Web3, after actually building something

My Saturday project was deploying a smart contract. It was a toy, a token with a fixed supply and a transfer function, copied mostly from a tutorial, deployed to one of the Ethereum test networks so it didn’t cost me real money. Then I wrote a little web page that showed my balance and let me send some to a second wallet. It took about four hours, most of which went on wallet setup and getting test ETH out of a faucet that kept timing out.

I did it because of Moxie Marlinspike’s My first impressions of web3, which went up on Friday and which I’ve now sent to more people than anything else this year (it’s January 11th, so, low bar, but still). Moxie built two dApps and an NFT, and his NFT is the best bit of the whole essay. It showed a different image depending on where you looked at it from, OpenSea, Rarible or your own wallet, because the NFT on the chain is just a URL, and whatever’s at the URL is up to whoever runs the server. A few days later OpenSea removed it, and then it disappeared from his wallet too, which tells you where the wallet was getting its idea of what he owned.

His main point is that “decentralized” mostly stops at the chain itself. Nobody’s browser or phone runs an Ethereum node, so dApps talk to the chain through a couple of API companies, Infura and Alchemy, and MetaMask does the same. The responses aren’t verified by the client. In his words, “These client APIs are not using anything to verify blockchain state or the authenticity of responses.”

My little Saturday project ran straight into this. The tutorial had me sign up for an Alchemy account in step two, before I’d written a line of Solidity, and paste an API key into a config file. My page read my balance through it. MetaMask, out of the box, sent my transactions through Infura. If either of them had decided to lie to me about my balance, my page would have shown the lie. The contract really is out there on thousands of nodes, and I have no reason to doubt that, but none of those nodes were mine, and every single request I made went through a company with a sign-up form and terms of service. That’s a normal web app with a very slow, very expensive database at the back.

To be fair, a normal web app is what I’d expect at this stage, and Moxie says much the same. His argument is that people don’t want to run their own servers, and never did. The web in 1995 was supposed to be everyone running their own stuff, and we ended up on a handful of platforms because running stuff is a chore. I agree with him, and I’d go further. I’ve run servers for most of my career, and I don’t want to run an Ethereum node. I tried to sync one once, a couple of years ago, got to around a third of the way there in a weekend, and gave up.

What I don’t buy is the line I keep hearing that web3 means users “own” things. What I owned on Saturday was an entry in a contract’s mapping that says address 0x… has 1,000 of my made-up tokens. That’s real, and nobody can take it away without my key (or my bug, there’s always my bug). But if someone sold me an NFT of a picture, I’d own an entry that points at a URL, and the picture would be on somebody’s server, same as now. The chain is good at one thing, an append-only ledger nobody controls, and when I took Bitcoin apart block by block back in 2014 I came away thinking the protocol was a genuinely clever piece of engineering. I still think so. I just haven’t seen anyone show me why my photo, my profile or my login needs to live on it.

The other thing that struck me was cost. On the main network, the transaction fees for even simple contract calls have been high enough lately that I wouldn’t have run my toy there at all, and I’d like to see an app where my users pay that much every time they click a button.

So where does that leave me? Somewhere around “interesting technology, mostly speculation on top”, which I realize is the least exciting take available, and I’d be happy to be wrong about it. If someone does build the version Moxie asks for at the end, where the client checks the answers it gets and trust is spread by cryptography instead of by a few API providers, I’ll be the first to try it. For now my token is sitting on a test network, worth exactly nothing, which is about what I paid for it.