2

I read other Q/A such as Why do Ethereum clients download the entire blockchain?, but no one addresses the question why the wallet can't just use a web-based API to read/update the blockchain when needed, rather than downloading and syncing the whole huge blockchain.

For years, I've worked the old client/server mentality, that the client just talk to a server where the data resides; even though it's a peer-to-peer network, why doesn't that model work here? Couldn't it randomly connect to someone node of a miner?

It looks like even the light-clients will download a certain amount of the blockchain as well?

Are all wallets considered "clients" then, by definition?

(I installed Parity on my C Drive, and it filled up the drive. Seems like they should at least warn you of the space required on the install, then I would have chosen a different drive.)

2

As mentioned by others, the problem with APIs is that they are centralized sources of information. This basically eliminates the single most important value-proposition of the blockchain. This is, arguably, more problematic than a fully-centralized service. Most fully-centralized services have methods of reverting malicious modifications of state if they are discovered (e.g.; if someone hacks your bank account, the bank itself is liable and must refund the money lost). The folks at Infura have happily stated that they don't see their service as a long-term solution. It is intended to be a better-than-nothing measure to help reduce the barrier of entry into the blockchain space.

Light clients are intended to address the size issues while maintaining the security of the blockchain, and will ultimately power most desktop blockchain applications (e.g.; the Mist browser). While they might not be 'light' by the standards of a classical client-server interaction, they are significantly more lightweight than running a true node. Once we have stabilized and well-tested light clients, they will allow for much more reasonable application sizes.

In terms of non-client solutions, I recently co-authored a whitepaper proposing a solution. I may be biased, but I think its pretty neat :) It allows for greatly increased security-guarantees and decentralization, but with overhead comparable to a centralized API. I'll add a tl;dr and link below in case anyone cares to know more.


whitepaper

TL;DR: Use a proof-of-stake style system to create trustless channels that allow groups of people with nodes to be rewarded for acting as API endpoints, and punished for any malicious activity. We show that we may engineer the system such that:

  1. Users may recoup their losses from the stake of malicious parties.

  2. The reward to tell the truth is always greater than the reward to lie.

  3. Decentralized infrastructure scales proportionate to demand (thanks to mining-esque reward system).

  4. Lightweight enough to function within regular website JavaScript, just like a centralized API.

  5. Not a side-chain (yay!).

  • Seems like the API could check with 3 random nodes, and if they all agree, then the answer should be safe. – NealWalters Aug 25 '17 at 13:49
  • In a sense, yes. There are a number of concerns that need to be structurally addressed though: Prevent any entity from gaming the randomization algorithm (if anyone can control it, they have the true power in the system, and all decentralization security is lost). Prevent any entity form lying to the user about the consensus of the nodes (the user needs assurances that a set of disinterested parties actually agreed). Ensure proper incentives (if we are relying on good-faith, all the security guarantees of the blockchain are once again gone). There are many more, but you see the problem. – fspmarshall Aug 25 '17 at 15:04
2

They could, but it's a security issue. If everyone relies on the same API's (like infura) then the entire network is actually centralized. To have true decentralization, you need to have everyone have a copy of the whole chain. Game theory plays in a bit, and its likely that as the chain gets bigger, more people will do this; but no self respecting wallet maker would call their wallet secure at the moment if they used an API.

  • So a malicious node (server) that executes such an API could return fake data, is that reason? – NealWalters Aug 21 '17 at 16:20
  • And since my node is not mining, how does my transfer transaction then get picked up by some other node to get written to a block? – NealWalters Aug 21 '17 at 16:23
  • Transactions are broadcast to the network through a p2p protocol, it will reach the mining nodes and will be incorporated in a future block. – Ismael Aug 21 '17 at 23:46
  • @NealWalters Yes, if you used a third-party service, they could return fake data. Hey, Mr. Madoff, how much money do I have after I gave you $1000 to invest on my behalf ten years ago? "Uh... you have a million dollars! Let me invest more of your money!" – lungj Aug 25 '17 at 1:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.