The IOTA Foundation's official blog, covering its Tangle ledger, data marketplace, product updates, and responses to security criticism.
Commenters use it to question IOTA's claims, such as the long-promised removal of the central coordinator and the vague Microsoft partnership, while others defend the project.
I feel like sharing a curious e-mail encounter I had with IOTA founder David Sønstebø.
After writing a blog post about the limitations of the Bitcoin blockchain, which got some attention on HN[1], I received an e-mail by someone named David (I didn't know who he was at the time), asking me:
> Hey Rune,
> I read your interesting article analysis of Bitcoin limitations. I was wondering if you have had any time to check out IOTA (www.iota.org) and the p2p Flash Network within it (https://blog.iota.org/instant-feeless-flash-channels-88572d9a4385)?
> [..]
Assuming this was just some random person asking for my opinion on IOTA, I replied with a critique, pointing out two weaknesses I was familiar with:
> The only thing I know about IOTA is that it’s centralized, through the so-called Coordinator. This makes it uninteresting to me. As I understand, the IOTA team argues that this is just a preliminary precaution, which will change as the size of the network grows, but I’m skeptical of this claim.
In any case, until it actually becomes decentralized, I don’t think I will have enough interest in it to learn how it works. So I think I will wait for this to happen before taking the time to learn about the system.
Also, I know that the IOTA team designed their own hash function, which turned out to be vulnerable to collision attacks, which sounds rather amateurish to me.
He promptly replied to this critique -- which I thought I was offering someone seeking advice on the soundness…
Also from IOTA foundation statement:
"Whether intentional or not, DCI’s report and subsequent refusal to follow proper disclosure procedure have caused misinformation about IOTA to continue circulating on social media. The latest round of attacks on Twitter attempts to undermine our recently announced corporate relationships — we find these attacks equally reprehensible. There is a reason why following proper disclosure protocols is so important, and we can only speculate as to why DCI refuses to comply.
We have spent much more time than we intended to on discussing this issue ad nauseum, and we would like to put it to bed. However, we can’t do that without help from the DCI team. To that end, we propose the following:
We hereby formally request DCI to complete the proper disclosure protocols: we call on Ethan, Neha and their team to release any and all code, documentation, research, etc., they have developed in conjunction with their findings.
If DCI are unable or unwilling to release all of the aforementioned documents, we call on them to retract their report fully and issue a brief apology, after which we will drop the subject entirely with no harm done.
If DCI do clarify and disclose their results fully, and a substantial and legitimate vulnerability is found, we will happily eat a slice of humble pie. We will own up to our mistake and apologize for it, thank them for helping us to improve the IOTA protocol, and reiterate our offer of a bounty reward as a token of…
Thank you for your reply (and I don't understand the downvotes), but I can't say it really changed my view on the currency.
>1. There have no vulnerabilities in the past. Please read: https://blog.iota.org/official-iota-foundation-response-to-t...
Let's have a look then. It's in 4 parts, the first two are not about the purported vulnerability but rather complaining that the people behind the discovery didn't disclose it properly and might have a hidden agenda. Fair enough I guess, but it's odd to start with that, it would make a much better point if it came after a strong rebuttal regarding the technical aspects of the vulnerability.
Then we get to the meat of the issue in the middle of page 3:
>2. IOTA Protocol Security and Tangle Reliability
So they start by addressing the "IOTA's coordinator is a single point of failure". Their reply is that... It's true but they never pretended that it was otherwise and that it's temporary:
>IOTA node operators, understanding the importance of the Coordinator’s role in securing the network while it is still young, voluntarily suspended operations during this time.
>The purpose of the Coordinator in the infancy stage of the IOTA network has been transparently communicated throughout the history of IOTA. As the team has explained at length, the Coordinator is a temporary measure to help bootstrap the network and protect it during its infancy. Once there are enough full nodes and transactions to secure and sustain the IOTA network,…
I've looked a bit into IOTA over the past weeks because I was trying to understand how it actually works. I still do not fully understand how the Tangle structure actually functions as a process and/or how it solves scalability issues. If someone smarter than me could enlighten me on this, i would be very thankful.
As far as I understand, one main difference between IOTA and classic blockchains is that there are no explicit mining nodes in the system who confirm all the transactions. Instead, if you issue a new transaction, you have to confirm (sign) 2 prior transactions first and do a little round of Proof-of-Work. These 2 prior transactions are called "tips" and are selected by a random walk. I'm not sure who exactly selects the tips (can you select the same ones over and over?) and if the correct tip selection is somehow enforced.
There was a controversy about the homebrew "Curl-P" hash function (P supposedly means Prototype according to the author Come-From-Beyond, previously involved with NXT). After a bumpy responsible disclosure process, MIT researchers Neha Narula et al published these findings: https://github.com/mit-dci/tangled-curl/blob/master/vuln-iota.md and an accompanying Medium post. IOTA Foundation dismissed the vulnerability as non-practical, but switched part of their crypto to Keccak instead: https://blog.iota.org/curl-disclosure-beyond-the-headline-1814048d08ef
So in the IOTA codebase, there is now "curl" (not to be confused with the HTTP library),…
I expect more from the HN community. Are you guys doing your homework before commenting? Doesn't seem so.
1. about crypto
Every time there is some news about iota here the usual 'don't roll your own crypto' comes up.
Yes, I think everyone agrees that doing that, if you don't know what you are doing, is dangerous. This is especially the case for you app and web developers. You guys have no business rolling your own crypto.
But think about it, if nobody rolls their own crypto then how will crypto progress?
Their use case is valid, they need something lightweight for IoT. They are trying to push the current state of the art.
They hired a company to help them improve their algorithms.
https://blog.iota.org/iota-foundation-hires-cybercrypt-615d2df79001
2. about 'fake' corporate partnerships
There is already so much clarification to be found via google but let me repeat.
We had this blog post announcing the data marketplace:
https://blog.iota.org/iota-data-marketplace-cb6be463ac7f
where some quotes from companies can be found. The mass media took this and interpreted it the way they wanted to. I mean just check headlines in newspapers etc. They are 90% bullshit.
And because of that you give the iota people so much flack? You denounce them as liars and whatnot. Very unprofessional. They never themselves said 'we have a formal partnership with Microsoft'. It's the people writing news articles, writing reddit comments, doing YouTube videos that interpret things, and other…
The problem comes down to this; at the current stage, an attacker could very easily amass 33% of the hashpower of the network, because hashing only happens at the instants when new transactions are being added to the tree, and is completed in a second using a normal laptop.
I was unable to find any information on how IOTA resolves this seemingly disturbing security issue on their website or in their whitepaper, but I did find the following information in two non-affiliated blogs (1, 2) after a lot of searching:
> Milestones: Milestone is a special transaction issued by a special node called Coordinator. The Coordinator is run by Iota Foundation, its main purpose is to protect the network until it grows strong enough to sustain against a large scale attack from those who own GPUs. Milestones set general direction for the tangle growth and do some kind of checkpointing. Transactions (in)directly referenced by milestones are considered as confirmed.
This means that IOTA in its current form does not provide any censorship resistance, since the path of the tree is centrally directed through a Coordinator node run by the IOTA Foundation. As such, IOTA is no more decentralized than an Apache Kafka cluster, or Ripple and their Unique Node List.
I would argue that this is crucial information a user needs to know, yet I have no idea how the average person is intended to learn about this, since it’s nowhere to be found in the IOTA whitepaper or on their website. (EDIT: Since this…