@@ -1,135 +1,136 @@
1−---
2−sort: 8
3−type: post
4−title: Common objections to Urbit
5−author: Curtis Yarvin
6−preview: Some common objections to Urbit, discussed.
7−layout: urbit,post
8−footer: true
9−navmode: navbar
10−navdpad: false
11−navselect: posts
12−navpath: /
13−navhome: /
14−navclass: urbit
15−---
16−
17−We love crowdsourced criticism. We've heard a lot of great
18−objections to Urbit. Surely there's more out there! If so,
19−comments are open at the bottom of the page. We'll revise this
20−document to include anything new and interesting.
1++++
2+title = "Common Objections to Urbit"
3+date = "2016-06-27"
4+description = "Some common objections to Urbit, discussed."
5+aliases = [
6+ "/posts/essays/common-objections-to-urbit",
7+ "/posts/common-objections-to-urbit",
8+ "/posts/objections/"
9+]
10+
11+[extra]
12+author = "Curtis Yarvin"
13+ship = "~sorreg-namtyv"
14+image = "https://storage.googleapis.com/media.urbit.org/site/posts/essays/common-objections-to-urbit-1.jpg"
15++++
16+
17+
18+
19+We love crowdsourced criticism. We've heard a lot of great
20+objections to Urbit. Surely there's more out there! We'll
21+revise this document to include anything new and interesting.
2122
2223Here's our list right now:
2324
2425- [Urbit is not ready for prime time.](#prime)
2526- [Nock jets are a total hoax.](#jets)
2627- [Urbit needs an infinitely extending packet/event log.](#log)
27−- [Urbit is a total scamcoin. It's 100% premined.](#scam)
28−- [Urbit isn't even really decentralized! It has a government!](#gov)
28+- [Urbit is a total scamcoin. It's 100% premined.](#scam)
29+- [Urbit isn't even really decentralized! It has a government!](#gov)
30+- [Sandstorm/IPFS/Ethereum is way ahead of Urbit.](#sand)
2931- [Urbit doesn't have enough planets for every human being.](#planet)
3032- [Cloud computing is inherently non-private.](#pwned)
3133- [Urbit will never be able to call any existing code.](#code)
32−- [Hoon is too weird. No one will be able to program in it.](#program)
34+- [Hoon is too weird. No one will be able to program in it.](#program)
3335- [Urbit programmers are stuck with Hoon.](#stuck)
3436- [Ordinary users will never be able to manage an Urbit server.](#user)
3537- [Urbit has no killer app.](#killer)
36−- [Urbit is a reactionary digital dictatorship.](#dictator)
3738- [Urbit is sniffed at by Houyhnhyms.](#horse)
3839
39−*"We choose to go to the moon, not because it is easy, but because it is hard."*
40+_"We choose to go to the moon, not because it is easy, but because it is hard."_
4041— [John F. Kennedy](https://www.youtube.com/watch?v=g25G1M4EXrQ)
4142
42−<h2 id="prime">Urbit is not ready for prime time.</h2>
43+## Urbit is not ready for prime time. {% #prime %}
4344
44−**TLDR**: we agree.
45+_TLDR_: we agree.
4546
46−Urbit right now is a fun toy. It is fun to learn Hoon. It is
47+Urbit right now is a fun toy. It is fun to learn Hoon. It is
4748even fun and quite practical to make actual contributions.
4849(Hoon's IEEE floating-point was written by someone we've never
49−met: `~nym`, formerly `~nodpet-rinned`.) In fact, we have never
50−seen anyone *not* have fun with Urbit.
50+met: `~nym`, formerly `~nodpet-rinned`.) In fact, we have never
51+seen anyone _not_ have fun with Urbit.
5152
52−But there is all kinds of stuff wrong with the codebase. Urbit's
53+But there is all kinds of stuff wrong with the codebase. Urbit's
5354documentation is much improved, but remains incredibly weak --
54−Arvo is almost totally undocumented. Scaling is poor at best.
55−Urbit's reliability is dubious. Its security is nil.
55+Arvo is almost totally undocumented. Scaling is poor at best.
56+Urbit's reliability is dubious. Its security is nil.
5657
57−Urbit is feature-frozen. The only thing we're working on now,
58+Urbit is feature-frozen. The only thing we're working on now,
5859and for the rest of 2016, is doc, debugging and and self-hosting.
5960In that order of importance -- teaching Urbit is more important
6061than fixing it, which is more important than making it useful.
6162But we're quite confident that these are all solvable problems.
6263
6364The most important milestone about Urbit today is that it's ready
64−for technical decisions to be made collectively. A system like
65−Urbit can only be invented by a mad auteur. It can't be
66−maintained or stabilized by a mad auteur. Our primary goal today
65+for technical decisions to be made collectively. A system like
66+Urbit can only be invented by a mad auteur. It can't be
67+maintained or stabilized by a mad auteur. Our primary goal today
6768is expanding the number of people who understand Urbit, and we
6869expect these pioneers to participate in technical governance.
6970
70−<h2 id="jets">Nock jets are a total hoax.</h2>
71+## Nock jets are a total hoax. {% #jets %}
7172
72−**TLDR**: all of computing is a hoax. You can't compare a hoax
73−to nothing. You can only compare it to all the other hoaxes.
73+_TLDR_: all of computing is a hoax. You can't compare a hoax
74+to nothing. You can only compare it to all the other hoaxes.
7475
75−A "jet" is a sort of software device driver in Urbit. Urbit is
76+A "jet" is a sort of software device driver in Urbit. Urbit is
7677precisely defined in terms of an interpreter that fits on a
77−T-shirt, Nock. But a naive implementation of Nock is nowhere
78+T-shirt, Nock. But a naive implementation of Nock is nowhere
7879near practical, because Nock has only one integer operation:
79−increment. For example, to decrement a number in Nock, you
80+increment. For example, to decrement a number in Nock, you
8081increment a counter up to the number under it.
8182
8283The only way an efficient Nock interpreter can work is to
8384recognize algorithms like decrement, and implement them
84−non-naively. By far the easiest way to do this is not to analyze
85+non-naively. By far the easiest way to do this is not to analyze
8586arbitrary code as it's being executed, but to register and match
86−well-known implementations in the standard library. No one
87+well-known implementations in the standard library. No one
8788should be writing their own decrement.
8889
89−But the semantics of the interpreter, *so long as the jet and the
90−jet harness are defined correctly*, are exactly those of Nock.
91−We are not extending or changing Nock in any way. We are just
90+But the semantics of the interpreter, _so long as the jet and the
91+jet harness are defined correctly_, are exactly those of Nock.
92+We are not extending or changing Nock in any way. We are just
9293taking a shortcut in certain cases we understand perfectly.
9394
9495It's not at all unprecedented to have implementations much more
95−complex than the corresponding specification. The x86
96+complex than the corresponding specification. The x86
9697instruction set is relatively simple; the complexity of its
97−decoding and execution path in a modern CPU is enormous. This
98+decoding and execution path in a modern CPU is enormous. This
9899path may well have "peephole optimizations" that replace matched
99−algorithms, and if it doesn't the modern compiler does. People,
100−*bad* people, use "jets" to cheat on benchmarks all the time.
100+algorithms, and if it doesn't the modern compiler does. People,
101+_bad_ people, use "jets" to cheat on benchmarks all the time.
101102
102−Nock is designed as a standard. It's built like a standard.
103+Nock is designed as a standard. It's built like a standard.
103104Typically what causes real problems in standards is ambiguity.
104105Two implementations are incompatible, but each swears it has the
105−right interpretation of the natural-language spec. This simply
106−cannot happen in the Nock world. If two implementations
107−disagree, at least one of them is incorrect. This puts us firmly
108−in "with enough eyeballs, all bugs are shallow" territory.
106+right interpretation of the natural-language spec. This simply
107+cannot happen in the Nock world. If two implementations
108+disagree, at least one of them is incorrect. This puts us firmly
109+in "with enough eyeballs, all bugs are shallow" territory.
109110
110111The fact remains, however, that a Nock interpreter without jets
111−is completely useless. And there is not even an informal
112+is completely useless. And there is not even an informal
112113document that tells you what jets you need for a reasonably
113−efficient Urbit. (There should be such a document.)
114+efficient Urbit. (There should be such a document.)
114115
115116The correct way to think about jets is not to compare them to a
116−perfect interpreter created by unicorns. Jets are a combined
117+perfect interpreter created by unicorns. Jets are a combined
117118replacement for two other techniques in language implementation:
118119intrinsics and a foreign-function interface.
119120
120121Compared to both intrinsics and an FFI, your jets have one key
121−disadvantage: they need to be specified in pure code. You may
122+disadvantage: they need to be specified in pure code. You may
122123not have this executable specification, which means you need to
123−write it. Is this really so bad for your development process?
124−An executable specification? Which can be trivially tested
124+write it. Is this really so bad for your development process?
125+An executable specification? Which can be trivially tested
125126against the efficient implementation?
126127
127128Compared to intrinsics, jets give you true separation between
128129mechanism and policy; only the interpreter, not the programmer
129−and not the compiler, needs to know what's accelerated.
130+and not the compiler, needs to know what's accelerated.
130131
131132Compared to an FFI, jets preclude I/O, so can be trivially
132−sandboxed. Except that the programmer needs to mark routines
133+sandboxed. Except that the programmer needs to mark routines
133134which may benefit from optimization with a hint, here too we
134135separate mechanism (efficient implementation) from policy.
135136
@@ -137,43 +138,41 @@ Yes, formal verification of jet equivalence is desirable.
137138However, in the real world, many specifications, including quite
138139complex ones, are tested into equivalence by brute force.
139140
140−Urbit has some jet abuses. The equivalence between our markdown
141−parser in Hoon and the CommonMark C library is super dubious. It
142−should be taken out and shot.
141+Urbit has some jet abuses. The equivalence between our markdown
142+parser in Hoon and the CommonMark C library is super dubious. It
143+should be revisited.
143144
144145But the miscomputation resulting from a minor jet discrepancy is
145−not a security hole or even fatal. It effectively means the
146+not a security hole or even fatal. It effectively means the
146147event history, computed correctly, does not match the current
147−state. The way to resolve this conflict is for the current state
148+state. The way to resolve this conflict is for the current state
148149to win, and the event history to be discarded -- not abnormal
149−anyway. See the next question.
150+anyway. See the next question.
150151
151−<h2 id="log">Urbit needs an infinitely extending packet/event
152−log.</h2>
152+## Urbit needs an infinitely extending packet/event. {% #log %}
153153
154−**TLDR**: no, it doesn't. Urbit can prune the log.
154+_TLDR_: no, it doesn't. Urbit can prune the log.
155155
156156We can prune the event log because the Urbit transition function
157157doesn't have any access to the event history -- just the current
158158state and the current event.
159159
160−Urbit defines the semantics of a complete event log. It doesn't
160+Urbit defines the semantics of a complete event log. It doesn't
161161and can't require an implementation to maintain the whole log.
162162It can maintain a checkpoint and the log since that checkpoint.
163−The current implementation of Urbit maintains
164163
165164However, any practical urbit maintains a periodically updated
166−checkpoint. Our present implementation doesn't provide a way to
167−prune the event log. But that's just a missing feature. We have
165+checkpoint. Our present implementation doesn't provide a way to
166+prune the event log. But that's just a missing feature. We have
168167one or two of those!
169168
170−<h2 id="scam">Urbit is a total scamcoin. It's 100% premined</h2>
169+## Urbit is a total scamcoin. It's 100% premined. {% #scam %}
171170
172−**TLDR**: yeah. But at least it's not the DAO.
171+_TLDR_: yeah. But at least it's not the DAO.
173172
174−Like a cryptocurrency, Urbit is a digital title. But Urbit is
175−digital land, not digital money. If you assess it as a currency,
176−it's a lousy currency. If you assess a cat as a dog, it's a
173+Like a cryptocurrency, Urbit is a digital title. But Urbit is
174+digital land, not digital money. If you assess it as a currency,
175+it's a lousy currency. If you assess a cat as a dog, it's a
177176lousy dog.
178177
179178In real-world economics, the crucial distinction between land and
@@ -181,25 +180,25 @@ money is that land (a) has intrinsic utility and (b) is
181180non-fungible.
182181
183182Because of (b) alone, frictionless transactions in land are
184−impossible. A blockchain is only needed to ensure zero-cost
185−high-frequency transactions. So digital land doesn't need a
186−blockchain. Which means it doesn't need mining.
183+impossible. A blockchain is only needed to ensure zero-cost
184+high-frequency transactions. So digital land doesn't need a
185+blockchain. Which means it doesn't need mining.
187186
188187Of course, just because a digital title system doesn't need
189188mining, doesn't mean it can't distribute an initial allocation by
190189proof-of-work -- or by any other arbitrary method which is
191−careful not to benefit the system's own developers. Could we
192−give away the Urbit address space randomly? Sure. But why?
190+careful not to benefit the system's own developers. Could we
191+give away the Urbit address space randomly? Sure. But why?
193192
194193Probably the purest design is the "proof-of-burn" initial
195−allocation used by some coins. By any standard, proof-of-burn is
194+allocation used by some coins. By any standard, proof-of-burn is
196195technically beautiful and results in an extraordinary level of
197−ethical independence. We can't help but admire it.
196+ethical independence. We can't help but admire it.
198197
199−But any altcoin or metacoin is just way less work than Urbit. An
198+But any altcoin or metacoin is just way less work than Urbit. An
200199altcoin can afford to burn even its creation energy, capturing no
201−value at all from its seigniorage. Your altcoin doesn't have a
202−clean-slate system software stack to drive. If your rocket has
200+value at all from its seigniorage. Your altcoin doesn't have a
201+clean-slate system software stack to drive. If your rocket has
203202to go to the moon, it's going to leave a little bit of smoke in
204203the air.
205204
@@ -208,80 +207,78 @@ of the currency are rewarded disproportionately for their effort.
208207The scamcoin is a get-rich-quick scheme, vaguely pyramid-shaped.
209208Nothing about Urbit matches this pattern at all.
210209
211−Curtis invented Urbit. So by the [homestead
210+Curtis invented Urbit. So by the [homestead
212211principle](https://en.wikipedia.org/wiki/Homestead_principle), he
213−started out owning all of it. But by now, Urbit's 8-bit galaxies
214−have already been distributed among [57 separate individuals]().
215−Curtis owns 4 -- or 24, counting his whole family. (Some of whom
216−he still owes money.)
212+started out owning all of it. But by now, Urbit's 8-bit galaxies
213+have already been distributed among [57 separate individuals](https://github.com/urbit/arvo/blob/master/sys/vane/ames.hoon#L118-L373).
214+Curtis owns 20, or about 8%.
217215
218216Tlon, the corporation which still runs Urbit development, has 95.
219−(Without Tlon, there is basically no Arvo.) 50 are reserved for
220−a hypothetical Urbit Foundation. Tlon employees have another 16.
217+(Without Tlon, there is basically no Arvo.) 50 are reserved for
218+a hypothetical Urbit Foundation. Tlon employees have another 16.
221219
222220The rest of the galaxies belong to donors, investors,
223221contributors, contest winners, and just random people who were in
224−the right place at the right time. One is a Silicon Valley
225−tycoon. Another is an Orthodox nun in a monastery in Greece. A
226−couple are ex-Tlon employees who might totally hate us. There is
222+the right place at the right time. One is a Silicon Valley
223+tycoon. Another is an Orthodox nun in a monastery in Greece. A
224+couple are ex-Tlon employees who might totally hate us. There is
227225nothing they all have in common, which is sort of the point.
228226
229227This property distribution looks a lot like land ownership in the
230−real world -- complex and asymmetrical. That's no accident. If
228+real world -- complex and asymmetrical. That's no accident. If
231229you have a problem living in New York because New York's real
232230estate is not distributed equally among its residents, you may
233−have a similar problem with Urbit. The reality is that Urbit,
231+have a similar problem with Urbit. The reality is that Urbit,
234232like New York, wasn't born yesterday and comes with a complex
235233ownership history which we couldn't possibly change, even if we
236234wanted to.
237235
238−Decentralization is hard. The only real goal of a property
236+Decentralization is hard. The only real goal of a property
239237system in address space is to create and maintain
240−decentralization. The whole network has to exhibit centrifugal
241−force, not centripetal force. Proof-of-work systems certainly
238+decentralization. The whole network has to exhibit centrifugal
239+force, not centripetal force. Proof-of-work systems certainly
242240seem to have unexpected centripetal qualities, producing
243−unanticipated concentrations of centralized hashpower. See the
241+unanticipated concentrations of centralized hashpower. See the
244242next objection.
245243
246−<h2 id="gov">Urbit isn't even really decentralized! It has a
247−government!</h2>
244+## Urbit isn't even really decentralized! It has a government! {% #gov %}
248245
249−**TLDR**: it's technically impossible for Urbit to be
250−decentralized at this stage of its life. Urbit is designed to
246+_TLDR_: it's technically impossible for Urbit to be
247+decentralized at this stage of its life. Urbit is designed to
251248achieve decentralization, not be born with it.
252249
253−A young network can't afford to be decentralized. It has to act
254−as a unit. Because it has no network effect, it needs every
255−scrap of efficiency it can get.
250+A young network can't afford to be decentralized. It has to act
251+as a unit. Because it has no network effect, it needs every
252+scrap of efficiency it can get.
256253
257254A decentralized general-purpose computing network like Urbit can
258−*only* be bootstrapped by a central government. For example, by
255+_only_ be bootstrapped by a central government. For example, by
259256default your urbit upgrades its OS automatically (like an
260−"evergreen" browser) with signed network updates. Whoever signs
257+"evergreen" browser) with signed network updates. Whoever signs
261258these updates is a government by definition.
262259
263260When it's impossible to eliminate centralized power, it becomes
264−necessary to tame, stabilize, and limit it. This should not be
261+necessary to tame, stabilize, and limit it. This should not be
265262surprising to anyone living under a constitutional government.
266263
267264As we found out with the DAO, if a network isn't ready to be
268−decentralized, its developers shouldn't even try. If Ethereum is
265+decentralized, its developers shouldn't even try. If Ethereum is
269266hard-forked to roll back the DAO (which looks like the most
270267probable result), it acknowledges that it both has a central
271−government, and needs a central government. Decentralization is
272−good. Pretend decentralization -- "decentralization theater" --
268+government, and needs a central government. Decentralization is
269+good. Pretend decentralization -- "decentralization theater" --
273270is harmful, and not a effective path to actual decentralization.
274271
275272A key test of a free software project's health is whether it can
276−fork. So long as the unity of the public-key hierarchy and the
273+fork. So long as the unity of the public-key hierarchy and the
277274network protocol is maintained, the Arvo kernel and Urbit system
278275can fork in all kinds of ways without disrupting the network.
279276Any stress will fragment the "government" that develops the
280−kernel, and as it fragments it grows more limited and stable.
277+kernel, and as it fragments it grows more limited and stable.
281278
282279Urbit is designed to govern itself collectively by address space
283−ownership -- effectively, "proof of stake." Any arbitrary power,
284−will tend to fracture along these property lines. For instance,
280+ownership -- effectively, "proof of stake." Any arbitrary power,
281+will tend to fracture along these property lines. For instance,
285282our hot updates are sent through the galaxy hierarchy; in a
286283development fork, active galaxies would pick upstream sources.
287284Two implementations of a standard are better than one.
@@ -291,72 +288,70 @@ we've created a global property map which is much more likely to
291288splinter further, than reunite.
292289
293290In the long run, every galaxy should have a separate owner, who
294−is a human being rather than a corporation. Combining galaxy
295−holdings will damage the reputation of both galaxies. The only
291+is a human being rather than a corporation. Combining galaxy
292+holdings will damage the reputation of both galaxies. The only
296293reason to merge ownership is to move toward incipient monopoly.
297294Whether a galaxy admits this openly or denies it dishonestly, its
298295reputation will suffer.
299296
300−The technical goal of Urbit is to create a network which, *if it
301−actually takes over the world*, inevitably becomes decentralized.
297+The technical goal of Urbit is to create a network which, _if it
298+actually takes over the world_, inevitably becomes decentralized.
302299Even if Urbit takes over the world, no individual or coherent
303−organization takes over the world. There is nothing even close
300+organization takes over the world. There is nothing even close
304301to a single point of failure in a mature, successful Urbit.
305302
306−This is the goal of all the new "web3" decentralized systems. If
303+This is the goal of all the new "web3" decentralized systems. If
307304IPFS, Sandstorm or Ethereum takes over the world, nobody takes
308−over the world. (The same is almost true of the Internet --
305+over the world. (The same is almost true of the Internet --
309306though it wouldn't be that surprising if a time traveler from
3103072116 revealed that ICANN had become a planetary government.)
311308
312309Urbit, by starting out as a centralized network, just reduces the
313−technical problem to match the actual goal. Only long-term
310+technical problem to match the actual goal. Only long-term
314311decentralization matters.
315312
316313It's very important that Urbit in 2116 be fully decentralized.
317314For Urbit in 2016, pretending to be decentralized would be a joke
318−at best, and a hoax at worst. And of course, no one can DAO us
315+at best, and a hoax at worst. And of course, no one can DAO us
319316-- since the property system is still just a central registry.
320−Among other things, we check it into Github. Github is not a
317+Among other things, we check it into GitHub. GitHub is not a
321318blockchain -- but still, good luck with that.
322319
323−[{Sandstorm, IPFS, Ethereum, ...} is way ahead of Urbit.](#sand)
324−<h2 id="sand">{Sandstorm, IPFS, Ethereum, ...} is way ahead of
325−Urbit.</h2>
320+## Sandstorm/IPFS/Ethereum is way ahead of Urbit. {% #sand %}
326321
327322In general, web3 (next distributed web) solutions don't compete
328−with each other. They support each other. Concretely, they are
323+with each other. They support each other. Concretely, they are
329324all part of each others' network effect.
330325
331326IPFS, Sandstorm, Ethereum, and Urbit can all take over the world
332−at the same time. None of them competes with the others. They
333−enable each other.
327+at the same time. None of them competes with the others. They
328+enable each other.
334329
335330For instance, IPFS and Urbit are both global immutable
336−namespaces. IPFS is a chord-routed, content-addressed namespace.
337−Urbit is a direct-routed, identity-addressed namespace. Urbit is
338−a typed revision-control system; IPFS is a blob store. IPFS
331+namespaces. IPFS is a chord-routed, content-addressed namespace.
332+Urbit is a direct-routed, identity-addressed namespace. Urbit is
333+a typed revision-control system; IPFS is a blob store. IPFS
339334isn't a computer; the work hasn't been done, but Urbit can easily
340335mount the IPFS namespace and compute functionally against it.
341336
342337So the better IPFS does, the less Urbit needs to struggle against
343−its lack of network effect. The better Urbit does, the easier it
338+its lack of network effect. The better Urbit does, the easier it
344339is for IPFS to point to a functional language that can actually
345−use its referential transparency directly. So their relationship
340+use its referential transparency directly. So their relationship
346341is symbiotic, not competitive at all.
347342
348343The closest thing to a general-purpose competitor that Urbit has
349−is Sandstorm. Sandstorm, which by the way rocks, is also a
344+is Sandstorm. Sandstorm, which by the way rocks, is also a
350345personal server built around a network protocol.
351346
352347But Sandstorm and Urbit compete in the way that, on the PC, the
353−OS and the browser compete. In theory, the OS could solve the
348+OS and the browser compete. In theory, the OS could solve the
354349problems that the browser solves; or the browser could be the OS.
355350In practice, Windows is a great OS to run a browser on.
356351
357352Similarly, a world in which Sandstorm takes off is an awesome
358353world for Urbit, because everyone who has a Sandstorm instance
359−has a great platform for running Urbit on. Urbit on Sandstorm
354+has a great platform for running Urbit on. Urbit on Sandstorm
360355will be a sort of "double-hulled" personal server, safer and more
361356friendly than either system alone.
362357
@@ -364,25 +359,24 @@ Sandstorm and Urbit have very different approaches to network
364359identification; Sandstorm uses capabilities, Urbit identity.
365360Broadly speaking, we believe, capabilities are optimal for
366361expressive power; but identity is optimal for the UI of the
367−common case. We'd need to see the Powerbox, Sandstorm's UI, more
362+common case. We'd need to see the Powerbox, Sandstorm's UI, more
368363fully fleshed out to understand its UI approach better.
369364
370−<h2 id="planet">Urbit doesn't have enough planets for every human
371−being.</h2>
365+## Urbit doesn't have enough planets for every human {% #planet %}
372366
373−A 32-bit planet is a tool, not a toy. Like a car, it's a device
374−for a responsible and independent adult. There aren't 4 billion
375−cars in the world, nor 4 billion independent adults.
367+A 32-bit planet is a tool, not a toy. Like a car, it's a device
368+for a responsible and independent adult. There aren't 4 billion
369+cars in the world, nor 4 billion independent adults.
376370
377371If you aren't an independent adult, and you don't need or even
378372shouldn't have unconditional digital freedom (no one's 8-year-old
379373daughter needs unconditional digital freedom), a moon from
380−someone else's planet is fine. (Even most of today's independent
374+someone else's planet is fine. (Even most of today's independent
381375adults don't complain enough about being Facebook's moons.)
382376
383377And limiting the supply of anything doesn't create a shortage.
384−It sets a price. Ideally, in the long run, we think a planet
385−should cost about $10. This could be off by an order of
378+It sets a price. Ideally, in the long run, we think a planet
379+should cost about $10. This could be off by an order of
386380magnitude either way, and it wouldn't be the end of the world.
387381
388382If a planet costs $10, that means you paid $10 to get a planet.
@@ -394,52 +388,51 @@ social network social.
394388There is always a tradeoff between free speech and free beer.
395389Urbit will always choose free speech.
396390
397−<h2 id="pwned">Cloud computing is inherently non-private.</h2>
391+## Cloud computing is inherently non-private. {% #pwned %}
398392
399−**TLDR**: a general-purpose cloud computer is much, much more
400−private than a special-purpose cloud computer. In general, a
393+_TLDR_: a general-purpose cloud computer is much, much more
394+private than a special-purpose cloud computer. In general, a
401395cloud VM is secure against corporations but not governments.
402396With a global adversary, compute in your closet -- or even on
403397your body.
404398
405399One reason we want the decentralized Internet is that we're tired
406−of giant corporations spying on us. Think about it this way:
407−Amazon is Netflix's main competitor. And yet, Netflix runs its
408−whole operation on AWS. Why is Netflix sure that Amazon won't
400+of giant corporations spying on us. Think about it this way:
401+Amazon is Netflix's main competitor. And yet, Netflix runs its
402+whole operation on AWS. Why is Netflix sure that Amazon won't
409403spy on it?
410404
411405A general-purpose virtual machine is special from a privacy
412406standpoint, just because it's commercially realistic to design
413407terms of service that prevent the host from peeking and poking at
414−the customer's machine. Crossing this moat is technically
408+the customer's machine. Crossing this moat is technically
415409nontrivial and can't possibly happen by any reasonable accident.
416410No hosting contract could contemplate it.
417411
418412Whereas when your cloud computer is a special-purpose machine --
419413just a database row on some corporation's mainframe -- there is
420414no way these services can promise not to handle your data.
421−Handling your data is *what they do*. On a special-purpose
415+Handling your data is _what they do_. On a special-purpose
422416server, the concept of privacy is not even defined.
423417
424418Where even a general-purpose server falls down is where the user
425419has a sovereign adversary, which can secretly violate explicit or
426−implicit hosting contracts. Users with a sovereign adversary
427−must rely only on their own physical security.
420+implicit hosting contracts. Users with a sovereign adversary
421+must rely only on their own physical security.
428422
429−However, most users don't have a sovereign adversary. And those
423+However, most users don't have a sovereign adversary. And those
430424who do maximize their "herd immunity" if they can use the same
431−protocols as those who don't. Otherwise, the adversary could
425+protocols as those who don't. Otherwise, the adversary could
432426simply focus on everyone who uses the secure protocols.
433427
434−Also, the portability of a cloud server image is critical. Of
428+Also, the portability of a cloud server image is critical. Of
435429course, since Urbit is formally specified, it's trivially
436−portable. In fact, one strategy against sovereign adversaries
430+portable. In fact, one strategy against sovereign adversaries
437431may be continuous rotation between hosts, like an MX missile.
438432
439−<h2 id="code">Urbit will never be able to call any existing
440−code.</h2>
433+## Urbit will never be able to call any existing code. {% #code %}
441434
442−**TLDR**: neither will Javascript. And dear Unix, the browser
435+_TLDR_: neither will Javascript. And dear Unix, the browser
443436does not miss interacting with your `$LD_LIBRARY_PATH` at all.
444437
445438You can't talk to the OS or use system libraries from Javascript.
@@ -448,33 +441,31 @@ compatibility bridge, native methods, or other interface between
448441Javascript and C.
449442
450443When in doubt, remember that Urbit is "the browser for the server
451−side." It plays by the same general rules. Isolation means
444+side." It plays by the same general rules. Isolation means
452445isolation.
453446
454−[There's no way Urbit will ever be adopted. It's too
455−weird.](#weird) <h2 id="weird">There's no way Urbit will ever be
456−adopted. It's too weird.</h2>
447+## There's no way Urbit will ever be adopted. It's too weird. {% #weird %}
457448
458−**TLDR**: Urbit adoption is designed to be driven by ordinary end
459−users. Urbit isn't ready for ordinary end users yet. We're
449+_TLDR_: Urbit adoption is designed to be driven by ordinary end
450+users. Urbit isn't ready for ordinary end users yet. We're
460451working on it -- come help.
461452
462−Right now, Urbit is a developer tool. Or rather, a developer toy
463−-- since the only thing it's useful for is developing Urbit. It
464−also could be a much better toy. We're working on that too.
453+Right now, Urbit is a developer tool. Or rather, a developer toy
454+-- since the only thing it's useful for is developing Urbit. It
455+also could be a much better toy. We're working on that too.
465456
466457But it's absolutely wrong to think of Urbit being adopted as a
467−developer tool in the conventional sense. If you think this is
458+developer tool in the conventional sense. If you think this is
468459almost impossible, you're right.
469460
470461If we look at the way most successful platforms are adopted,
471−they're not adopted for their own virtues. They're adopted
472−because they're part of a larger solution. It's very hard to
473−displace a native component of an existing platform. Urbit is
462+they're not adopted for their own virtues. They're adopted
463+because they're part of a larger solution. It's very hard to
464+displace a native component of an existing platform. Urbit is
474465not trying to do this.
475466
476467C is a better language than Pascal, but it didn't beat Pascal
477−because it's a better language. C beat Pascal because C was the
468+because it's a better language. C beat Pascal because C was the
478469native language of Unix, and people wanted to program in Unix.
479470People don't use Javascript because Javascript is a great
480471language, but because it's the native language of the browser.
@@ -482,9 +473,9 @@ Replacing the native language of a platform may be doable -- but
482473it's incredibly hard.
483474
484475Hoon is not competing with C, or even Haskell, as a Unix
485−programming language. The only reason to program in Hoon is that
486−it's the native language of Urbit. Urbit is not competing with
487−node.js or Rails as a Web backend. The only reason to run Urbit
476+programming language. The only reason to program in Hoon is that
477+it's the native language of Urbit. Urbit is not competing with
478+node.js or Rails as a Web backend. The only reason to run Urbit
488479is to run a personal server.
489480
490481Nock is cool, but it only gets adopted if Hoon gets adopted.
@@ -493,10 +484,9 @@ Urbit only gets adopted if it's useful as a personal server for
493484human beings -- most of whom won't be Hoon programmers, or
494485programmers at all.
495486
496−<h2 id="program">Hoon is too weird. No one will be able to
497−program in it.</h2>
487+## Hoon is too weird. No one will be able to program in it. {% #program %}
498488
499−**TLDR**: Hoon is ridiculously simple. Our documentation and
489+_TLDR_: Hoon is ridiculously simple. Our documentation and
500490tooling are just immature.
501491
502492It's pretty fair to assume that (a) functional programming is
@@ -506,96 +496,94 @@ so (c) Hoon must be hard-squared.
506496Actually, Hoon is weird even for a functional language because
507497it's an attempt to remove the hardest things about functional
508498programming: category theory, lazy evaluation, and gratuitous
509−abstraction. To know a language is to know what the compiler is
499+abstraction. To know a language is to know what the compiler is
510500doing; all the semantics of the Hoon compiler fit in 2000 lines
511501of code.
512502
513503It's too easy for us to wind up living in Isaac Asimov's Trantor,
514504a world in which everything got invented thousands of years ago
515−and the idea of new technology is just weird and scary. History
505+and the idea of new technology is just weird and scary. History
516506isn't over yet, and nor is technical history.
517507
518−New things are harder to learn than old things. We ask smart
519−high-school students to learn calculus. Think about how much
508+New things are harder to learn than old things. We ask smart
509+high-school students to learn calculus. Think about how much
520510harder it was for Newton and Leibniz to invent calculus, or for
521−their first students to pick it up. Hoon is nowhere near as hard
511+their first students to pick it up. Hoon is nowhere near as hard
522512as calculus.
523513
524514Most of the difference is just the collective certainty that our
525515society conveys to a high-school student that calculus is
526−learnable. When you're learning Urbit, you don't have this
516+learnable. When you're learning Urbit, you don't have this
527517collective knowledge; so you don't have the confidence that the
528−problem is solvable. Confidence makes a huge difference.
518+problem is solvable. Confidence makes a huge difference.
529519Moreover, any bug or glitch in the developer experience destroys
530520this confidence and takes a long time to heal.
531521
532−Yes, we know: Hoon remains quite hard to learn. Again, we have
533−no reason to think this problem isn't solvable. Public
522+Yes, we know: Hoon remains quite hard to learn. Again, we have
523+no reason to think this problem isn't solvable. Public
534524enlightenment remains our main priority.
535525
536−<h2 id="stuck">Urbit programmers are stuck with Hoon.</h2>
526+## Urbit programmers are stuck with Hoon. {% #stuck %}
537527
538−**TLDR**: patience, grasshopper.
528+_TLDR_: patience, grasshopper.
539529
540530There's quite a straightforward way to implement any perfectly
541−specified language with a reliable interpreter in Hoon. First,
542−write an interpreter for that language in Hoon. Second, jet that
543−intepreter function with the existing implementation.
531+specified language with a reliable interpreter in Hoon. First,
532+write an interpreter for that language in Hoon. Second, jet that intepreter function with the existing implementation.
544533
545−It is not clear that Javascript is *quite* well-defined enough
546−for this treatment. But Lua probably is.
534+It is not clear that Javascript is _quite_ well-defined enough
535+for this treatment. But Lua probably is.
547536
548−<h2 id="user">Ordinary users will never be able to manage an
549−Urbit server.</h2>
537+## Ordinary users will never be able to manage an Urbit server. {% #user %}
550538
551−**TLDR**: Urbit's technical simplicity has always been designed
552−to drive human usability. But the polish is the last thing that
553−goes on. So we can't evaluate this claim right now.
539+_TLDR_: Urbit's technical simplicity has always been designed
540+to drive human usability. But the polish is the last thing that
541+goes on. So we can't evaluate this claim right now.
554542
555−Right now, Urbit is only for geeks. You already need to be able
556−to wrangle a Unix machine to run it. What's the point?
543+Right now, Urbit is only for geeks. You already need to be able
544+to wrangle a Unix machine to run it. What's the point?
557545
558−This Urbit isn't the real Urbit. It's an early milestone on the
546+This Urbit isn't the real Urbit. It's an early milestone on the
559547way to the real Urbit.
560548
561549The real Urbit -- for normal human beings -- is a hosted service.
562−Getting a planet is as easy as signing up for Facebook. Probably
563−many users will think of it as another web account. They might
550+Getting a planet is as easy as signing up for Facebook. Probably
551+many users will think of it as another web account. They might
564552not even know it can run more apps than the ones they use.
565553
566554A deterministic, persistent cloud computer is something different
567−from a traditional server. Normally when we think of a server in
555+from a traditional server. Normally when we think of a server in
568556the cloud, we think of it like a live animal -- a creature that
569−needs to be cared for, fed, and herded. A file in the cloud is
557+needs to be cared for, fed, and herded. A file in the cloud is
570558more like a rock -- you can forget about it for ten years.
571559
572560An urbit is a general-purpose computer, but it doesn't even have
573−the concept of a reboot. It upgrades itself. If you don't feed
561+the concept of a reboot. It upgrades itself. If you don't feed
574562it any packets for ten years, then turn it back on, it will spend
575−a day or two upgrading itself, then be back to normal. Maybe
563+a day or two upgrading itself, then be back to normal. Maybe
576564it's something in between a rock and an animal -- a cactus?
577565
578566Another huge difference versus an Internet server is that we're
579567confident that Urbit's limited supply of identities will make it
580−easy to keep abusers off the network. So far, so good -- but of
568+easy to keep abusers off the network. So far, so good -- but of
581569course, no one abuses a young network.
582570
583571The bottom line is that managing your urbit has to be as easy as
584−managing your iPhone. Normally, it consists of deciding what
572+managing your iPhone. Normally, it consists of deciding what
585573apps you want to be running, and how much you trust them.
586574Resources can't be free, so sometimes you have to play memory
587−police. Humans have shown that they can handle these tasks.
575+police. Humans have shown that they can handle these tasks.
588576
589577Our '70s OSes and networks, which were great designs in their day
590578and have matured into excellent industrial tools, give us a
591579totally misleading impression of how hard it should be to manage
592−a general-purpose computer. Computing isn't scary or dangerous.
593−Unix and the Internet are scary and dangerous. That's fine for
580+a general-purpose computer. Computing isn't scary or dangerous.
581+Unix and the Internet are scary and dangerous. That's fine for
594582an industrial tool, but not a personal tool.
595583
596−<h2 id="killer">Urbit has no killer app.</h2>
584+## Urbit has no killer app. {% #killer %}
597585
598−**TLDR**: the killer app is personal API aggregation.
586+_TLDR_: the killer app is personal API aggregation.
599587
600588It's a truism that any new platform has to be fundamentally much
601589better at solving some problem than the mature platform it seeks
@@ -608,23 +596,23 @@ From the developer's perspective, Urbit's advantage is that it's
608596a network stack which provides exactly-once delivery of typed,
609597validated, transactional, encrypted and authenticated messages.
610598The difference between an Urbit API and a REST API is like the
611−difference between a paved road and a dirt road. On the other
599+difference between a paved road and a dirt road. On the other
612600hand, you do need to learn a new functional language.
613601
614602From the user's perspective, there's one task that any personal
615603server can perform, that can't be performed by any Web service:
616604unrestricted API aggregation.
617605
618−Well before Urbit is ready to *replace* any conventional web
619−services, it should be ready to *command* them in place by API.
620−(Or if needed, by scraping.) If all you care about is being in
606+Well before Urbit is ready to _replace_ any conventional web
607+services, it should be ready to _command_ them in place by API.
608+(Or if needed, by scraping.) If all you care about is being in
621609control of your own data, it's fine to leave it in the hands of
622610these services, as you have the API secrets to get it out.
623611
624612Managing a set of security connections to your existing services
625613is one of the first important tasks of a modern personal server.
626614This is a stateful task that typically requires both a durable
627−API key and a temporary OAuth token. APIs change all the time,
615+API key and a temporary OAuth token. APIs change all the time,
628616so connection maintenance also requires evergreen updates.
629617
630618The origin of this API key will vary, but usually the best way to
@@ -636,7 +624,7 @@ do with your own data.
636624
637625Terms of service which constrain the use of data (as opposed to
638626the abuse of the service) simply aren't realistic and will no
639−longer apply. This enables a variety of novel user experiences
627+longer apply. This enables a variety of novel user experiences
640628which aren't implementable as traditional web services, and also
641629aren't available via conventional third-party API aggregators.
642630
@@ -644,67 +632,42 @@ Also, since Urbit is after all quite immature, it doesn't make
644632much sense to restrict this security state to code within Urbit.
645633The Urbit interpreter `vere` runs as a Unix daemon that
646634implements the FUSE user-level filesystem protocol, and maps the
647−data on your services into the Unix filesystem. For example, one
648−of our demos lets you `ls` your Github issues.
635+data on your services into the Unix filesystem. For example, one
636+of our demos lets you `ls` your GitHub issues.
649637
650638So it's straightforward to build, for instance, a Python app that
651−uses Urbit as a gateway to mash up a bunch of web services. As a
639+uses Urbit as a gateway to mash up a bunch of web services. As a
652640Unix programmer, you might even just regard Urbit as a generic
653641Web API gateway daemon, without worrying about its internals.
654642
655−We have other ideas for initial killer apps. But this, we feel,
656−is the best one. API libraries for `npm` et al abound.
643+We have other ideas for initial killer apps. But this, we feel,
644+is the best one. API libraries for `npm` et al abound.
657645Stateful, self-updating, generic API aggregators with FUSE
658646integration, also integrated with a reactive web server, are
659647rarer.
660648
661−<h2 id="dictator">Urbit is a reactionary digital
662−dictatorship.</h2>
663−
664−**TLDR**: Facebook is a digital dictatorship.
665−Urbit is a decentralized network with a republican constitution.
666−
667−It's especially important to combat the impression that Tlon is a
668−reactionary conspiracy. Tlon is a Delaware corporation. It
669−exists to make its investors as rich as possible. We are not
670−aware of our investors' ideologies. We are pretty confident that
671−they don't take precedence, ever, over turning a profit.
672−
673−As in any corporation, Tlon's employees work for its investors.
674−Those employees would have trouble conspiring in any political
675−sense, though. In 2016 election terms, two of us are for
676−Sanders, one for Clinton, and two for Trump.
677−
678−Now, in the long run, it's quite wrong for Urbit to be run by any
679−profit-oriented corporation, Delaware or otherwise. This is why
680−we've partitioned off 50 galaxies for a future Urbit Foundation.
681−Furthermore, the power of *any* central body in Urbit is designed
682−to wane over time. But we can't get ahead of ourselves in this.
683−Urbit, to create an effective and competent digital republic,
684−needs to move slowly and carefully in establishing it.
685−
686−<h2 id="horse">Urbit is sniffed at by Houyhnhyms.</h2>
649+## Urbit is sniffed at by Houyhnhyms. {% #horse %}
687650
688651It's difficult to categorize [this awesome
689652essay](http://ngnghm.github.io/blog/2016/06/11/chapter-10-houyhnhnms-vs-martians/)
690−a single bullet point. So I've saved it for last.
653+in a single bullet point. So I've saved it for last.
691654
692655When reading this essay, it's important not to forget the amazing
693656absence of genuine, mutually critical discourse in computer
694−science (as in most sciences today). You never hear what Swift's
695−designers think of Go, or vice versa. And critical public
657+science (as in most sciences today). You never hear what Swift's
658+designers think of Go, or vice versa. And critical public
696659discourse decreases, not increases, with increasing academic
697660legitimacy.
698661
699662The basic test of any field purportedly scientific in nature is
700663whether its researchers are genuinely interested in each others'
701−work, and willing to share these genuine responses publicly. If
664+work, and willing to share these genuine responses publicly. If
702665this practice does not exist, the field may still be useful
703−and/or interesting. But it is not science.
666+and/or interesting. But it is not science.
704667
705−What's awesome about Fare's essay is that he's *doing it right*.
706−All the actual details are irrelevant. And mostly wrong. But
707−that's of very little importance compared to *doing it right*.
668+What's awesome about Fare's essay is that he's _doing it right_.
669+All the actual details are irrelevant. And mostly wrong. But
670+that's of very little importance compared to _doing it right_.
708671
709672Anyway, we've already addressed the idea that jets are a sham.
710673Some other points:
@@ -712,11 +675,11 @@ Some other points:
712675### Event-sourcing and/or caching is a pattern, not a layer
713676
714677Fare' is perfectly right that "one size does not fit all" in
715−persistence. Generally, Urbit uses event-sourced persistence.
678+persistence. Generally, Urbit uses event-sourced persistence.
716679
717680But it has multiple layers of event-sourcing: in the definition
718681of Urbit itself; in the application sandbox vane (Gall), and in
719−the application itself. Urbit also has a completely orthogonal
682+the application itself. Urbit also has a completely orthogonal
720683revision control system (Clay).
721684
722685And there is not a single cache across the whole system, though
@@ -730,33 +693,33 @@ or feature, and equally fatal whichever direction you fail.
730693### Let's be clear about why DSLs suck
731694
732695DSLs suck not because they are difficult to newbies in the base
733−language. DSLs suck because every time a programmer, even one
734−*experienced* in the base language, comes into a new codebase or
696+language. DSLs suck because every time a programmer, even one
697+_experienced_ in the base language, comes into a new codebase or
735698project, she has to learn a new custom language.
736699
737−You need enormous wins to justify this cost. It's the goal of
700+You need enormous wins to justify this cost. It's the goal of
738701the base language designer to preempt these wins, creating a
739702language which is almost never so tiresome and full of
740703boilerplate that it requires a DSL or template layer.
741704
742705Hoon is almost entirely made of macros -- but they are internal,
743−fixed, built-in macros (with no gensyms). This fixed set of
744−macros is essentially enough. Occasionally we want to add one or
745−two. But we never, ever pine for context-dependent macros.
706+fixed, built-in macros (with no gensyms). This fixed set of
707+macros is essentially enough. Occasionally we want to add one or
708+two. But we never, ever pine for context-dependent macros.
746709
747710### Determinism is not consensus, and is not constraining
748711
749712Fare' is totally right that an urbit's data is meant for itself
750−alone. In fact, an urbit has the right to compute incorrectly if
751−it wants. We go to considerable lengths to ensure that you can't
713+alone. In fact, an urbit has the right to compute incorrectly if
714+it wants. We go to considerable lengths to ensure that you can't
752715gain any particular advantage by incorrect computing.
753716
754717The whole point of Nock is that it's so low-level that there is
755−no conceivable advantage in upgrading it. Divergence is just
756−pointless. This is not a question of network integrity, just of
718+no conceivable advantage in upgrading it. Divergence is just
719+pointless. This is not a question of network integrity, just of
757720practical standardization.
758721
759−This consistency stops at Nock. Without anyone violating the
722+This consistency stops at Nock. Without anyone violating the
760723correctness of their lifecycle functions, anyone or everyone in
761−Urbit could replace Hoon with Javascript. Determinism does not
724+Urbit could replace Hoon with Javascript. Determinism does not
762725cramp Urbit's semantic style in any way, shape or form.