Will Scott

Category: Post

  • Post-Meritocracy

    A defining characteristic of the industrialized world has been the promise of meritocracy: if you’re smart and work hard, you can improve your position in life. The promise has always had limits, and class mobility has often been more aspiration than reality, but the belief itself has been a driving motivation for much of society. Across nearly every country, a large majority of respondents rate hard work and ambition as essential or very important to getting ahead.

    That promise is unlikely to keep holding.

    The end of hard work as leverage

    Much of what we have thought of as “hard work” is on the verge of being automated, if it isn’t already. Agriculture, transportation, manufacturing, and increasingly service work — the industries that employ most of the population — are all becoming cheaper to run with machines than with people. For the average person, this means their skills will hold little marginal value. Beyond a set of specialty positions, which won’t have room for most of us, it is unclear what would motivate the employment of humans at all.

    If effort no longer converts into advancement, what does? The obvious fallback is what came before meritocracy: wealth and power held by families and dynasties, passed down through succession. Those who have it keep it; those who don’t, can’t get it.

    How do we square the promise of an “abundant” future with the power dynamics of today? An abundance that applies only where it doesn’t infringe on the domain of someone who was more powerful than you in 2026 is inherently constrained, and ultimately authoritarian.

    The dynasties of old

    This would be bad in the familiar way — without the possibility of revolution or turnover, we risk being stuck in the same patterns indefinitely. But it may be worse than historical dynasties.

    In past empires, power was concentrated in individuals or small groups, and their competence varied wildly over time. That instability was, perversely, a source of change. An incompetent or overly oppressive ruler degraded the system quickly and hastened their own replacement. In the world we’re heading toward, the machinery of governance and production can run largely independently of who benefits from it. A poor heir no longer brings the system down with them, which removes one of history’s most reliable correctives.

    There is a silver lining: as long as power ultimately rests with humans, it inherits human irrationality. Whims, feuds, and mistakes will continue to create openings, even in an otherwise stable system.

    The game isn’t over

    Two aspects of our trajectory give me hope.

    The first is that future is not settled. Even under optimistic assumptions about progress, today’s leaders and power holders will not personally live forever — though their dynasties might. The power transitions that remain therefore become critically important in shaping what comes next.

    The second is that no individual or fiefdom can yet wield a majority of power. Supply chains are too complex, dependencies too intertwined, and motivations too diverse. As long as that remains true, alliances are possible and competition persists. The game may become more efficient, but it still offers a basis for counteracting individual dominance and a platform for collective bargaining.

    Looking outward

    Still, the existence of statistical or game-theoretic paths to advancement doesn’t fill the hole left by meritocracy. Individual ambition seems to be an important part of our humanity, and something we should structurally try to preserve.

    Ambition thrives when we are small relative to our environment — when the thing we push against is nature, or the unknown, rather than each other. It is much harder to sustain when the main game is dividing up a fixed pie. Our best hope, then, is to look outward: to find a larger frontier, a bigger obstacle we can push against together, and reframe the problem as one where ambition still has a role to play.

  • Preparation & Infrastructure

    One of the more interesting consequences of the current evolution in security is what it does to our notion of best practices. As both discovery and exploitation of vulnerabilities speed up, we want our infrastructure to be very responsive, and ideally fairly automatic: rotating keys across hosts, applying patches, and reacting to new disclosures without waiting for someone to find a free evening.

    Tools like unattended-upgrades get us part of the way there. But they raise a harder question: what setup is actually net positive? An automated system that can log in and rotate keys across your infrastructure is itself a new and highly privileged point of compromise. We want responsiveness without that access becoming the weakest link.

    Well-trodden paths

    One heuristic that feels increasingly important is to stay on the well-trodden path. If your setup follows a simple, common structure — say, a minimal Ansible configuration that lots of other people are running in roughly the same shape — it seems much more likely that updates will arrive as expected and can be applied automatically without breaking things.

    This was true with human operators as well. The difference is that a human administrator had the chance to learn the environment over time, and could absorb the quirks of a bespoke setup. Automation is far less forgiving of outliers, and the cost of being unusual goes up when the expectation is that changes land without someone watching.

    What seems likely to remain true

    A few practices seem robust to this shift:

    • A clear separation between control plane and data plane. The control plane should normally not be reachable at all, or should require additional hardware credentials to access. This segmentation is worth enforcing deliberately.
    • Offline backups. These remain one of the most important pieces of risk management, precisely because they sit outside the reach of anything automated.

    Shrinking the public surface

    Public services are becoming more dangerous to run. The safer posture is minimal exposed surface area — just SSH authentication or an equivalent — so that you only meaningfully talk with remote entities you already have reason to trust.

    At the same time, you need to track feeds of threats, exploits, and updates so you can patch before someone uses a vulnerability against you. This is a tricky balance. Either you trust an authority to filter and provide a sanitized feed, at the cost of both speed and autonomy, or you take on the diligence yourself: working out whether an upstream package has been compromised, or whether reports in your feed are themselves malicious. That raises an uncomfortable question — do we trust our own infrastructure and evaluation to be up to par at identifying supply chain attacks automatically?

    How do we keep offering public services?

    If exposure is the problem, there are a few directions worth exploring:

    • DMZ’d hosts, where compromise of a VM or host remains quarantined from everything else.
    • “Dark forest” services that aren’t truly public, but are exposed only to an extended LAN, a tailnet, or a defined community. We aren’t very good at defining these trust boundaries today. The friction is high enough that we rarely get beyond authenticating individuals with SSH or GPG keys, or else we retreat into a platform silo like Discord or Telegram.
    • Evolving what we mean by maintenance, so that unattended upgrades become something closer to a trustworthy, well-scoped process rather than a blanket grant of access.

    None of these is a complete answer, and each trades independence for safety.

  • On Trust

    There has been a fair amount of effort on UCAN (User Controlled Authorization Networks), and other types of ‘decentralized credentials’ over the last couple years. These efforts perpetuate the same control structures that exist today, with delegated trees of hierarchical control. This is in contrast to a personal or ‘decentralized’ trust we might hope for in peer to peer networks. It is difficult to use DIDs, UCANs, or other proposed mechanisms for reputation and network formation without finding ourselves back trusting an authority – they are both easily captured and naturally lend themselves to centralization of control. We need a fundamentally different trust infrastructure in order to build resilient, peer to peer networks.

    On non-hierarchical models for trust

    The main barrier is not a technical one – we have seen technical implementations (e.g. the GPG web of trust) for decades. There is an intuitive design for how a flat trust model can be implemented. The problem lies in a dis-satisfaction from the emergent properties of that naive network structure. This tension has been framed in a couple different ways. One perspective is that the user experience in bootstrapping trust is overly cumbersome, and this friction leads to an insufficiently dense trust network. A different perspective on the same tension is that a user-driven trust system is at-odds with transitive / automatic trust relations, and that actions to ‘ease’ the user experience are fundamentally reducing user control.

    We can find a space for exploration, by calling out this tension as a false dichotomy. The choice is not between a single authority vs user-directed trust links, but about distributing trust structures. There is a space for organic / automatic way to generate and allow for the reflection and evolution of trust that is neither user-directed nor rooted in a single authority. The bit-torrent tit-for-tat mechanism is one form of this, where protocol-compliant behavior leads to an increasing buffer for data transfer within the protocol.

    Trust or Reputation

    There is a related notion that is more regularly referred to in protocols as a concept of ‘reputation’. Reputation can be viewed as a property of a node in a system rather than one of an edge. (e.g. reputation is often constructed as a metric that is transitive, or where a node has a single consensus value. This is different from how we normally think of our personal trust in another user.)

    What then exactly are we trying to capture in a measure for ‘Trust’? In the hierarchical systems of web 2, it’s meant to provide some assurance that “someone is who they say they are”. It isn’t an indication that there are ‘aligned beliefs’, but rather that the expected entity is behind a given identifier. The properties that come from systems like TLS / CAs look very similar to reputation in this sense. While each individual can over-ride and manually configure which authorities to trust, that definition of trust is meaning a confidence in adherence to protocol and of coherence between expectation and reality.

    Scoping trust

    A challenge we sometimes run into when talking about trust as it relates to technical networks is that our expectation of scope is typically much more limited in digital or transactional contexts than they are in real life. When you refer to a person as a “trusted individual”, the implication is not only that this is not an ‘imposter’, but also that the person has some level of altruism or aligned / positive motivations. While some formulations use reputation as a stand-in for this additional notion of trust, I would argue that it is perhaps better thought of as an understanding of motivations. The trust is that it is understandable what game someone is playing, what their motivations are, and thus what their rational behavior will be.

    Narrow interactions, like those scoped in technical protocols, are intentionally limited to exclude externalities, but this also makes it difficult to understand if other nodes have ulterior motives in participating in the protocol. The analysis of what can be learned by a participant, and the other uses that can be derived from participation is not always easy to analyze, and the lack of completeness is unsatisfying. In contrast, the design of protocols to not leak information is difficult-to-impossible, and difficult to justify. Even the determination and understanding of risk present in a system is an expensive proposition.

    Categorizing mechanisms

    How do we build distributed notions that reflect this notion of confidence that another participant is also playing the same game as us?

    If we take the narrower view of actions within the protocol, we can get to a somewhat useful taxonomy of work in this space.

    • The bit-torrent tit-for-tat algorithm uses the demonstration from the other participant that they’re following the protocol as a signal to continue the conversation.
    • A set of protocols use a proof of work, or computational puzzle as a way for participants to demonstrate that it is worth something to them to participate.
    • Protocols like TLS have added revocation lists, and things shaped like “proofs of bad behavior” as ways to share knowledge of identities that have misbehaved. If the cost of creating an identity is high, and your misbehavior causes “reputational damage”, your rational behavior becomes more incentivized to follow the protocol.
    • Finally, there is emerging growth of validation-based protocols. Cryptographic proofs are increasingly able to provide an assertion that computation has been performed per the expected protocol, and reduces the space of valid-but-not-compliant actions that can be taken.

    The complement to this category are protocols that make use of external costs. In many cases the cost is difficult to quantify, which leaves modeling of the strength of the protocol trust levels equally difficult to pin down. At the same time, it means that there is the ability for costs to be higher relative to what could be built into a protocol in isolation.

    • Protocols which involve a validation of ‘real name’ (linking an ID, bank account, cell phone, etc) are able to retaliate for misbehavior using the legal system.
    • Protocols involving social graphs use the potential of negative impact to your standing with your friends.
    • Protocols requiring registration with a phone number, or who distribute their app only for mobile devices are leveraging the cost of those assets as part of the account cost.

    Increasing trust

    From the previous categories we can see that there are two ways that they end up leaning on for increasing this notion of trust.

    The first is increasing the cost of defection. Increasing the costs tied to creating or re-creating an account increase this cost. Impacting a reputation or decreasing utility likewise are ways to increase the cost of not following a protocol

    The second way that trust is increased is by increasing a user’s confidence that they will be able to succeed in getting resolution when another user defects. In most of the ‘in protocol’ cost models, resolution occurs as part of the protocol itself. Bit-torrent won’t continue rewarding peers that aren’t honoring the tit-for-tat agreement. Submitting a computation without a valid proof transcript will be ignored. It is the out of protocol actions where this subjective confidence is most at issue. Actions like Facebook suspending Cambridge Analytica (and publicized moderation actions more generally) demonstrate to users that enforcement is taking place.

    Full circle

    How do we provide decentralized notions of trust that can be dense and mesh with protocol needs for automatic establishment?

    By ensuring that the risk associated with a trust link is less than what can be mitigated when trust is broken. This can be done in one of three ways:

    1. The benefit of breaking trust can be reduced
    2. The cost associated with punishment can be increased
    3. Regularity (or user perception) of breaking trust leading to punishment can be increased

    Concretely, the hesitancy to form a mesh network comes most often from the lack of a concretely defined threat model. When a protocol comes with a well scoped definition of misbehavior, it is typically much easier to enforce compliance and to frame the protocol in a way that provides comfort to participants.

    It’s worth noting that we are often concerned with one of the hardest forms of this scenario – which is balancing the ease of participation in a system with the indirect and difficult to identify surveillance risks. Concrete examples of this tension are nation-state identification of Tor users, RIAA identification of bit-torrent users, or IRS identification of crypto currency users. In all of these cases, a user joining the protocol may behave as normal, but may also record network identifiers of other participants they encounter. An unaccountable out-of-protocol leaking of these known identifiers then leads to repercussions to other participants. I don’t know if the preceding discussion is the best framing in this specific case. I think it can be used as a lens still, but the interesting question here is mostly around the first point of reducing the benefits around breaking trust, and in reducing the signal that such an attack gets in the initial level of participation in the protocol.

  • The City

    Earlier this week I visited The City with a group of friends. It’s an interesting place, and I’m glad I took the time to experience it, as it provided a unique context to reflect on a set of more abstract ideas.

    The claim to fame of the city is that it is the largest art installation on earth – a mile by 1.5 miles of terrain sculpted over something like 50 years into an aesthetically pleasing ‘city’ – a series of gravel mounds and hollows each curbed and delineated by gravel roads. There are a couple of distinct sculptures within the space – brutalist/minimalist concrete structures, a series of triangles on one end of the city and a deconstructed, cantilevered cube on the other.

    The city is as much the experience as it is the physical art itself – each day one group of 6 people is allowed to visit by the foundation set up to administrate the exhibit. The visit typically involves a 2.5hr pilgrimage from the antithetical los Vegas up to the city, itself near Area 51 in the high Nevada desert. The city as a place is meant to be timeless – which is effected with a permanent crew to rebuild after storms lead to erosion, and to sweep the paths each day to erase the footprints from previous visitors.

    • There were a few primary ideas I took away from the piece while walking through it for the 3 allotted hours. I’m sure much of this is a reflection of the head space I was in, and aren’t intentional on the part of Heizer as an artist.
    • Insignificance – The scale of the piece, while vast, remains dwarfed by the surrounding Nevada mountains and what nature has created
    • Illusory – The artifacts which appear as coherent monuments from afar break apart into a much more fragile and hard to interpret components as one gets closer to inspect them.
    • Permanence – Despite all efforts, any attempt at permanence is doomed to fail, but that can’t and shouldn’t discourage the attempt to fight against entropy. I think there’s an argument for a preference for growth/evolution over permanence, but I think that’s beyond the experience I took away from this piece.
    • The essence of urban life – what is the emergent behavior between the individual participants and the overall experience of a city?

    The city, along with its other restrictive policies requires visitors to agree not to take photos. There are enough photos online to get a reasonable approximation of the experience despite this. It perhaps indicates this policy has been effective in limiting the use of the city as a canvas for selfies / other subjects, and maintaining its position as a sole protagonist.

  • Retrieval Constraints

    A couple months ago I wrote up some of the edges that I’ve encountered in thinking about how to structure decentralized data transfer systems. These are an extension of the limitations that were initially encountered in bittorrent style tit-for-tat exchanges, and have now matured into a much more extensive field looking at incentives and other mechanisms that can be leveraged to create robust systems.

    See the long-form essay on mirror

    My top take-away from this line of thought is that it does seem like within our initial framing of how data transfer might happen we end up still relying on reputation as a way to estimate transferability of experience, and in estimating trust for whether past behavior will continue to subsequent performance.

  • Coordination, or Attention

    A current meme is that one of the major points of limitation in our ability to execute is coordination systems. The claim, which is somewhat enticing, is that our communities are already incredibly powerful, but we lack the coordination systems to reliably be productive together, or to scale up the types of systems we can create efficiently.

    I think there’s a counter argument worthy of exploration that attention remains a limiting resource. Our lack of coordination is not so much a technical limitation of the systems we use, but rather that the other people we are coordinating with are often distracted, and don’t pay attention to where boundaries are set.

    This tension remains a core reason for why in person gatherings can be so energizing – they force presence by participants and capture attention more effectively than our technical systems. As our work becomes increasingly global this hack will become less able to capture attention at frequent intervals.

    How do we capture dedicated attention? One path could be through curating memes. Belief can be an effective driver of attention and focus.

    One of the paths I’m most excited about is curiosity. Effectiveness of puzzles and creating experiences to activate curiosity is a set of techniques that are not well integrated into how we work and coordinate.

  • Private Retrieval

    It’s very exciting to have a public face to the thoughts around how to enable effective private access to data.

    Research Announcement

    EthCC Announcement

    The basic hypothesis here is that there’s a high-leverage opportunity to attract thought around scaling the range of anonymous database or data transfer techniques to reach something with better properties that the systems we have today.

    I’ve learned a lot about what goes into running a grant fund already in my minor involvement helping to set up this program, and am excited to see the next stage of it’s lifecycle as we begin to engage with proposals and grantees.

  • Building Decentralization

    Building Decentralization

    I talked earlier this week on some of the current problems in decentralization at the rc3 event. It’s easy to be pessimistic about the current silo’d technological landscape, but decentralized platforms are continuing to make progress and there’s reason to be hopeful. At the same time, there’s a green field of many more decentralized protocols to discover and define beyond the current notions of DHTs and Consensus protocols.

    The RC3 event was a great commemoration of the traditional chaos congress. The extent of culture and community that was brought into the 2d virtual world managed to capture some of the essence of the in-person event. Like the real events, it was a great opportunity for mixing whimsy and technical learning. In that spirit, I rehashed some measurement work to generate the following statistics about the event:

    • The most common character accessory was wearing a mask, which were donned by 30% of participants.
    • The badge shown on the most user profiles was ‘On Webcam‘, a badge I awarded to a scraped list of usernames on the 2nd day of the event. It was about 3x more popular than the second most popular badge, received for visiting the CERT, which only functioned near the end of the event.
    • A total of 385 badges were awarded and publicly displayed on user profile pages.
    • A total of 334 distinct pronouns were used by users. Only 5 of them were attempts at cross-site scripting attacks.
    • The user population was approximately that of the recent in-person events. Of those, my measurement estimated about 1/3rd participated in the 2d virtual world portion of the event.
    • There were only 2 users who used the same description of themselves on their profiles: ‘Moin!’

    These statistics come from a fairly simple script that measured user pages near the end of the event. User IDs were largely sequential and could be enumerated without issue. This was needed as a step in awarding badges, which could only be done with the non-enumerable “usernames”, rather than these User IDs. One of the things that makes the CCC events unique is their transience, which allows for a safer form of expression than our more usual permanently logged and recorded online experience. In that spirit I have subsequently deleted my collected list of usernames and saved only these summary statistics.

  • Unlocking North Korean Karaoke

    Unlocking North Korean Karaoke

    I recently got the opportunity to understand what was going on with a Tianchi android KTV console with north korean content loaded on it. A description of the encryption and evolution of DRM protections associated with the device is published on the North Korea Tech blog.

  • What's Left for private Messaging

    What's Left for private Messaging

    I had the privilege to address the annual Chaos Communication Congress (36C3) in Leipzig last week about the state and remaining issues in private communications.

    The recording of the video has been made available by the CCC, and I have also posted the slides.

    The TL;DR for me is that many of the trade-offs are balancing the stability of user experience with privacy mechanisms – and finding more ergonomic user experience interactions will be as important as new systems schemes are to improving the ecosystem.

    I am particularly excited by the number of ongoing effort reducing trust in central servers. Many of the mechanistic trade-offs we face are due to the topology of our systems. With systems designed for fully anonymous interaction, like mixnets, PIR, and oblivious messaging, we can model and mitigate threats from much more realistic adversaries than we do with popular channels today. (For instance, consider an office which has received a whistle blowing message. If the receiving investigation wants to identify the source, they likely control both the local network, and have the ability to send messages to the account that initiated the conversation. Our current designs will find it quite difficult to protect a user from this scenario)