The importance of full-stack openness and verifiability

Special thanks to Ahmed Ghappour, bunnie, Daniel Genkin, Graham Liu, Michael Gao, mlsudo, Tim Ansell, Quintus Kilbourn, Tina Zhen, Balvi volunteers and GrapheneOS developers for feedback and discussion.

特别感谢 Ahmed Ghappour、bunnie、Daniel Genkin、Graham Liu、Michael Gau、mlsudo、Tim Ansell、Quintus Kilbourn、Tinazhen、Balvi 志愿者和 GrapheneOS 开发人员的反馈和讨论。

Perhaps the biggest trend of this century so far can be summarized by the phrase "the internet has become real life".

也许本世纪迄今为止最大的趋势可以用“互联网已经成为现实生活”来概括。

It started with email and instant messaging.

它始于电子邮件和即时消息传递。

Private conversations that for millennia past were done with mouths, ears, pen and paper, now run on digital infrastructure.

几千年来，私人对话是通过嘴巴、耳朵、笔和纸进行的，现在则在数字基础设施上进行。

Then, we got digital finance - both crypto finance, and digitization of traditional finance itself.

然后，我们有了数字金融——包括加密金融和传统金融本身的数字化。

Then, our health: thanks to smartphones, personal health tracking watches, and data inferred from purchases, all kinds of information about our own bodies is being processed through computers and computer networks.

然后，我们的健康：借助智能手机、个人健康跟踪手表以及从购买中推断出的数据，有关我们自己身体的各种信息正在通过计算机和计算机网络进行处理。

Over the next twenty years, I expect this trend to take over all kinds of other domains, including various government processes (eventually even voting), monitoring of the public environment for physical and biological indicators and threats, and ultimately, with brain-computer interfaces, even our own minds.

在接下来的二十年里，我预计这种趋势将接管各种其他领域，包括各种政府流程（最终甚至投票）、对公共环境的物理和生物指标及威胁的监测，以及最终通过脑机接口，甚至我们自己的思想。

I do not think that these trends are avoidable; their benefits are too great, and in a highly competitive global environment, civilizations that reject these technologies will lose first competitiveness and then sovereignty to those that embrace them.

我不认为这些趋势是可以避免的；它们的好处太大了，在竞争激烈的全球环境中，拒绝这些技术的文明将首先失去竞争力，然后输给拥抱它们的文明。

However, in addition to offering powerful benefits, these technologies deeply affect power dynamics, both within and between countries .

然而，除了提供强大的好处外，这些技术还深刻影响国家内部和国家之间的权力动态。

The civilizations that gained the most from new waves of technology are not the ones who consumed the technology, but the ones who produced it.

从新的技术浪潮中获益最多的文明不是那些消耗技术的文明，而是那些生产技术的文明。

Centrally planned equal access programs to locked-down platforms and APIs can at best provide only a small fraction of this, and fail in circumstances that fall outside of a pre-determined "normal".

集中规划的对锁定平台和 API 的平等访问计划最多只能提供其中的一小部分，并且在超出预定“正常”范围的情况下会失败。

Additionally, this future involves a lot of trust being put in technology .

此外，这个未来涉及对技术的高度信任。

If that trust is broken (eg.

如果这种信任被打破（例如。

backdoors, security failures), we get really big problems.

后门、安全故障），我们遇到了很大的问题。

Even the mere possibility of that trust being broken forces a fallback to fundamentally exclusionary social models of trust ("was this thing built by people I trust?").

即使是这种信任被打破的可能性，也会迫使人们退回到根本上排他性的社会信任模式（“这个东西是由我信任的人建造的吗？”）。

This creates incentives that propagate up the stack: the sovereign is he who decides on the state of exception.

这创造了向上传播的激励：主权者是决定例外状态的人。

Avoiding these problems requires technology across the stack - software, hardware and bio - that has two intertwined properties: genuine openness (ie.

避免这些问题需要跨堆栈的技术 - 软件、硬件和生物 - 它具有两个相互交织的属性：真正的开放性（即。

open source, including free licensing) and verifiability (including, ideally, directly by end users) .

开源，包括免费许可）和可验证性（最好包括最终用户直接验证）。

The internet is real life.

互联网就是现实生活。

We want it to become a utopia and not a dystopia.

我们希望它成为一个乌托邦而不是反乌托邦。

We saw the consequences of unequal access to the technological means of production during Covid.

在新冠疫情期间，我们看到了生产技术手段不平等的后果。

Vaccines were produced in only a few countries, which led to large disparities between when different countries were able to get access to them.

疫苗只在少数几个国家生产，这导致不同国家获得疫苗的时间存在巨大差异。

Wealthier countries got top-quality vaccines in 2021, others got lower-quality vaccines in 2022 or 2023.

富裕国家在 2021 年获得了高质量的疫苗，其他国家则在 2022 年或 2023 年获得了质量较低的疫苗。

There were initiatives to try to ensure equal access , but because the vaccines were designed to rely on capital-intensive proprietary manufacturing processes that could only be done in a few places, these initiatives could only do so much.

有一些举措试图确保平等获得机会，但由于疫苗的设计依赖于资本密集型的专有制造工艺，而这些工艺只能在少数地方完成，因此这些举措只能发挥有限的作用。

The second major issue with vaccines was the opaque science and communications strategy that tried to pretend to the public that they carried literally zero risks or downsides, which was untrue and ended up contributing greatly to mistrust .

疫苗的第二个主要问题是不透明的科学和传播策略，试图向公众假装它们的风险或负面影响为零，但这是不真实的，最终极大地加剧了不信任。

Today, this mistrust has spiraled into what feels like a rejection of half a century of science.

如今，这种不信任已经演变成一种对半个世纪科学的拒绝。

In fact, both problems are resolvable.

事实上，这两个问题都是可以解决的。

Vaccines like the Balvi -funded PopVax are cheaper to develop, and made with a much more open process, reducing access inequality and at the same time making it easier to analyze and verify their safety and effectiveness.

像 Balvi 资助的 PopVax 这样的疫苗开发成本更低，并且生产过程更加开放，减少了获取不平等，同时更容易分析和验证其安全性和有效性。

We can go even further in designing vaccines for verifiability first.

我们可以更进一步地首先设计可验证的疫苗。

Similar issues apply for the digital side of biotech .

类似的问题也适用于生物技术的数字方面。

When you talk to longevity researchers, one of the first things that you will universally hear is that the future of anti-aging medicine is personalized and data-driven .

当您与长寿研究人员交谈时，您普遍听到的第一件事就是抗衰老医学的未来是个性化和数据驱动的。

To know what medicines and what changes in nutrients to suggest to a person today, you need to know the current condition of their body.

要知道今天向人们建议哪些药物和哪些营养素变化，您需要了解他们当前的身体状况。

This is much more effective if there can be a large amount of data digitally collected and processed, in real time .

如果能够实时地以数字方式收集和处理大量数据，这会更加有效。

This watch collects 1000x more data about you than Worldcoin.

这款手表收集的有关您的数据比 Worldcoin 多 1000 倍。

This has upsides and downsides.

这有优点也有缺点。

The same idea applies for defensive biotech aimed at downside prevention, such as fighting pandemics .

同样的想法也适用于旨在预防负面影响的防御性生物技术，例如抗击流行病。

The earlier a pandemic is detected, the more likely it is that it can be stopped at the source - and even if it can't, each week gives more time to prepare and start working on countermeasures.

越早发现大流行，就越有可能从源头阻止它——即使不能，每周也会有更多的时间来准备和开始制定对策。

While a pandemic is ongoing, there is a lot of value in being able to know in what locations people are getting sick, in order to deploy countermeasures in real time.

当大流行仍在持续时，能够了解人们在哪些地方患病，以便实时部署应对措施具有很大的价值。

If the average person who gets sick with a pandemic learns it, and self-isolates within an hour, that implies up to 72x less spread than if they go around infecting others for three days.

如果普通感染大流行病的人知道了这一点，并在一小时内自我隔离，这意味着传播速度比他们三天内感染他人的传播速度要低 72 倍。

If we know which 20% of locations are responsible for 80% of the spread, improving air quality there can add further gains.

如果我们知道哪 20% 的地点造成了 80% 的传播，改善那里的空气质量可以进一步增加收益。

All of this requires (i) lots and lots of sensors , and (ii) the ability for the sensors to communicate in real time to feed information to other systems.

所有这些都需要（i）大量传感器，以及（ii）传感器能够实时通信以向其他系统提供信息。

And if we go even further in the "scifi" direction, we get to brain-computer interfaces , which can enable great productivity, help people better understand each other through telepathic communication, and unlock safer paths to highly intelligent AI.

如果我们在“科幻”方向上走得更远，我们就会看到脑机接口，它可以实现巨大的生产力，帮助人们通过心灵感应交流更好地理解彼此，并开启通往高度智能人工智能的更安全的道路。

If the infrastructure for biological and health tracking (for individuals and for spaces) is proprietary, then the data goes into the hands of large corporations by default.

如果生物和健康跟踪基础设施（针​​对个人和空间）是专有的，那么数据将默认落入大公司手中。

Those corporations have the ability to build all kinds of applications on top, and others do not.

这些公司有能力在其上构建各种应用程序，而其他公司则没有。

They may offer it via API access, but API access will be limited and used for monopolistic rent extraction, and can be taken away at any time.

他们可以通过API访问来提供，但API访问将受到限制并用于垄断性的租金提取，并且可以随时被剥夺。

This means that a small number of people and corporations have access to the most important ingredients for a major area of 21ˢᵗ century technology, which in turn limits who can economically benefit from it.

这意味着少数人和企业可以获得 21 世纪技术主要领域最重要的成分，这反过来又限制了谁可以从中获得经济利益。

And on the other hand, if this kind of personal health data is insecure, someone who hacks it can blackmail you over any health issues, optimize pricing of insurance and healthcare products to extract value from you, and if the data includes location tracking they know where to wait for you to kidnap you.

另一方面，如果这种个人健康数据不安全，黑客攻击它的人可以就任何健康问题勒索你，优化保险和医疗保健产品的定价以从你身上榨取价值，如果数据包括位置跟踪，他们知道在哪里等你绑架你。

And in the other direction, your location data ( very often hacked ) can be used to infer information about your health.

另一方面，您的位置数据（经常被黑客入侵）可用于推断有关您的健康状况的信息。

If your BCI gets hacked that means a hostile actor is literally reading (or worse, writing) your mind.

如果您的 BCI 遭到黑客攻击，则意味着敌对行为者实际上正在读取（或更糟糕的是，写入）您的想法。

This is no longer science fiction: see here for a plausible attack by which a BCI hack can lead to someone losing motor control.

这不再是科幻小说：请参阅此处，了解一种看似合理的攻击，BCI 黑客可以通过该攻击导致某人失去运动控制。

All in all, a huge amount of benefits, but also significant risks: risks that a strong emphasis on openness and verifiability are very well suited to mitigating.

总而言之，带来了巨大的好处，但也存在重大风险：强调开放性和可验证性的风险非常适合缓解。

Earlier this month I had to fill in and sign a form that was required for a legal function.

本月早些时候，我必须填写并签署一份法律职能所需的表格。

At the time I was not in the country.

那时我不在国内。

A national electronic signing system existed, but I did not have it set up at the time.

国家电子签名系统已经存在，但我当时还没有建立它。

I had to print out the form, sign it, walk over to a nearby DHL, spend a bunch of time filling in the paper form, and then paying for the form to be express-shipped halfway across the world.

我必须打印出表格，签名，走到附近的 DHL，花大量时间填写纸质表格，然后支付表格的费用，以便将表格快递到半个世界。

Time required: half an hour, cost: $119.

所需时间：半小时，费用：119 美元。

On that same day I had to sign a (digital) transaction to perform an action on the Ethereum blockchain.

同一天，我必须签署一项（数字）交易才能在以太坊区块链上执行操作。

Time required: 5 seconds, cost: $0.10 (and, to be fair, without the blockchain a signature can be completely free).

所需时间：5 秒，成本：0.10 美元（公平地说，没有区块链，签名可以完全免费）。

These kinds of stories are easy to find in corporate or nonprofit governance, management of intellectual property rights, and much more.

这类故事在公司或非营利组织治理、知识产权管理等领域很容易找到。

For the past decade, you can find them in the pitch decks of a significant fraction of all blockchain startups.

在过去的十年里，你可以在很大一部分区块链初创公司的融资演讲稿中找到他们。

And on top of this, there is the mother of all use cases of "digitally exercising personal authority": payments and finance.

除此之外，还有“数字化行使个人权力”的所有用例之母：支付和金融。

There is of course a big risk in all this: what if either the software or the hardware gets hacked?

当然，这一切都存在很大的风险：如果软件或硬件被黑客入侵怎么办？

This is a risk that the crypto space was early to recognize: the blockchain is permissionless and decentralized, and so if you lose access to your funds , there is no resource, no uncle in the sky that you can call for help.

这是加密货币领域很早就认识到的一个风险：区块链是无需许可和去中心化的，因此，如果你无法使用你的资金，就没有资源，没有可以求助的天上叔叔。

Not your keys, not your coins.

不是你的钥匙，不是你的硬币。

For this reason, the crypto space was early to thinking about multisig and social recovery wallets , and hardware wallets .

因此，加密货币领域很早就开始考虑多重签名和社交恢复钱包以及硬件钱包。

In reality, however, there are many situations where lack of a trusted uncle in the sky is not an ideological choice, but an inherent part of the scenario.

然而，在现实中，很多情况下，缺少一个值得信赖的天上叔叔并不是意识形态的选择，而是场景的固有部分。

In fact, even in traditional finance, the "uncle in the sky" fails to protect most people: for example, only 4% of scam victims recover their losses .

事实上，即使在传统金融领域，“天上叔叔”也无法保护大多数人：例如，只有4%的诈骗受害者挽回了损失。

In use cases that involve custody of personal data , reverting a leak is impossible even in principle.

在涉及个人数据保管的用例中，即使原则上也不可能恢复泄漏。

Hence, we need true verifiability and security - of both the software and, ultimately, the hardware .

因此，我们需要软件和最终硬件的真正可验证性和安全性。

One proposed technique for inspecting that computer chips were manufactured correctly.

一项提议的技术用于检查计算机芯片是否正确制造。

Importantly, in the case of hardware, the risk that we are trying to prevent goes far beyond "is the manufacturer evil?".

重要的是，就硬件而言，我们试图防止的风险远远超出了“制造商是邪恶的吗？”。

Rather, the problem is that there is a large number of dependencies, most of which are closed source, and any one of them being negligent can cause unacceptable security outcomes .

相反，问题在于存在大量的依赖关系，其中大多数是闭源的，其中任何一个疏忽都可能导致不可接受的安全结果。

This paper shows recent examples of how microarchitecture choices can undermine the side-channel resistance of designs that are provably secure in a model that looks at the software alone.

本文展示了最近的示例，说明微架构选择如何破坏设计的侧通道阻力，而这些设计在仅考虑软件的模型中已证明是安全的。

Attacks like EUCLEAK depend on vulnerabilities that are much harder to find because of how many components are proprietary.

像 EUCLEAK 这样的攻击依赖于漏洞，但由于有很多组件是专有的，因此更难发现这些漏洞。

AI models can have backdoors inserted at training time if they are trained on compromised hardware .

如果人工智能模型是在受损的硬件上进行训练的，那么它们可能会在训练时插入后门。

Another issue in all of these cases is downsides from closed and centralized systems, even if they are perfectly secure.

所有这些情况下的另一个问题是封闭和集中式系统的缺点，即使它们是完全安全的。

Centralization creates ongoing leverage between individuals, companies or countries: if your core infrastructure is built and maintained by a potentially untrustworthy company in a potentially untrustworthy country, you are vulnerable to pressure (eg.

集中化在个人、公司或国家之间创造了持续的杠杆作用：如果你的核心基础设施是由潜在不值得信任的国家/地区的一个潜在不值得信任的公司构建和维护的，那么你很容易受到压力（例如，压力）。

see Henry Farrell on weaponized interdependence ).

参见亨利·法雷尔关于武器化相互依赖的文章）。

This is the sort of problem that crypto is meant to solve - but it exists in far more domains than just the financial.

这就是加密货币旨在解决的问题 - 但它存在于比金融更广泛的领域。

I frequently talk to people of various stripes who are trying to figure out better forms of government that are well suited for their various contexts in 21ˢᵗ century.

我经常与不同阶层的人们交谈，他们试图找出适合 21 世纪不同背景的更好的政府形式。

Some, like Audrey Tang , are trying to take political systems that are already functional and bring them to the next level, empowering local open-source communities and using mechanisms like citizens' assemblies, sortition and quadratic voting.

一些人，比如奥黛丽·唐(Audrey Tang)，正试图将已经运作的政治体系提升到一个新的水平，赋予当地开源社区权力，并使用公民大会、抽签和二次投票等机制。

Others are starting from the bottom: here is a constitution recently proposed by some Russian-born political scientists for Russia, featuring strong guarantees of individual freedom and local autonomy, strong institutional bias toward peace and against aggression, and an unprecedentedly strong role for direct democracy.

其他人则从底层开始：这是一些俄罗斯出生的政治学家最近为俄罗斯提出的一部宪法，其特点是对个人自由和地方自治的强有力保障，对和平和反对侵略的强烈制度偏见，以及直接民主的空前强大作用。

Others, like economists working on land value tax or congestion pricing, are trying to improve their country's economics .

其他人，例如研究土地增值税或拥堵定价的经济学家，正在努力改善本国的经济。

Different people may have different levels of enthusiasm for each idea.

不同的人对每个想法的热情程度可能不同。

But one thing that they all have in common is they all involve high-bandwidth participation , and so any realistic implementation has to be digital .

但它们的一个共同点是它们都涉及高带宽参与，因此任何实际的实施都必须是数字化的。

Pen and paper is okay for a very basic record of who owns what and elections run once every four years, but not for anything that asks for our input with higher bandwidth or frequency.

对于谁拥有什么以及每四年举行一次的选举的基本记录来说，笔和纸是可以的，但对于需要更高带宽或频率输入的任何事情来说，笔和纸就不行了。

Historically, however, security researchers' reception to the idea of things like electronic voting has ranged from skeptical to hostile.

然而，从历史上看，安全研究人员对电子投票等想法的接受程度从怀疑到敌对。

Here is a good summary of the case against electronic voting.

这是反对电子投票案例的一个很好的总结。

Quoting from that document:

引用该文件：

First of all, the technology is "black box software," meaning that the public is not allowed access into the software that controls the voting machines.

首先，该技术是“黑匣子软件”，这意味着公众不得访问控制投票机的软件。

Although companies protect their software to protect against fraud (and to beat back competition), this also leaves the public with no idea of how the voting software works.

尽管公司保护他们的软件以防止欺诈（并击败竞争），但这也让公众不知道投票软件是如何工作的。

It would be simple for the company to manipulate the software to produce fraudulent results.

该公司很容易操纵该软件来产生欺诈性结果。

Also, the vendors who market the machines are in competition with each other, and there is no guarantee that they are producing the machines in the best interest of the voters and the accuracy of the ballots.

此外，销售这些机器的供应商相互竞争，并且不能保证他们生产的机器符合选民的最大利益和选票的准确性。

There are lots of real-world cases that justify this skepticism.

有很多现实世界的案例证明了这种怀疑是正确的。

These arguments apply verbatim in all kinds of other situations.

这些论点逐字适用于各种其他情况。

But I predict that as technology progresses, the "let's not do it at all" response will become less and less realistic, across a wide range of domains.

但我预测，随着技术的进步，“我们根本不这样做”的反应将在广泛的领域变得越来越不现实。

The world is rapidly becoming more efficient (for better or worse) due to technology, and I predict that any system that does not follow this trend will become less and less relevant to individual and collective affairs as people route around it.

由于技术的原因，世界正在迅速变得更加高效（无论好坏），我预测，任何不遵循这一趋势的系统将随着人们绕行它而变得越来越不与个人和集体事务相关。

And so we need an alternative: to actually do the hard thing and figure out how to make complicated tech solutions secure and verifiable.

因此，我们需要另一种选择：实际做困难的事情，找出如何使复杂的技术解决方案安全且可验证。

Theoretically, "secure and verifiable" and "open-source" are two different things.

理论上，“安全可验证”和“开源”是两个不同的东西。

It is definitely possible for something to be proprietary and secure : airplanes are highly proprietary technology but on the whole commercial aviation is a very safe way to travel .

某些东西绝对有可能是专有且安全的：飞机是高度专有的技术，但总体而言，商业航空是一种非常安全的旅行方式。

But what a proprietary model cannot achieve is common knowledge of security - the ability to be trusted by mutually distrusting actors.

但专有模型无法实现的是安全常识——被互不信任的参与者信任的能力。

Civic systems like elections are one type of situation where common knowledge of security is important.

选举等公民制度是安全常识非常重要的一种情况。

Another is evidence gathering in courts.

另一个是在法庭上收集证据。

Recently, in Massachusetts, a large volume breathalyzer evidence was ruled invalid because information about faults in the tests was found to have been covered up.

最近，在马萨诸塞州，大量呼气分析仪的证据被裁定无效，因为有关测试中的错误信息被发现被掩盖了。

Quoting the article:

引用文章：

Wait, so were all of the results faulty?

等等，那么所有的结果都是错误的吗？

No. In fact, there weren't calibration issues with the breathalyzer tests in most of the cases.

不会。事实上，在大多数情况下，呼气分析仪测试不存在校准问题。

However, since investigators later found that the state crime lab withheld evidence showing the problems were more widespread than they said, Justice Frank Gaziano wrote that all of those defendants had their due process rights violated.

然而，由于调查人员后来发现国家犯罪实验室隐瞒了表明问题比他们所说的更为普遍的证据，弗兰克·加齐亚诺法官写道，所有这些被告的正当程序权利都受到了侵犯。

Due process in courts is inherently a domain where what is required is not just fairness and accuracy, but common knowledge in fairness and accuracy - because if there is not common knowledge that courts are doing the right thing, society can easily spiral into people taking matters into their own hands.

法院的正当程序本质上是一个领域，所需要的不仅是公平和准确，而且还要求公平和准确的常识——因为如果没有法院正在做正确的事情的常识，社会很容易陷入人们把事情掌握在自己手中的情况。

In addition to verifiability, there are also inherent benefits to openness itself.

除了可验证性之外，开放性本身也有其固有的好处。

Openness allows local groups to design systems for governance, identity, and other needs in ways that are compatible with local goals.

开放性允许当地团体以与当地目标兼容的方式设计治理、身份和其他需求的系统。

If voting systems were proprietary, then a country (or province or town) that wanted to experiment with a new one would have a much harder time: they would have to either convince the company to implement their preferred rules as a feature, or start from scratch and go through all the work to make it secure.

如果投票系统是专有的，那么想要尝试新投票系统的国家（或省或城镇）将会遇到困难：他们必须说服公司将其首选规则作为一项功能实施，或者从头开始并完成所有工作以确保其安全。

This adds a high cost to innovation in political systems.

这增加了政治制度创新的高昂成本。

A more open-source hacker-ethic approach, in any of these areas, would put more agency in the hands of local implementers, whether they are acting as individuals or as part of governments or corporations.

在任何这些领域，更加开源的黑客道德方法都会将更多的代理权交给当地实施者，无论他们是作为个人还是作为政府或公司的一部分。

For this to be possible, open tools for building need to be widely available, and the infrastructure and code bases need to be freely licensed to allow others to build on top.

为了实现这一点，开放式构建工具需要广泛使用，并且基础设施和代码库需要免费许可，以允许其他人在其上进行构建。

To the extent that the goal is minimizing power differentials, copyleft is especially valuable .

就目标是最小化权力差异而言，Copyleft 尤其有价值。

A final area of civic tech that will matter in the next years is physical security .

未来几年最重要的民用技术领域是物理安全。

Surveillance cameras have been popping up everywhere over the past two decades, causing many civil liberties worries.

过去二十年来，监控摄像头随处可见，引起了许多公民自由的担忧。

Unfortunately, I predict that the recent rise of drone warfare will make "don't do high tech security" no longer a viable option.

不幸的是，我预测最近无人机战争的兴起将使“不做高科技安全”不再是一个可行的选择。

Even if a country's own laws do not infringe on a person's freedom, that means nothing if the country cannot protect you from other countries (or rogue corporations or individuals) imposing their laws on you instead.

即使一个国家自己的法律不侵犯一个人的自由，但如果该国家不能保护您免受其他国家（或流氓公司或个人）将其法律强加于您的侵害，那也毫无意义。

Drones make such attacks much easier.

无人机使此类攻击变得更加容易。

Ergo, we need countermeasures, that will likely involve lots of counter-drone systems and sensors and cameras.

因此，我们需要对策，这可能会涉及大量反无人机系统、传感器和摄像头。

If these tools are proprietary, data collection will be opaque and centralized.

如果这些工具是专有的，那么数据收集将是不透明和集中的。

If these tools are open and verifiable, then we have a chance at a better approach: security equipment that provably outputs only a limited amount of data in a limited number of situations and deletes the rest .

如果这些工具是开放且可验证的，那么我们就有机会采用更好的方法：安全设备可以证明在有限数量的情况下仅输出有限数量的数据并删除其余数据。

We could have a digitized physical security future that is more like digital guard dogs than a digital panopticon .

我们可以拥有一个数字化的物理安全未来，它更像是数字看门狗，而不是数字圆形监狱。

One could imagine a world where public monitoring devices are required to be open source and verifiable, and anyone has a legal right to randomly choose a monitoring device in public and take it apart and verify it.

人们可以想象这样一个世界：公共监控设备需要开源且可验证，任何人都有合法权利在公共场合随机选择一个监控设备并将其拆开并进行验证。

University computer science clubs could frequently do this as an educational exercise.

大学计算机科学俱乐部经常将其作为一种教育活动。

We cannot avoid having digital computer things that are deeply embedded in all kinds of aspects of our (personal and collective) lives.

我们无法避免数字计算机产品深深嵌入我们（个人和集体）生活的各个方面。

By default, we will likely get digital computer things that are built and run by centralized corporations, optimized for a few people's profit motives, backdoored by their host governments, and where most of the world has no way to participate in their creation or know if they're secure.

默认情况下，我们可能会得到由中心化公司构建和运行的数字计算机产品，针对少数人的利润动机进行优化，被东道国政府设置后门，世界上大多数人无法参与其创建或知道它们是否安全。

But we can try to steer toward a better alternative.

但我们可以尝试转向更好的选择。

This is a world where we have much more safety and freedom and equal access to the global economy than today.

在这个世界上，我们比今天拥有更多的安全和自由以及平等参与全球经济的机会。

But making this world happen requires much more investment in various technologies:

但要实现这个世界需要对各种技术进行更多投资：

The cybersecurity fatalism of the 00s is wrong: bugs (and backdoors) can be beaten.

00 年代的网络安全宿命论是错误的：错误（和后门）是可以被击败的。

We "just" have to learn to value security more than other competing goals.

我们“只是”必须学会比其他竞争目标更重视安全。

Open-source and security-focused operating systems.

开源且注重安全的操作系统。

More and more of these are starting to pop up: GrapheneOS as a security-focused version of Android, minimal security-focused kernels like Asterinas , and Huawei's HarmonyOS (which has an open source version ) is using formal verification (I expect many readers will think "if it's Huawei, surely it has backdoors", but this misses the whole point: it shouldn't matter who produces something, as long as it's open and anyone can verify it .

越来越多的此类内容开始出现：GrapheneOS作为Android的安全版本，像Asterinas这样的最小安全内核，华为的HarmonyOS（有开源版本）正在使用形式验证（我预计很多读者会想“如果是华为，肯定有后门”，但这忽略了重点：谁生产的东西并不重要，只要它是开放的并且任何人都可以验证它。

This is a great example of how openness and verifiability can fight against global balkanization)

这是开放性和可验证性如何对抗全球巴尔干化的一个很好的例子）

Secure open-source hardware .

保护开源硬件。

No software is secure if you can't be sure that your hardware is actually running that software, and is not leaking data separately on the side.

如果您无法确定您的硬件实际上正在运行该软件，并且不会单独泄漏数据，那么任何软件都是不安全的。

I am most interested in two short-term targets in this regard:

我最感兴趣的是这方面的两个短期目标：

Secure open toolchains for building open-source hardware .

用于构建开源硬件的安全开放工具链。

Today, designing hardware depends on a whole series of closed-source dependencies.

如今，设计硬件依赖于一系列闭源依赖项。

This drastically raises the cost of making hardware, and makes the process much more permissioned.

这极大地提高了制造硬件的成本，并使该过程获得更多许可。

It also makes hardware verification impractical: if the tooling that generates the chip design is closed source, you don't know what you're verifying against.

它还使得硬件验证变得不切实际：如果生成芯片设计的工具是闭源的，那么您不知道要验证什么。

Even tools like scan chains that exist today are often unusable in practice because too much of the necessary tooling is closed source.

即使是当今存在的扫描链等工具在实践中也常常无法使用，因为太多必要的工具是闭源的。

This can all be changed.

这一切都是可以改变的。

Hardware verification (eg.

硬件验证（例如

IRIS , and X-ray scanning ).

IRIS 和 X 射线扫描）。

We need ways of scanning chips to verify that they actually have the logic that they are supposed to have, and that they do not have extra components that allow unexpected forms of tampering and data extraction.

我们需要扫描芯片的方法来验证它们实际上具有应有的逻辑，并且它们没有允许意外形式的篡改和数据提取的额外组件。

This can be done destructively : auditors randomly order products containing computer chips (using identities that appear to be average end users), and then take the chips apart and verify that the logic matches up.

这可能是破坏性的：审计员随机订购包含计算机芯片的产品（使用看似普通最终用户的身份），然后将芯片拆开并验证逻辑是否匹配。

With IRIS or X-ray scanning, it can be done non-destructively , allowing every chip to potentially be scanned.

通过 IRIS 或 X 射线扫描，可以非破坏性地完成，从而可以扫描每个芯片。

To achieve common knowledge of trust, we ideally want hardware verification techniques that are within reach of large groups of people .

为了实现信任的共同知识，我们理想地希望硬件验证技术能够为大多数人所使用。

X-ray machines today are not yet in this position.

今天的 X 射线机还没有达到这个位置。

This situation can be improved in two ways.

这种情况可以通过两种方式得到改善。

First, we can refine verification equipment (and verification-friendliness of chips) so that the equipment is more widely accessible.

首先，我们可以改进验证设备（以及芯片的验证友好性），使设备更广泛地使用。

Second, we can supplement "full verification" with more limited forms of verification that can even be done on smartphones (such as ID tags and signatures from keys generated by physical unclonable functions ), that verify more restrictive claims like "was this machine part of a batch that was produced by a known manufacturer, of which a random sample is known to have been verified in detail by third-party groups?"

其次，我们可以用更有限的验证形式来补充“全面验证”，这些验证甚至可以在智能手机上完成（例如ID标签和由物理不可克隆功能生成的密钥签名），验证更严格的声明，例如“这台机器是否是由已知制造商生产的批次的一部分，其中已知随机样本已被第三方团体详细验证？”

Open source, low-cost, local environmental and bio monitoring equipment .

开源、低成本、本地环境和生物监测设备。

It should be possible for communities and individuals to measure their environment and themselves and identify biological risks.

社区和个人应该能够测量他们的环境和自身并识别生物风险。

This includes technology in many form factors: personal-scale medical equipment like OpenWater , air quality sensors, universal airborne disease sensors (eg.

这包括多种形式的技术：个人规模的医疗设备，如 OpenWater、空气质量传感器、通用空气传播疾病传感器（例如，空气传播疾病传感器）。

Varro ), and larger-scale environmental monitoring.

Varro ）和更大规模的环境监测。

Openness and verifiability on every layer of the stack matters

堆栈每一层的开放性和可验证性都很重要

A key difference between this vision and a more "traditional" vision of technology is that it's much more friendly to local sovereignty and individual empowerment and freedom.

这种愿景与更“传统”的技术愿景之间的一个关键区别在于，它对地方主权以及个人赋权和自由更加友好。

Security is done less by scouring the entire world and making sure there are zero bad guys anywhere, and more by making the world more robust at every level.

通过搜索整个世界并确保任何地方都没有坏人，可以减少安全性，而通过使世界在各个层面上变得更加强大来实现安全性。

Openness means openness to build upon and improve every layer of technology, and not just centrally planned open-access API programs.

开放性意味着开放性地构建和改进每一层技术，而不仅仅是集中规划的开放访问 API 程序。

Verification is not something reserved to proprietary rubber-stamp auditors that may well be colluding with the companies and governments rolling out the technology - it's a right, and a socially encouraged hobby, for the people.

验证并不是专门为橡皮图章审计员保留的东西，他们很可能与推出该技术的公司和政府勾结——这是人民的一项权利，也是一种社会鼓励的爱好。

I believe that this vision is more robust, and more compatible with our fractured global twenty-first century.

我相信这个愿景更加坚定，也更加符合我们破碎的全球二十一世纪。

But we do not have infinite time to execute on this vision.

但我们没有无限的时间来实现这一愿景。

Centralized approaches to security, that involve putting more centralized data collection and backdoors, and reducing verification entirely to "was this made by a trusted developer or manufacturer", are moving forward rapidly.

集中式安全方法正在迅速发展，其中包括设置更集中的数据收集和后门，并将验证完全减少到“这是由值得信赖的开发商或制造商制作的”。

Centralized attempts to substitute for true open access have been attempted for decades.

几十年来，人们一直在尝试用中心化的方式来替代真正的开放访问。

It started perhaps with Facebook's internet.org , and it will continue, each attempt more sophisticated than the last.

它可能始于 Facebook 的 internet.org，并将继续下去，每次尝试都比上一次更加复杂。

We need to both move quickly to compete with these approaches, and make the public case, to people and institutions, that a better solution is possible.

我们需要迅速采取行动与这些方法竞争，并向人们和机构公开证明更好的解决方案是可能的。

If we can succeed in this vision, one way to understand the world that we get is that it is a kind of retro-futurism.

如果我们能够成功实现这一愿景，那么理解我们所看到的世界的一种方式就是，它是一种复古未来主义。

On the one hand, we get the benefits of much more powerful technologies allowing us to improve our health, organize ourselves in much more efficient and resilient ways, and protect ourselves against threats, both old and new.

一方面，我们受益于更强大的技术，使我们能够改善健康，以更有效和更有弹性的方式组织自己，并保护自己免受新旧威胁。

On the other hand, we get a world that brings back properties that were second-nature to everyone back in 1900: the infrastructure is free for people to take apart, verify and modify to suit their own needs, anyone is able to participate not just as a consumer or an "app builder", but at any layer of the stack, and anyone is able to have confidence that a device does what it says it does.

另一方面，我们看到的世界又恢复了 1900 年每个人的第二天性：基础设施可以免费供人们拆卸、验证和修改以满足自己的需求，任何人都可以不仅作为消费者或“应用程序构建者”参与，而且可以在堆栈的任何层参与，并且任何人都能够相信设备会按照其所说的那样进行操作。

Designing for verifiability has a cost: many optimizations to both hardware and software deliver highly-demanded gains in speed come at the cost of making the design more inscrutable or more fragile.

可验证性设计是有成本的：对硬件和软件的许多优化提供了高要求的速度增益，但代价是使设计变得更加难以理解或更加脆弱。

Open source makes it more challenging to make money under many standard business models.

开源使得在许多标准商业模式下赚钱变得更具挑战性。

I believe that both issues are overstated - but this is not something that the world will be convinced of overnight.

我认为这两个问题都被夸大了——但这并不是世界一夜之间就能相信的事情。

This leads to a question: what is the pragmatic short-term goal to shoot for ?

这就引出了一个问题：务实的短期目标是什么？

I will propose one answer: work toward a fully open-source and verification-friendly stack targeted toward high-security, non-performance-critical applications - both consumer and institutional, long-distance and in-person.

我将提出一个答案：致力于建立一个完全开源且易于验证的堆栈，目标是高安全性、非性能关键型应用程序（消费者和机构、长途和面对面）。

This would include hardware and software and bio.

这将包括硬件、软件和生物。

Most computation that really needs security does not really need speed , and even in the cases where it does, there are often ways to combine performant-but-untrusted and trusted-but-not-performant components to achieve high levels of performance and trust for many applications.

大多数真正需要安全性的计算并不真正需要速度，即使在需要速度的情况下，通常也有方法将高性能但不受信任和受信任但性能不佳的组件组合起来，以实现许多应用程序的高水平性能和信任。

It is unrealistic to achieve maximum security and openness for everything.

一切都达到最大的安全性和开放性是不现实的。

But we can start by ensuring that these properties are available in those domains where they really matter.

但我们可以首先确保这些属性在真正重要的领域中可用。