learn-blockchain-with-phoebe / Leader session 6 of 6
Learn Blockchain with Phoebe · Leader session 6 of 6

Deciding whether you need one

The question is not whether a chain works. It works, precisely and narrowly, in the way the five sessions before this one described. The question is whether the narrow thing it does is the thing your situation needs, and there are four questions that settle it faster than any pilot. Most registers fail at the third question and should be a database. A few pass all four, and for those a chain is not a fashion, it is the cheapest way to stop an argument about whose copy is right.

🟡 Foundations Anyone being sold a chain Anyone who has to sign off on one 45 min
0-3 · Welcome 3-20 · The four questions 20-28 · The argument, and what to ask 28-45 · Build-along and Q&A
Part 0

Neither a debunk nor a pitch

Two failure modes face each other across most boardroom tables. One is buying a chain because the word carries weight, for a register that one organisation keeps and everybody already relies on. The other is refusing one on principle, in a situation where three parties are arguing about whose spreadsheet is authoritative and a shared history would end the argument tomorrow. Both are expensive. The way out of both is a short list of questions that can be answered without a proof of concept.

Live = presented in the 45 minutes Self-study = the full depth, after class 🔍 Every diagram zooms

★ What you walk out with tonight. Four questions you can put to any proposal in ten minutes, with the honest answer attached to each way they can go. A clear view of the one argument in this subject that is genuinely unsettled, so you can recognise which side the person opposite you is on. And four questions to ask a vendor, chosen because the answers are hard to dress up.

LiveWhat is actually being compared4 min▶

The comparison is almost never chain against nothing. It is a chain against an ordinary database with access control and an append only audit log, which is a mature, cheap, well understood thing that most organisations already run. Stated that way, the chain has to earn a specific difference rather than a general feeling of rigour.

The difference it earns is this. An audit log inside one organisation is kept by the same administrators who run the system it audits, so it answers the question "did somebody outside change this" and cannot answer "did we change this". A register that several independent parties hold and check can answer the second question. Everything else in the decision follows from whether the second question is one you actually need answered.

Real world

Harbourgate's six entries are worth protecting because a buyer, an insurer and the port authority may one day disagree about the seal on consignment 42. If the port authority were the only party that ever read the register, the same six entries in a table with a locked audit log would serve just as well and cost far less to run.

Self-studyThe words that will keep coming back4 min▶
  • Trusted keeper. A party all participants accept as the custodian of the record. Where one exists, most of the argument for a chain disappears.
  • Audit log. An append only record of every change made to a store. The direct competitor to a chain, and usually the right answer.
  • Permissioned register. One where a named group runs the machines and decides who may write. Most enterprise proposals are this shape.
  • Open register. One anyone may read, copy and add to. A different set of trade offs and a different set of problems.
  • Governance. Who can change the rules: the software, what counts as a valid entry, who is admitted. The question that decides what a register really is.
  • Point of entry verification. Whatever checks a fact before it becomes an entry. Without it, a chain preserves unchecked claims perfectly.
  • Operating cost. Several parties running machines, agreeing on upgrades and holding keys, forever. Rarely in the business case and never small.
Part 1 · covers the decision path

Four questions, in order, and the first no is the answer

17 min live

Each question comes from something already established. Whether a history has to be shared, and whether anyone accepts a keeper, came out of who agrees and how. Whether the threat is a participant rather than an outsider came out of the three stage attack. Whether entries can be checked as they arrive came out of the oracle problem. They are in this order because the earlier ones are cheaper to answer.

Answer in order. Stop at the first no. QUESTION 1 · IS THE HISTORY SHARED Do several parties who do not fully trust each other need to share one history of the same events? IF NO One party, one history. An ordinary database is the whole answer. YES QUESTION 2 · WHO IS THE THREAT Does anyone need to detect tampering by a participant, rather than only by an outsider? IF NO Outsiders are a perimeter problem. Access control and backups, not this. YES QUESTION 3 · IS THERE A KEEPER Is there no party that all of them accept as the keeper of the record? IF NO, SO SUCH A PARTY EXISTS Use them. A database, access control and an audit log, at a fraction of the cost. YES QUESTION 4 · CAN THE ENTRY BE CHECKED Can the thing being recorded actually be verified at the point where it is entered? IF NO Unchecked claims get preserved, not checked. Fix the entry point first. YES FOUR YES ANSWERS, AND A SHARED CHAIN IS THE REASONABLE ENGINEERING CHOICE Several suspicious parties, no keeper any of them will accept, and entries that can be checked as they arrive. A shared history every party holds ends the argument about whose copy is authoritative, which is what it is for.
🔍 Click to zoom - the questions are in cost order, so the cheapest one to answer is also the one that eliminates most proposals.
Live Answer for a register you actually keep. The first no decides it.

1 · Do several parties who do not fully trust each other need to share one history of the same events?

2 · Does anyone need to detect tampering by a participant, rather than only by an outsider?

3 · Is there no party that all of them accept as the keeper of the record?

4 · Can the thing being recorded actually be verified at the point where it is entered?

...

Nothing here is scored and nothing is weighted. The path reads in order and stops at the first answer that settles it, which is also how the conversation should go.
LiveQuestion three does most of the work4 min▶

Most proposals die here, and they should. If every party involved already accepts one organisation as the keeper of the record, that organisation can run a database, restrict who writes to it, keep an append only audit log, and hand out read access. It is cheaper to build, cheaper to run, staffed by people who already exist, and understood by every auditor who will ever look at it.

Saying so is not cynicism and it is not a lack of ambition. A chain removes the need for an accepted keeper, at the cost of coordinating several operators forever. Paying that cost when the keeper exists and everybody is happy with them is buying a solution to a problem you do not have, which is the most common way these projects fail.

LiveThe case where it genuinely is the right tool4 min▶

Now the other direction, at full strength. Take several organisations with real commercial tension between them, each holding a piece of the same history, none willing to let a competitor or a counterparty hold the master copy, and a regulator or a court likely to ask one day whose version is correct. That situation is not solved by better spreadsheets. It is solved by a shared history in which each party holds a copy, every entry is hashed and linked, and a rewrite by any one of them produces a version that disagrees with everybody else's.

What that buys is specific: the argument about whose copy is authoritative stops being an argument. Nobody has to be trusted with custody, because custody is not held by anyone. In a situation with that shape, a chain is the cheap answer and the alternatives are the expensive ones, and the people who dismiss the whole subject as hype are wrong about this case.

Self-studyWhy a database with an audit log is not automatically enough4 min▶

The steelman for the other side of question three deserves stating properly. An audit log is a record kept by the same administrators who run the system it audits. It answers the question "did somebody without access change this" very well. It cannot answer "did the people who run this change it", because whoever can rewrite the data can generally rewrite the log, and if they cannot, they can ask the person who can.

So the keeper has to be accepted, not merely nominated. Test it by asking the other parties, not the keeper. Where the answer is that everybody genuinely trusts them, the audit log is enough. Where the answer is that everybody puts up with them, question three is a yes after all and the proposal is alive again.

Part 2 · covers the argument, and the vendor

The part that is genuinely unsettled

8 min live

There is one live argument in this subject that competent people have not resolved, and it is worth knowing both sides rather than picking one and defending it. It is about whether a permissioned register run by a named group of organisations earns the complexity it costs.

Two serious positions on permissioned registers The complexity is earned No single participant can quietly revise a history that every participant holds and checks. An audit log inside one organisation is kept by the same people who run the thing it audits. Where that asymmetry is the actual problem, no amount of database hardening removes it. The cost buys one property nothing else provides. The complexity is not earned Most registers described as multi party have one organisation everybody already relies on. A permissioned register with a controlling group is a database with more moving parts and more people who must agree before anything changes. The point of entry stays the weak link either way, so the accuracy of the record is unchanged. Both positions are held by serious practitioners, and the disagreement is about how often the first case is real. Which one applies to you is a question about your situation, and the four questions above are how you answer it.
🔍 Click to zoom - notice that the two sides agree completely about the mechanics. They disagree about how common the situation is.
LiveBoth sides, at their strongest4 min▶

The case for is that a property exists here which nothing else in ordinary engineering provides: a history that no single participant can revise without every other participant seeing a disagreement. Where several organisations must share one record and none of them can be the custodian, that property is the requirement, and the coordination cost is the price of a requirement rather than an overhead.

The case against is that the property is real and the situation is rare. Look closely at most multi party registers and there is a dominant organisation everyone already deals with, a controlling group that can change the software and the membership, and an entry point nobody has hardened. At that point the register has the coordination cost of a chain and the trust model of a database, which is the worst of both.

The honest position is that both are right about different cases, and that the disagreement is about frequency. Anyone who tells you their side applies universally is selling something, in either direction.

Which brings the six sessions to the only artefact that survives contact with a sales meeting: four questions whose answers are hard to dress up, because each one has a concrete thing that has to be named.

Four questions for whoever is selling WHAT TO ASK WHAT YOU ARE LISTENING FOR What exactly is on the chain? A hash of a document, or the document. A pointer to a file on somebody's server is a register that guarantees nothing at all about the file. Who runs the machines that hold the copies? Names of organisations, not a count of nodes. Copies held by one operator in three regions are one copy, for every purpose that matters here. Who can change the rules? Somebody upgrades the software, decides what counts as a valid entry and admits new writers. That group is the governance, whatever the diagram says. What happens when an entry is wrong? If the answer is that it cannot be, the answer is wrong. Ask to see the correction procedure, and how an ordinary reader finds the correction. Four plain answers are worth more than any pilot. Taken together they tell you whether what is on offer is a shared history or a database with extra steps.
🔍 Click to zoom - each question has a concrete noun in the answer, which is why they are hard to deflect.
Self-studyWhat would actually settle the argument4 min▶

Both camps could be moved by evidence, which is a good sign that the disagreement is real rather than tribal. The case for would be strengthened by registers where a participant did attempt a revision, the other copies disagreed, and the disagreement was caught and acted on. The case against would be strengthened by registers that ran for years, produced no such event, and were quietly replaced by a database with no loss.

What neither side is short of is opinion, and what both sides are short of is that evidence published in a form anyone can check. Until it exists, the four questions are the tool: they replace a general argument about the technology with a specific argument about your situation, which is the only argument that can be settled.

Part 3 · build-along

Run the path on something real

17 min hands on

No code. Six steps on a proposal in front of you now, or the register you have been carrying through the earlier sessions. The output is a written recommendation with its reasoning attached, which is the thing that survives a change of sponsor.

Name the parties

List every organisation that would hold a copy, by name. Then mark the ones who would actually check it rather than store it. A copy nobody checks provides nothing, and the marked list is your real answer to question one.

Find the keeper, or prove there is none

Ask each party who they would accept as custodian. Ask them, not the candidate. If a single name comes back from everybody, write the recommendation for a database with access control and an audit log and stop there.

Say who the threat is

Write down whether the worry is an outsider or a participant. If it is an outsider, say plainly which control addresses it, because it will not be the register.

Check the entry point

For the two or three most important fields, say what checks them before they are recorded. If the honest answer is nothing, fix that first and note that the register would have preserved unchecked claims perfectly.

Put the four vendor questions in writing

Send them ahead of the meeting rather than asking in it. Written answers are harder to improvise, and the difference between the written and the spoken answer is itself informative.

Write the recommendation, either way

One page. The answer to each of the four questions, the recommendation that follows, and the honest claim about what the chosen option does and does not guarantee. Whether the recommendation is yes or no, the reasoning is the valuable part.

The habit to keep. Ask what would have to be true for the other recommendation to be right. If you are recommending a database, say what would change your mind. If you are recommending a chain, say the same. A recommendation that cannot describe its own opposite has not been thought through.

Check yourself

Three questions

Three organisations share a record, and all three already accept one of them as the custodian. What is the better engineering answer?

A chain buys the removal of the custodian, at the cost of several organisations coordinating forever. Where the custodian exists and is genuinely accepted, that cost purchases nothing. Test acceptance by asking the other parties rather than the candidate.

A proposal passes the first three questions, but nothing checks the values before they are recorded. What follows?

Comparing copies detects disagreement between copies, not disagreement with the world. Every party would hold an identical, perfectly verifying copy of the same wrong value. Accuracy is decided at the point of entry and nowhere else.

A vendor says their register has forty nodes. What is the follow up question, and why?

Independence is the property being bought, and it is a property of who operates the machines rather than of how many there are. A count is the easiest number to make impressive and the least informative one, so ask for names.

Before you sign anything

Homework

Thirty minutes, and it is the work that makes the six sessions pay for themselves.

Write the one page recommendation

Four questions, four answers, one recommendation, and the honest claim about what it does and does not guarantee. Put a date on it, because the answer to question three changes when relationships between organisations change.

Send the four vendor questions

To whoever is selling, in writing, before the next meeting. Keep the replies next to the recommendation. If there is no vendor, send them to whoever internally is proposing the build, which is the same exercise with less politeness required.

Covered tonight

What this session covers

✓The four question decision pathShared history, who the threat is, whether a keeper exists, and whether entries can be checked.
✓When a database is the better answerAn accepted keeper plus access control plus an audit log, and why saying so is not cynicism.
✓When a chain genuinely is the right toolSeveral suspicious parties, no acceptable custodian, and entries that can be checked as they arrive.
✓The argument that is not settledWhether permissioned registers earn their complexity, stated at full strength on both sides.
✓Four questions for a vendorWhat is on it, who runs the machines, who changes the rules, and what happens when an entry is wrong.
◐Doing all of it by handHashing, building, breaking, mining, proving. The practitioner track, starting with p1.
○Key management, rotation and certificate hygieneA discipline of its own, covered in the security and access control courses.
○Named commercial chains and their roadmapsThey move faster than a course can, and none of the decision depends on which one.
Take this with you

Cheat sheet

Question 1. Do several parties who do not fully trust each other share one history?
Question 2. Is the threat a participant, or only an outsider?
Question 3. Is there no party all of them accept as keeper? This is where most proposals end.
Question 4. Can the entry be verified at the point it is made?
The usual answer. A database, access control, an audit log. Recommending it is not cynicism.
The real case. No acceptable custodian, and the argument about whose copy is right needs to stop.
The open argument. Whether permissioned registers earn their complexity. Both sides are serious.
Ask the vendor. What is on it, who runs the machines, who changes the rules, what happens when an entry is wrong.