Digital Signatures

[elf-pavlik]

Capturing very early just to let it brew slowly in our minds. Since we deal with agreements, trust relations etc. We need to make sure people can rely on technology they use. Some relevant work in this field which I follow.

• http://opencreds.org/ (see videos on the bottom of the page)
• https://github.com/digitalbazaar/jsonld-signatures
• http://manu.sporny.org/2013/sm-vs-jose/

More long term tools which can help people feel comfortable about their private keys, especially ones used for 'high stake' agreements/contracts.

• http://www.w3.org/TR/WebCryptoAPI/
• https://www.nitrokey.com/

[ahdinosaur]

the project in this space that i most support: ssb, which has an architecture that would allow digital signatures to operate at a layer below our vocab, i.e. everything is digitally signed by default.

[bhaugen]

I once saw a pattern that I like for conversations for action for contract formation and execution: each message in the conversation was signed and appended to the previous messages in a document that was sent as the next message. (Did that compute?)

In other words, at the end of the conversation, all of the messages in the conversation were included in a single document representing the whole conversation, and each of the participants had an identical copy.

[bhaugen]

If I understand this comment by @melvincarvalho correction, LOD does not yet have signatures?

But I do think as signatures get rolled into linked data, it will be an awesome advantage. What to do in the medium term is an open question. And I think we'll learn more as the system gets wider usage.

[bhaugen]

@ahdinosaur

the project in this space that i most support: ssb, which has an architecture that would allow digital signatures to operate at a layer below our vocab, i.e. everything is digitally signed by default.

Do you think it is feasible (and practical) to use ssb and LOD together? [Edit: seems like that could automatically implement that C4A pattern...)

[elf-pavlik]

https://web-payments.org/specs/source/ld-signatures/

has currently one implementation: https://github.com/digitalbazaar/jsonld-signatures which you can see in action on: http://json-ld.org/playground/

and I plan to help with writing rdf-signatures module for: https://github.com/rdf-ext/rdf-ext#modules

[bhaugen]

@ahdinosaur if you have time and patience, you could look at the conversation about signatures etc over on https://gitter.im/solid/chat right now. They are pretty far behind the ssb gang in thinking about this stuff.

[bhaugen]

they are still stuck on ACL's, too, or so it seems to me.

[ahdinosaur]

@bhaugen says: Do you think it is feasible (and practical) to use ssb and LOD together? [Edit: seems like that could automatically implement that C4A pattern...)

re-posting my response when you asked that question to me on Patchwork:

SSB in a nutshell:

• each user has a feed associated with a public and private keypair
• each feed is a linked list of message signed with the associated private key
• each message's content is a JSON object, which may be encrypted with the public key of the intended recipient

so it would be possible to use JSON-LD as the content of VF messages in SSB, but i wouldn't mind if we dropped the LD and just did VF messages as plain old (strictly structured) JSON objects.

related: Inter-Planetary Linked Data.

[bhaugen]

Let's say for https://github.com/valueflows/valueflows/issues/135 lots of people want to publish their economic profile and link it with a community (which would be sorta like a pub in patchwork). And then maybe eventually start to conduct economic conversations with their neighbors who have compatible outputs and inputs.

How they could do that via ssb or ipfs just using a browser? Or, what would be the minimum software installation requirement?

[ahdinosaur]

for the minimum, i'd forget dream machines like ssb or ipfs or rdf and instead just do it with django and sql like y'all know best. :wink:

[bhaugen]

The mythical vocabulator will be django, but will emit pdf in various flavors.

The mapping project needs to be more radically decentralized. Lots of people need to be able to publish their own economic profiles and be findable. Django won't work. Some further development of personator might.

[elf-pavlik]

so it would be possible to use JSON-LD as the content of VF messages in SSB, but i wouldn't mind if we dropped the LD and just did VF messages as plain old (strictly structured) JSON objects.

Does anyone uses graph data structures in SSB messages or everyone tries to structure the data as trees? #123

Do you have exmples of JSON data used by SSB which different implementations of client apps can create and display across implementations? How do you query that data?

[bhaugen]

Related: https://plus.google.com/u/0/+BernardVatant1/posts/5EKT5gg8S18

I'm currently trying to figure how the Semantic Web would be deployed using #IPFS identifiers instead of #HTTP #URI . As I understand it, IPFS keys identify immutable files, including versioning etc ... which is great for semantic persistence.

[edit: and he pinged @elf-pavlik on his question...]

[bhaugen]

Followup, link from Bernard Vatant's comment thread: https://github.com/ipfs/ipfs/issues/36

[ahdinosaur]

@elf-pavlik if you use Patchwork, you can see the data being used.

when i updated my avatar:

{
  "id": "%Wkoa9COh03VHE500dNU01w4Vv/UCBJt/X/UTzdNCVbU=.sha256",
  "previous": "%IMzcPvb8/Pk6SpBw9yoMkjT7dreMKSVgBGrBfh0YoAo=.sha256",
  "author": "@6ilZq3kN0F+dXFHAPjAwMm87JEb/VdB+LC9eIMW3sa0=.ed25519",
  "sequence": 731,
  "timestamp": 1465831077692,
  "hash": "sha256",
  "content": {
    "type": "about",
    "about": "@6ilZq3kN0F+dXFHAPjAwMm87JEb/VdB+LC9eIMW3sa0=.ed25519",
    "image": {
      "link": "&nhWyD+DsovdcW2NCo+r/PmFYes07TPhUGBN06w18bIU=.sha256",
      "size": 593785,
      "type": "image/png",
      "width": 512,
      "height": 512
    }
  },
  "signature": "ZZMEyH82KPiN/+6PRMDz3ZVF9E0SjDk0jenaiIgmIgWgX0ji5Zg2EIRzMCeVg/6FIORLWa/wd7HFpIW/C6VKAw==.sig.ed25519"
}

when Cel posted a new thread about "ssb stats chart: daily activity", includes a cool image blob:

{
  "id": "%5Byj8jIYpy9iYwRAMpn/ocla7aro86j1HsLzeaim/9o=.sha256",
  "previous": "%LanDqKPEa7aFC+GtjajIbachToKbXEtEFm6SuzoRMa8=.sha256",
  "author": "@f/6sQ6d2CMxRUhLpspgGIulDxDCwYD7DzFzPNr7u5AU=.ed25519",
  "sequence": 1274,
  "timestamp": 1465107126026,
  "hash": "sha256",
  "content": {
    "type": "post",
    "text": "# ssb stats chart: daily activity\n![daily activity.png](&HqwNIOc0tOpPeJKr6Isx6fiMIrIdmIe0h528kR25ikc=.sha256)\n\nEach column has a colored pixel for each user that made at least one message with a timestamp from that day. Each user has a unique pixel color. In the [interactive version][demo], you can hover over a column or a pixel to see more info about a day or a user. [Source][]\n\ninspired by the [loomio cohort retention graph](%GopD9kch16uQzq1qVBRei7mNMJy1IN987MXFhXmGQuI=.sha256): cc @mixmix\n\n[source]: https://github.com/ssbc/ssb-usage-stats/commit/95e9cda7988ef7638d4a8160e74db0269617d5fc\n[demo]: https://celehner.com/ssbc/stats/daily.html\n\nalso, congrats to #campJS for getting the most people on patchwork at once so far",
    "mentions": [
      {
        "link": "&HqwNIOc0tOpPeJKr6Isx6fiMIrIdmIe0h528kR25ikc=.sha256",
        "name": "daily-usage.png",
        "size": 7632,
        "type": "image/png"
      },
      {
        "link": "%GopD9kch16uQzq1qVBRei7mNMJy1IN987MXFhXmGQuI=.sha256"
      },
      {
        "link": "@ye+QM09iPcDJD6YvQYjoQc7sLF/IFhmNbEqgdzQo3lQ=.ed25519",
        "name": "mixmix"
      }
    ],
    "channel": "patchwork-meta"
  },
  "signature": "a8whqR7mqv3/o/8n7eLGglN+wMZnBtOQTVHoG02RFfOkhkypmESxQ5cIJaWBTY3KZjvKCbjLhScdGpI3e0uJBQ==.sig.ed25519"
}

reply by Mix to above post:

{
  "id": "%j5tdf1++8mkr4MWc91XeehhsKwCEEnIGbfgK/Uak3Qc=.sha256",
  "previous": "%i8qT7jfUuOGKELDf7X610MtZOP85RvVtdAZ+VxArASQ=.sha256",
  "author": "@ye+QM09iPcDJD6YvQYjoQc7sLF/IFhmNbEqgdzQo3lQ=.ed25519",
  "sequence": 3044,
  "timestamp": 1465107591007,
  "hash": "sha256",
  "content": {
    "type": "post",
    "text": "<3 \ncredit goes to @simontegg for that early loomio graph I think",
    "root": "%5Byj8jIYpy9iYwRAMpn/ocla7aro86j1HsLzeaim/9o=.sha256",
    "branch": "%5Byj8jIYpy9iYwRAMpn/ocla7aro86j1HsLzeaim/9o=.sha256",
    "mentions": [
      {
        "link": "@JkvRmp8juumHPgq1h+yVDKfHkQlQOa2Mwlg//NhauEE=.ed25519",
        "name": "simontegg"
      }
    ],
    "channel": "patchwork-meta"
  },
  "signature": "VLwDErHNwwVvXpBJUp7/KhSnGveZQ1JvbzfFs+t4tH///zdI+FBUVvFEXSfpCfHoACbrOfgPs/HnJ4K37aiEDQ==.sig.ed25519"
}

super secret message from Dominic:

{
  "id": "%nM6RTOjHefYOJ60iDYqZ4UcnPiOlgrqfRc7EvACoYMk=.sha256",
  "previous": "%05mqD8r+ydcmRJNn9xI23bHuYplsHta/WKTid0Ety8o=.sha256",
  "author": "@EMovhfIrFk4NihAKnRNhrfRaqIhBv1Wj8pTxJNgvCCY=.ed25519",
  "sequence": 2654,
  "timestamp": 1465879364787,
  "hash": "sha256",
  "content": "mQgbNBMcbC1FdF8qMMddnEwU62A4SEcSWxj32XGo/uh7E1nWXQadq/i04TvI3SLhfIgG5b0lNQwaYxC8oe/MzOv7v5S4ERLdo0wfeeAkRiMTP09c5crDQI9Wdk7GnV3DRg2AMkwJvpRmHh2NgGYO8s/1hcOHw3p2xavjebNxcTm7JQU+pBz3epqTxW+YPcyVl81hTZXeID+arQpIhKjf1vafyGmYyphJh6ZV1bKcu8VCySk1LptqKuqpPKCj/G3I6m5JypULcgIEVBZjGF7CAkeJ2cMJwxdVf2ZjrDETBa4VjhTyrkX2t/a5NFAA3cxQeybTtP0ke4M49wzONnxcqfLij+GAuRkSKE2NHqYdSfgGXO9gHFunMWAk/4Adgx+kPr4YilKYF26lWQsZNLdkrWxdI2MCGNp626gkpPX5hlVcUdl9Vq35hJ99mfJqsLbI5zBjFoJreftIX9exl4bGxixs4T4q5ZB8qPTLG0OHbFjyOoSE5VnSCQXKv5oMGG3aNEJr/vVeof12Vntdr046KkmtiMFGzV8n34ZbEurysmtrL3I1VFpX6xQI3RPCH/14ggxZu9dus8CQcn6VMmf4hgXHI6wl/Zh1+EEkl4/9EOFnrC1pelUXfy319Z0JxkgDsMYJ+LrbPNbYC/MHiGACKcE04B0v10lncHKRle4CRnAa6DlFO8Pc8JNlFmjV7XDuq4BB0hkikbFS72wR8e+6DscSq2HOFVniZqIKygp14m4/0mbHNEllGttq+fjjFx3kAh6s8As5+JcGM60zLFeG8n0dIh/L9i72/vylQDaOdkwXAwx4+heyOXOW17Aytx02JB6X22L3DyTcs2/L1PRcvUNyGIBcE9E4uFFLKWpLAOyaNTme52VP5CkSrRMVPouGqa8is2vn+yb8/V2zEpGDo8mKqikagYjfIvg9Yq4NuA==.box",
  "signature": "VgM0sZrLwJU+64MrC/FSCeQlPrrEzm9Kh7AUlfNIjpIfym33jo7GkQWreYqtHc47/F9bXvzE1Fbbeoq0DgV7Bw==.sig.ed25519"
}

here's a message meant for git-ssb (a re-implementation of git and GitHub using ssb), but shows up as a JSON object within the Patchwork interface:

{
  "id": "%hcwi8D0JLb5/uBLJ8+r1/xLRttMm6tCGtLZSf00A6kU=.sha256",
  "previous": "%GTfts8EFs1rM4eWV2gUSfC0w7xxsi885aKmYz+chcJ8=.sha256",
  "author": "@KSW+Uwrc1wLzaCjJF8MZZl+wmw1P1LgB3ANiLbgS454=.ed25519",
  "sequence": 22,
  "timestamp": 1465883791460,
  "hash": "sha256",
  "content": {
    "type": "issue",
    "project": "%q5d5Du+9WkaSdjc8aJPZm+jMrqgo0tmfR+RcX5ZZ6H4=.sha256",
    "title": "Issues ought to flow from bottom to top",
    "text": "Shouldn't new issues be at the top of the list instead of the bottom?"
  },
  "signature": "ztGA7Rzlp08z7jjX/8xTsZWI/P8sXO3rMeYdd4JbVVwFoW1tAvWtgDOHNLVSuv9SkwOVesRXfne5kXxzuu2DAw==.sig.ed25519"
}

so it's all graphs, every message can have links to other messages, agents, or blobs, but using strictly structured JSON objects.

you query ssb using ssb-links, which builds on map-filter-reduce, which builds on streamview.

[elf-pavlik]

If I want to just display 200 cards of people (eg. list of group memebers), do I have to fetch full 200 feeds just to know their latest avatars? I got impression that you don't edit old messages but always post new one with update.

Do you know some web app which would resolve SSB links and fetch data that they point to?

[ahdinosaur]

@elf-pavlik anyone can post a message about anyone, so i can set my name or avatar for you. but yes, to get messages created by any user, you must replicate their entire feeds. by default, you are replicating the feeds of those you follow and those who they follow (friend-of-a-friend / two degrees of separation), so as with most common social networks as long as you're friends with a super-node, you're good. there's talk of being able to ask specific friends for a specific message, in order to fetch missing messages within a thread, but it's still not a global fetch. you're also right that each feed is append-only, you can only add new messages.

Do you know some web app which would resolve SSB links and fetch data that they point to?

@mixmix tried this with porthole, is out-of-date by now.

[almereyda]

We have moved the ValueFlows organization from GitHub to https://lab.allmende.io/valueflows.

This issue has been closed here, and all further discussion on this issue can be done at

https://lab.allmende.io/valueflows/forum-valueflo-ws/-/issues/23.

If you have not done so, you are very welcome to register at https://lab.allmende.io and join the ValueFlows organization there.