Massimo Albarello

#ICP security involves different thinking vs proof-of-stake networks, so direct comparisons are hard. Differences include: 1 "Deterministic decentralization" ⬆️ vs simple Nakamoto Coefficients 2 Games of life ⬆️ vs small-game fallacies 3 Hardware ⬆️ vs liquid stake Big thanks to Justin Bons for his willingness to debate the ICP community on this subject – these days theoretical debate is sorely lacking – but he does not cover these differences in his analysis. He therefore provides a good opportunity for me to draw attention to the differences, and explain them to those interested: /* Deterministic decentralization */ Decentralization, generally speaking, is a nebulous term that is difficult to measure – should we measure the decentralization of the Bitcoin network by the rather small number of mining pools that might double-spend by colluding, or by the much larger minimum number of individual miners that would need to collude, upon the assumption that miners would leave any pool involved in an attack? Or, should we measure the decentralization of Ethereum using the number of individual virtual validators nodes running in the cloud, or by the number of Big Tech clouds that control them? These are tough questions. The Internet Computer uses a decentralization framework, which underpins the security of its protocols, known as "deterministic decentralization." This aims to calculate and create decentralization both with more certainty (more security) and also with less replication (more efficiency). It is more nuanced than basic "Nakamoto Coefficient" thinking. The system is made possible because the network runs under the direct and exclusive control of an advanced permissionless DAO that is integrated into its protocols called the NNS, or "Network Nervous System," which currently has more than $3b of ICP staked and huge numbers of participants (it's the biggest DAO community around today). The NNS adopts/rejects proposals that do many things, two of which are particularly relevant to decentralization: 1) it hands out "node provider" profiles to those who ask for them, and 2) scales the network by forming and configuring subnet blockchains by adding and removing node machine hardware operated by different node providers. Node providers obtain profiles by submitting proposals that specify the data centers they will be installing node machines within, which information then gets associated with their profiles. Another type of proposal, which anyone can submit, forms new subnets from existing nodes, or adjust subnets by adding/removing nodes, with the requirement that "deterministic decentralization" is observed. This involves combining node machines from 1) different node providers, 2) installed in different data centers, which are 3) in different geographies, and 4) different jurisdictions. The purpose is to create subnets which would require a higher degree of node provider collusion to break, and which are also resilient to e.g. a nuclear bomb hitting data centers in a geography, or a government/regulatory area attack executed within a jurisdiction such as the EU. Some subnets also have special purposes, such as those hosting e.g. bitcoin, and have higher replication factors as needed – security is on a cost/benefit curve and tailored precisely to need. It is important to compare this to traditional proof-of-stake practice, where validators are anonymous, and mostly run on Big Tech's cloud services. For example, the Hetzner cloud suddenly shutdown 40% of the Solana network, more than 1,000 of its validators, after deciding it didn't want them. By implication, it could also also have taken full control of the network. Further, consider that vast numbers of cloud validators on Ethereum are in practice sometimes created by one operator behind the scenes. Arguably, the cloud providers are the nodes, not the validators they host. Deterministic decentralization does not depend on having huge numbers of anonymous validators running in the cloud, and I would argue provides more dependable decentralization that is also certainly much more efficient. If required, the Internet Computer's network protocols allow for very large numbers of nodes to be combined into subnets. Where they are not, it is because analysis performed wrt deterministic decentralization indicates that it would be unnecessarily wasteful. /* Games of life */ I don't always agree with Nick Szabo's thinking, but one of his pieces that I think is INCREDIBLY insightful and generally important for the crypto industry, and often overlooked, is his post titled "Small-game fallacies." unenumerated.blogspot.com/20… Small-game fallacies often occur in proof-of-stake modeling, which assumes that validator behavior is determined exclusively by incentives existing within the narrowly defined constraints of crypto economic systems e.g. that anonymously deposited stake ("collateral") is the primary determinant of validator behavior, including cheating/not cheating. This is incorrect. Szabo draws attention to the fact that human behavior occurs within the much larger "games of life." For example, most validators won't cheat, not because of fear of losing their stake, but for reasons of personal integrity, professional pride, and fear of retribution (both from others in their industry seeking revenge, and from legal systems that with to punish them for their crimes). These incentives can exert much greater forces than anonymously staked cryptocurrency. The Internet Computer considers the larger games of life by ensuring, among other things, that node providers (which are typically companies) identify themselves. Those colluding to defraud the network will be subject to much more than the loss of their stake. Indeed, they can be subject to the full force of the law around the world. As the assets hosted by networks become increasingly valuable, it becomes harder and harder for proof-of-stake advocates to claim that they are sufficiently protected by validator stake. The larger games of life are required. /* Hardware stake */ The Internet Computer runs on sovereign hardware called "node machines," which are built/purchased by independent "node providers" who install/run them from independent data centers around the world. In the "proof-of" terminology, it is "proof-of-useful-work" (PoUW). This hardware-based approach is diametrically opposed to proof-of-stake, which typically sees validators running on Big Tech's cloud services, run by anonymous operators, who have joined them to the network staking some amount of cryptocurrency. As per the preceding section, the thousands of validators running on Amazon Web Services should really be seen as one node, for reasons highlighted by the Hetzner incident, but that's beside the point – what we need to compare here is the *types* of stake involved in proof-of-stake vs Internet Computer nodes. An ICP node is not joined to the network by staking ICP tokens, but rather by merit of being standardized hardware that can keep up with the nodes it is combined with (and thus not get expelled). This standardized hardware is expensive. It costs $20k+ per node machine (and those wishing to support optimized AI smart contracts will likely find the specs for those nodes will probably exceed $100k). This hardware is of course a form of stake that the node providers put at risk, and it is not one that is not liquid. The cost fully includes both the cost of acquiring and installing the hardware, and the hosting contracts with data centers. If a node provider is kicked off the network for cheating, or running substandard hardware that can't keep up with the block rate, in practice they will have problems reselling their accumulated hardware, will be unable to recoup setup costs, and will often be stuck with contracts for co-location and bandwidth. By contrast, a proof-of-stake validator node on Amazon can be spun up and down on a button click. Nothing is staked apart from the cryptocurrency. However, that can be hypothecated using liquid staking – in short, what is actually staked is a much more wooly subject. While, as explained in the previous section, we believe that the larger games of life trump the small game fallacies of narrowly defined proof-of-stake crypto economic systems – not just in theory but technical practice – we also believe that it's often hard to determine what is actually staked when the stake is cryptocurrency. We would argue, as with many things in crypto theory, that the truth is far more nuanced that the big brassy theory boilerplates justifying the design of major proof-of-stake networks would suggest. In summary – the stability of hardware stake, and the forces created by the larger games of life unleashed via intelligent decentralized governance that carefully combines hardware operated by identifiable node providers in a scheme of deterministic decentralization, allows decentralization to be measured and tuned more accurately with far greater predictability, and therefore safety.