Whiteboard Series with NEAR | Ep: 18 Tal Moran from Spacemesh |

Captions as YouTube publishes them, usually machine-generated, so product and people names can be misheard.

1. 0:03

   hi everyone this is Alex from near with me today is Professor Tom Moran from space mesh and we will talk today about the protocol we'll go into a lot of technical details so now would you like to introduce yourself and give a very brief overview of the protocol yes sure hi everyone I'm tell I'm a professor IDC of Xillia in Israel and my area research is not surprisingly cryptography so I've been working on cryptographic protocols for a

2. 0:32

   pretty long time and a few years ago I got interested in blockchain and actually you know discovered like this amazing satoshi nakamoto blockchain protocol that solves these open problems in Byzantine Agreement by sort of sidestepping the issue and it was very interesting like there's amazing stuff but there are lots of big problems so I started thinking about you know what we can do how can we solve these big problems and the the main

3. 1:07

   problems that I was trying to solve where I guess one is scalability right so a nakamoto's blockchain protocol basic has this inherent scalability limit you can't get it's not what it is right now so that seven transactions per second is below the sort of inherent limit but you still you cannot scale it as far as you'd like to do the way the protocol is built so want to try to deal with that there's a problem of security

4. 1:43

   and this this actually comes in lots of different things so I'll get a bit deeper into that later there's a problem of energy costs right and specifically when we talk about proof-of-work it's horrible right it's it's great in terms of like it's a nice idea you can verify it it has lots of good properties but energy cost is not one of the good properties and that's also inherent you

5. 2:07

   can't make it more efficient to get lower she costs and not only is it bad for the environment which is already quite a bad thing it's also expensive right the system has to support itself which means the higher the cost of mining the higher the transaction fees have to be so these are all three things I want to talk about then there's the issue of fairness which these are all sort of interconnected and by fairness there are several things here I think maybe the

6. 2:39

   thing that is the most annoying right if I want to join Bitcoin now I can't actually use my home computer to mine it's just totally impractical and unprofitable and it it cost so much and I have to wait so long until I get it it's just there's no way for me to join unless I'm willing to actually spend a lot of money and there's this giant difference orders of magnitude difference in terms of how much it costs me - mine is sort of a small user versus how much it cost me to mind if I have enough capital to buy you know an ASIC

7. 3:10

   if I can locate a factory in a country with low electricity costs and low cooling cost things like that so these are the issues that were trying to deal with by redesigning the core protocol so what are the things that space mesh does or maybe before we get to that let me say one word about security right the whole point of a cryptocurrency is you don't have to trust any one entity you

8. 3:40

   don't have to trust the government you don't have to trust some you know small committee of users that control the system you need to trust something a lot more reasonable say there's an honest majority of users or not or but and the math behind it is good but when the system gets very complex and all these systems are very complex even Bitcoin which is compared to most systems very

9. 4:07

   simple it's still quite complex it's very very hard to be confident that the math behind it is good so even you forget about the implementation problems which is a whole issue of itself right so even protocol though the math is good the implementation can be bad but just getting you know this assurance that we're running a protocol that works that's not easy and I think any modern

10. 4:31

    photographer won't really trust the protocol unless it has a security proof now security proof doesn't say no this protocol is secure we don't know how to do that unfortunately what we do with the security proof is reduce this protocol that the security of the protocol from something like trust me this is a good protocol or you know I've tried to break it and I can't which is not a very you know confident inspiring assertion to a small set of assumptions that ideally have been studied for a

11. 5:05

    long time by very many people and and we can be much more confident and then you get a statement of the form if these assumptions are true then mathematically we can prove that the whole protocol is secure and it gets us these nice guarantees and again we have to say formally exactly what we mean and I think in in crypto currencies at least personally I would not trust any protocol that doesn't have this form of a security proof because history has taught us that you know when you design

12. 5:36

    a system even if you do have a proof it might not be secure but if you don't have one it's almost invariably broken in some way ok so this is just an aside about as security what are the assumptions actually that we need so one one assumption that we always need is this honest majority so in fact if we want to get consensus when there is a malicious adversary there is this mathematical proof from the 70s basically that we have to have enormous majority and the what they said

13. 6:12

    in the 70s or you need to prove we can prove that it's impossible that anonymous majority and this is why it seems so impossible to get this type of cryptocurrency on the internet where you know anybody can come up with as many identities as they want right and then they they can't we can never guarantee you know its majority on the Internet until Satoshi who came up with a sigh

14. 6:36

    that now we can instead of saying the odds majority of users we have an honest majority of resources so I'm saying resources here and not CPU oh she said CPU but we can generalize this and we always mean some kind of resource to base the system on and what spacefish does is it replaces this proof-of-work resource with what we call a proof of space-time what is the proof of space-time it's a proof that I stored some data on my disk basically I used part of my disk space for a period of

15. 7:20

    time slightly similarly to proof of work I'm not doing anything useful with my disk space right I'm storing junk on it but I can't use that part of the disk for anything else and why that space-time it's not enough to say that you know I have a disk with you know one terabyte free because if I can reuse that disk every five minutes for something else then I'm sort of not bounded by how much resources I can use so the actual resource that costs me is how long I do

16. 7:52

    things and if you think about you know how we buy storage right say you're buying storage from Amazon right you pay by disk space times how long you want it for so this is what this proof of space-time does so that's one one change that space measure does we want to replace proof of work with proof of space-time this has two effects well it has more than two but you know two important ones in terms of of this one okay we got rid of the energy costs why

17. 8:22

    because storing things on a disk doesn't cost energy we can just keep the computer even turned off right and the the disk just doesn't take up energy okay this is everything I'm going to say has me with this little caveat of course it's not doesn't go to zero there are some energy costs you need to create the disks you need to do other things and specifically you also need to spend some

18. 8:46

    energy initialize the storage and this is in some ways inherent in this kind of proof because if I want to prove to you that I stored something big but at the same time I don't want to send you everything right I want to say I can or I don't want to have to download this one terabyte from somewhere on the internet in order to get it then I want to be able to generate myself but if I can generate it myself and fill the disk what prevents

19. 9:15

    me from generating it proving that I have it and then erasing it all and next week when I need it again I just regenerate it right so now I haven't used disk at all I just used work and the whole point is we don't want people to use work so we want to make it a rational choice to actually keep things on your disk and in order to do that we make it expensive to initialize so basically you're doing an initial proof

20. 9:38

    of work in order to initialize this disk space and after that you just prove that you're still holding it so in theory you could always just erase it and then redo the initialization but that costs you the proof of work money right so it's expensive to do that and it's going to be much cheaper to store it for the period of time we're asking you to store it for so basically there is some

21. 10:04

    initial energy costs but if you amortize it over the time you're going to be using the storage then it's sort of arbitrarily close to zero okay so this is said one thing is gets rid of energy cause a second thing for how long do you usually store something on the deal so again the final parameters aren't completely fixed or like a lot of knobs that you can tune and part of what we're going to be doing in test net is you know fixing these parameters the current parameter is set to something like two

22. 10:30

    weeks yeah so every two weeks you're going to have to prove that you're still storing this data so this also has to do with fairness why because first of all there aren't these orders of magnitude differences in costs between you know discs that I buy as a consumer and discs that say somebody who has a lot of capital combined it's not to say there aren't differences Amazon can buy discs for a lot cheaper than I can buy but it's not you know three orders of magnitude difference but

23. 11:03

    the main thing here is that if I already bought a disk and a lot of people you know have reasonably you know powerful computers they come with you know two terabyte four terabyte disks and they use very little of it so if I already bought the disk for a different purpose and I have it at home and there's you know two terabytes sitting unused the marginal cost for me to fill up this two

24. 11:27

    terabytes is actually much less than Amazon's cost to buy a new disc so if I'm doing something trying to you know mine at scale then my cost is going to be the cost of discs and as a home user it's going to be harder for me to compete with that but if I'm a small user and I just want to use my left over space then Amazon can't compete with me because my marginal cost is basically zero and basically what we are hoping

25. 11:57

    this has is the effect of generating a very long tail of users so instead of having this problem where you know once big parties big players come in then the small players are pushed out they're priced out because they can't compete anymore we can have big players and small players coexisting so it's a fair distribution we can have this sort of long tail and ideally we'd have you know

26. 12:20

    some big players but many many many small players so that the some of the space contributed by small players is actually in the majority right this is the ideal we're not completely sure that this will work out but you know the protocol obviously doesn't care about how the distribution looks as long as it's sort of distributed enough now why do we care that it's distributed enough

27. 12:44

    let's go to the honest majority assumption right so our assumption instead of assuming there's an honest majority of CPU space of CPU power we're assuming that the majority of the space the disk space is controlled by honest parties and having this long tail makes this a lot more reasonable right if you have only five parties controlling you know 60% of the resources then it's a

28. 13:13

    bit iffy to say yeah we ABB's we trust our trillion dollar economy on the fact that there aren't three of them that are colluding to do something bad but if you have no 800,000 people controlling this it seems a lot more reasonable yep but quick question here right it's a quick question here the show time I'm honest participant right so realistically I will be contributing something on the order of one terabyte right yes that's the upper bound of how

29. 13:45

    much probably probably not Yeah right so I feel today for example has 15,000 full nodes not just mining nodes but it's like everybody who has a full fully sink state right so let's say spaceman spaceman has the same order of magnitude that means that the malicious actor needs to have on the order of 15 petabytes right of space so we're hoping actually for like in order to have magnitude more miners than this and I think part of this is it so a full node

30. 14:15

    is something that sort of not really rewarded right if you're not mining it's it's like you're contributing things to the network it's already amazing that you have that many full nodes and you know not that many miners right the people actually like to contribute here but in our case it's actually going to be a lot easier to get in as a miner right and I think this sort of low barrier to entry is a big difference

31. 14:38

    between us and and other systems which means I think we have a chance of getting this very large number of miners and actually distributing it in a more fair way okay so we talked about fairness I'm not going to cross it up we actually get fairness the the other thing that connects fairness to security is something we call incentive compatibility which is is it actually rational to follow the protocol

32. 15:12

    instructions right when the protocol says do this is it - you're in your best interest to actually do that and why is this very important because when you say we have an honest majority that's an assumption but what we were saying is people behave honestly but if it's actually better like personally for me to behave dishonestly I get more money by doing something bad is it reasonable to assume that actually

33. 15:37

    a majority of the people will behave honestly and I think in the cryptocurrency sit it's not very reasonable it's much more reasonable to assume that people behave rationally though everybody will do something that's in their best interest and so what you want to prove for this type of protocol is that doing whatever is in your best interest actually is the honest protocol you don't you don't lose by following the honest protocol or at least you know you can't maybe you lose

34. 16:03

    a tiny bit but you won't be you know feel feel like you're being taken advantage of by being honest here and this is a problem so like Bitcoin for example is provably not incentive compatible right if you say withhold blocks then you are helping yourself there's actually a papers out you know showing this a specific attack of how you can do it like what's the best strategy and it turns out it's a better strategy than just publishing the block when you get it but if everybody actually followed this best for

35. 16:36

    themselves strategy of withholding the block and only publishing once they see somebody else has published things like that then the security of the whole system just breaks so first of all you know even though there is this attack on Bitcoin we don't see people doing it so there there are sort of you know other orders of magnitude to play maybe people think that you know if they attack the

36. 17:00

    system this way they might get more you know in the near term but then the whole Bitcoin thing will crash and they won't get sorry you know there are other factors but but also don't you need 25 percent of the cash power executed yes but you know some tools have the Samara so in theory there are entities that could launch these attacks and right now they're not but you know do you want to

37. 17:25

    trust your system to sort of the goodwill of the people it's it's not going to be clear it's much much better if you can actually prove that it's instead of compatible so one of the things we want to do is show that our system is incentive compatible this is one of that so Guiding motivations when developing space mesh okay so now maybe we'll dive in a little bit into the the core of the protocol so we said one change we made

38. 17:55

    was we replaced as proof of work with proof of space-time the other big change we made is we replaced chain with a mesh what do we mean by a mesh a layered dad so instead of having one block every on average ten minutes we now have many many blocks so we think something like 200 again this is a final parameters can be tuned but this is the current thing we're working on for test net so we have

39. 18:28

    many blocks and each of these blocks in say layer 10 this would be layer 11 point to the blocks in the previous layers okay we have many blocks per layer in order to guarantee this fairness and incentive compatibility what we want is for these blocks to be in some sense symmetric so there's no one special block that is the leader and we use that block but there's a set of blocks all the honest blocks if you're

40. 19:05

    supposed to generate a block in layer 11 then your block will get it it will definitely get in if you're behaving honestly and which means that all these attacks are an incentive compatibility where I'm trying to prevent you from doing things in order to get me to something better they stopped working because basically improved you cannot prevent me from doing anything and also if you behave honestly you'll get your reward but without knowing the protocol yet right but it feels like some sort of

41. 19:36

    attacks where everybody in layer 11 somehow manages to agree to you can order this block because because that that means the total reward distributed will be lower okay so so that's a good point so again we're assuming an honest majority so the honest majority assumption means that you know here we have a majority of blocks that are going to agree to vote for this so whenever there's an honest

42. 20:02

    block the majority of the blocks and the next layer will still vote for this what will will the producer of this block lose anything if everybody else voted for this block but they did not know all right so so for them specifically it is it is a rational behavior to vote for fewer blocks right no they don't gain anything by doing it right so okay so what we get in terms of like the formal guarantee is something that we call an epsilon Nash equilibrium it's a little

43. 20:33

    bit stronger than that because in a regular Nash equilibrium it holds that if everybody else is honest the best thing for you to do is to behave honestly - and by epsilon Nash we mean the best thing but you might lose like some tiny Epsilon okay so what we get is something stronger if a majority is honest we don't need everybody to be honest even if there's like you know a third of the network that's behaving maliciously not just you know rationally

44. 21:04

    but you know completely trying to do bad things it's still worthwhile for you up to this epsilon to do the right thing and the idea is this epsilon is small enough that for instance the costs of writing your own code to behave maliciously it's just not worth it and so then it becomes reasonable to actually assume that there's an honest majority and the sort of yourself perpetuates but then the question is let's say there is somebody who is

45. 21:33

    sufficiently powerful to have so I guess as an honest participant I'm not creating block in every at every layer right I'm going okay ting but let's say I'm sufficiently powerful to have multiple layers in a row just like layer of 10 11 12 would it not be ideal for me after generating the block full there Tam shut down my network you know to save resources and just create block in eleven and twelve that only approves my

46. 21:58

    block in the previous layers does make sense and to so your think to get network resources right so like I don't want it because networks to cost money right and I need to store those blocks locally so I don't know if it matters that much because you know blocks 10 11 12 or 5 minutes apart its current parameters so like if you have several layers okay you keep your computer on for another five minutes I'm

47. 22:21

    not sure it's it's part of the Epsilon yeah obviously you know we're not going to be covering every type of like slight denial of service attack because you just cannot there are some things that again they go into this epsilon you can make a tiny bit more if you do things that you know if you consider the fact they're full nodes that don't get any reward right now and still contribute

48. 22:44

    then it seems reasonable that this won't happen too often and as long as it you know this this bad behavior is limited to say one third of the of the space then our proof says that you know we'll still get consensus and we'll get liveness and you know everything will be good cool so for sure we're diving into the consensus say dive into consensus so first before we get into consensus what

49. 23:08

    exactly are we trying to get consensus on and what are the challenges so when we have this kind of mesh what we're assuming is in terms of what the adversary can do are trying to overestimate the adversary trying to say we're going to prove that even with some super powerful adversary and by super powerful I don't mean in terms of the fraction of the network but in terms of what its capabilities are like controlling the timing of the network right this is one of the most difficult

50. 23:38

    things to overcome so even with this kind of a very powerful adversary we still are going to get our good properties consensus and lightness and the main thing that the adversary does to attack is it can basically decide on the order and timing of messages that the honest parties see so it's not completely unrestricted otherwise nothing would work we were assuming in terms of our network communication assumption that honest parties will

51. 24:12

    always where they're all connected to the same gossip network and say within 30 seconds anything that I see on the network every other honest party will see or if I send something on the network and if any other party or every other honest party will see within 30 seconds but if you said something and I sent something or maybe I sent two different messages then the adversary can make sure you get one and then maybe you'll get the other one only 30 seconds

52. 24:37

    later and maybe some other honest party will get the second message first and the the first message 30 seconds after that so you see things in a very different order which means one of our guiding principles is we don't want to use the timing of messages in order to to rely on that to get consensus because we don't agree on it and even more than that we don't want to have to sort of

53. 25:02

    record the time in order to decide what's in consensus and what isn't because this is not something I can prove I want this really nice property that Bitcoin and also aetherium have that if I wake up say the Sleeping Beauty wakes up after a hundred years and now you know somebody says this is the state of the block mesh she can decide if somebody gives her a different state of the block mesh he can decide which one is right without having to trust them that you know I was there I saw that this came before that right

54. 25:34

    that's not something you can prove so the actual consensus state depends only on the messages I receive not on their order so what do I need to decide you need to decide for each of these layers so each layer has a number right so this is layer 10 this is layer 11 this would be layer 12 and and in each layer there are many blocks on average say 200 and each block says which layer it's in so this block says it's in later 11 this block says it's in layer 10 it could be

55. 26:05

    in terms of time that you know honest parties will always transmit blocks on time so when I say maybe one thing that's a bit different here our layers are five minutes apart exactly it's not a probabilistic thing so every five minutes there's a layer at ten o'clock there's a layer 10:05 there's a layer so the the layer number actually corresponds to an actual real time okay so I say this block is at

56. 26:28

    what happens if I publish a block over here but I claim it's at layer ten so this should not be something that's accepted right because if this actually was in layer ten then I'm changing history because I'm already at layer thirteen at this point so we need to decide which blocks are actually in the layer they claim to be in and which are not so we call this the validity of the

57. 26:50

    blocks for each layer we need to decide no you know these are the valid blocks and some blocks are invalid so these are invalid blocks and we always want to maintain the property that the honest blocks will always be agreed to be valid for the malicious blocks we don't actually care so they could be valid they could be involved basically if you're doing something bad maybe will invalidate you if you behave honestly you'll be valid if you sort of behave

58. 27:24

    somewhat in the middle then maybe yes maybe no what we care about in this case is only that all honest parties actually agree okay so how do we agree and maybe one more thing about the challenge is so we said if something is over here it's sort of easy to see okay this is definitely not supposed to be and everybody agrees that it's not in and this is sort of the easy case and if

59. 27:48

    something it goes exactly on time again it's an easy case everybody will agree that it's it's supposed to be in what about if it's somewhere in the middle so said that there's like this five minutes right every five minutes there's a layer what happens if the adversary on purpose sends a block that's here for 12 yeah so yeah it sends a block for 12 that's here so it's between 12 and 13 and it makes

60. 28:12

    sure that some honest parties sort of put it before the threshold and some honest parties put it after the threshold so now honest parties won't agree exactly on where this block is and this is the difficult case that we have to we have to resolve we have to still get consensus on it but the separate question which I guess is like a different level would that not require some trusted source of time no it just required okay depends what you mean in some sense yes

61. 28:44

    we require that all parties agree on the current time within some reasonable balance so when we said we assume that you know honest parties see each other's messages within 30 seconds then this sort of includes in it the differences in clocks so suppose we have in your a three second difference in our clocks still by your time you've transmitted something it's ten I should receive it

62. 29:09

    before No ten and thirty seconds according to my own clock so this three second thing goes in right but the argument is if space mesh becomes multi trillion-dollar blockchain it will be significantly cheaper to corrupt in TP NTP servers right then to corrupt so adversary will just grab the NTP server and make sure that the discrepancy in time is like five hours so that's not so easy right

63. 29:33

    you're right it the the the interns implementation the protocol has to sort of ensure that it's keeping time accurately and so the implementation can see that time is jumped by five hour hours that will never happen right this is like there's no time zones or you just need this absolute how long has it been since Genesis so I think this is not an insurmountable problem and in fact this problem does occur in other systems as well right you do need real time to be vaguely in sync in almost

64. 30:04

    every blockchain protocol I think yeah so there is this sort of very weak trust assumption in terms of my clock is more or less okay you're right okay so so how do we get consensus so if the the high-level what we're going to do is we're going to vote so what I'm going to describe now is sort of this very very inefficient protocol that so gets the security right but in terms of practicality it's like you know N

65. 30:36

    squared complexity it's horrible so our protocol actually does the same thing but we optimized it you know several steps so it no it's actually much much better in terms of communication in terms of CPU or you know so it actually makes this practical but for the sake of you know understanding what going on it's much easier to describe it this way so what do we do every it's a different-colored so nice thing we have lots of colors every block is going to basically vote about every other block

66. 31:07

    in previous layers so all of history and I want it sort of point to all of the blocks that I see and for each of these blocks I'm going to say is this a valid block or is this an invalid look and if I don't point to a block it means I haven't seen this block so I'm basically saying this is invalid so I don't need to explicitly point to blocks that I'm explicitly voting against and then what we do is we collect the votes so we

67. 31:39

    count the votes the votes are actually weighted so they're weighted by sort of how much resource I expended we'll get into sort of how do we decide when we're eligible to generate blocks exist I think one of the interesting things that's different about our protocol but basically now we're counting and then the majority decides so this is great for all of those things that we all agree on the majority is going to decide that is honest so the majority will decide in the same way so if there's an

68. 32:12

    honest block everybody is going to vote for it and if it's sort of far enough in the past then I vote according to what I see so if I see the majority voted for it I'm going to vote for it as well after I can I can change my vote in the future layers no just whenever I have a new block it votes but that so for example I produced block here and I thought this is valid but then later when I was producing blocking layer that

69. 32:35

    key I can change it yes yeah I saw I saw that majority of people disagree with me I will say so you count all the votes up till you know the current time and this gives you sort of your own opinion about all the previous blocks and then your block will say what is your opinion about at the current time about every previous block and so if all the honest parties agree that this is valid then in the next layer they will count the votes all of the honest parties will agree

70. 33:00

    that this has the majority valid so they'll all agree that this is valid and this majority will just grow and and then as within a few layers it will just always converge yes and and in fact because these layers are very big it's again it depends on exactly how much probability of area are willing to tolerate but for like 2 to the minus 40 probability of error and you know 200 blocks per layer even if one-third of the blocks are

71. 33:25

    voting completely differently within four layers you're completely converted in this case so this is wonderful and then you could have that basically the same argument as why bitcoin can't be reversed it happens here right you have the probability that you're going to sort of change the majority it depends only on how many votes the margin of votes how many plus versus how many - and the fraction of the resources that

72. 33:51

    the adversary controls and so this is actually going to happen much faster than Bitcoin so in Bitcoin right we have this one block every 10 minutes but here the margin grows by 200 blocks every five minutes so so once we were in this good position then you get really really fast convergence but then it feels like the following would work right so let's say these five five validators right

73. 34:15

    validator score 5-5 block producers and let's say that at the first step it happened that and there's like particular block we are getting about and that block was produced on the boundary yeah so I didn't get to the boundary yet this is the hard case right what I've just described so far is the easy case right everybody agrees right if it's in or if it's out and then we get conversions like that so that's great but the whole point is how do we decide about these and actually in this

74. 34:47

    case it turns out it's a really big problem and this is a really big problem in all these protocols and here we can't use sort of Bitcoin solution which is there's going to be one true block that will decide and we'll all agree on it because there's only one right so there's going to be many so it could be that you know in this layer half the honest parties vote for it and then half

75. 35:11

    the honest parties vote against it okay now in the next layer the adversary will put another block here that votes for it and another block here that votes against it and if half the the honest parties see this one in half see this one first and all those blocks as well and they all see these because these are honest block then again this this split can continue you only need one block here to do this right so you can continue this forever so this is bad we don't want this case okay so what do we do so this this is

76. 35:44

    what we call The Tortoise protocol there's another part of it that I hope I'll get to talk about later it's an important part of it but for the sake of the overview let's talk about the hare protocol first so the hare protocol basically is this really fast bootstrapping method to get us to agree on these blocks and it really happens off chain so it still uses the gossip network but the results of the hare

77. 36:09

    protocol are only recorded as votes on the chain so what is the hare protocol maybe yes sir why do we call this the tortoise protocol because it's it's very robust it's a bit slow and we'll talk about what do we mean by slow until now it just sounds fast but it's you know sure that's the important thing right it guarantees irreversibility and you know this ticks and everything once we have agreed on something it will stay agreed what does the hare protocol do what it

78. 36:41

    does is we select a different committee so here we have basically these these blocks are subsets of all of the users right that are selected to generate blocks for the hare protocol we use just completely different committees but in a sort of similar way we select a random committee the hare committees are actually a lot larger so the hare committee is going to be something like 800 committee members and

79. 37:10

    then well they could all use a Byzantine agreement protocol to decide about all these blocks so basically at every layer boundary we start a new independent Byzantine agreement protocol a new hair protocol that decides on all the blocks in the previous layer and then instead of voting according so in the hair protocol I vote according to whether it's on time or not into my own opinion but because it's a Byzantine agreement at the end all the honest

80. 37:40

    parties are guaranteed to agree and now the rest of the honest parties who didn't participate in the hair protocol they see the results and they vote according to the results of the hair protocol so now all honest parties are going to agree on this it might be an it might be out we're not sure right but the hair protocol is this property that if all honest parties agree on something that's going to be the output if they don't agree we don't know what output is going to be but we do know that they will agree on it so there's a little wrinkle here

81. 38:06

    something that we want is to prevent these denial of service attacks and here we use a trick from Al Gore and or similar to Al Gore and where we're sort of assuming that if there are lots and lots of players you can't you know do not DDoS everyone but if you know that somebody you know said something in a previous round and they're going to talk again then you can focus on their IP and then just kill them and and this is the problem so if you have you know a

82. 38:38

    protocol with 800 committee members and they need to talk for several rounds which they do because Byzantine protocols you need several rounds of talking then after the first round you could kill all the honest ones and now you're left sort of you don't have an honest majority in this anymore so so we use the the al-quran trick of player replace ability basically we have several rounds but at every round there's a different committee which is totally independent of the previous committee and this is really really fast so we can do it on average again it

83. 39:09

    depends if we're under attack or not if we're under attack we do it I think something like two minutes or no maybe five minutes average I think so is it like a bit less than the layer time if we're not under attack it's much faster but if it's five minutes isn't it too late for the for the blood producers here it's eight layers no so maybe there's two minutes yeah we did the calculation so that it so in the optimistic case it actually happens early enough that the next layer

84. 39:43

    can use it in the pessimistic case then it might not be finished for this layer so if you haven't seen the hare protocol results for this layer then instead of voting sort of directly you say look I'm still waiting I don't know what the results are for this layer and I'll vote for the previous layer instead but because they're an average it takes very few rounds and you know this is like the

85. 40:08

    this long time is if you have one third of the out of the network being actively attacked by the adversary this is when it can take this 8-round average so we assume most of the time this is not going to happen because it doesn't really it's not a rational thing to do right it's just if you weren't trying to take down the network but you know you can't take down the network so you can

86. 40:31

    just slow it down a little bit so so this is what the hare protocol does and basically now we get agreement and then the tortoise ensures that okay this agreement is now going to be set in stone because the majority just grows and grows okay so said there's another important property of the tortoise protocol which is it has to do with security I think is something important for protocols in general is what what is the robustness

87. 41:01

    of the protocol and by robustness I mean we said our protocol is secure as long as their assumptions hold but we want this protocol to run for a very long time right so what are our assumptions we have this connectivity assumption we have the honest majority assumption and we have some mathematical assumptions like you know the same things that other protocols use no sha-256 is collision

88. 41:25

    resistant and behaves in you know certain ways and yeah you know you can't break a lip to curve signatures and things like that so for mathematical assumptions then you know they're either broken forever or not and we're sort of summe that they're going to keep holding on for a long time and this is a very common everybody does that but for the other assumptions their assumptions on behavior unlike real life things right and an honest majority means what people

89. 41:49

    are actually doing it's not something we can proof and you know there is some very low probability that things will happen that will violate these assumptions suppose there is a giant a giant you know power outage right all of China is is now without electricity all the computers go down so suddenly we don't have an honest majority okay for a few hours or maybe somebody got somehow a short spike and managed to hack into

90. 42:19

    AWS and use all their disk space and you know also into Google at the same time they're using all their disk space for a short period of time too late they're caught so you know these things could happen they're very very low probability so we don't usually protect against them but if you take a long enough period of time then low probability events will happen right you think about lightning strikes right the probability that

91. 42:45

    lightning will strike you know at this moment here is super low it could happen but it's very very low but the probability the lightning strikes somewhere in the world is actually not that low at all right lightning does strike all the time all around the world so we have to have our system be robust in the sense that if these bad things happen we don't want to say okay now the system is dead because over a long enough time they

92. 43:10

    will happen so we want okay what can we guarantee if the you know everything bad is happening the adversary hacks into all the world's computers and changes everything okay then there's not much you can do but if there's like power outage and I mean lost honest majority for a while so the adversary can do all sorts of bad things but at the very least we want the system to sort of

93. 43:34

    write itself after so now now that there is an honest majority again we're back to you know our assumptions are holding then we want to at least guarantee that we're in consensus again right we don't want some kind of manual intervention to be necessary and to decides it's like then there are three somebody who's deciding what is the new consensus this is a bad thing for this distributed system that and requires that we want to require

94. 43:58

    very little trust so we have something that we call self-healing mode and basically what self-healing mode is is the tortoise can work without a hare protocol at all and the the tortoise protocol works only based on the messages I see so after we you know if we had a network split or if we had you know some bad things and maybe I didn't see all the messages you didn't see some of them after we're connected again there's an honest majority again we all you know exchange all the messages all

95. 44:32

    the history saw so now we're going to agree again that's the store to see the the hair protocol so you don't need the hair protocol okay so it only sees the the block approvals like votes the the what I said that the hair protocol just bootstraps our agreement for voting in the tortoise but once the the hair protocol is gone I don't actually need the hair protocol messages to agree on on what the state is so what I'm going

96. 44:59

    to do is basically we're in agreement so first of all it just from the fact that the the tortoise protocol result is a deterministic function of the messages I see means that if we're not under attack if we have one layer that you know was quiet nobody attacked at all then we all saw the same messages then we're already in consensus and we just agreed completely because we saw everything but if we are under constant attack after

97. 45:30

    this still so maybe a low-level attack so self-healing in our protocol actually requires some slightly stronger properties so you know usually were robust against one third corruption so here you might need know maybe it at most I don't remember what the numbers are right now but like one six or something like that so you know you what do we mean by one thing we only we don't need the

98. 45:54

    adversary to corrupt that amount we say it doesn't attack with more than that amount so even if it's corrupted one-third but it only attacks with one six then self-healing will work and basically the way self-healing works is we we modified this voting protocol so this this happens all the time right this is part of the core tortoise protocol that we changed in order to allow self-healing so what I said here is not exact it's not that we just have a simple majority what we're doing

99. 46:26

    actually is we have three states so if we look at the margin of votes so this is the vote margin all right so here would be all votes plus here is all votes - okay and this is zero this is an equal number right so here what we said before was basically that like the name thing is this I think is a plus and this I think is a minus in order to allow self-healing we're going to use a kind of trick from sort of classical Byzantine Agreement protocols we're

100. 47:07

     going to change this and we're going to add something around the zero so that now this is a plus this is a minus and here we're going to do something differently we're going to have a coin flip and this coin flip is going to be what we call a weak coin flip where everybody agrees on the coin all the honest parties agree on the coin with some constant probability say you know one-third okay and sorry 2/3 everybody

101. 47:55

     is agrees on the coin with probability 2/3 and so with probability 1/3 everybody agrees that it's zero with probably one-third everybody agrees that it's one and with probably one-third that can decide they don't have to agree the adversary just says what each honest party thinks is the coin and the property we have about this vote margin this property that we maintain is that honest parties can disagree right so an

102. 48:20

     honest party if it's here it means it sees you know a lot more plus than - and if it's here it sees a lot more - than Plus but how why can y do honest parties disagree they can only disagree if they receive different messages basically they're counting votes so you and I can only disagree if by this much right if we the weight of the met of the votes that we disagree on is at least this much but this is bounded the weight of the votes that we disagree on right we

103. 48:50

     never disagree on honest blocks because those are a guarantee that we see them together so we only disagree on the dishonest blocks that are published in the past short period so basically what we're saying is you can't disagree by too much because the honest the the adversary cannot generate too many dishonest books but it could still be the case that one honest party is here

104. 49:13

     right and another one is here yes so so right so what we're saying is we're bounded right you can disagree by less than this right so it could be that an honest party is here and one is here it could be that there's an honest party here and one here but but it can't be that these two are honest buyers okay and now the the coin flip basically is a plus or a minus so let's suppose we're in this case it's symmetric for the other case if we're in this case then

105. 49:44

     this one will always say Plus this one we'll use the coin now with probability 1/3 right all the honest parties will see the coin as a plus so with probability 1/3 all the honest parties are going to agree but that means that in the next round right there they're going to see a majority voting in the same direction and so basically one in the next round all the honest parties are going to shift so they're going to be here and and now we can get basically to full

106. 50:19

     agreement so okay but probably the two thirds this doesn't happen but in every round sort of independent we we have this good case so if we're in the bad case then we're just back to where we started and this means that you know very very fast you you will have by very fascinating you know one third to the to the N when n is the number of layers is a probability that you managed to sort of miss out it's our two thirds today

107. 50:44

     yes right so this this goes down exponentially fast so so pretty fast but exponentially fast it's still number of layers this is why we say that the torte is sort of slow but sure right it it's much slower than the hare protocol which is immediate but if this doesn't work nicer if the hare protocol doesn't work this will still guarantee consensus and once we have consensus then the hare protocol will start working again and

108. 51:08

     then we'll get there we'll be back in the good case so we have this sort of automated mechanism to heal from from bad things okay maybe I will talk a little bit about how we decide eligibility because I think that's something interesting and it's different from how other protocols do it so most protocols that we know basically do this random sampling right they say every block or the like the the block

109. 51:38

     that is going to be generated or these protocols that doodads have like a set of blocks or committees right everybody sort of self select in some way whether they can join the committee and we randomly sample them and this is how they get into the committee in our protocol we actually do it a little bit different we're going to do it deterministically and the way we do it is we have when you start out right you're

110. 52:15

     doing this proof of space-time so you need to generate space we have initialization but once you do that every time you only need to prove every two weeks that you've stored space and this proof goes into something that we call an ATX an activation transaction may be transaction is not that you know completely good name for it because these are sort of like they're freestanding they don't have to be inside blocks so you don't need to convince somebody to put this in their

111. 52:46

     block for you to join right you just publish it and everybody sees it and this ATX contains a post if we have time I will talk about exactly which kind of there's some subtleties here and it contains these sort of a commitments to where I'm going to generate blocks so we divided the layers into a box of two weeks so every 4030 two layers or whenever and in order to generate blocks

112. 53:20

     you have to publish an ATX in the previous set book so we have you know an epoch now you generated an ATX here this makes you eligible so now you're active means you're eligible to generate blocks here and you're actually guaranteed deterministic a so everybody is going to publish one ATX in every epoch every miner and this guarantees that you get to publish a block here where is this block publish so this is randomized

113. 53:54

     basically and part of your ID is a vrf key verifiable random function so your idea is this public key and the next thing about a verifiable random function is it's a function that when you give it an input it gives it an output that looks random to everybody else but you can prove it's the correct output and you cannot control it there's only one correct output so this Viera is basically going to decide which layer your block is in so

114. 54:26

     what is the input the input that's a very good point the input is basically your ID that's the part of the the vrf public key the layer number sorry the the epoch number the epoch number M and an index I where I is so here you're going to commit to the number of blocks the number of blocks you can decide what D is up to some parameters you can get into that in a bit okay so basically if

115. 55:05

     you know the epoch in advance you do because epochs just epoch number is one two three and the index so this is the first block in that half of the second block and so forth then you know we're in the epoch going to be but I say but let's say I want to put a lot of my hash bow sorry just power into the same spot I can grind you can write on your IDs yeah yes so that's bad you're right so

116. 55:28

     there's actually an extra thing here which we call an epoch bacon so an epic bacon and it's actually quite a bit weaker than most beacons it's something that all the honest parties agree on it's something you cannot predict when you generate your ID so actually you only become actively in that after the first epoch beacon that you couldn't have predicted in advance after you published your first ID so grinding doesn't help because you don't know what this F of beacon is going to be but at the beginning of the epoch you

117. 56:05

     do know exactly where in epoch you're going to be published but they have an epoch beacon we need to have some sort of consensus on a trade okay so so we need consensus for the honest parties so there are several ways to do it so the easiest way is to use a vdf so we just say you know use the vdf that should run for two weeks right after two weeks this is the output and then you continue iterating this for them

118. 56:30

     two weeks you get an output and everybody can verify that and there's there's only one true answer and you can't get it before the week so this gives sort of perfect parameters but there's a big cost to it you have to trust the vdf and all the VD FS we know of require these sort of new algebraic computational assumptions or trusts and setup or they're not super nice in terms of what we have to assume to get them to

119. 56:54

     work so you know everybody is using be DFS they're they're you know amazing mathematical objects but I'm not sure we might end up using them just because the parameters in some sense are better but but we can actually do it without a PDF because the problem here is that we're sampling right but we do have this advantage that over an epoch we're not sampling right we have these eighty X's are basically deterministic everybody

120. 57:27

     registers and we know for sure that there's an honest majority of 80 X's for sure by means if our assumption holds of course so we can use that to have sort of each 80 X vote for say the next F box beacon and it's it's not quite that simple but we can get a protocol that gives you a very little influence all right the adversary you might be able to do a little bit to change the the beacon but it can't do too much and

121. 57:57

     the other nice thing is that you don't actually we know you don't need to prove that the epic beacon is something you just write in your ATX this is my beacon number and the protocol we have these sort of modifications of the voting rules so that if you're using the wrong beacon I don't count your vote or at least I don't count your vote for a while I postponed it so that it doesn't

122. 58:22

     actually help you if you concentrate your power yeah so so I think one of the nice things is is that we have this deterministic guarantee you're you're definitely going to get a block so how many blocks you actually get so you can get how many you want you can get lots and lots of blocks you can get a block in every layer if you want and if you do that you might be considered invalid in the sense that you're not going to get a

123. 58:52

     reward so the right number of blocks is basically see how many people are registered the previous set booked and then set the number so that the average number of blocks per layer is 200 right but we don't verify that you don't use too many blocks actually the only thing we're worried about is using too few blocks why because if everybody is spread out across the layer but you have

124. 59:17

     all your power in one block then again you have this problem where your voting powers can be concentrated in a few layers but but this you can show that you can't have too few blocks by basically showing how many people are registered that you see right so if you see very few people registered you need many blocks because it means you need many blocks per layer in order to to get to one block you need to see that there's a lot of weight already there and the honest parties will also see it

125. 59:45

     so they'll also just use one block earlier I actually have one other interesting question so as the protocol goes right we have some sort of stability as of let's say five layers ago right but the last five layers they pretty so it depends if work on their attack and how heavy the attack is right in in ideal conditions then maybe already the previous layer is under intense if we're under one third of the

126. 1:00:17

     chain is being one third of the powers attacking us then occasionally we'll get a hair protocol that takes longer to so then we might have like the few previous layers are not yet in consensus but within a layer is there specific order in which blocks are applied yeah okay so that's actually a good question so what we decided we're doing so far is just deciding which blocks are in the lair and how do you get from that to like a total order

127. 1:00:46

     on transactions right because this is what we need to run smart contracts or to do things like that and basically what we're saying if we agree on which blocks are in the lair then it's easy we can decide to or whatever arbitrary rule we want say we order them by their hash all right and this is the order and transactions another thing that I didn't mention but transactions actually um ideally you know they'll have different

128. 1:01:10

     transactions each block but they could be duplicated because this block and this block don't talk to each other while they're generating so the idea is everybody chooses a random subset of the transactions you have fairly little overlap so you're actually going to get a high throughput but there could be some duplications so again we have this some kind of rule to say and so the the transaction counts as the first place

129. 1:01:34

     that appears in a block or if you want to randomize it you can think of you know you take all the blocks together pool all the transactions and then do some random order but there is a reasonable actor right will they not prefer to choose transactions which have the highest no so you don't get the way that the reward system works is you don't get rewarded directly for the transactions you put it there the rewards are shared first of all among

130. 1:02:00

     the layer and actually also among neighboring layers so that you don't have bad incentives like I want to you know not include this in this layer because I know I have a block in the next layer and there are fewer various things like that so so we sort of spread out this thing so yeah you do want to include that if there's like too many transactions to include which i think is you know this would be wonderful here

131. 1:02:24

     you can like the limit and the number of transactions is very large so in general you just you have everything inside and then it doesn't matter which ones you chose but if you do get to the case where there's you know too many transactions to fit even here then you you want to incentivize sort of everyone to choose a slightly higher value transactions but yeah this is it's not

132. 1:02:48

     like a I want the highest one and everybody will choose the same one because overall it's actually better for you to coordinate so that everybody you'll get as many transactions as possible and not just the one that it's heist okay so this is like a very high-level overview and yeah and your other specific things so I can talk a little bit about how this proof of space-time works because this is this actually this paper is already out it was accepted to crypto so it's now an

133. 1:03:21

     ePrint you can read it and it will be presented in the conference in August okay so let's recap what we want to do with a proof of space-time right I want to prove to you that I'm storing a lot of data and I'm storing it you know consistently for two weeks and then another two weeks and the basic idea is I'm going to fill my disk with junk but I need this junk to have special properties so for

134. 1:03:58

     instance one property that I want this junk you have is that it's incompressible that is I shouldn't be able to you know store some small seed and be able to easily recreate this junk and so what is incompressible say random data that's incompressible right but I can't just show you that I stored random data because it could be that I actually didn't store a random data I stored pseudo random data which has a very small C that lets me generate it at all

135. 1:04:30

     so so what do we actually store what we're going to do here is we're going to store the output of proofs of work and they're going to have this special property that they're incompressible so I I have this giant table right and each cell of the table is going to be a proof-of-work so generating this table is going to cost me work it's going to be expensive right now we're talking in something of the order of you know two days on a GPU to generate this time and it's important

136. 1:05:04

     that it's expensive because if it was not expensive then I could decide not to store the data and just generate it again every time so in order to make it rational for me to use this space-time resource then I want to make it expensive enough that just storing it and not touching it yeah it's good so I want to make that the price of regenerating higher than the price of storing it for two weeks and that's pretty easy because storage is quite cheap so so this two days should have

137. 1:05:34

     sort of a nice margin and in fact it might be even a good enough margin for like commercial services where if you want to pay Amazon to store for it's still cheaper to do that than to to generate it regenerate it okay so this is what I'm storing how do I prove to you that I'm storing it so the like the native first attempt is okay so what are the what are the challenges that it's proved so they're going to be your ID yes we have an ID all right so say the

138. 1:06:05

     challenge here is write your proof of work ID and index all right so this will be your ID and one your idea and two and so forth so this is going to be hard to generate we have these property that you cannot compress the output but now what what do I do I two weeks have passed I maybe I even somehow you know committed to this is like the first neiva temped and now I ask you and now you say oh

139. 1:06:38

     okay fine show me your story show me you know three random places in the table okay so if I've committed in advance a with a Merkel tree then I can I'll have to show you three random places actually have to have these random places at the table but that's actually not a good proof of space-time why because I can decide not to store the table but just recreate those specific three things you asked me about so so that's going to be bad right I

140. 1:07:12

     want to force you to store everything but we're going to do something almost the same so it's a very very simple proof what we're going to do is we're going to say let's say this is your table okay I'm going to give you a challenge after two weeks and you're going to create a Merkle tree where the hash function uses the challenge so I'm going to hash instead of just hashing the two leaves I hash the challenge and

141. 1:07:43

     then the two leaves okay so the regular Merkle tree would be you know a and B and here's a challenge in a and B and and I do that in the same way right until I get the root okay now I'm going to describe an interactive protocol so I send you the root of this tree and then you give me these random leaves and I have to show you a path in the Merkle tree so this actually does prove that you stored the data why are they at

142. 1:08:15

     least that you had most of the table all right so to get an idea suppose you only had half of the table you decided not to sort happen you don't have to while you're building this tree you have to commit in advance to which parts you decided to regenerate in which you didn't so if you only regenerate it half right then with probability 1/2 every time I ask you I'm going to land on one of these leaves that you didn't regenerate and so I'll catch you but

143. 1:08:39

     with the note let's say it's one terabyte of data right isn't computing this Merkle tree will be like on the wardrobe okay so good good question so so you do have to go over it's one linear read over the depending on how much memory one or two linear reads of the memory to generate this tree it's not so bad for one terabyte of data the hash we use the proof of double the proof of work here uses a much heavier hash and when you do the miracle tree you actually don't need to do each of

144. 1:09:14

     these the output of the proof of work is actually quite small so you don't even need to do all of them you can batch them together so it turns out in terms of actual parameters it's not too bad it might take you I don't know 10 minutes half an hour depending on the size again it's like if you're a magnetic disc but it's all linear it's like sequential rate so it's it's not bad but you're

145. 1:09:41

     only doing this once every two weeks so like once every two weeks you read one terabyte but let's say instead of doing that right so let's say that the output here was proof of work of ID index but also of this T outputs right this DL which I'd because table is zero right then for me to reproduce this I would have to recompute like if this is sufficiently far to the to the bottom and and right I would have to reproduce

146. 1:10:14

     the big part of the table right yes so so there actually are proofs of space that were published earlier that use something a bit more common you don't actually need the proof of work here that use these sort of interesting graph structures that have these properties that if you can get the hash of the end of the graph then you have to have a lot of space while you're doing it so you can prove that you're actually storing

147. 1:10:40

     space with a lot of these hashes and everything depends on everything else in this sort of interesting way the reason we're doing this is first of all to a lot simpler but also one of the the properties this has is it you can change the difficulty so we're saying the difficulty that of these proofs of work needs to be enough that it's more expensive to regenerate than to store for two weeks if you remember we said that everybody publishes an ATX this

148. 1:11:12

     seems a little suspicious right because if we have more and more miners that means our communication grows right the reason everybody else does sampling is that you want your communication to be constant independent of the number of miners and here you know we have 800,000 miners then you have 800,000 a TX's if we have no two million miners we have you know more than twice that so the communication is just going to grow so how do we deal with that so right now

149. 1:11:44

     we've said there's a two-week epoch then this will be sort of good up to about 800,000 miners if we want more than that we can increase the epoch size so you can say okay once we get to 1 million miners the epoch is going to grow to be you know four weeks instead of two weeks and then basically you're just using the 80 X's less frequently so so the communication can still stay constant but now this table has to hold on it has to be more expensive than a full month

150. 1:12:16

     of storage so it could be that we need more work so how do we do that well we could just say right run everything over but this is not super reasonable and the this kind of protocol they basically require that to run things over and they also require like the harder it gets or the more space it it needs to take so these are a bit problematic here we have this sort of nice mechanism where you can just sort of make each if we use the hash based proof of work right then you can just say each of these is going to get a

151. 1:12:49

     little bit harder so you can go over the table some of them are already good so basically you're only paying the difference in the difficulty so you can serve incremental e increase the difficulty and this has this nice property we also have these properties like what the relative very few of them are going to be good right so if you if you know exactly the proportion that cause it's not like you're going to be requesting one extra zero it could be

152. 1:13:14

     that you're just requesting has it slightly yes if you repress one extra zero then right half of them will be good but but you're only doing the you know the difference in the work right so and so then we're not actually waiting for two weeks we're using proof of elapsed time right we're not trusting that okay yes so this is an interactive protocol and which is not really something you can use in the setting so first of all we make this non interactive by using this know very well no trick called Fiat

153. 1:13:44

     Samir which basically says instead of me sending you the route and then you giving me random challenges I just take this put it into a hash and pretend that you sent me the results of the hash as the challenges and if it's difficult enough to find good things then this is secure so so this is non interactive but you still need to trust here right that two weeks have passed so how do we get

154. 1:14:08

     around that we use this proof of elapsed time and so basically what we're saying is right we have this post the post has two phases it has phase 1 say in the beginning of the epoch so this is epic 1 and then it has phase 2 and epic too so you send the same post and now I know that two weeks have passed but I want but if I have to actually be there to check that two weeks have passed and I'm violating this property that only the messages matter

155. 1:14:41

     so instead of doing that what you're going to do is you're going to take that the output of this post so the commitment to it and put it into a proof of elapsed time so we'll talk about this in a second and then we'll take the output of this and use it as the challenge in the the proof phase of the post and basically this guarantees you know if you check this result and this result that two weeks must have passed and this is self-contained you don't

156. 1:15:14

     need anybody to trust anybody I mean you don't need the trusses but you need to run this point so okay so now this seems like ok we're back to proof of work why is this not just a regular proof of work everybody doesn't need to run to Porat right exactly right so the poet can be one server that actually gives everybody so the the answers and it only costs once so again you know the the poet server does need to be trusted there

157. 1:15:38

     doesn't need to be only one but if you're saying you're paying a fee to use a poet server so anyone can run their poet server the more users a poet server has actually the lower the feet can can charge because it's costs don't depend on the number of users so you have this sort of aggregation where you'd expect that no there will be very few poet servers with huge number of users can always verify the results but you don't need to

158. 1:16:04

     trust but but you don't need to pay a lot for them you there's actually the very little work being done in terms of the whole system so did we cover give or take everything I well you know there's many layers that we didn't cover but I think in overview yeah it's right over here cool and we always have the same question at the end which is not technical when is main that so I think right now

159. 1:16:33

     test net is around the corner something I think July is the current plan and maintenance I think in the beginning of 2020 I'm not sure exactly the you know how firm the dates are but this is sort of the the general idea cool exciting yes okay okay thanks everyone for watching until next time Hugh thank you