azimuth is the data of the
29+public key infrastructure - roughly, this is the list of
30+[ships](@/docs/glossary/ship.md) and which Ethereum address owns them, along
31+with other data such as networking keys and sponsorship status. The Senate has
32+no ability to touch this data directly. This is in direct contrast to all
33+existing centralized services, where your account is always at risk of being
34+taken away from you. What the Senate can change is Ecliptic, which is the
35+“business logic” that decides how you can interact with the data in Azimuth.
36+These are mechanisms such as what powers various
37+[proxies](@/docs/glossary/proxies.md) have, how stars/planets are released over
38+time, and how sponsorship works. Put another way, the data and database format
39+must remain the same, but the rules by which we interact with it may change
40+according to the governance rules we [detail below](#senate).
41+
42+## Changelist {#changelist}
43+
44+The currently open vote to Ecliptic contains the following changes: Fixed ERC721
45+compatibility Self-modifying proxies Upgraded Claims contract
46+
47+### Fixed ERC721 compatibility
48+
49+The contract definition of the Ecliptic includes various functions and events
50+that make it conform to the ERC721 (non-fungible token) standard. However, two
51+events have [ever so slightly
52+non-confirming](https://github.com/urbit/azimuth/issues/8) descriptions. This
53+causes Ethereum explorers like Etherscan to incorrectly recognize Azimuth as
54+ERC20 (fungible token), rather than ERC721.
55+
56+The proposed change simply modifies the event descriptions to accurately match
57+the ERC721 definition. This does not affect any functionality within the
58+contract itself.
59+
60+### Self-modifying proxies
61+
62+Owners of Azimuth assets are allowed to configure "proxy addresses" for those
63+assets: Ethereum addresses allowed to act "as" the owner, but only for a subset
64+of operations. For example, setting the management proxy will let you change
65+your networking keys and sponsor using that address, just like your ownership
66+address can. This is useful for keeping the ownership keys in very cold storage,
67+while still letting you perform lower-value operations.
68+
69+Currently, only the ownership address is allowed to change proxy addresses.
70+Fairly early on after Azimuth's deployment, we realized it might be nice for
71+proxies to be able to change themselves.
72+
73+This means that, in addition to being able to configure networking keys and
74+sponsorship, your management proxy would be able to assign a new management
75+proxy. This would let you or a trusted third party holding your management proxy
76+rotate your proxy keys without needing to take your ownership keys out of cold
77+storage.
78+
79+### Upgraded Claims contract
80+
81+[The Claims
82+contract](https://github.com/urbit/azimuth/blob/master/contracts/Claims.sol)
83+lets asset managers associate various attestations with their identity. For
84+example, an Ethereum address to send donations to, or proving ownership of a
85+Twitter account.
86+
87+For ease of use by off-chain tools and services, the contract emits events
88+(notifications) whenever any claims are updated. However, the current version of
89+the contract has a bug where it does not emit events when all claims are removed
90+at once (clearClaims()). This "gap" in the event stream makes it much more
91+difficult to write off-chain tools around this contract. Considering Claims has
92+seen [practically no
93+use](https://etherscan.io/address/0xe7e7f69b34d7d9bd8d61fb22c33b22708947971a#events)
94+since it was first deployed, it should not be a problem to simply start over
95+fresh with a new contract that contains [the
96+fix](https://github.com/urbit/azimuth/pull/32) for the described bug.
97+
98+The reason we must do an Ecliptic upgrade to switch to a new Claims contract, is
99+that it is tied in with the logic for transferring an asset. If the asset is
100+flagged for "reset" (common when transferring to/from someone other than
101+yourself), its configured proxies, networking keys and claims are cleared during
102+transfer. As such, the Ecliptic will need to know about the address of the new
103+Claims contract.
104+
105+## Urbit Governance {#senate}
106+
107+
108+
109+The ultimate goal of Urbit is to become a digital republic manifested as a peer
110+to peer network owned and controlled by its users. The goal of Tlon, then, is to
111+become a company which builds products for Urbit rather than being the primary
112+driving force behind its development. We’d like to take this opportunity to
113+spell out our perspective on where we’re at in that process. We’ve already
114+written a good deal about Urbit governance in the past on this blog, so we avoid
115+rehashing too much, but the first contract upgrade is an apt time for a routine
116+checkup. Here are some previous posts that are relevant, but please note that
117+some of them are several years old and as such may not accurately reflect our
118+current position, but still serve as useful historical markers. We hope to
119+revisit and refresh these documents soon. [2016.5.16 - Interim
120+Constitution](@/blog/interim-constitution.md) [2016.5.16 - The
121+Urbit Address Space](@/blog/the-urbit-address-space.md)
122+[2016.6.24 - The DAO as a Lesson in Decentralized
123+Governance](@/blog/the-dao-as-a-lesson-in-decentralized-governance.md)
124+[2019.1.11 - Governance of
125+urbit.org](@/blog/governance-of-urbit.md)
126+
127+### Galactic Senate
128+
129+The Galactic Senate is composed of all [galaxy](@/docs/glossary/galaxy.md)
130+holders, which at present consists of more than 100 individuals and a few
131+organizations, including Tlon and the Urbit.org Foundation. Using the Azimuth
132+voting contract, the Senate can present and vote on two kinds of proposals:
133+[document proposals](@/docs/glossary/docvote.md) and [upgrade
134+proposals](@/docs/glossary/upgrade.md). Thus far, all matters which the Senate
135+has voted on have been document proposals. The [most recent
136+vote](https://github.com/urbit/azimuth/pull/34) declared the Urbit network as
137+(i) being secure (as confirmed by a [third party
138+audit](@/blog/security-audit.md)) and (ii) having reached continuity (as in, no
139+further [network breaches](@/docs/glossary/breach.md) are expected). Previous votes
140+were to declare that [Azimuth is live](https://github.com/urbit/azimuth/pull/25)
141+and that [Arvo is stable](https://github.com/urbit/azimuth/pull/24).
142+
143+### Address space distribution
144+
145+Perhaps the most informative measure of how decentralized Urbit is in terms of
146+how many independent parties hold address space. By the very nature of Urbit, it
147+is impossible to know this with great accuracy (a common feature of
148+decentralized projects). However, the movement of galaxies is closely watched
149+and thus we have a fairly good idea of how distributed they are.
150+
151+In the beginning, Urbit’s creator Curtis Yarvin was in possession of the entire
152+address space - all 256 galaxies, and everything underneath it. A network of one
153+is no network at all, and so over the last decade Urbit’s development has been
154+primarily driven by selling or giving away these galaxies. On [June 1,
155+2016](@/blog/the-urbit-address-space.md), the allocation was:
156+
157+> 95, to the Tlon Corporation. 50, to urbit.org, the future community
158+> foundation. 40, to Tlon employees and their family members (24 to Curtis, who
159+> started in 2002; 16 to everyone else, who started in 2014). 34, to outside
160+> investors in Tlon. 37, to 33 other individuals, who donated to the project,
161+> contributed code or services, won a contest, or were just in the right place
162+> at the right time.
163+
164+In the period since then leading up to the present, Tlon has sold a number of
165+its galaxies to fund development, and others have changed hands, to the point
166+that Tlon and urbit.org no longer possess a majority share of galaxies. In
167+January 2019, [Curtis gave all of his galaxies](@/blog/a-founders-farewell.md) to
168+Tlon when he left the project. In August 2020 we shared an update on the [known
169+distribution of address space](@/blog/value-of-address-space-pt3.md), where
170+Curtis’ galaxies are marked as Tlon’s “naked galaxies”. Since then, Tlon
171+disbursed its naked galaxies among the employees that wanted one who did not
172+already possess one, thus removing Tlon and urbit.org’s controlling share of the
173+Senate. Galaxies held by current and former Tlon employees are entirely
174+independent of Tlon Corporation—they may do with them, and vote with them, as
175+they please. `~ravmel-ropdyl` plans to give more color to this decision in the
176+near future.
177+
178+Distribution of stars is much more difficult to know. There is an active market
179+for stars on [OpenSea](https://opensea.io/collection/urbit-id), so we know that
180+they are changing hands frequently, but checking the number of distinct Ethereum
181+addresses that hold stars does not tell you very much information since there
182+are many legitimate reasons one person might hold each of their stars at
183+different addresses.
184+
185+### Software and smart contracts
186+
187+As was written in [The DAO as a Lesson in Decentralized
188+Governance](https://urbit.org/blog/the-dao-as-a-lesson-in-decentralized-governance/),
189+we are keenly aware of the threat of _decentralization theater_. Urbit has
190+undergone steady progress towards decentralization, and with the developments we
191+outline below it’s never been more clear that the project is beginning to leave
192+the cradle of Tlon. It’s also important to note that decentralization of a
193+project is always a procession away from an initial centralized state—you cannot
194+go from A to Z without first traversing every letter in between. While Urbit was
195+centralized during its earliest stages, the journey towards a network owned and
196+controlled by the users is now well underway.
197+
198+In the past, nearly all Urbit software was written by Tlon. While Tlon is still the only corporation actively updating Urbit’s MIT-licensed open source software, namely [Vere](@/docs/glossary/vere.md) (the runtime), and [Arvo](@/docs/glossary/arvo.md) (the kernel), unaffiliated individuals have been making enormous contributions to Urbit over the past couple of years via the [grants program](https://grants.urbit.org/history). Recent examples include the [Bitcoin node and wallet integration](https://github.com/urbit/urbit/pull/4940), [WebRTC integration](https://grants.urbit.org/proposals/21131866-webrtc-gall-agent-and-external-app), [Port, an Urbit installer and ship manager](https://github.com/arthyn/port), and [`|fuse`, an important primitive for 3rd party software distribution](https://github.com/urbit/urbit/pull/4820).
199+
200+The only real power Tlon holds over Urbit is the ability to push [OTA
201+updates](@/docs/glossary/ota-updates.md) via `~zod`, and suggest that people
202+download our binaries. To the best of our knowledge, all extant galaxies
203+retrieve their OTA updates from `~zod`, who forward it to their stars, who
204+forward it to their planets. This software distribution route is merely a
205+convenient default setting. Ships initially retrieve OTA updates from their
206+sponsor, but they have full authority to retrieve updates from whoever they want
207+with the `|ota` command, or even to only install software updates by hand if
208+they so choose.
209+
210+In the future, one can easily imagine many organizations shipping their own
211+distributions of Urbit from their own urbit nodes, somewhat analogously to the
212+large number of Linux distributions which exist today. There is nothing we can
213+do to stop a group from forking Urbit, declaring `~sampel-palnet` the new `~zod`
214+(both for updates and for sponsorship purposes), and retrieving all OTA updates
215+via that route and building their own binaries. This is all by design, and we
216+wouldn’t want it any other way.
217+
218+The use of the Azimuth smart contracts is also somewhat optional. By changing a
219+few lines of code to point their ships at another set of PKI smart contracts,
220+they could rid themselves of hierarchical peer discovery entirely and make use
221+of some other routing strategy such as [Kademlia based DHT
222+routing](https://en.wikipedia.org/wiki/Kademlia). This would likely give rise to
223+an entirely separate network. The fact that the network is fully capable of such
224+a schism helps keep the Senate honest and accountable to the users. If they ever
225+were to vote on a contract modification that greatly angered or upset a portion
226+of the user base, they would be inviting such a schism and be entirely deserving
227+of it. In that sense, the power to control the network is already held by the
228+users, they just have not yet had a reason to make use of it.
229+
230+### Legitimacy
231+
232+The only way by which Tlon and the Senate hold any power is via legitimacy.
233+Vitalik Buterin recently wrote a [very informative
234+article](https://vitalik.ca/general/2021/03/23/legitimacy.html) on the role of
235+legitimacy in decentralized governance, and I do not know of a better source to
236+understand how Tlon and the Senate are kept in check by the users. Besides the
237+DAO split resulting in Ethereum and Ethereum Classic mentioned in the article,
238+perhaps the most prominent example of the power users have over a decentralized
239+network is the saga of [Steem and Justin
240+Sun](https://www.coindesk.com/justin-sun-bought-steemit-steem-moved-to-limit-his-power).
241+The short version of the story is that Justin Sun bought a controlling share of
242+the Steem blockchain and attempted to exert control over it, and the users
243+banded together to fork the blockchain into one called Hive, which was identical
244+to Steem except with Sun’s token balance set to zero. An analogous outcome for
245+Urbit would be that the Senate makes sweeping changes to the PKI and invites a
246+schism like that outlined above.
247+
248+For these reasons, there are strong disincentives for any one organization or
249+individual to acquire too many galaxies. The more galaxies one party possesses,
250+the fewer there are with strong incentives to stimulate efforts to build on the
251+network, reducing the value of holding that space, and the greater the risk that
252+the users will perceive this as a power grab by a party without their interests
253+in mind. This is in contrast to real-life republics, where there is little risk
254+for one party to accumulate as much power as they can manage since the cost to
255+the citizens to overthrow that power is enormous. Thus, only especially
256+egregious displays of power ever result in rebellion. Within the Urbit republic,
257+users need only to change the code they run to leave the Senate powerless, and
258+so the threat of rebellion is much more real. We estimate that within a digital
259+republic like Urbit, the centrifugal forces outweigh the centripetal forces, and
260+that the outcome of this is more stable than the reverse.
261+
262+### Why have governance at all?
263+
264+An important question the reader may still have lingering is: why does Urbit
265+need governance at all? The short answer is: (i) there will always be necessary
266+protocol upgrades that cannot be foreseen, and (ii) a total lack of governance
267+inevitably gives rise to a shadow government with undefined powers that is
268+almost impossible to hold accountable.
269+
270+With (ii), we see this to be the case on many early blockchain projects where
271+power is shared by the developers and the miners, but what each is capable of
272+doing has never been codified and thus users of the blockchain can never have a
273+great deal of certainty of what changes might occur in the future. This doesn’t
274+guarantee a bad outcome, but it does create more wariness for individuals to
275+contribute to a project when they cannot know whether they really have a say in
276+its direction. Recognizing this issue, many newer blockchain and
277+blockchain-adjacent projects have built in governance mechanisms that lay out
278+exactly what an individual can expect should they join and contribute to that
279+network.
280+
281+As for (i), with Urbit being a wholly new kind of network, it would take some
282+incredible luck and crystal ball gazing to get the PKI exactly right on the very
283+first try without ever needing another modification. Thus, some mechanism was
284+needed to guarantee that the PKI’s logic could be altered. Leaving control of
285+Azimuth in the hands of Tlon would have just granted Tlon dictatorial power and
286+a future that becomes more uncertain the further one gazes. There’s certainly
287+room to argue that the Galactic Senate is not a perfect system, but our interim
288+constitution did outline potential roles for stars and planets to play in
289+governance in the future, so there is ample opportunity for the system to evolve
290+in response to the will of the users. As always, it is important to keep in mind
291+the unfinished nature of the Urbit of today and the still moldable clay of the
292+Urbit of tomorrow—nothing yet is set in stone.
293+