ewillbefull

There's no absolute requirement for using Facebook to communicate with others over the Internet, so there's no sensible reason why they (or anyone else) should be compelled to host content they don't like.

Just because certain platforms are popular doesn't really change things from a legal or a moral perspective, and it might be because of their editorial discretion that they are popular in the first place.

> Banks, electricity companies, railway operators

These are bad examples in a discussion about speech protections... those businesses are providing services, not just engaging in speech.

Also, those businesses _do_ act to arbitrarily refuse to serve people. My bank sent me a letter last year saying that in ~10 days my account will be closed and they'll send me a check with the account contents. No reason, no appeals.

> The 'trapdoor' is in the protocol by design.

Only due to ignorance. It is well known that the bases of a Pedersen commitment can and should be sampled randomly; a trusted setup is only subverting the security of the primitive.

That's great! There are many issues with trusted setups that people aren't paying enough attention to.

There is nothing new about this article. The article is pointing out that in addition to the trapdoors of the proving system, it's possible to subvert the arithmetic circuit used as well. The ceremonies used by Zcash have the property that the parameters are perfectly bound to the circuit.

Not sure why this isn't mentioned in the article.

> This article is about the fact that there could be a backdoor, whose absence can only be proven by revealing all participants' toxic waste.

This is incorrect, as stated above. Instead of revealing their toxic waste, we reveal proofs-of-knowledge so we can use pairings to ensure the parameters encode the circuit correctly.

In our case, the use of grsec was one of the simplest counter-measures that achieved an almost purely additive security improvement. That's even when accepting the risk that grsec has security bugs in it.

If the participant did everything right, one of the only remaining ways that the secrets could be exfiltrated from the machine was by exploiting a theoretical vulnerability in xorriso, the software we use to read/write DVDs for airgapped communication in the ceremony. Even then, it was likely to leave an evidence trail on the DVDs for post-hoc review.

As an extra precaution, we needed to impose strict policies on the xorriso process. Grsec was trivial to employ using off-the-shelf Alpine Linux tools, and didn't require any dependencies which would increase the cost of auditing afterward. Grsec was also not likely to introduce bugs we couldn't catch in post-hoc review due to the evidence trail left on the DVDs.

The hope was to force an adversary to exploit both xorriso and grsec in practice. One important question is: was grsec likely to introduce a category of bugs that would not otherwise exist in Linux already? I think the answer to that question is no. Funny enough, just a day or two before the ceremony the Dirty COW vulnerability was patched in the Linux kernel, and we just managed to update our OS before the scheduled ceremony.

I'm Sean from Zcash, I coordinated the MPC and wrote the software. I messaged you on twitter or emailed you or something about this last year.

> it made it sound like I repeated the number uncritically

I didn't say you regurgitated it. I said the person you talked to did, presumably after looking at libsnark or an unrelated paper.

> The fact that competent experts could be unfamiliar with Zcash's crypto to the degree that they could disagree on basic facts like that is a sign of concern, precisely because it's yet another strong sign that the crypto is quite new.

I claim the person you talked to was looking at the wrong curve construction. 2^80 is quite a torch to carry into an argument and no experts that we know have ever suggested a security level less than 2^96. The only "disagreements" about security were far more subtle and reasonable than what your blog post suggested.

The protocol could not scale to a large number of participants at the time. Just with six participants it took an entire weekend to perform.

> To both yourself and the person you're replying too, please don't put words in my mouth.

What words did I put in your mouth? I cited the 2^80 figure in your blog post and a reasonable theory for why you would bring up such a figure. "Regurgitated" came across as snide so I apologize for that.

Note that you used this unsubstantiated figure to say "the fact that there’s disagreement is a bad sign." If there isn't actually any disagreement and the figure is unsubstantiated, why is it not baseless FUD? (BTW I notified you of this error in your blog post some time ago but never heard back.)

> what I said is that post-hoc review hasn't been done, even a year after the fact.

I know, I wasn't replying to you. As I said, I believe more auditing is needed. I also don't believe some kind of one-and-done audit of the software/deterministic builds would satisfy either of us.