[e-cvs] cvs commit: e/doc/talks/pisa/paper index.html
markm@eros.cs.jhu.edu
markm@eros.cs.jhu.edu
Mon, 7 Jan 2002 01:00:23 -0500
markm 02/01/07 01:00:23
Modified: doc/talks/pisa/paper index.html
Log:
more
Revision Changes Path
1.40 +141 -85 e/doc/talks/pisa/paper/index.html
Index: index.html
===================================================================
RCS file: /cvs/e/doc/talks/pisa/paper/index.html,v
retrieving revision 1.39
retrieving revision 1.40
diff -u -r1.39 -r1.40
--- index.html 2002/01/06 23:55:28 1.39
+++ index.html 2002/01/07 06:00:23 1.40
@@ -148,6 +148,19 @@
contracts</i> to bridge between the above abstract world and local systems
of largely unwritten arrangements. An example shows how the outcome
of a smart contract may gain local legitimacy. </p>
+ <p><b>Limitations and Hazards</b>. What other novel problems will we encounter
+ on the digital path? First, smart contracts will be<i> unable to express</i>
+ the subtle richness of contracts written in natural language, leading
+ to techniques for combining the two kinds of contract elements into
+ <i>split contracts</i>. Second, a naively deployed smart contract system
+ could exacerbate rather than diminish the dangers of <i>regulatory capture</i>
+ -- the participants could end up with less vulnerability to local governments
+ but more vulnerability to distant governments, over which they exert
+ even less influence. This section explains how both of these problems
+ may be addressed. </p>
+ <p>Being untested, we can be sure the digital path will encounter further
+ problems, indeed more problems than we can anticipate. This section
+ just scratches the surface.</p>
<p><b>Why the Third World First?</b> Why may the third world lead the
first in the transition to smart contract mediated global commerce?
Because of differences in the nature of <i>legitimacy</i> in these two
@@ -192,10 +205,10 @@
<p>But to understand the success of the first world requires something more
than Fukuyama's analysis. No matter what the culture, simple cognitive
limitations prevent any of us from knowing, much less trusting, more than
- a very small fraction of the members of our societies. Nevertheless, in
- the first world massive numbers of strangers meet, trade, do business,
- negotiate, and sign contracts, despite lack of any prior knowledge of,
- or reasons to trust in, each other. How is this possible?</p>
+ a very small fraction of the members of our societies [<a href="#Hayek37">Hayek37</a>].
+ Nevertheless, in the first world massive numbers of strangers meet, trade,
+ do business, negotiate, and sign contracts, despite lack of any prior
+ knowledge of, or reasons to trust in, each other. How is this possible?</p>
<p></p>
<p>De Soto's earlier book, <i>The Other Path</i> [<a href="#deSoto89">deSoto89</a>],
tells a complementary story. De Soto can also be understood as explaining
@@ -255,7 +268,12 @@
<td>
<p align="center"><i>The division of labor is limited by the extent
of the market.</i></p>
- <p align="right">--Adam Smith</p>
+ <p align="right"><i>--Adam Smith</i></p>
+ <p align="right"><i>Modern civilization has given man undreamt of
+ powers largely because, without understanding it, he has developed
+ methods of utilizing more knowledge and resources than any one
+ mind is aware of.</i></p>
+ <p align="right"><i>--Friedrich Hayek </i>[<a href="#Hayek78">Hayek78</a>]</p>
</td>
</tr>
</table>
@@ -426,17 +444,20 @@
of learning all this local knowledge itself, and without imposing the
costs of homogenization? By the use of smart contracts.</p>
<p><font color="#000000">In smart contracts, a software program is the operational
- embodiment of a contract [<a href="#Szabo97">Szabo97</a>]. A drink vending
- machine is a very primitive example of a smart contract being executed
- on a contract host -- the vending software executing on the vending machine
- hardware. This combination of contract and contract host is a partially
- trusted intermediary between the drink manufacturer and the purchaser.
- It escrows drinks and money, and performs an exchange of those goods when
- both have been presented. There is even a rollback process, in which it
- returns the money if the drink cannot be delivered. Traditional contracts
- are understood to be backed by a coercive enforcement system made of courts
- and cops. However, the vending machine does not have the option of such
- recourse following a breach. In what sense is it a contract?</font></p>
+ embodiment of a contract [<a href="#Szabo97">Szabo97</a>], where the program's
+ behavior enforces the terms of the contract, or at least raises the cost
+ of violating the contract. Szabo introduces the concept with the example
+ of a drink vending machine. A drink vending machine is a very primitive
+ example of a smart contract being executed on a contract host -- the vending
+ software executing on the vending machine hardware. This combination of
+ contract and contract host is a partially trusted intermediary between
+ the drink manufacturer and the purchaser. It escrows drinks and money,
+ and performs an exchange of those goods when both have been presented.
+ There is even a rollback process, in which it returns the money if the
+ drink cannot be delivered. Traditional contracts are understood to be
+ backed by a coercive enforcement system made of courts and cops. However,
+ the vending machine does not have the option of such recourse following
+ a breach. In what sense is it a contract?</font></p>
<p>The vending-machine-as-contract would indeed require separate enforcement
if it dispensed the drink first and then demanded payment. However, by
escrowing both drinks and payment before dispensing either, it also dispenses
@@ -464,10 +485,10 @@
will compete in the market. In this paper we explore escrow-based smart
contracts, not because we expect this form to dominate, but because their
logic is vastly easier to explain; because they are easier to build, and
- so will occur sooner; and because they apply to participants with no prior
- reputation, which helps for bootstrapping the transition. Likewise, for
- the electronic systems of title (called <i>issuers</i> below), in this
- paper we assume systems that provide for instant settlement [<a href="#e-gold">e-gold</a>].
+ so will occur sooner; and most of all because they apply to participants
+ with no prior reputation, which helps lower barriers to entry. Likewise,
+ for the electronic systems of title (called <i>issuers</i> below), in
+ this paper we assume systems that provide for instant settlement [<a href="#e-gold">e-gold</a>].
Although delayed settlement may substantially reduce capital costs [<a href="#Selgin01" target="_top">Selgin01</a>],
they would turn smart contracts into explosions of complexity.</p>
<h3><font color="#000000"><img src="images/4-exchange.gif" width="390" height="266" align="right"></font>Contracts
@@ -567,7 +588,8 @@
host presumably has a valuable reputation at stake, which helps secure
its honest behavior. (More sophisticated cryptographic protocols are possible
which further limit a player's vulnerability to a dishonest contract host
- or issuer, but these are beyond the scope of this paper.) </p>
+ or issuer [<a href="#Beaver98">Beaver98</a>], but these are beyond the
+ scope of this paper.) </p>
<p> The money is an eright in part because it is <i>third-party assayable.
</i> Even though Bob does not currently possess this eright, Bob, through
the contract host, can determine which issuer backs this eright, and what
@@ -586,10 +608,8 @@
smart contracts explained so far -- the vending machine and the exchange
game -- cannot turn assets into capital. To do so requires contracts that
unfold over time, like a mortgage. To explain how such unfolding creates
- ever more abstract forms of property, a simple clear example is the <i>covered
- call option</i>. (Such instruments are kindergarten finance for many,
- so excuse us while we belabor the obvious. Re-explaining the familiar
- is often necessary when translating into a different medium.)</font></p>
+ ever more abstract forms of property, we step through a simpler example
+ contract, the <i>covered call option</i>. </font></p>
<p><font color="#000000">Alice has an <i>option</i> when she has the right,
but not the obligation, to engage in some action at some agreed price
before some deadline. Alice has a <i>call</i> option when she has the
@@ -725,7 +745,7 @@
holder, according to customary law in that community, as recorded at the
time of titling.</p>
<p>Although the conflict is resolved in this scenario, there will remain
- pressures for homogenizing capital-creating-contracts; but these are normal
+ pressures for homogenizing capital-creating contracts; but these are normal
market pressures. In the above scenario, Alice will no longer lose the
sale to Fred through Fred's lack of trust in Alice. But she is still in
danger of losing the sale through Fred's inability to understand the contract's
@@ -842,54 +862,64 @@
claims about Sam's past intentions. Such recordings should also help overcome
barriers of language and literacy.</p>
<h1><a name="limits"></a>Limitations and Hazards</h1>
- <h3><a name="human"></a>Incorporating Human Language, Perception, and Judgement</h3>
+ <p>The governmental path, having been previously navigated, has limitation,
+ problems, and dangers we can anticipate. The digital path is untrod and
+ mostly unknown, and subject to the blind spots of wishful thinking. In
+ this section we take a first stab at some of the problems lurking ahead
+ of us, but many more issues remain.</p>
+ <h3><a name="human"></a>Incorporating Human Language, Perception, and Judgment</h3>
<p>Many preexisting and desired arrangements will not be expressible purely
as smart contracts. Conventional contracts make use of the rich expressiveness
- of human language, perception, and judgement, all of which are vastly
- more subtle and sophisticated than any currently automated alternative.
- Between the poles of fully human contracts and fully automated contracts
- there is a spectrum of arrangements we call <i>split contracts</i> --
- the contract is split between automated and non-automated parts. The first
- smart contracting system, AMIX [<a href="#Walker89">Walker89</a>, <a href="#Miller99">Miller99</a>]
- demonstrates well some of the ways such split contracts can be designed,
- so the two parts can play together well, enabling us to take advantages
- of the strengths of both.</p>
- <p>For example, a split contract could consist of an automated game, adequate
- if a dispute does not arise; natural language text expressing what the
- game could not, relevant only during a dispute; and an agreement on which
- person or institution should read the text and arbitrate the outcome of
- a dispute. From a game-centric perspective, the ability to declare the
- outcome in dispute is only another move in the game, and the arbitrator
- is only another player. From a paper-contract-centric perspective, the
- text as interpreted by the arbiter is the outcome of last resort, and
- so is the "real" contract -- the game is only a lighter weight
- approximation for typical non-disputed cases.</p>
+ of human language, perception, and judgment; all of which are vastly more
+ subtle and sophisticated than any currently automatable alternative. Between
+ the poles of fully human contracts and fully automated contracts is a
+ spectrum of arrangements we call <i>split contracts</i> -- the contract
+ is split between automated and non-automated parts. The first smart contracting
+ system, AMIX [<a href="#Walker89">Walker89</a>, <a href="#Miller99">Miller99</a>],
+ demonstrates some of the ways to design split contracts so the two parts
+ can play together well, enabling us to take advantage of the strengths
+ of both.</p>
+ <p>For example, a split contract could consist of </p>
+ <ul>
+ <li>an automated game, adequate if a dispute does not arise; </li>
+ <li>natural language text expressing what the game could not, relevant
+ only during a dispute; and</li>
+ <li> an agreement on which person or institution should read the text
+ and arbitrate the outcome of a dispute. </li>
+ </ul>
+ <p>From a game-centric perspective, the ability to declare the outcome to
+ be in dispute is only another move in the game, and the arbiter is only
+ another player. From a paper-contract-centric perspective, the text as
+ interpreted by the arbiter is the outcome of last resort, and so is the
+ "real" contract -- the game is only a lighter weight approximation
+ for typical non-disputed cases.</p>
<p>Another form of split would be by layers. Whereas the logic of a mortgage
game may be fully automated, the rights being put up as collateral are
limited to those held by the original property holder according to the
- governing village's law. The contracts needed to represent these latter
- may often remain mostly non-automated. In Figure 7, contract host #1 would
- provide Fred as well with the text or video, and the identity of the agreed
- arbiter. Fred would then take these into account as well in assessing
- the value of Alice's chair. </p>
+ governing village's law. The contract needed to represent these latter
+ may often remain mostly non-automated. In Figure 7, contract host #1,
+ as issuer of these locally-defined rights, would provide Fred as well
+ with the text or video, and the identity of the agreed arbiter. Fred would
+ then take these into account as well in assessing the value of Alice's
+ chair -- the rights Alice would like to use as collateral.</p>
<h3><a name="capture"></a>Regulatory Capture <i>vs.</i> Regulatory Arbitrage</h3>
<div align="center"></div>
- <p>Well before the Net, the growth of widely trusted large scale institutions
- in the West -- the partial concentration of economic activity into the
- backbone -- made possible the rise of the large regulatory state. This
- concentration, despite its benefits, also dramatically lowered the cost
- of regulation, as there were far fewer places in the network that needed
- monitoring. These concentrations made economic activities of various sorts
- subject to <i>regulatory capture</i>.</p>
+ <p>Historically, the growth of widely trusted large scale institutions in
+ the West -- and the corresponding partial concentration of economic activity
+ into the trust backbone -- made possible the rise of the large regulatory
+ state. This concentration, despite its benefits, also dramatically lowered
+ the cost of regulation, as there were far fewer places in the economy
+ that needed monitoring, such as the banks. These concentrations made economic
+ activities of various sorts subject to <i>regulatory capture</i>.</p>
<p>Although the Net has allowed the consumers of electronic goods and services
- to escape limitations of geography and jurisdiction, but has so far not
+ to escape limitations of geography and jurisdiction, so far it has not
provided the same escape for producers, especially those with worldwide
name recognition. These remain tied to some government, and subject to
its decrees. </p>
<p>On de Soto's governmental path, the informals come to be dependent on
the integrity of their own governments, in danger of local regulatory
capture. On the digital path, by having their contracts rely on the trustworthiness
- of first world trust hubs, haven't we just transfered this vulnerability
+ of first world trust hubs, haven't we just transferred this vulnerability
from their own governments to those of the first world, over which they
have even less influence? </p>
<div align="center">
@@ -903,26 +933,39 @@
</tr>
</table>
</div>
- <p>The nature of the dangers depends on the nature of the architecture.
- The architectures in which the first generation of electronic media were
- deployed -- radio and television -- amplified censorship and diminished
- free speech. The Net has dramatically turned this around, creating actual
- rights of free speech vastly in excess of even the best constitutional
- attempts. Might a decent architecture for distributed smart contracting
- treat regulation as damage and route around it? </p>
+ <p>The nature of the dangers depend on the nature of the architecture. The
+ architectures of the first generation of electronic media -- radio and
+ television -- amplified censorship and diminished free speech. The architecture
+ of the Net has dramatically turned this around, creating actual freedom
+ of speech more absolutely than even the best constitutions. Might a decent
+ architecture for distributed smart contracting treat regulation as damage
+ and route around it? </p>
<p>The most powerful answer is already implicit in the architecture of the
- digital path -- a diversity contract hosts, spread across competing jurisdictions,
- themselves competing to establish a reputation for operating honestly.
- Any one government going bad would endanger many contracts, but will cause
- a flight of business towards climates expected to remain freer. This dynamic
- is already seen for international money flows.</p>
+ digital path -- a diversity of contract hosts, spread across competing
+ jurisdictions, themselves competing to establish a reputation for operating
+ honestly. Any one government going bad would endanger many contracts and
+ much property, but will cause a flight of electronic business towards
+ climates expected to remain freer. This dynamic is already seen for international
+ money flows.</p>
<p><i>Fault tolerant computing</i> studies how to build reliable systems
- from unreliable components. Because of the dangers of regulatory capture,
- an actual first-world contract host can be seen as an unreliable component.
- From a set of these we may build a reliable virtual contract host in a
- variety of ways. For example, we can use a <i>voting protocol</i> in which
- a <i>quorum</i> of, let's say, 5 out of 7 actual contract hosts have to
- agree on an outcome in order for the issuers to honor the outcome.</p>
+ from unreliable components. For example, for certain demanding applications
+ an individual actual computer may be considered unreliable, but a reliable
+ virtual computer may be synthesized from several actual computers by comparing
+ the outcome of each step in a kind of voting process. Due to dangers of
+ regulatory capture as well as internal corruption, an actual first-world
+ trust hub may be considered an analogously unreliable component. From
+ a set of these we may synthesize a reliable virtual trust hub in a variety
+ of ways, such as a <i>voting protocol</i> in which a <i>quorum</i> of,
+ let's say, 5 out of 7 actual contract hosts have to agree on an outcome
+ in order for it to be considered an outcome of the synthetic virtual contract
+ host; and in order for that game's issuers to honor the outcome. These
+ issuers themselves can be virtual reliable issuers in this same sense
+ [<a href="#Szabo99">Szabo99</a>]. </p>
+ <p>Making such technologies work is tricky, so we should not try to achieve
+ trans-jurisdictional fault tolerance before we get started, but we should
+ also make sure not to paint ourselves into a corner -- we need to understand
+ how a simpler working system could incrementally grow to support such
+ fault tolerant protocols.</p>
<h3></h3>
<h1><a name="thirdfirst"></a>Why the Third World First?</h1>
<p>This new world of Net-based jurisdiction-free coercionless smart contracting
@@ -939,13 +982,12 @@
societies, having made the transition to the governmental path long ago,
have enjoyed great wealth, but have paid a subtle price in flexibility.
In most rich first world countries the issue of legitimacy is inextricably
- coupled to legality. With the exception of Italy, for a business in these
- countries to be judged legitimate by the culture, and for others to consider
- their dealings with this business to be legitimate, the business must
- be legal -- it must operate within the formal legal system. By contrast,
- in Italy and among the informals, the formal legal system has no monopoly
- on legitimacy -- many extralegal institutions enjoy widespread popular
- legitimacy.</p>
+ coupled to legality. For a business in these countries to be judged legitimate
+ by the culture, and for others to consider their dealings with this business
+ to be legitimate, the business must be legal -- it must operate within
+ the formal legal system. By contrast, among the informals the formal legal
+ system has no monopoly on legitimacy -- many extralegal institutions enjoy
+ widespread popular legitimacy.</p>
<p>As explained above, a new system of law will only be seen as legitimate
if it accommodates, incorporates, and builds on preexisting systems of
legitimacy. The preexisting formal and informal systems each have a very
@@ -1035,6 +1077,9 @@
and Randy Farmer for AMIX, The American Information Exchange, circa 1991.</p>
<p><a name="Bartley62"></a>[Bartley62] William W. Bartley, III, <i><b>The
Retreat to Commitment</b> </i>Open Court Publishing, 1962.</p>
+ <p><a name="Beaver98"></a>[Beaver98] Donald Beaver, Avishai Wool, "<b>Quorum-Based
+ Secure Multi-party Computation</b>" in Lecture Notes in Computer
+ Science, Springer Verlag, 1998. Online at <a href="http://link.springer.de/link/service/series/0558/bibs/1403/14030375.htm">http://link.springer.de/link/service/series/0558/bibs/1403/14030375.htm</a>.</p>
<p><a name="Birch97"></a>[Burch97] Greg Burch, personal communication.</p>
<p><a name="deSoto89"></a>[deSoto89] Hernando de Soto, "<b>The Other
Path</b>", Harper & Row, 1989.</p>
@@ -1054,6 +1099,15 @@
Operating Systems Review, September 1985, pp. 8-25. Updated at <a href="http://www.cis.upenn.edu/%7EKeyKOS/OSRpaper.html">http://www.cis.upenn.edu/~KeyKOS/OSRpaper.html</a>.</p>
<p><a name="Hardy99"></a>[Hardy99] Norm Hardy, "<b>Computer Security,
the Very Idea</b>". Online at <a href="http://www.cap-lore.com/Dual.html">http://www.cap-lore.com/Dual.html</a>.</p>
+ <p><a name="Hayek37"></a>[Hayek37] Friedrich A. Hayek, "<b>Economics
+ and Knowledge</b>", in Economica, 1937. repr in L.S.E. Essays on
+ Cost, London School of Economics and Political Science, Weidenfeld and
+ Nicolson, 1973. Online at <a href="http://www.virtualschool.edu/mon/Economics/HayekEconomicsAndKnowledge.html">http://www.virtualschool.edu/mon/Economics/HayekEconomicsAndKnowledge.html</a>.</p>
+ <p><a name="Hayek78"></a>[Hayek78] Friedrich A. Hayek, "<b>New Studies
+ in Philosophy, Politics, Economics and the History of Ideas</b>",
+ University of Chicago Press, Chicago, 1978.</p>
+ <p><a name="Hayek88"></a>[Hayek88] Friedrich A. Hayek, "<b>The Fatal
+ Conceit</b>", University of Chicago Press, 1988.</p>
<p><a name="Hewitt73"></a>[Hewitt73] Carl Hewitt, Peter Bishop, Richard
Stieger, "<b>A Universal Modular Actor Formalism for Artificial Intelligence</b>",
Proceedings of the 1973 International Joint Conference on Artificial Intelligence,
@@ -1106,6 +1160,8 @@
2 no 9, 1997. Updated copy at <a href="http://szabo.best.vwh.net/formalize.html">http://szabo.best.vwh.net/formalize.html</a>.</p>
<p><a name="Szabo98"></a>[Szabo98] Nick Szabo, "<b>Video Contracts</b>",
1998. Online at <a href="http://szabo.best.vwh.net/video.html">http://szabo.best.vwh.net/video.html</a>.</p>
+ <p><a name="Szabo99"></a>[Szabo99] Nick Szabo, "Secure Property Titles
+ with Owner Authority", Online at <a href="http://szabo.best.vwh.net/securetitle.html">http://szabo.best.vwh.net/securetitle.html</a>.</p>
<p><a name="Tribble95"></a>[Tribble95] Eric Dean Tribble, Mark S. Miller,
Norm Hardy, Dave Krieger, "<b>Joule: Distributed Application Foundations</b>",
http://www.agorics.com/joule.html, 1995.</p>