►
From YouTube: Relative Routing
Description
Presented at IBC Working Group: Genesis
Berlin, 2019
A
So
just
a
bit
I'm
gonna
just
start
with
sort
of
basic
orientation
sort
of
how,
before
the
Agora
stack,
how
goreck
sees
the
world
and
how
this
relates
to
what
all
of
us
are
discussing.
So
we've
also
had
in
mind
this
completely
cross-platform
world
chain,
multiple
chains,
non
chains
in
this
diagram,
each
each
individual
rectangle
is
a
physical
machine,
but
each
stack
as
a
logical
chain.
So
from
our
perspective,
the
chain
is
just
a
highly
credible
machine,
highly
credible,
logical
machine.
A
B
A
A
horn
is
just
like
a
classic
on
pbft,
with
no,
with
just
a
permission:
private
blocking
right,
a
colander,
yeah,
yeah
or
yeah
hyper
ledger
yeah
and
you
know
so.
We
also
want
to
be
clear
across
the
private
and
public.
We
just
want
to
be
crossed
everything.
Ok,
so
then
this
is
the
bat
level.
Each
phat
is
a
process
like
unit,
and
the
VATS
are
only
asynchronously
coupled
to
each
other
they're
just
sort
of
the
defining
characteristic
of
fat.
Then
we
have
multiple
vats
sitting
on
a
chain.
A
We
had
sort
of
this
internal
operating
system
like
way
to
convey
messages
between
vats
on
the
same
chain
and
then
between
chains.
We,
you
know
what
we
arrived
at.
The
Sun
was
between
callback
companions
very,
very
much
like
Ivy
City,
and
that's
that's
largely
what
I'm
hoping
we
all
reconcile
and
bring
together
into
one
mechanism.
A
Ok
and
then
our
application
layer
must
starts
by
built
by
layering
on
this,
a
system
of
this
object
capabilities
and
we're
using
the
JavaScript
language
to
do
that.
But
the
mechanism
is
actually
not
JavaScript,
specific
and
other
languages
can
play
in
this,
but
I'll
just
stick
with
JavaScript
and
the
key
idea
here
is
that
objects
that
can
just
point
at
each
other
with
regular.
B
A
This
is
layer
on
cryptographic
protocols
here
at
the
pointers
that
all
of
this
should
have
object:
capability
safety,
centers
that
all
of
these
references
are
capabilities
and
messages
between
objects
and
different
paths,
weather
or
the
remote.
If
they're
between
vets,
they
can
only
be
asynchronous
messages.
A
B
A
These
are
actually
I
can
talk
about
it
using
the
terminology,
I
learned
yesterday,
those
are
channels
these
are
channel
between
bets
over
here.
We
see
two
different
channels
between
this
chain
and
the
chain
that
this
guy's
riding
on.
So
these
would
be
multiplexed
over
one
connection
which
isn't
shown,
but
the
main
thing
is
that
on
every
intervention,
ection
was
good
at
this
level
we
can
think
of
that
as
a
channel
and
then
we're
multiplexing
multiple
object.
References
on
one
channel.
B
A
B
A
Is
what
object
you
objects
within
of
that
are
mutually
distrusting?
That's
are
mutually
distrusted
and
platforms
are
virtually
expressly,
so
it's
usually
suspicious
objects
and
mutually
suspicious.
That's
talking
to
each
Lee
suspicious
opportunity
to
other
mutually
suspicious
objects
or
mutually
suspicious
facts
are.
B
A
A
A
A
Then,
on
top
of
this,
we
build
our
you
rights
and
smart
contracting
lawyers,
and
there
is
a
loop
here
which,
which
we
consider
to
be
very
important
to
the
nature
of
the
of
the
rights
and
contracts
we're
creating,
which
is
smart
contracts,
manipulate
rights.
But
any
contract
that
unfolds
over
time
to
continue
to
participation
in
that
contract
is
itself
a
valuable
position
to
be
in.
We
want
to
make
that
position.
They
tradable
right
itself
the
right
to
continue
to
participate
in
the
contract
from
that
position
and
that's
the
way
you
get.
A
Jumped
ahead
there,
so
so
the
server
here
these
are
the
three
protocol
layers
of
our
system.
So
this
is
what
we've
been
calling
back
to
P,
which
the
trying
to
reconcile
five.
You
see
that,
on
top
of
that
we
build
cap
DP,
so
cap
DP
builds
capabilities
out
of
that.
That
TP
builds
that's
motive
machines
and
here
keep
the
builds
rights
and
smart
contracting
out
of.
A
Yeah,
so
the
key
thing
over
here
is
that,
because
the
we
have
this
generic
movie
right
that
covers
fungible
and
non-functional,
the
Troubles
covers
shareable
and
exclusive.
Just
the
range
of
variation
of
rights,
we're
phrasing
most
of
our
contracts,
so
they're
not
specific
to
one
kind
of
life
they
can
deal
with
any
life.
That's
described
in
the
air
to
pay
and
the
rights
to
participate.
The
contract
is
itself,
could
kind
of
right
that
is
described
in
a
RTP.
The
result
is
you
have
higher
in
composition?
A
The
rights
per
to
derive
rights
produced
by
creating
a
contract
is
still
the
cleaned
of
right
than
any
generic
generic.
We
parameterize
that
the
contract
can
accept
his
inputs,
so
you
can
easily
build
networks
of
contracts
will
give
you
this
slide,
yeah,
okay,
so,
let's
first
of
all
concentrate
on
the
object
capability.
Later
we
keep
the
key
mechanism
to
keep
transaction.
The
object
capability
layer
is
just
the
message
center,
where
object.
Alice
invokes
object,
Bob,
passing
reference
to
Kerala.
B
A
B
A
The
way
we
notate
the
immediate
cause,
that's
the
transmat,
it's
only
due
at
the
end
of
that,
and
then
the
bank
is
the
eventual
send
where
you
get.
That's
the
asynchronous
one
where
what
you're
doing
conceptually
is
you're
you're
queuing
on
the
cue
of
wherever
bob
is
whether
bob
is
local,
remote,
there's
something
there.
Each
of
that.
A
Those
people
with
an
incoming
message,
ping
you're
queuing
on
the
queue
of
that
host,
a
bob,
the
need
to
eventually
deliver
the
message
to
of
a
Carol
to
Bob,
and
each
of
those
cheap
messages
is
a
separate
atomic
transaction.
We
call
the
term
of
the
event,
and-
and
so
you
get
these
nice
tempis
nice
temporal
operation,
isolation
of
each
separate
eventual
message.
B
A
So
so,
if
you
thought
you're
only
doing
that
month,
objects
wouldn't
same
fat,
but
yes,
the
semantics
of
it
is
that
the
colleague
the
caller
is
completely
blocked
until
the
collie
is
done
and
there's
a
very
important
side
effect
contract
here,
which
is
they
have
opposite
pros
and
cons.
With
regard
to
reasoning
about
correctness
with
the
dot
on.
A
You
know
that
Muffit
that
no
side
effects
have
happened
between
the
caller,
making
the
request
and
the
collie
receiving
the
request,
then
that
it's
sort
of
an
instantaneous
transfer,
but
the
collie
is
receiving
the
request,
while
there's
call
stack
above
them
and
therefore
local
object
and
variants
might
be
suspended,
because
various
quality
callers
on
the
call
chain
might
have
suspended
in
variants
while
they're
making
the
clause.
So
it's
really
sort
of
useful
for
sub.
Go
where
you're
trying
to
do
something
as
part
of
a
larger
goal.
A
Eventual
send
you're
guaranteed
that
every
reception
starts
with
an
empty
stack.
So
all
invariants
all
look
local.
That
invariant
should
be
restored,
but
it
happens
an
arbitrary
time
later,
so
other,
inter
other
events,
may
have
interleaved
changing
state
in
other
ways.
So
it's
exactly
the
the
opposite
of
pros
and
cons.
B
A
Is
Saudi,
so
the
exclamation
mark
is
a
syntactic
sugar
that
we've
proposed
to
the
atmosphere
committee,
so
we
hope
that
it
actually
infects
bang.
We
hope
that
it
actually
appears
in
a
future
version
of
JavaScript.
What
we're
actually
doing
the
tongue
right
now
is
we're
we're
doing
something,
we're
writing
it.
Without
a
loop,
it's
been
using
function,
composition,
basically
we're
emulating
infix,
bang
approximately
what
the
band
would
be
sugar
do,
but,
but
but
the
in
fix
things
when
we
think
about
it.
B
B
A
A
A
So
bob
is
a
local
is
an
instance.
Variable
of
the
alice
object,
which
is
this
over
here,
represents
the
alice
object,
holding
a
local
instance
for
holding
a
part
of
her
state.
The
reference
to
Bob,
just
the
variable
Bob.
Well
as
the
variable
Carol,
is
this
dot,
and
because
alice
has
a
reference
to
both,
she
can
connect
it,
but
if
the
if
Bob
does
not
already
have
reference,
Carol
often
only
come
to
have
a
reference
to
Carol.
By
virtue
of
an
introduction
like
this,
we
use
the
phrase.
B
A
So
we
distort
it.
So
so
what
thank
you
stories
yeah
director,
so
he
can
cast
his
reference
on,
but
he
can
only
pass
it
on
to
destinations
that
he
himself
has
actually
right
so
so
and
which
is,
by
the
way
reason
I
emphasize.
That
is
a
tremendous
amount
of
the
access
control,
literature
that
ignores
the
ability
to
impose
controls
there.
If
Bob
despised
a
part
of
an
isolated
sub
graph,
then
we
give
him
Carol.
He
can't
cause
Carol
to
exit
the
subway.
We
still
have
this
containment
problem
so.
B
A
And
the
crucial
thing
that
this
that
this
slideshow
doesn't
help
visualize
is
that,
if
analyst
doesn't
want
to
give
Bob
full
access
to
Carol,
what
Alice
does
instead
is.
She
creates
an
attenuated,
an
intermediate
object
that
front-ends
Carol
prevents
part
of
Carol's
Authority
acts
like
Carol,
typically,
except
into
this
attenuated
way,
and
then
passes
Bob
access
to
the
attenuator.
So
the
classic
example
is
a
revocable
forwarder.
That
is
a
temporal
only
forward.
A
B
A
It
is
important
for
some
purposes
it's
important,
especially
under
partition,
so
if,
if
Alice
just
does
it
the
normal
way,
then
you're
exactly
right
about
what
the
consequences
that
the
intend
you
ater
is
running
in
the
same
fat
as
Alice
and
all
messages
can
Bob
then
go
through
Alice's
attenuate
in
it
now,
because
the
VATS
are
mutually
suspicious.
It
obviously
doesn't
work
under
the
normal
assumptions
for
Alice
to
to
create
the
attenuator
in
Bob's
vat
that
be.
A
However,
it
does
work
for
Alice
to
create
the
attenuator
in
that
city,
because
the
nature
of
Carroll,
the
nature
of
the
rights
being
attenuated,
is
according
to
that
see
in
water.
So
you're
not
there's
no
additional
vulnerability
by
putting
the
attenuator
there
and
you
have
better
connectivity
properties
under
partition,
except
for
one
issue,
which
is
if,
if
it's
in
that
egg,
then
no
matter
what
partition
happens.
Alice
knows
that
once
she
revokes
Bob
cannot
access
Carol.
A
B
A
Switch
which
the
which
basically
said
with
where
we
we're
in
a
proper
client
of
the
attenuator,
is
in
some
client
might
not
be
able
to
get
message
to
the
attenuator
promptly.
The
inten
you
a
term
reacts
to
need
millions
client
to
connectivity
by
falling
back
to
a
safe
state
which
would
be
to
stop
forwarding
messages,
no
yeah.
B
A
One,
unlike
all
the
other,
the
additional
processors.
So
if
you
have
the
trust,
assumption
and
Alice
is
going
to
trust
that,
even
though
she
doesn't
trust
Bob,
then
she
can
do
is
after
that
and
yeah
okay.
So
so,
with
this,
being
sort
of
the
general
object
object
relationship.
Then,
when
you
divide
this
into
bats
or
divide
this
into
platforms,
what
we
find
is
that
there's
exactly
five
ways
in
which
this
graph
can
be
cut
between
platforms
and
the
most
challenging
way.
One
is
this
one:
this
is
the
one
that
brings
up
all
of
the
issues.
A
A
Over
here,
I'm
going
to
do
a
simplified
form
of
tap
TP
that
predates
Brian's
work
on
this
point
set
on
where
you
just
have
a
single
tap:
TP
/
vet,
ignoring
the
local
operating
system
in
shape.
So
you
basically
have
local
SES
security
script
language.
Then
you
have
capped
EP,
serialization
and
serialization
around
that
and
then,
of
course,
you've
got
all
the
encryption
and
that
TP
stuff
beyond
that
which
I'm
going
to
I'm
just
going
to
assume
the
rest
of
the
presentation
until
we
get
to
name
it,
okay,
and
so
so.
A
In
order
for
Ellis
to
have
logically
a
reference
to
Bob
network,
she
actually
has
a
reference
through
some
bookkeeping,
incap
TP
that
goes
across
through
other
bulky
and
a
PPO
pair
and
goes
Bob.
So
these
arrows
are
sort
of
the
the
directions
represented
by
different
parts
of
bookkeeping
and
I'm
shown,
and
but
the
areas
are
too
big,
some
containing
them
into
that
notation
by
shining
the
arrows
first.
So
you
understand
what
the
directionality
is.
That's
implied
by
this
note.
So
basically
these
are
different
tables
and
because
chains
can't
keep
secrets.
A
A
We
just
see
lists
and
a
capability
operatives,
and,
if
you
don't
know
what
I
see
was
don't
worry
about
all
I'm
about
to
explain
so
bob
was
registered
in
the
bat
feed
export
table
at
some
number
it's
registered
and
corresponding
import
table
and
that
a
the
same
number
Alice
when
she
think
she
was
talking
to
Bob.
She
was
really
talking
to
a
local
proxy
for
Bob
that
just
locally
acts
like
he's
in
bed
to
be
portable
causes
the
serialization
that
gets
uncie
realized
at
the
export
table.
A
Looking
up
Bob,
you
delivered
the
thing
about
capability
safety
without
confidentiality,
but
with
authentication
is
that
when
that
B
receives
a
message
from
that,
a
that
B
can
tell
that
it
came
from
that
and
therefore
can
interpret
the
message
on
these
when
serializing
it
relative
to
this
text.
Okay,
so
a
so
that
a
can
pause,
Bob
to
be
invoked,
but
that
C
can
only
address
this
exploitative
and
therefore,
in
this
situation,
seek
not
invoke
Bob.
The.
A
The
that's
a
common
thing:
whichever
way
you
do
it
half
the
audience
will
think
it's
back.
Oh.
B
B
A
B
A
Channel
cannot
show
me
I
think,
but
basically
this
pair
is
match
with
this
pair
and
their
look
and
what
be
looks
at
up
based
on
a
validity
predicate.
The
message
came
from
that
see
in
placements,
so
in
that
drawing
bob
has
not
been
exported
to
see
right,
and
so
it's
not
in
the
table
and
that
way,
there's
no
expression
see,
can
make
to
that
be
to
invoke
an
operation.
A
B
A
B
A
A
Then
there's
two
additional
tables
here,
which
are
the
key
thing
to
doing:
a
no
secrecy
capability,
handoff
between
three
bats,
which
is
this
is
the
table
of
things
that
a
is
asking
see
to
provide
to
be.
This
is
the
table
of
things
that
feeds
asking
see
to
provide
2x
and
it's
a
handoff
table,
so
these
imports
and
exports
and
then
handoff
tables,
so
the
handoff
tables
are
really
about
directly
about
three
party
relationships.
A
A
Okay
and
then
that's
just
the
handoff
table,
explanation
I
just
gave
okay,
so
when
a
sentence
says
Bambang
clue
of
Carol,
please
that's
the
asynchronous
message:
she's
sending
it
to
the
local
proxy
proxy
is
part
of
the
cap
teepee
system,
so
it
causes
serialization
and
that
causes
two
messages
to
deliver.
The
first
message
is:
there's
a
message:
that's
not
shown
riding
on
this.
It's
not
a
message
to
Carol's
message
to
that
seat.
Basically
bookkeeping
mechanism.
To
that
see,
that's
that
gives
an
index
into
the
handoff
table.
A
A
A
This
is
an
adequate
example
to
bring
up
all
the
issues,
but
it
turns
out
it's
important
to
remember:
it's
not
specific
to
the
center.
Trying
order
comes
up
a
lot.
What
the
triangle
order
in
the
same
here
is
after
this
message
has
been
delivered
to
that
city,
then,
hey
is
telling
me
asked
that
see
for
what
I
left
for
you
at
the
number
Carol
a
to
big
and
then
deliver
foods
Bob
with
that
argument,
so
that's
effectively
with
being
encoded
there.
A
Says
where
that
being
says
to
that
see
after
this
message
has
been
delivered
to
you,
then
it
asks
that
see
what
did
that
a
leaf
for
me
at
the
index
Carol
ate
a
bit
now,
because
this
whole
system
is
asynchronous.
What's
imagine
that
that
C
is
actually
offline
it?
So
all
these
messages
are
just
hanging
out
with
some
store-and-forward
infrastructure
and
might
not
have
been
delivered
yet.
A
Okay,
now:
here's
where
the
trying
interesting
crime
that
we're
engine
comes,
which
is
that
a
tried
to
admit
the
message
on
this
route,
but
maybe
for
whatever
reason
it's
not
getting,
and
that
being
wants
to
send
this
message
over
here
after
the
message
arrives,
but
wants
to
take
its
own
responsibility
for
ensuring
that
this
message
arrives,
so
that
its
continued
liveness
of
other
messages
after
this
one
doesn't
end
on
that
a
succeeding
at
getting
this
message
to
that
city.
Good!
A
So,
what's
going
on
here
is
that
the
all
of
the
unacknowledged
messages
in
that
a
to
that
C
direction,
specifically
different
acknowledgments-
and
this
is
a
low
level
place
where
the
acknowledgments
become
really
important.
There's
all
the
unacknowledged
traffic
from
A
to
C
gets
encapsulated
in
and
as
a
as
an
additional
payload
in
the
message
that
went
from
A
to
B
and
the
right
way
to
think
about.
A
This
is
in
various
certificate
authorization
system
like
spooky,
Sunday,
there's
a
certificate
chain
and
the
certificate
chain
grows
as
the
delegation
this
one,
the
certificate
chain
is
always
being
truncated
by
further
acknowledgments,
but
it's
growing
with
regard
to
the
unacknowledged
traffic
in
a
very
similar
way
as
a
certificate
check
for
for
chain
of
delegations.
So
this
message
carries
the
same:
encapsulated
unacknowledged
traffic
was
the
unacknowledged
traffic.
If
that
C
gets
the
traffic
redundant
Lee.
A
Obviously
it's
that
C's
responsibility
to
detect
the
duplicates
and
reject
the
redundancy,
but
that
way
once
B
receives
receives
the
message
with
with
the
unacknowledged
for
a
to
be
traffic.
C
can
take
responsibility
for
making
sure
that
those
messages
get
to
be
get
to
see
ahead
of
further
messages
from
beta.
So.
B
A
A
As
far
as
that
bee
is
concerned,
all
of
this
unacknowledged
traffic
doesn't
need
to
be
understood
by
B
at
all.
It's
just
here's
a
bunch
of
crap
that
a
is
telling
me
just
go
ahead
and
send
this
to
seed
ahead
of
further
a
to
see
further
B
to
see
traffic.
That
is
provoked
by
receiving
this
message
for
me,
and
it's
a
responsibility
for
that
crap
for
that
blob
of
stuff
to
make
sense
to
validate
a
city.
A
As
having
come
from
a
so,
even
though
it's
so
there's
a
real
separation
sort
of
physical
routing
versus
logical,
it's
it's
just
that
this
is
where
we
get.
The
weird
abstraction
late
across,
which
is
in
this
scenario
in
some
sense,
be,
is
acting
as
a
physical
router
for
this
message,
but
validation
wise.
This
message
is
only
coming
from
a
B
is
not
in
the
validation
chain.
For
this
message,.
A
B
A
Right
so
yeah,
it's
clearest
when
you
think
about
these
as
encrypted
traffic,
which
doesn't
apply
to
public
chains,
but
where
each
of
these
would
be
lets
say
a
separately
secret.
Keeping
in
point
you
can
encrypt
traffic
to
then
this
would
just
be
encrypted
by
a
for
C
would
be
having
complete
complete
non-visible
in.
B
B
A
A
A
Will
if
it's
happening
before
the
redundant
delivery
of
this
message,
there's
no
problem
because
then
to
deliver
its
message
came
later.
If
it
happens
after
the
delivery
of
this
passage.
Well,
then
this
message
came
first,
there's
no
violation
for
so,
in
both
cases,
there's
no
violation.
What
happens?
There's
messages.
A
B
So
the
existing
systems
mostly
been
built.
Don't
you
yes
right,
he's
to
the
extent
I'm
do
not
forward
unacknowledged
traffic
from
A
to
B
to
C
the
the
the
bees
ability
to
communicate
with
see
will
depend
on
in
C
catching
up
right,
and
so,
if
there's
a
partition
between
a
and
C
you're,
all
right.
So
so
this
is
entirely
a
robustness
for
done
the
optimization.
Well,
no
there's
also
trust.
A
A
A
It
means
that
one
of
the
entities
can
cause
a
logical
partition
where
the
partition
was
not
exhaustless,
so
in
other
words
you're
yeah,
so
so,
with
this
redundant
traffic,
he
never
has
to
wait
on
a
to
continue
talking
to
say
and
and
without
this.
This
thing
then
be
a
can
induce
a
partition
effectively
between
B
and
C,
and
that's
an
attack
say.
A
No,
no,
no!
This
is
any
further,
even
if
they
and
C
are
already
connected
further
traffic
from
A
to
B.
That
needs
to
be
about
states
of
Carroll
that
are
the
successor
states
of
Carroll.
Having
processed
previous
messages
from
Alice,
then
that
has
to
force
those
prior
message:
messages
from
Alice
to
get
delivered
so
that
the
stateful
assumptions
in
the
carrying
the
Carroll
reference
and
the
foo
message
of
preserved
after.
A
B
Okay,
so
Mike
wait
that
everything
that's
handed
across
is
true,
resolves
the
results
or
protects
against
these
issues
up
to
the
point
of
completing
these
hands.
Yes,
okay,
which
means
you
couldn't,
for
example,
just
saying
you
know
what
I'm
gonna
just
include
the
previous
ten
messages
and
I'm
need
acknowledgement.
I
just
assumed
my
rate
is
kind
of
up-to-date
to
the
extent
that
it
is
correct
about
the
messages
that
that
a
will
hand
to
be
to
redundantly
provide
some
protection.
B
Right,
if
that
a
included
some
messages
that
happen
to
be
acknowledged,
oh,
that
would
be
harmless.
That
would
be
harmless
right.
So
my
if
it
happened
to
not
include
some
messages
that
were
actually
unacknowledged,
that
it
is
not
succeeded
in
providing
as
much
country's
contacts
head
protection,
but
it
is
provided
some
well.
A
So,
in
that
case,
what
happens
is
it's
a
z',
a
what
a
told
thee
to
deliver
was
supposed
to
have
been
adequate
for
me
to
continue
talking.
So,
if
a
didn't
provide
what
was
adequate,
that's
on
a
and
therefore
B
can
continue
talking
to
see
after
it's
delivered,
whatever
a
asked
them
to
deliver,
because
it's
no
longer
being
no
longer
has
any
obligation
to
wait
for
for
a
coordination
with
that
meeting.
B
Yeah
supposedly
possible
yeah
I
know
he
was
getting
to
what
whether
or
not
we
acknowledge,
but
that's
too
far
than
me,
so
we
frame
this
in
the
terms
of
data
availability.
If
I
understand
this
correctly,
what
we're
doing
here
is
saying
that
we
want
data
availability
of
a
subset
of
estate,
oddly,
insofar
as
it
will
relate
to
known
transactions
between
B
and
C.
Yes,.
A
B
A
So,
in
the
worst
case
is
that
it
is
convert
or
an
expense-
it's
probably
quadratic,
but
these
chains
keep
getting
truncated
by
acknowledgments
and
in
a
blockchain
situation
where
the
partition
boundaries
are
orthogonal
to
the
replication
batteries.
Typically,
then,
as
long
as
B
is
in
a
partition
where
it
can
see
that
you
know,
but
this
is
a
message
that's
obligated
to
be
delivered
to
C,
then
B.
That's
that's
addict!
That's
an
adequate
storage
for
B!
You
have
to
know
about
this
message,
so
it
can
cause
it
to
be
delivered
ahead
ahead.
B
A
So
so
so
there's
a
bunch
of
engine.
So
in
the
case
where
you
just
have
infinite
logs
for
chained
participants
and
you've
got
redundancy
that
crosses
partition,
boundaries
which
are
useful
for
read
purposes,
they're,
not
useful
for
update
purposes.
If
you're,
not
innocent
majority,
on
the
partition
but
they're
so
useful
for
read
purposes,
then
a
lot
of
the
engineering
can
make
one
of
these
overheads
go
away.
But,
logically,
this
is
the
availability
of
okay.
So.
B
A
A
Copying
out
of
the
tables
to
the
individual
entries
in
the
table
only
live
for
the
handoff.
It's
only
the
entries
in
these
tables
that
are
longer
and
at
that
point
you've
completed
the
delivery
of
the
message
to
Bob
and
Bob
has
a
reference
through
all
the
bookkeeping
account.
So
the
key
issue,
the
key
naming
issue
by
which
the
object
layer
crosses
into
the
underlying
IBC
layer,
is
the
issue
of
naming
the
NCLEX.
It
might
be
that
before
this
happened,
that
B
had
never
heard
of
that
scene
and
that
C
had
never
heard
of
that
B.
A
A
So
so
there's
this
general
notion
of
a
self
event,
cating
designator,
which
is
a
name
for
something
where
the
name
gives
you
all
of
the
information
that
you
need
to
figure
out
whether
something
was
allegedly
the
thing
that
the
name
names
whether
that
actually
is
the
thing
so
the
most
later
example
of
that
is
a
there's,
a
cryptographic
hash
of
just
a
mutable
data.
The
hash
gives
you
everything
you
not
need
to
know
so
that,
without
relying
on
any
other
Authority,
you
can
now
validate
that
alleged
data.
Is
the
data
designated
that
designate
over
here?
A
We're
not
talking
we'll
talk
about
designating
these
active
objects?
So
the
name
has
a
salt
for
the
name
to
be
a
self
authenticating
designator
it
has
to.
It
has
to
tell
you
two
things:
it
has
to
say
how
to
send
to
the
name
thing
and
how
to
so
that,
so
that
so
that
the
main
thing
will
receive
the
message
and
treat
it
as
something
that
was
legitimate
consent
and
then
how
to
receive
from
the
main
thing
so
you're
only
so
that
you're
validating
that
alleged
message
from
that
end.
Point
actually
is
the
message.
A
So
for
the
single
machine
end
point
systems
were
just
just
a
one
to
one
TLS
connection,
which
the
self
offending
designator
is
just
a
public
key
thing
and
we're
stuck
there
no
longer
doing
that,
even
among
single
chains,
because
it
just
doesn't
generalize
so
where
you
treat
each
message
individually
as
something
to
be
encrypted
and
signed,
or
decrypted
and
verified
that
works
between
endpoints
in
a
way
that
generalizes
to
let's
say
just
permission
quorums
but
then
for
general
chains
to
talk.
A
A
So
where
did
these
names
show
up
long,
which
is
the
system
with
global
names
like
public
key
fingerprints?
Then
then
this
thing
has
the
name
egg,
and
it
knows
the
name
be
insane
over
here.
C
knows
in
the
initial
conditions
here
seen
those
than
they
may
be
know
the
name
a
but
see
does
not
know
the
name
B.
He
does
not
know
the
name
safe.
A
So
when
C
receives
this
message,
the
message
contains
the
name
of
B.
So
at
this
point,
C
learns
the
name
of
day
and
likewise
with
that
message
being
learns,
the
name
of
C
and
by
learning
them
see
it
sets
up
the
you
know,
start
setting
up
the
connection,
tries
to
establish
a
connection
to
say,
like
YC,
Christ
established
connection
fee
and
keep
the
key
thing
that
enables
the
state
to
succeed.
B
A
B
A
A
Because
so
B,
when
it
hears
about
see
from
a
it,
starts
setting
up
a
connection
and
setting
up
a
connection,
it
sets
up
the
your
the
talk
and
listen
devices
over
here
and
you
also
contact
C
and
ask
seed
set
up
a
connection
back
to
it.
I
mean
basically
to
be
the
counterparty
and
so
C,
instead
of
being
coming.
Part
of
the
connection
has
to
establish
the
bookkeeper
to
be
the
counterparty.
So
an
incoming
the
counterparty
learn
this
name
be
this
part
of
the
connection.
A
Do
you
think,
is
that
the
B
name
that
appears
this
way
has
to
be
check
at
the
same
as
the
be
named
in
tears
over.
There
doesn't
have
to
be
bit
for
bit
identical
and
that's
that's
important,
because
with
stateful
stateful
things
where
you're
tracking
the
latest
state
you've
heard
about
the
chain,
you
need
so
basically
as
a
prefix
trucking,
then,
if
one
one
name
is
a
valid
prefix
of
the
other
name,
and
you
can
always
update
to
the
latest
Navy
percent.
A
Okay,
now
now
I
can
get
to
a
question
that
you
asked
yesterday
that
caused
me
to
do
a
whole
bunch
of
work
on
the
slides
last
night,
which
is
the
in
a
case
where
we've
got
routing
through
hubs
for
purposes
of
chain
validity.
That
chain
validity
is
semantically
significant.
A
reaching
be
through
H
is
logically,
very
different
than
a
directly
validating
big.
It's
because
now
it's
it's
a
weaker
trust,
a
is
depending
on
its
ability
to
validate
age,
depending
on
agents
claims
about
having
validated
big,
and
so
so.
A
This
thing
so
far,
I've
only
presented
names
as
absolute
leaders
and
the
absolute
names
doesn't
deal
with
on
how
you
name
things
when
you're
naming
things
from
the
local
position
so
now,
rather,
if
you
think,
if
we
think
of
these
names
as
being
global,
coordinates
in
some
kind
of
abstract
space.
Well,
we
now
want
to
do
is
to
is
to
forget
about
global,
coordinates
and
think
about
local
address
where
one
something
that's
given.
That's
in
one
position
in
the
abstract
space
is
trying
to
do
relative.
Addressing
of
something
that's.
B
B
A
So
I'm,
okay,
I,
haven't
gotten
to
peg
him
if,
okay,
okay,
good
so
I'm
good
I'm,
almost
done
with
this
one.
Something
that's
good
so
what's
going
on
here,
is
that
the
thing
that
a
now
knows
as
Nancy
is
just
yeah
and
we're
just
using
as
an
analogy
of
vector
space.
So
he
knows
the
displacement
from
A
to
C
as
a
vector
in
that
direction.
It
knows
the
displacement
from
A
to
B
as
a
vector
in
that
direction.
What.
B
A
B
A
Vector
space
as
an
analogy
look
I
will
deconstruct
the
analogy
of
a
material,
but
the
analogy
I
mean
I,
couldn't
think
about
this
until
I
thought
in
terms
of
the
analogy,
then
I
was
able
to
be
constructive,
so
likewise
she
knows
the
direction
together
to
get
the
a
that
doesn't
know
anything
about
being
vice
versa.
So
it's
the
same
knowledge
relationships,
but
now,
just
with
regard
to
relative
naming.
A
So
in
order
for
a
Patel
see
about
B.
Well,
we
have
this
logical,
subtraction
operator
and
what
the
subtraction
operator
means
depends
on
the
concreteness
of
what
what
we
mean
by
this
analogy
to
vectors.
So
whatever
we
mean
by
vectors
that
we
mean
we
mean
subtraction
in
that
space.
Sorry!
So,
given
that
a
knows
these
two
relative
names
that
does
the
subtraction
to
get
the
name
finished
all
see
to
explain
to
see
how
to
get
to
B.
A
It
does
because
what
we're
talking
about
is
self-authenticating
designators,
where
we're
talking
about
the
names
have
to
serve
the
role
of
self-authenticating
designating.
It
has
to
tell
C
enough
that
C
can
validate
big
and
and
but-but-but
hold,
that
question
I
get
to
the
slide
that
answers,
but
but
don't
drop
the
question.
A
Okay.
So
having
calculated
this
now
without
any
any
global
names.
For
that
it's
basically,
you
know
I
say
to
you
where
now
it's
pronouns
relative
to
the
collection,
when
the
thing
that
you
will
that
gets
in
that
direction
from
you
asks
you
for
this
index,
give
it
the
character,
and
likewise
does
a
subtraction
that
way
and
says
to
be
when
the
thing
in
that
direction,
for
you
apps
for
for
karele
to
be
I'm.
Sorry
ask
it
to
pick
up
the
thing
that
that
way
that
this
guy
left
for
it
at
Carroll,
a
big.
B
B
A
A
A
You
got
so
then
be
in
order
to
formulate
the
message
to
to
see
pick
up.
The
reference
does
its
own
arithmetic
to
figure
out
how
how
C
would
get
back
to
a
and
then
the
key
thing
is
that
these
two
are
the
second
and
two
identities
complete
the
hand
off
through
the
hand
off
table.
Okay.
Now,
let's
deconstruct
the
the
vector
metaphor.
A
So
let's
take
a
look
at
some
possible
subtract,
logical,
subtraction
operators.
Well,
one
is
that
if
X
logical
subtract
Y
is
just
X,
then
what
you've
done
is
you're,
don't
you're!
You
just
have
to
have
your.
This
is
sort
of
these
general
case
of
just
absolute
names
right.
So
when
you
want
to
deal
with
absolute
things,
you
just
defined
that
subtraction
operator
now
you
just
had
to
absolutely.
A
B
A
So
this,
basically,
if
this
is
how
I
get
to
one
slide-
and
this
is
how
I
get
to
the
other
side-
then
work
explain
to
the
get
to
over
here.
To
get
that
side,
you
do
the
flip
each
of
these
in
directionality,
and
you
also
put
them
in
reverse
order
and
then
basically,
you
explain,
get
retrace
the
path
to
get
back
to
me
and
then
go
for
me
to
the
other
guy.
So
then,
you're
always
moving
back
through
yourself.
A
A
This
cannot
be
in
any
demint
in
any
trust.
Nestle
sense
worse
than
this.
This
is
clearly
better
than
this,
because
once
we
have
this,
you're
no
longer
dependent
on
a
and
there's
no
way
in
which
you
have
a
dependence
of
trust
dependency.
Here
that
you
didn't
already
have
you,
so
you
can
always
simplify
these
things,
these
things-
and
this
is
in
fact
what
you
wanted
to
explain
to
see
as
a
validation
chain.
A
A
Okay
and
then
we
can
compose
these
things.
So
this
is
minus
absolute.
This
is
minus
tap,
so
we
can
suppose
a
minus
absolute
path.
By
saying
pair
of
designators,
X
X,
1,
X,
2
minus
compose
y1
y2
is
posed
with
a
compose
the
P,
so
the
algebra
have
nice
compositional
property,
and
this
is
exactly
what
we
want
for
our
case,
where
in
fact,
each
endpoint
has
an
absolute
name
and
has
a
chain
validity
path,
and
we
want
to.
We
want
the
composition
of
these
things.
To
explain
to
see.
B
A
A
B
A
To
see
okay,
so
right
so
good
to
think
the
key
thing
is:
what's
the
required
starting
knowledge
so
that
everything
else
can
be
derived
from
the
starting,
a
knowledge
and
so
over
here.
The
only
assumption
is
that
a
starting
knowledge
is
a
validation
path
from
A
to
B,
which
clearly
he
needs
to
have
since
a
is
perceived
to
already
talking
to
me.
It
must
already
know
some
validation
to
get
things.
B
B
A
A
Yeah,
that
would
be
the
special
case
where
it's
just
a
hub
topology,
but
this
basically
you
can
have
an
arm
traits
apology
and
what's
going
on
here,
is
if
there's
a
joint
point
where
from
there
you
can
go
to
a
through
something
on
some
other
path
and
come
back
again
and
then
go
to
see.
You
can
truncate
the
part
where
you
just
go.
Basically,
you
can
truncate
the
self-contained
loops,
just
get
rid
of
the
loops,
and
then
you
have
half
excluding.
A
A
If,
if,
if
C
connects
to
be
through
through
another
path,
let's
say
from
a
separate
different
hub,
then
that
different
hub
has
different
trust
assumptions
and
and
because
of
those
different
trust
assumptions
before
the
using
the
validator.
That
Aid
is
not
endorsing
that
chained
to
be
through
h2,
but
is
not
valid
interpretation
by
C
of
the
introduction
that
a
members
even
even.