zkSummit - ZK0x02 - Park Bench Panel

Transcript

all right what did we have going back we have some questions so we try to be a little contentious since this is the price the topic of this entire event was your knowledge and privacy we thought we'd dig a little into privacy and see if anyone here has some opinions and if anyone out there has some opinions on and this is a classic I wonder if this will work why would you want privacy if you have nothing to hide you know terrorist this data is view of all information wanting to be free and

out in the world is not by any means to be condemned and is probably something we all share to some degree but I think we probably also can relate to the reality that different ideas perhaps more radical or curious ideas emerge in the presence of privacy so it's not that IIIi don't know anybody that wants for example important and compelling data that needs to be private today to still be private in ten thousand years when it is the subject of compelling anthropological research but we know that good ideas take time to incubate

and they take time to incubate in private and if there's a sense that the state is watching or that corporations who have a contrary interest to our own or watching then I think we know that our perhaps playfulness and and childlike wonder that's accompanied some wonderful ideas might be stifled during that time so I think privacy is important during the period when ideas incubate and grow to become great so I really can't relate to the question at all like I have so many things too high like okay can I ask a follow-up then so at what point is it not like think

that's that's a you sort of defined like there's a time where things need to be private and then there's a time where they aren't what defines that and who defines that so for me a lot of this is how I present myself within different social groups we're here and like we're a bunch of crypto people talking about crypto and privacy and nobody needs to know about any hypothetical irregular birthmark on my back right like it's just not what if we want to know it's not important or relevant to my identity as a human being within this particular group and a lot of things that I present to the group are not important to my family they don't really care about ZK snarks or Bitcoin or things like that

privacy is a lot about controlling the information that we share with groups right I project an identity I'm a pretty cool guy named James and you know I want to be able to curate my identity even when you know it's relatively innocuous things I want to be able to control what you know about me because I'm trying to present an image to you so I think my view on this is pretty similar to psychedelic mark hamill here where'd like Justin oh yes I could Alex AK out of Quebec this is good as well so

anyway yeah I think my view is pretty similar to yours Justin that I think that exciting that if you have nothing to hide you have nothing to fear is a very utopian view if you have if you have nothing to hide you can still absolutely have things to fear I mean like in the if you live in like I don't know some small very conservative town you probably don't want to come out about the fact that you're trans for example not because being trans is wrong not because you want to hide this fact from from people who might accept it but because you might suffer the threat of violence but and then of course at the state level I mean I think probably in

this conference more than any I think a lot of people would say that many currently illegal drugs like there's nothing immoral about taking them for example but you may suffer state violence as a result of taking them like police raids on your home etc and this is actually like a real-world use case of privacy and cryptography is paying for illegal drugs I'm gonna cut you off at some point yeah I think basically like made my point okay I can just keep ranting like you got it you didn't answer sir sure I'll take this in a little bit of a different direction so I think that right now the world is marked by this profound loss of control over your own private data and that I'm not entirely certain that it's possible for

any person in a practical sense to keep information about themselves private in 2018 and that I only see that getting worse and worse going forward so I think in a number of small use cases like cryptocurrency maybe due to the efforts of people in this room will have an ability to pay for drugs that are private but all the other details that surround that aren't going to be something where you can ensure that other people don't find out so I kind of wonder whether privacy is this moment in moment in history rather where we are currently living at the end of it and that going forward there just isn't any left so I think that like really quite so for instance talk about DNA data everybody's really concerned about their their DNA becoming public or getting abused by other firms but even if you're

not submitting that information to say a 23andme or an ancestry com there's still routine medical procedures that everybody goes through and there are health care providers that aggregate that information and it's only a matter of time until enough of them get breached that everybody's DNA data is public on the internet all of the time and you can't go back from that so what do you do you have to start designing systems or making regulations and laws that deal with the future where most of the information is public about most of the people all the time well so that's my take on that oh you want to take this guy all right audience questions who has a question or a comment it doesn't have to be on this

topic can be any question how can this current state of cryptocurrency security be reasonably more secure than it is today how can cryptocurrencies security be more secure than it is today so I think that a lot of the tools that we're building with our first generation there's somebody's a rough cut of what a compiler looks like to build a smart contract there's somebody's rough cut of what you know software looks like to build a blockchain and I haven't seen a whole lot of really serious study about things beyond just the consensus algorithms that we use to you know negotiate consensus across a giant distributed protocol I think that there's a huge amount of room to gain

from my topic you know I'm particularly interested in smart contract security of just let's take another take at building a compiler on top of reasonable components like LVM and instead of come up with our own buy code language use something that already exists that's fit for the purpose so that unfortunately takes a lot of effort and there's a nurse in the community to stick with what we've got but every other field rediscovers a new language every year whether it's go swift rusts or typescript or and everybody creates new crates and new libraries for those things quite rapidly I don't feel like we should tie ourselves down and refuse to be nimble and break with the past to get something better in the future I

think that's the main thing that holds people back so a lot of other fields do iterate quite rapidly but cryptography and other high security applications iterate very slowly we've had open SSL as a standard for quite a long time and you've seen like NaCl lib sodium based stuff coming up but overall like cryptography and high-impact applications move pretty slow I don't know if we want block chains to be rapidly at sure so I think you could split that in two halves I do agree with you on the cryptography part take slow consistent steps forward and verify appropriately I

think there's other parts of it that you can break down like I would love to just rewrite this a little decompiler from scratch and I know I could do it and it would be fine but like yeah no I like it it's not a high assurance piece of code and you have reusable reliable underlying components that you can build with you know the LLVM team has done some amazing things with it so yes I think you're in a different position when you talk about like how do we deploy ZK starks on a broad scale or how do we you know more efficiently build them you probably don't want to dive into it oh wait wait before we you I think there's some other people who need to answer so yeah I think your point about research is is

quite good like I think there is quite a lot of research in the sort of privacy and zero knowledge proof so I mean that's what a lot of the talks here at being about Africa's reasons true I mean the well the the Z cache and I think mostly the Z cache team has been doing a lot of really good work implementing sort of a lot of the ideas that be coming out of it yeah I think that like a lot of the privacy tech is sort of like vaguely floating around in the research space without like a good solid implementation but like the same was true of Bitcoin like the components of Bitcoin we were floating around for a long time sort of blockchains and proof of work and this kind of and like applying that to currency these things

all we're all existed before Bitcoin but they needed a practical implementation before they took off I think the same is true for a lot of the privacy tech that we have where like these these ideas have been floating around for a while with like some amount of smaller scale implementations but it's gonna take like some inflation a photo ID really take off them out of that maybe Zee cash is that I don't have any association with Ozzy costume so I can't tell you but I mean okay how do we make essentially the security aspects of cryptocurrency more secure I think if anybody tells you they know the so they're probably trying to sell you something I think there's one thing though that I think is pretty obvious we

could start all treating each other like adult citizens of the Internet one thing adults are allowed to do is sign contracts I don't know who else is with me but I think that if you want to sign arbitrary bytes with your aetherium keypair there needs to be tooling for that I think it's ridiculous if that still does not exist all right questions I an opinion on that question I think we should have a lot of huge bounties so for example if you find maybe we should do this I think if you find a way to forge sea cash you know like a hund and you disclose it to us $100,000 prize or

$200,000 prize and I think there should be a lot of stuff like that all right you just made an opinion friend who do we knock off okay so that was an opinion do we go for another question then well we get the other panelists response to that opinion oh there's an opinion festering right I I agree somewhat with the idea that bug bounties are really important especially in the sort of high reliability world of crypto I think so our work Power Team will be trying to have some market our founder shirt this isn't a minimal techno label this

is this is a blockchain company it might be quite hard to tava so a little bit I don't know if to ask someone who actually knows about the party theme plan but there's a I don't know how much feedback we've had from the from the bug bounty does is there any other parity people who know more yeah almost none almost none right exactly I think that just the fact that it's not established is is like this that there aren't that many bug bounties in the crypto world I think already that's one problem plus the fact that like the

bounties for forging for example Z cash are so in like immensely high the the there's very little bug bounty that any one party could give that would counteract there and I think like apples having the same problem where like the the the cough there so the how money you could get from creating a bug or finding a bug in like the kernel of Mac of Mac OS is is so high that there's very little they can do to actually create a bug bounty that the offsets that cost oh I don't know bug bounties seemed to me I mean although it's hard to argue with the reality that they sometimes work

well they seem to me to be kind of stuck in the old orthodox financial notion that exactly one person is responsible for compelling change in the world and we know i i'm you know if you work in software at all or i imagine if you were invent in any space you know that typically when there's a good idea there are several parties that contemporaneously come up with that same idea around the world and so I think for bounties to be meaningful they need to transition to some way which I've not yet been able to imagine that rewards contemporaneous invention by disconnected parties you know independent parties around the world in different languages and in different

cultures and you know I tend to agree with you but I'm I was thinking along the same lines of him it's if I have a bug that lets me for Jersey cash I can over time just withdraw up to all the shielded you know easy cash ever with nobody noticing so it'll set me up for a few decades probably if if you can put together like a 10 million dollar bug bounty I would they consider it though cool we need a question so I actually had an opinion on this if that's okay go for it all right so I work at the etherium Foundation and right now we're ramping up our bounties program not within the foundation itself

but within the ecosystem with people like the bounties Network and the honey is another name for one but basically we have things like our testing team has one tester right now because a few of them had to leave so we put up a bounty for people to make you know client consensus tests etc and people are flocking to it it's actually working out so when you're talking about bug bounties for individual things within a project it actually is seeming to work so far as long as you incentivize it correctly and you make it properly it like sued anonymous for bounties for like major client bugs and things like that that is much more difficult I agree with you guys cool your your off sorry welcome you could you can always come

back on if you have some other opinions do you guys want to talk about that or you can also just pass so I think that this is a pretty delicate balancing act because with if you can fake snarks obviously there's not enough money out there to incentivize revealing that bug when we're talking about testing it's all like really low value very basic you know consensus tests it's a lot of what programmers would consider grunt work but then I think that's a really good use case the other like end of the spectrum that is also bad is like the file coin bounties they put a hundred

thousand dollar bounty on a major cryptographic problem that would require a grad student researcher several months to solve and for file coin who has hundreds of millions and is asking for mission critical software mission-critical cryptographic structures well the the space is trying to under pay researchers and engineers pretty drastically I think there's a lot to be said for bounties but we need to re-examine how we approach them and I'm glad to hear that the etherium foundation is having success so I think what you're saying that you had success with the sort of low-level writing tests and what you were talking about with the fall coin bounties I think they're more

like implementation bounties where there's sort of like they know what work needs to be done they can measure the amount of they they can estimate the amount of time that would take and they can sort of estimate the amount money that that would translate to I think that's quite separate to a bug bounty of if you find a bug you can get this amount of money which are a lot that they are a lot harder to sort of estimate the the correct sort of financial incentives there because you don't know what the bug is really I mean you can tell you can you can price it per area of bug B even the impact like you would only get so coarse-grained I think that maybe the implementation bugs are like a lot simpler and saying that

something works as implementation as an implication bounty maybe doesn't necessarily translate to success for bug bounties yeah I just want to add in terms of purely financial gain you yeah you couldn't make a bounty high enough that it would be better than exploiting a forgery bug but I'm guessing typically it will be like a person who's at least kind of a good person but has also some temptation in such a case I think okay maybe it shouldn't be a high major you

two hundred thousand three hundred thousand you know it should be high enough that for a reasonably moral person who is not an angel he would prefer that path than to exploit the forgery okay questions let's see the hands give some new people a chance well even if you'd gained like 10 million from exporting the bug then that 10 million in your life as a real-world person would be very difficult to cash out and it will be very difficult to wonder that so it would be better to report it to a book bounty that would give you at least let's say 500,000 or

maybe 1 million I mean there is that notion of dirty money and how do you wanna dirty money versus clean money right opinion yeah ok James oh you're up you always come back up oh so many bottles this is what happens when you introduce beer now you know you can't say it yet I'm sorry I know it's other thoughts on this comment so never discount altruism there's a lot of people in this room who could break a lot of and then we'll fix it

without getting any bug bounty so there's a lot of good people in the world however that's super optimistic and there are people who would steal as well so for those people it's not always dirty money in fact I'm not super technical but can someone confirm that like if the bug was found and Z cash and they were to exploit it they could get away without people knowing the coins were minted is that correct for the most part ok so yeah if that happens then we're screwed so yeah but I think another question is it clear that it would be illegal say you find some something in the code that enables you to forge a trillion dollars is it clear that there's any law against it yeah do you have an opinion there

there's a question that comes so he's voiced his opinion you voice in and then we have another question I don't think you could make it there's very few arguments you can make that that would be illegal right like it's the the crypto space is still pretty unregulated even though I cos have had some attention recently and like security by sending the police to your door is not a very reliable or trustworthy form of security by just saying that something is secure because it would be illegal to break the security is not very convincing and does not inspire trust because you know it's its security that can be defeated by a crazy man with a

big gun or at least them yeah okay questions so for bug bounty so I feel like there's two really important questions to get everybody on the same page that need to get answered the first one you hinted at which is do you think that a bug bounty being available changes someone's behavior from bad to good and then the second is do you think that bugs in say cryptocurrency clients are sparse or dense because I think that whether they are sparse or dense determines the strategy for bug bounties being effective or he he almost had a question no we give it to what do we what do we say I'm leading the witness

yeah Fredrik I'm I need a you're the jury what do i what I do what my vote is but it's a question opinion you're up [Laughter] for finding a bug in the protocol here yeah so regarding if bugs are dense or sparse and I maybe didn't understand your question entirely accurately I guess the way you phrased it but for aetherium we have a fuzz tester and that finds bugs a lot that found like 9

concerns this critical bugs within a week of our release period right before or at least a hard fork like breaking change so I would feel like they're pretty sparse in that regard but then the ones that are extra like hard to find and you can't find by a fuzzer those would be deep I guess that's how I think about it at least no no wait it's not your turn and actually you don't get to answer your own question no no you don't you don't it's you it's me yeah yeah ok so I really don't want to offend anyone and no I mean the team at go etherium is amazing but looking at that code for a few hours

no I you know where this is going so I would be concerned that there's both a lot of sparse bugs and dense books but I I would say that people in the space don't have the time to dig around maybe people who really really like Bitcoin will have some incentive to exploit that but I don't know yeah I don't think you've read in on this do you what was the question again do you want to just repeat the two it was do you believe that it's effective to run a bug bounty where

folks are either sparse or folks are nice so this parts for debt versus dents I have no idea I yeah I think bounty can change people's behavior I see it in myself in cases where I've like I have a plastic bottle in my hand and I well people write this say the person who found the bug is kind of a random person for you know a super the extreme black hat or maybe it wouldn't change we're saying for for me for example a the the

example I want to give say I'm holding a plastic bottle if the recycling can is right right there I will recycle it if I need to walk around with this bottle for 50 minutes before fine either there's some fresh hold where I won't do the good thing that's how I experienced this in with myself with stuff all the time and so given that the person will find the bug will be kind of a random person not extreme to one I think yes the bounties can change behavior from bad to good have the three of you guys answered yes okay I oh just a second okay I want to see questions put up hands All Hands All Hands oh oh there's one there I mean

when you have a lot of these I guess what you would call sparse bugs it depends how much work a researcher has put into finding that bug because for example if the bug bounty is $100,000 and actually you were asking for questions this is an opinion that's totally oh yeah no I just meant like things like hands I do have a hand up so okay if a researcher has put like a hundred thousand dollars of his time like what he would get paid at university for example like to finding this bug and then the bug bounty is only fifty thousand then you know he really doesn't have an incentive like oh he can't cover his living cost he's put that he's put that money in so what you need is bug bounties probably where the

payoffs are variable or you say like look I found this thing I'm not revealing it until you commit to paying me like that much that's Mike that's called something else isn't that okay you're on incentives you're up you're up [Laughter] extortion oh okay yeah he's really you've been patient all these answers imply that the bug bounty actually pays out and that the vendor actually wants to say that they have a bug in their software which is not the case in the majority well not the majority but in

some of the larger vendors so while I love the etherium foundation if somebody were to find a huge game-breaking exploit it's up in the air whether or not if you the Aryan foundation is gonna go yeah that's a bug for example Sony or even bit fee on Twitter yeah these things don't always work the way that very opinion II and it sucks cuz it's a shame you don't get to answer that but I'm on the security team you'll never do that alright you're up yeah that was not a question by the way when I say questions I mean like whatever you want to say hands basically should we get answers on this yeah yeah so I think fortunately in our space bug bounty

programs have been pretty correct like I've seen a lot of payouts especially by the etherium foundation but you're going forward we might see the behavior that we see like we'd be few wallet or with Apple Microsoft whatever so yeah pretty much pretty much that and regarding whether a bug bounty can change the behavior everyone here is like calculating the hours of researchers time but there is also another aspect projects working using these tools and using basically everything from this space can discover bugs by themselves for example one of the projects that I worked on discovered the bug in the silicon power

and we didn't have any issues with reporting that because it actually didn't take any extra time so that's another aspect to look at I mean researchers are not the only entities for discovering bugs in these projects people who use this projects also discovering bugs in them so yeah do I get to say my answer now yeah okay so yeah I'll dial this back a little bit so for the do they change behavior thing I don't think that any black hat out there would be convinced at all they're gonna give me a couple hundred thousand dollars to like give up my entire life of crime and completely change the moral compass that I have in my head and not

hack the thing cuz I you know I don't think that's funny and I don't want to do it so their method of rewarding people to create a more active contribution network and a more active just group of collaborators but ultimately the bad people that are out there that want to get you aren't gonna be changed one iota sorry for that touchy touchy subject one iota by the existence of a bounty on the other hand sparse force dense like I hate when I see people giving out bounties and they're just streaming them out at like a hundred dollars or a thousand dollars a pop if you're paying out bounties just left and right you have an engineering problem and you need to pay someone to

go fix the underlying security issue instead of outsource all ownership of that to a bunch of volunteers so like the the line of thinking in the blockchain community that oh because I have about because I have a bounty program I'm safe is a little bit misguided like sure it can be part of a solution but there's a lot of things that need to go into making a project safe that aren't a bounty and a really good indicator that you've done one too soon or that it's not providing the output that you want is that you're paying out too often and at too low a price it should be a high number it should be infrequent that's when you're doing it well do you have a giveaway so yeah I completely agree that you know

bounties are only maybe even marginally effective if you actually have sparse bugs if you have like serious bugs where someone actually has to dive in and find them like if you have tons and tons of issues in your codebase it's not something that a bounty is gonna solve but at the same time of course it's not going to flip the people who are chasing that huge back like the hundred million dollars that they would get if they exploit some bug in the wild but the goal is like and it's maybe a bit unfair because it creates a race but the the goal is to like overwhelm those people with honest contributors even though only one of those guys gets paid may actually be able to leverage more effort

into finding those kinds of bugs than someone who's exploiting them the system maliciously ok hands oh now there's some there's some over there is there anything that is other than bounties yeah we can also anything other than bounties all the hands went down oh there's none back there kind of related to bounties but not about bounties is just that this idea that people are just kind of hanging out and looking for bugs to like just solve and they've got nothing better to do is kind of untrue and related to that is the pipeline of how are we making sure that more people are acquiring these skills and solving these problems within the community so I

think that yeah when it comes to the bug bounties it's a nice idea but it's not wholly realistic that people need to make a living and people need like they've got other things in life that they care about they need to come up with yeah how are they gonna pay their rent and stuff and they're not like ok I'll just spend a few months looking for this big problem cuz I got time to spare a lot of people don't have that luxury in this world and so how do we help people make a living and then also how do we help them like like become part of this pipeline and not share this knowledge you're up come on you're out nice a well stated opinion followed by a question do you have any

thoughts on that the question is like whether it actually exists that people are doing like just taking a few months to look for bugs I think that's very very unlikely even they're really really like awesome pay off bugs but they don't know that they exist they don't know that those bugs exists so it's it's almost definitely it's almost definitely people who are already working on the thing like people who are like how do I extend this or trying to understand how it worked at deep arcane knowledge and are getting paid to do it

yeah who are ya yes do you want a microphone so you can look at like the Microsoft bug bounties they have the mitigation bounties that are a hundred and like a hundred and fifty thousand dollars and every single team that has one those have been people that weren't seeking to find the bounty but that just stumbled into something then they're like oh I guess I got paid too and the vast majority of them have been academic teams that we're gonna do research and like had publications same thing the Facebook Internet defence prize and then you've got the Apple bug bounty which is the one for like food security bypass bugs like to you know get information

off people's phones and they're turned off and no one has claimed it because even though you set out this enormous prize what you were saying that like okay it's gonna take about a twelve month dedicated engineering effort with about a team of four people and then we'll get a two hundred thousand dollar prize out of it there's no amount of money that you can offer that makes that make sense so no one has claimed that bug bounty that is a poorly engineered bounty all right of course there's one I think you didn't weigh in yet you didn't yeah well I just I don't know I just Mearing their opinions on this people think the if people think that they're going to be researchers out there

looking for bugs in your project just because you have a bounty when you're sadly mistaken because for the majority of ICO projects out there for example they have a lot large community but most of that community is probably either interested in staking if that and probably just waiting to find a return on their tokens itself and they're not necessarily coming through the code to find bugs to help you out and if they are they're probably more closely acquainted with your project through maybe the through the developers and even then it's still iffy I really just having a bug body project does not ever at all imply people are ever going to

find these bounties or that you're gonna pay out just okay laughs last point more questions but what do you want to say oh right well what I was gonna say is students do that's that's the best audio for bug bounties no because $500 is a meaningful amount of money to our twenty year old so how do you yeah how do you train up a new generation of people is sometimes these bug bounties are great as learning exercises for people that don't know anything yet so you're not gonna get the expert but you'll get the beginners okay question question more than a bug bounty program to do all

right hands changing tack completely zero knowledge proof and particularly ZK snacks overhyped that is a is that a leading question I think it's a fine question are they overhyped okay we just leave it are they overhyped okay as you look at this audience of I have to walk out of here and actually walk home without being murdered however I would say to an extent yes but but but cryptography goes through height cycles and doesn't it does blockchain is at the

top of hype right now ZK Starks are sort of you know at the top of along coasting along with this as well right now there's probably not that many people in this room maybe on two hands if that that could probably walk anybody through the math of the ZK snark right now with that said it might be a little overhyped and we have round tables to help curtail this so people can learn how to apply them properly and when to know when they can apply them in some cases I've seen some examples where they may have been able to use more traditional cryptographic means of just regular proof of knowledge than an actual ZK snark which is way more complex so yeah

I think it's wrong just a little just a little please don't kill me go go this way do you think so I personally don't think that they're overhyped like sure they're complex or there are a lot of things that are complex and still useful like you don't actually have to understand how something works to understand its value like what academics just do a lot of the time is just create sort of black boxes like they'll design like oh here the the here the the the properties that this protocol has to fulfill and then you can sort of plug that into some other system and you have an instantiation and then in practice you have probably some library that's well vetted and nobody really knows how it works except for some like people with deep arcane knowledge and but everybody uses it it's actually

effective the only questions that are still open or really just can you make them efficient enough can you do things like I didn't know aggregation well enough can you merge proofs can we find useful applications and those are the questions that are still a bit shaky but yeah probably will get better I don't know how much better so what are we doing to make sure that the people who are able to solve those problems are acutely aware of how those problems need to actually be implemented the solutions need to be implemented so the feedback loop of the people who are able yeah to basically in academia or wherever to do

the research and to solve the difficult problems do they know what we need how are we making sure that we're talking about this that's what I want to know I think that's what we need to do and then we won't be overhyped uh-huh so I don't think they're overhyped so I'm not a cook talker for myself there are people on my team that are and I've you know spoken to them quite a bit about use cases for this kind of stuff and I see that we're just at the beginning of it I think that there are more complex assertions that you can make with zero knowledge proof that people haven't tried to do yet so like there might be information that a company has that they don't want to disclose poke like okay so I have a client list I would like to prove to you

that I have such and such people as clients or some number of them or some value but I can't do that right now without just telling you who they are so trying to find opportunities like that that fit into real use cases for either businesses or maybe even national security we're like governments all over the world accumulate a vast amount of classified information if there are a way to expose that to the public in a way that wouldn't endanger the actual integrity of the data through zero knowledge proof that would be cool and there's I think a lot of opportunities to explore those different use cases in the next few years now that the underlying cryptography has become efficient enough that we can start to try it so I don't come right can't it you already answered therefore

one okay okay so I think before we can and this is my you say they're not high they're not hyped I say there may be just a little bit I think there's a compromise here and it is ZK snarks and zero knowledge proof need to be standardized and there standardization going on right now that everyone in this room should at least attempt to try to participate in it's that important that this happens z cash has been a major and helper in that I think the first one the first standardization workshop was that Z calm he's not at Z cash at all okay yeah okay yeah so is that Zeke on zero before oh

yeah that's right it was big and then after that was the fhe one I think right or is after oh yeah there was some standardization with workshops yeah yeah so there was a standardization workshop but everyone in this room is affiliated and we're working on zero knowledge proof sand things like this should participate in that and before we can really I think make a ferris assumption that it is hyped that is hyped enough or underhyped or overhyped we need tools that allow us to easily understand when these problems can be applied I don't think there's enough tools like that out there lip snark for example is helping but I'm really excited to see what in the next five years

comes out of ZK snarks and ZK Starks for that matter okay hands hey do you still have your no okay your hand with up for a while I'm gonna add an opinion here given how high blockchain is I don't think snarks are overhyped because there's so many privacy problems that blockchains have that we will need zero knowledge proves for on the other hand I do agree though and I think you with the orange cow or wolf or whatever made it made a bit of a face when you're saying oh you can do a membership proof for the zero knowledge proof membership proofs are not necessarily you don't need a zero knowledge proof to do a membership proof and I think I just said there are

people who have okay so anyway but the the membership proof is one thing that you can use in it uses hero knowledge proof for I think zero knowledge proof SAR hype right now because maybe vitalik wrote a blog post and so their entire blockchain world knows about it there are many other cryptographic tools were not familiar enough yet with such as multi-party computation and things that me not being a cryptographer I don't know well enough either but I do think that see Renaud foods are not overhyped everything else is not hype to know you're up dan nice to have you up here twice be careful do you guys want to answer this I guess there was no real questions

like there are other corruptor do we just have a better product okay hands hands hands his hands been up for a while no yes half opinion half question like is the need for like bounties in crypto completely overblown simply by the fact of spectra likes the speculation making it actually worth trying to game the system in any way instead of spending more resources on like doing security work for real security researcher or student they prioritize their time like fixing live SSL and all these kind of thing bugs that actually protect real

important data and not just people's virtual currency I think that's actually still question ish plus we went back to bounties so shall we just do it no we're back on bounties guys all right we can't shake it keep going was it not yeah yeah go ahead like that there's a lot of really important cryptographic work that happens in open-source projects that aren't blocked rain-related is that what you're referring to right yeah there's not bound

yeah it's where the money's that I mean like that there's there's funding for solving super bug bounties in this in the blockchain space because there's money there and because of speculation but when it comes to like the the cryptographic protocols that like underpin like the internet and stuff like that like all these other things like there's not as much money to like figure out the security problems of those so I mean that's kind of unfortunate but it's so there's not bug bounties there I mean there's some but there's not money there it's usually third parties like the Mozilla secure open-source fund and open tech fund and all these other ones that are funding

like security audits of these open source projects that are used that are not blockchain related I think too many in the industry like the heartbleed was a bit of a wake-up call because I'm and don't quote me on these numbers but open SSL had like to maintain errs and it was literally used by the entire world and at least now I think Google definitely and a few other companies that well their business is broken if SSL breaks stepped up and are like helping I don't know how they're helping but I think this it is something that we were maybe not aware of enough that there are so many open-source projects sometimes decades old that are yeah not getting enough attention and are running on

every phone every in every project that you could think of yeah I mean mostly in parallel with that I think it's it's the hype of blockchains has only increased funding for those bug bounties but actually the necessity of other bug bounties is actually probably higher even if you consider current pipe and price levels I mean yeah SSL if there's huge bugs there takes down Google it takes like the whole freakin internet that would be really bad but that even if blockchains were way less types I think the the sort of catastrophic implications of some of those bugs like if you could just print money secretly without anybody realizing and slowly

trickle it out it doesn't matter if the price is one or a hundred I mean you're talking about a scale where you can just sort of deplete the entire market and you know that's that's a huge issue regardless of whether that market has a lot of tap through a little bit actually I can make it opinion right right oh yeah we have a person is gonna jump in yeah so I have the opinion that GK snarks and and zeroes proofs are actually almost under height so and so this morning we have a round table we had a round table we had a round table with GDP are now GDP RS is that you have the right to be forgotten and you have

to the right to control your data now anything that is personal information falls under that regulation and a personal if piece of information is anything that can get referred back to your person either in the data set that's stored or in any additional data now the problem is there's almost nothing that can't be combined in a way to refer back to the - to the person even if it's just a hash or anything so we will end up with a situation in which we will have to think of security by initial design where we put the fractions on the blockchain and on the storages that only prove that something has taken place the way that was supposed to where as everything else

needs to be somewhere else and this can only be done by homomorphic encryption ZK ders snarks starix whatever bulletproof and whatever comes out there so this is as close to the magic wand that we can actually use and I think the ZK snart or the zero knowledge proof as such is just as important as blockchain technology as a whole that was amazing and we are actually at time right on that comment so I think I agree I think this wraps up the park bench panel everyone widely agrees I hope you guys like this we this is a second time we've done this panel

set up it's kind of neat again thanks to everyone for coming out and now there are drinks and that's it there's actually just drinks and a chance to talk to people do we have anything else we want to say thank you very much for coming up yeah all right let's party