Vitalik: Building a fully Open Source stack that is highly secure and easy to verify.

Original Title: The Importance of Full Stack Openness and Verifiability

Author: Vitalik Buterin, founder of Ethereum; Compiled by: Golden Finance

Perhaps the biggest trend of this century so far can be summed up with the phrase "the internet has become part of real life." It began with email and instant messaging. For thousands of years, human private communication was conducted through mouth, ear, pen, and paper, but today it operates through digital infrastructure. Then came digital finance—both crypto finance and the digitization of traditional finance itself. Next, we saw the impact on our health: thanks to smartphones, personal health tracking watches, and data inferred from purchasing behavior, various information about our own bodies is being processed through computers and computer networks. In the next two decades, I expect this trend to cover a variety of other areas, including various government processes (eventually even voting), monitoring of physical and biological indicators and threats in public environments, and ultimately, with the help of brain-computer interfaces, even our own thoughts.

I believe these trends are inevitable; the benefits they bring are simply too great, and in a fiercely competitive global environment, civilizations that reject these technologies will first lose their competitiveness, while those that embrace these technologies will gain an advantage. However, these technologies, in addition to bringing significant benefits, also profoundly affect the power dynamics within and between nations.

The civilizations that benefit the most from the new wave of technology are not those that consume technology, but those that create technology. Centralized plans for equal access can at best provide only a small part of closed platforms and application programming interfaces, and they will fail when exceeding the preset "norm." Moreover, this future requires people to have great trust in technology. If that trust is broken (for example, in the presence of backdoors or security vulnerabilities), it will lead to very serious problems. Even the mere possibility of that trust being broken will force people to revert to fundamentally exclusive social trust models ("Is this made by someone I trust?"). This will create an incentive mechanism that will spread upward along the entire technology stack: those who have decision-making power are the sovereigns.

To avoid these issues, the entire technology stack (including software, hardware, and biotechnology) must possess two interwoven characteristics: genuine openness (i.e., open source, including free licensing) and verifiability (ideally, including direct verification by end users).

###The Importance of Openness and Verifiability in the Health Sector

During the COVID-19 pandemic, we saw the consequences of unequal access to production technology. Vaccines were produced only in a few countries, leading to significant differences in the timing of vaccine availability across different nations. Developed countries received high-quality vaccines in 2021, while other countries only received lower-quality vaccines in 2022 or 2023. Although there were some initiatives aimed at ensuring equal access to vaccines, their effectiveness was very limited due to the fact that vaccine design relies on capital-intensive proprietary production processes, which can only be carried out in a few locations.

COVID-19 vaccination coverage from 2021 to 2023.

The second major issue with vaccines is the lack of transparency in their science and communication strategies, attempting to conceal any risks or drawbacks of the vaccine from the public, which is inconsistent with the facts and ultimately significantly exacerbated public distrust. Today, this distrust has evolved into an almost complete rejection of scientific research findings from the past half-century.

In fact, both of these issues can be resolved. Vaccine development costs, like those of PopVax funded by Balvi, are lower, and the research and production processes are more open and transparent, reducing inequality in access while also making it easier to analyze and verify their safety and efficacy. We can take vaccine design a step further by prioritizing verifiability.

Similar issues exist in the digital field of biotechnology. One of the common statements you will hear when talking to longevity researchers is that the future of anti-aging medicine is personalized and data-driven. To know which medications and nutritional changes should be recommended to patients today, you need to understand their current physical condition. If large amounts of data can be collected and processed digitally in real-time, it would be even more effective.

The same principle applies to defensive biotechnology aimed at preventing adverse effects, such as combating epidemics. The earlier an epidemic is detected, the more likely it is to be stopped at its source – even if it cannot be, every additional week can provide more time for preparation and the development of countermeasures. During the course of an epidemic, being able to know in real-time where people are falling ill is greatly valuable for deploying response measures. If an average person infected with an epidemic learns of their condition and self-isolates within one hour of becoming ill, their transmission rate will be 72 times slower than if they infect others three days after becoming ill. If it is known that 20% of locations cause 80% of the transmission, then improving air quality in those areas can yield further benefits. All of this requires (i) a large number of sensors, as well as (ii) sensors that can communicate in real-time to provide information to other systems.

If we venture further in the direction of "science fiction," we will come into contact with brain-computer interface technology, which can enhance productivity, help people understand each other better through telepathy, and pave a safer path toward highly intelligent AI.

If the infrastructure for biological and health tracking (including personal and spatial) is proprietary, then the data automatically falls into the hands of large corporations. These companies have the ability to build various applications on this basis, while others cannot. They might have access to the data through APIs, but API access will be restricted and used for monopolistic fee extraction, and it can be revoked at any time. This means that only a few individuals and companies can access the most important elements of 21st-century technology, which in turn limits who can profit from it.

On the other hand, if this type of personal health data is not secure, hackers can extort you over any health issues after a breach, manipulating the prices of insurance and healthcare products to profit from you. If this data includes location tracking features, they even know where to wait to kidnap you. Conversely, your location data (which is often hacked) can be used to infer your health status. If your brain-machine interface is hacked, it means hostile forces are reading (or worse, altering) your thoughts. This is no longer science fiction.

In summary, this brings great benefits, but also significant risks: the strong emphasis on openness and verifiability is precisely suitable for mitigating these risks.

###The Importance of Openness and Verifiability in Personal and Commercial Digital Technology

At the beginning of this month, I needed to fill out and sign a form required by a law firm. At that time, I was not in the country. Although there is a national electronic signature system, I did not have it installed at that time. I had to print the form, sign it, and then walk to a nearby DHL courier company, spending a lot of time filling out the paper form, and finally had to pay to send the form by courier to the other side of the globe. Time required: half an hour, cost: $119. On the same day, I needed to sign a (digital) transaction on the Ethereum blockchain to execute an operation. Time required: 5 seconds, cost: $0.10 (fairly speaking, without blockchain, the signature could be completely free).

Such stories are everywhere in the governance of enterprises or non-profit organizations, intellectual property management, and other fields. Over the past decade, you can find them in the financing plans of quite a number of blockchain startups. In addition, there is the most typical use case of "digitally exercising personal power": payment and finance.

Of course, there are significant risks involved: what if the software or hardware is hacked? The cryptocurrency sector recognized this risk early on: the blockchain is permissionless and decentralized, so once you lose access to your funds, there are no resources to turn to for help. No keys, no coins. Therefore, the cryptocurrency sector began to consider multi-signature and social recovery wallets, as well as hardware wallets. However, in reality, the lack of a trustworthy "guardian angel" in many cases is not an ideological choice, but an inherent part of the scenario. In fact, even in traditional finance, "guardian angels" cannot protect the majority: for instance, only 4% of scam victims are able to recover their losses. In use cases involving personal data custodianship, even theoretically, data breaches cannot be restored. Therefore, we need true verifiability and security—both in software and hardware.

A technology for checking whether a computer chip is manufactured correctly.

Importantly, in terms of hardware, the risks we are trying to guard against go far beyond questions like "Are manufacturers evil?" The issue lies in the existence of numerous dependencies, most of which are closed-source, and any negligence in one link can lead to unacceptable security consequences. This paper presents some recent examples illustrating how choices in microarchitecture can undermine the resistance to side-channel attacks of designs that are provably secure in models that consider only software. Attacks like EUCLEAK rely on vulnerabilities that are harder to detect due to the proprietary nature of many components. If training occurs on compromised hardware, AI models may have backdoors implanted during training.

Another issue in all these cases is that even if closed and centralized systems are absolutely secure, there are still some drawbacks. Centralization can create persistent influence among individuals, companies, or countries: if your core infrastructure is built and maintained by a possibly untrustworthy company in a possibly untrustworthy country, you can easily be subject to pressure. This is exactly the problem that cryptocurrencies aim to solve—but the areas where such problems exist extend far beyond just the financial sector.

###The Importance of Openness and Verifiability in Digital Citizenship Technology

I often talk to people from various sectors who are trying to explore better forms of government that are more suitable for the different national conditions in the context of the 21st century. Some are trying to elevate the existing political system to a new level, empowering local open-source communities and using mechanisms such as citizens' assemblies, lotteries, and secondary voting. Others, such as economists studying land value tax or congestion charges, are trying to improve their country's economy.

Different people may have varying degrees of enthusiasm for each idea. However, they all share a common point, which is that they require high-bandwidth participation, and therefore any realistic implementation must be digital. It is acceptable to use pen-and-paper records for basic matters such as who owns what and elections held every four years, but this is not feasible for anything that requires higher bandwidth or more frequent solicitation of our opinions.

However, historically, the level of acceptance among security researchers for ideas such as electronic voting has ranged from skepticism to hostility. Below is a good summary of the case against electronic voting. The content cited from the document:

First of all, this technology is "black box software," which means the public cannot access the software that controls the voting machines. While companies protect their software to prevent fraud (and to combat competitors), this also leaves the public completely unaware of how the voting software works. Companies can easily manipulate the software to produce fraudulent results. Moreover, the vendors selling these machines compete with each other, making it impossible to guarantee that the machines they produce are in the best interests of voters and ensure the accuracy of ballots.

There are many cases in the real world that can prove this suspicion is reasonable.

A Critical Analysis of Internet Voting in Estonia in 2014.

These arguments apply in various other contexts. But I predict that as technology advances, the response of "let's just not do it" will become increasingly impractical in many fields. The world is rapidly becoming more efficient due to technological development (for better or worse), and I predict that any system that does not follow this trend will become increasingly irrelevant as people bypass it. Therefore, we need an alternative: to really tackle those difficult tasks and figure out how to make complex technological solutions secure and verifiable.

In theory, "secure verifiable" and "open source" are two different things. In certain aspects, it is absolutely possible to be both proprietary and secure: airplanes are highly proprietary technology, but overall, commercial aviation is a very safe mode of travel. However, what proprietary models cannot achieve is secure consensus - that is, the ability to gain the trust of participants who do not trust each other.

Citizen systems such as elections are a crucial scenario for secure consensus. Another scenario is the collection of evidence in court. Recently, in Massachusetts, evidence from a large-capacity alcohol tester was deemed inadmissible because information regarding a malfunction in the test was found to have been concealed. The article cites as follows:

Wait, so all the results are incorrect? No. In fact, most cases' alcohol test results do not have calibration issues. However, because investigators later discovered that the state crime lab had concealed evidence, indicating that the problem was more widespread than they had stated, Judge Frank Gaziano wrote that the due process rights of all these defendants were violated.

The due process of the court is essentially a domain that not only requires fairness and accuracy but also a consensus on fairness and accuracy—because without a consensus on the court doing the right thing, society can easily fall into a situation where people act on their own accord.

In addition to verifiability, openness itself has intrinsic advantages. Openness allows local communities to design systems for governance, identity, and other needs in a way that is compatible with local goals. If the voting system is proprietary, then a country (or province or town) wishing to try a new voting system will face greater difficulties: they either have to persuade the company to implement their preferred rules as a feature, or they must start from scratch, doing all the work to ensure its security. This increases the high costs of innovation in political systems.

In any of the aforementioned areas, a greater emphasis on open-source hacker ethics will grant local implementers more autonomy, whether they are individuals or part of governments or enterprises. To achieve this, open building tools need to be widely available, and infrastructure and codebases must be freely licensed to allow others to develop and build upon them. To minimize power disparities, copyright sharing licenses (Copyleft) are particularly important.

In the coming years, another important area of civic technology will be physical security. Unfortunately, I predict that the rise of drone warfare will make "low-tech security" no longer viable. Even if a country's laws do not infringe on personal freedoms, it is meaningless if that country cannot protect you from other nations (or unlawful enterprises or individuals) imposing their laws upon you. Drones make such attacks easier. Therefore, we need to take countermeasures, which will likely involve a large number of anti-drone systems, sensors, and cameras.

If these tools are proprietary, data collection will be opaque and centralized. If these tools are open and verifiable, then we have the opportunity to find better methods: secure devices can prove that they only output a limited amount of data under limited conditions and delete the rest. We could have a digitized physical security future that resembles a digital watchdog rather than a digital surveillance prison. We can imagine a world where public surveillance devices must be open source and verifiable, and anyone has the legal right to randomly select a surveillance device in public, then dismantle it and verify it. University computer science clubs could often use this as an educational activity.

###Open-source and verifiable method

We cannot avoid digital computers being deeply embedded in various aspects of our (individual and collective) lives. By default, we are likely to get digital computers built and operated by centralized companies, optimized for the interests of a few, with backdoors set by the governments of their respective countries, and most people in the world cannot participate in their creation or know whether they are secure. But we can try to find better alternatives.

Imagine a world like this:

• You have a secure personal electronic device – it has the functionality of a mobile phone, the security of a hardware wallet, and an inspectability that is not quite like a mechanical watch but very close.
• Your messaging applications are encrypted, the message patterns are obfuscated through a mixed network, and all code has been formally verified. You can rest assured that your private communications are indeed private.
• Your finances are standardized ERC20 assets on-chain (or a server that publishes hash values and proofs on-chain to ensure correctness) managed by a wallet controlled by your personal electronic devices. If you lose your device, you can recover it through other devices of your choice, family, friends, or institutions (not necessarily the government: if anyone can easily do this, for example, a church can also provide it).
• An open-source version of infrastructure similar to Starlink already exists, allowing us to achieve powerful global connectivity without relying on a few individual participants.
• The open LLM on your device will scan your activities, provide suggestions and autocomplete tasks, and warn you when you may be obtaining incorrect information or about to make a mistake.
• This operating system is also open source and has been formally verified.
• You are wearing an all-weather personal health tracking device, which is also open source and verifiable, allowing you to access data and ensure that no one else can access it without your consent.
• We have more advanced forms of governance that use a combination of lotteries, citizen assemblies, runoff voting, and typically clever democratic voting methods to set goals, and some method to filter opinions from experts to determine how to achieve those goals. As a participant, you can be assured that the system is executing the rules in a way that you understand.
• Public places are equipped with monitoring devices to track biological variables (such as carbon dioxide and air quality index levels, the presence of airborne diseases, and wastewater). However, these devices (as well as any surveillance cameras and defense drones) are open source and verifiable, and there is a legal framework in place that allows the public to randomly inspect these devices through the legal system.

Compared to today, this world is safer, freer, and participates more equally in the global economy. But to achieve such a world, more investment in various technologies is needed:

• More advanced forms of cryptography. I refer to it as the "Egyptian God Card" of cryptography — ZK-SNARK, which is fully homomorphic encryption and obfuscation technology — is so powerful because it allows you to perform arbitrary program computations on data in a multi-party environment, guaranteeing the output while keeping the data and computation process private. This makes more powerful privacy-preserving applications possible. Tools related to cryptography (for example, blockchain can provide strong guarantees for applications, ensuring that data is not tampered with and users are not excluded; differential privacy techniques can add noise to data, further protecting privacy) are also applicable here.
• Application and User-Level Security. An application is only secure if the security guarantees it provides can truly be understood and verified by users. This will require software frameworks that make it easy to build applications with strong security properties. Importantly, it also requires browsers, operating systems, and other middleware (such as locally running observer LLMs) to play their respective roles in verifying applications, assessing their risk levels, and presenting this information to users.
• Formal Verification. We can use automated proof methods to verify whether a program meets the properties we care about, such as not leaking data or being resistant to unauthorized modifications by third parties. Lean has recently become a popular formal verification language. These techniques have begun to be used to verify ZK-SNARK proof algorithms for the Ethereum Virtual Machine ( EVM) and other high-value, high-risk crypto use cases, and are being applied in broader fields. In addition, we also need to make further progress in other more common security practices.

The deterministic view of cybersecurity in the 2000s is wrong: vulnerabilities (and backdoors) can be overcome. We "just" need to learn to prioritize security over other competitive objectives.

• Open-source and security-focused operating systems. An increasing number of such operating systems are beginning to emerge: GrapheneOS as a secure version of Android, streamlined security kernels like Asterinas, and Huawei's HarmonyOS (its open-source version) are utilizing formal verification (as long as it is open, anyone can verify, who produces it does not matter. This is a great example of how openness and verifiability can counter global fragmentation.)
• The security of secure open-source hardware. If you cannot ensure that the hardware is indeed running the software and that no data is being disclosed separately, then any software is insecure. In this regard, I am most interested in two short-term goals:
• Personal security electronic devices — Blockchain enthusiasts refer to them as "hardware wallets," while open-source advocates call them "secure phones." However, once you understand the necessity of security and universality, the two will ultimately merge into one.
• Physical Infrastructure in Public Spaces – Smart locks, the biometric monitoring devices I mentioned above, and general "Internet of Things" technology. We need to be able to trust them. This requires openness and verifiability.
• A secure open toolchain for building open-source hardware. Today, hardware design relies on a series of closed-source dependencies. This significantly increases the cost of hardware manufacturing and makes the entire process more reliant on licensing. It also renders hardware validation impractical: if the tools generating the chip designs are closed-source, you don't know what to validate. Even existing tools like scan chains often become unusable in practice because too many necessary tools are closed-source. All of this can change.
• Hardware validation (e.g., infrared and X-ray scanning). We need methods to scan chips to verify that they genuinely possess their intended logic and do not have any extraneous components, to prevent accidental tampering and data extraction. This can be done destructively: auditors randomly order products containing computer chips (posing as seemingly ordinary end users), then open the chips and verify if the logic matches. Using infrared or X-ray scanning, this can be performed non-destructively, potentially allowing for scanning of each chip.
• In order to achieve a trust consensus, ideally we need hardware verification technology that the public can easily master. Today's X-ray machines do not yet reach this level. This situation can be improved in two ways. First, we can enhance the verification devices (as well as the friendliness of chip verification) to make the devices more accessible to the public. Second, we can supplement some more limited forms of verification on the basis of "comprehensive verification", which can even be completed on smartphones (such as ID tags and key signatures generated by physically unclonable functions), to verify stricter claims, for example, "Does this machine belong to a batch produced by a known manufacturer, and has the random sample from that batch been thoroughly verified by a third-party organization?"
• Open-source, low-cost, localized environmental and biological monitoring devices. Communities and individuals should be able to measure themselves and their environment and identify biological risks. This includes various forms of technology: personal medical devices (e.g., OpenWater), air quality sensors, universal airborne disease sensors (e.g., Varro), and larger-scale environmental monitoring equipment.

The openness and verifiability of each layer of the stack are very important.

###From here to there

A key difference between this vision and the more "traditional" technological vision is that it is more friendly to local sovereignty, individual empowerment, and freedom. Security is not achieved by searching the world and ensuring there are no bad actors anywhere, but rather by making the world more robust at all levels. Openness means openly building and improving every layer of technology, not just centralized planned open access API programs. Verification is not the exclusive domain of proprietary stamped auditors (who are likely colluding with the companies and governments that launched the technology) — it is a right of the people and a socially encouraged pastime.

I believe that this vision is stronger and more aligned with the fragmented global landscape of the 21st century. However, we do not have unlimited time to execute this vision. Centralized security measures, including more centralized data collection and backdoors, as well as simplifying verification to "Is this made by a trusted developer or manufacturer?", are rapidly evolving. For decades, attempts have been made to replace genuine open access with centralized methods. This attempt may have begun with Facebook's internet.org and will continue, with each attempt becoming more complex than the last. We need to act quickly to compete with these methods and publicly demonstrate to both the public and institutions that better solutions are possible.

If we can successfully achieve this vision, then one way to understand the world we live in is as a form of retro futurism. On one hand, we benefit from more powerful technologies that enable us to improve health, organize more efficiently and resiliently, and protect ourselves from new and old threats. On the other hand, the world we acquire regains some characteristics that people took for granted in 1900: infrastructure is freely dismantleable, verifiable, and modifiable by individuals to meet their own needs; anyone can participate, not just as consumers or "app developers," but at any level of the stack; anyone can be assured that devices will operate as claimed.

Verifiability in design comes at a cost: many software and hardware optimizations, while providing the much-needed speed improvements, result in designs that are harder to grasp or more fragile. Open source makes it more difficult to profit under many standard business models. I believe both of these issues are exaggerated—but this is not something that can convince the world overnight. This raises a question: what pragmatic goals should we pursue in the short term?

I will propose a solution: dedicated to creating a fully open-source and easily verifiable stack, aimed at high security and low-performance applications—whether consumer-facing or institutional, remote or face-to-face. This will encompass hardware, software, and biometric technology. Most computing that truly requires security does not usually need speed; even in cases where speed is required, there are often ways to combine high-performance but untrusted components with trusted but low-performance components, thereby achieving high levels of performance and trust for many applications. Achieving the highest security and openness for everything is unrealistic. But we can start by ensuring that these features are available in genuinely important areas.