Slice

895 posts

Slice banner
Slice

Slice

@slice__so

The World Marketplace ▼

Ethereum Beigetreten Mart 2021
3 Folgt3.7K Follower
Angehefteter Tweet
Slice
Slice@slice__so·
ERC-8128: Signed HTTP Requests with Ethereum. A signature-based authentication standard that cryptographically binds identity and intent to every request. The missing primitive to securely verify humans, machines, and AI agents on the web, built on Ethereum.
English
57
155
707
139.9K
Slice retweetet
jacopo.eth
jacopo.eth@jacopo_eth·
how it feels building @slice__so these days
jacopo.eth tweet media
English
0
2
4
151
Slice retweetet
jacopo.eth
jacopo.eth@jacopo_eth·
Just opened a PR to add first-class ERC-8128 support to Better Auth. Still early and lots to improve, but after using it for a few days I'm already excited by how easy it makes adopting secure signature-based auth in apps and backends. Working on this also made me appreciate just how amazing Better Auth is. github.com/better-auth/be…
English
1
2
10
264
Slice retweetet
jacopo.eth
jacopo.eth@jacopo_eth·
Exactly. Agents need different permissions, **identities** and lifecycles. ERC-8128 solves this at the protocol layer: - each agent gets its own identity (an Ethereum account) - each request is cryptographically signed by that agent - the API derives identity from the request itself, then checks what that agent is allowed to do for a given user At its core, it's a low-level agent auth primitive for the web, built on HTTP message signatures.
Beka@bekacru

I think we have a problem here because of how people think of what an agent is An agent isn’t the application (which oauth is designed for). An agent isn’t “cursor” or “claude code”, the agent is the specific actor within that runtime. Two separate chats in the your cursor are not the same agent. They have different contexts, different intents and should have different permissions, identities, and lifecycles. And unfortunately oauth was never designed for this An agent that is only supposed to read my email must not have permission to delete my email, even if I want another agent to be able to do that within a given time frame

English
2
2
9
469
Slice retweetet
jacopo.eth
jacopo.eth@jacopo_eth·
you realize how transformative ethereum can be once you see it for what it really is: a global shared memory and programming layer. that’s exactly the mental model we used at @slice__so to rethink commerce from first principles.
vitalik.eth@VitalikButerin

I was recently at Real World Crypto (that's crypto as in cryptography) and the associated side events, and one thing that struck me was that it was a clarifying experience in terms of understanding *what blockchains are for*. We blockchain people (myself included) often have a tendency to start off from the perspective that we are Ethereum, and therefore we need to go around and find use cases for Ethereum - and generate arguments for why sticking Ethereum into all kinds of places is beneficial. But recently I have been thinking from a different perspective. For a moment, let us forget that we are "the Ethereum community". Rather, we are maintainers of the Ethereum tool, and members of the {CROPS (censorship-resistant, open-source, private, secure) tech | sanctuary tech | non-corposlop tech | d/acc | ...} community. Going in with zero attachment to Ethereum specifically, and entering a context (like RWC) where there are people with in-principle aligned values but no blockchain baggage, can we re-derive from zero in what places Ethereum adds the most value? From attending the events, the first answer that comes up is actually not what you think. It's not smart contracts, it's not even payments. It's what cryptographers call a "public bulletin board". See, lots of cryptographic protocols - including secure online voting, secure software and website version control, certificate revocation... - all require some publicly writable and readable place where people can post blobs of data. This does not require any computation functionality. In fact, it does not directly require money - though it does _indirectly_ require money, because if you want permissionless anti-spam it has to be economic. The only thing it _fundamentally_ requires is data availability. And it just so happened that Ethereum recently did an upgrade (PeerDAS) to increase the amount of data availability it provides by 2.3x, with a path to going another 10-100x higher! Next, payments. Many protocols require payments for many reasons. Some things need to be charged for to reduce spam. Other things because they are services provided by someone who expends resources and needs to be compensated. If you want a permissionless API that does not get spammed to death, you need payments. And Ethereum + ZK payment channels (eg. ethresear.ch/t/zk-api-usage… ) is one of the best payment systems for APIs you can come up with. If you are making a private and secure application (eg. a messenger, or many other things), and you do not want to let people to spam the system by creating a million accounts and then uploading a gigabyte-sized video on each one, you need sybil resistance, and if you care about security and privacy, you really should care about permissionless participation (ie. don't have mandatory phone number dependency). ETH payment as anti-sybil tool is a natural backstop in such use cases. Finally, smart contracts. One major use case is _security deposits_: ETH put into lockboxes that provably get destroyed if a proof is submitted that the owner violated some protocol rule. Another is actually implementing things like ZK payment channels. A third is making it easy to have pointers to "digital objects" that represent some socially defined external entity (not necessarily an RWA!), and for those pointers to interact with each other. *Technically*, for every use case other than use cases handling ETH itself, the smart contracts are "just a convenience": you could just use the chain as a bulletin board, and use ZK-SNARKs to provide the results of any computations over it. But in practice, standardizing such things is hard, and you get the most interoperability if you just take the same mechanism that enables programs to control ETH, and let other digital objects use it too. And from here, we start getting into a huge number of potential applications, including all of the things happening in defi. --- So yes, Ethereum has a lot of value, that you can see from first principles if you take a step back and see it purely as a technical tool: global shared memory. I suspect that a big bottleneck to seeing more of this kind of usage is that the world has not yet updated to the fact that we are no longer in 2020-22, fees are now extremely low, and we have a much stronger scaling roadmap to make sure that they will continue to stay low, even if much higher levels of usage return. Infrastructure for not exposing fee volatility to users is much more mature (eg. one way to do this for many use cases is to just operate a blob publisher). Ethereum blobs as a bulletin board, ETH as an asset and universal-backup means of payment, and Ethereum smart contracts as a shared programming layer, all make total sense as part of a decentralized, private and secure open source software stack. But we should continue to improve the Ethereum protocol and infrastructure so that it's actually effective in all of these situations.

English
0
2
3
309
Slice retweetet
AI on Base
AI on Base@AIonBase_·
4 open standards for the agentic commerce 🧵 agents need to work, get paid, and be trusted across organizations with no platform in the middle. this is the stack: 1) ERC-8128 by @slice__so / HTTP auth every API key ever issued is a liability. stolen, leaked, rotated, expired. the server owns your access. ERC-8128: agent signs every HTTP request with its ETH wallet. impersonation → signature proves key ownership tampering → body hash catches any modification replay → nonce makes each request single-use 2) x402 by @CoinbaseDev / HTTP payments agents are the first internet participant that can pay programmatically without a card, account, or KYC. agent ➝ GET /resource server ← 402: pay X to Y agent ➝ pays in USDC server ← 200: access granted you don't need to buy a $20 subscription for one-time use. x402 makes it possible to charge per exact usage. 3) ERC-8004 by @ethereumfndn dAI team / trust registry once agents can prove who they are, next question: can they be trusted? ERC-8004 is an onchain discovery and trust layer. three registries: identity, reputation, validation. broader than agents. MCP tool servers, oracles, any HTTP service can register and build portable rep today. rep scales with stakes: score → TEE → ZK proof → staking 4) ERC-8183 by @virtuals_io x dAI team / escrow jobs agents need to hire each other. client locks funds → provider submits work → evaluator attests → escrow releases every completed job produces a portable record. owned by no one, readable by any facilitator on any chain. today stripe owns your chargeback history. on ERC-8183 that rep is yours. This is agentic commerce.
AI on Base tweet media
English
7
8
44
2.1K
Slice retweetet
jacopo.eth
jacopo.eth@jacopo_eth·
we've hidden an easter egg in this thread hinting at an erc8128 integration we're shipping soon. been testing it for the past few days, it's by far the best way to authenticate with erc8128. can't wait!
Slice@slice__so

The ERC-8128 Playground is live on erc8128.org Choose what to sign with your wallet, and try out the full signature lifecycle: compose → sign → verify. It's the easiest way to understand request binding, non-replayability, and this new authentication primitive.

English
0
2
4
266
Steve Krouse
Steve Krouse@stevekrouse·
i regret to inform you that i found a legitimate use-case for crypto: killing api keys
English
38
28
716
132.8K
Slice retweetet
jacopo.eth
jacopo.eth@jacopo_eth·
once you grasp ethereum signed requests, you’ll wonder why it took us so long to adopt them. try them yourself in the ERC-8128 playground.
Slice@slice__so

The ERC-8128 Playground is live on erc8128.org Choose what to sign with your wallet, and try out the full signature lifecycle: compose → sign → verify. It's the easiest way to understand request binding, non-replayability, and this new authentication primitive.

English
1
2
7
467
Slice
Slice@slice__so·
You can also test error responses: send a DELETE that’s class-bound or replayable, and the verifier tells you exactly what’s missing via the Accept-Signature response header. Signers can then adapt and resubmit immediately.
English
2
0
3
87
Slice
Slice@slice__so·
The ERC-8128 Playground is live on erc8128.org Choose what to sign with your wallet, and try out the full signature lifecycle: compose → sign → verify. It's the easiest way to understand request binding, non-replayability, and this new authentication primitive.
English
2
1
13
1.7K
Slice retweetet
jacopo.eth
jacopo.eth@jacopo_eth·
Decentralized commerce is sanctuary tech. Financial freedom isn’t enough. People need to buy, sell, and build businesses on infrastructure that can’t be captured. Stores anyone can open. Payments no one can freeze. Protocols with no owner to pressure. That’s Slice.
vitalik.eth@VitalikButerin

Over the past year, many people I talk to have expressed worry about two topics: * Various aspects of the way the world is going: government control and surveillance, wars, corporate power and surveillance, tech enshittification / corposlop, social media becoming a memetic warzone, AI and how it interplays with all of the above... * The brute reality that Ethereum seems to be absent from meaningfully improving the lives of people subject to these things, even on the dimensions we deeply care about (eg. freedom, privacy, security of digital life, community self-organization) It is easy to bond over the first, to commiserate over the fact that beauty and good in the world seems to be receding and darkness advancing, and uncaring powerful people in high places are making this happen. But ultimately, it is easy to acknowledge problems, the hard thing is actually shining a light forward, coming up with a concrete plan that makes the situation better. The second has been weighing heavily on my mind, and on the minds of many of our brightest and most idealistic Ethereans. I personally never felt any upset or fear when political memecoins went on Solana, or various zero-sum gambling applications go on whatever 250 millisecond block chain strikes their fancy. But it *does* weigh on me that, through all of the various low-grade online memetic wars, international overreaches of corporate and government power, and other issues of the last few years, Ethereum has been playing a very limited role in making people's lives better. What *are* the liberating technologies? Starlink is the most obvious one. Locally-running open-weights LLMs are another. Signal is a third. Community Notes is a fourth, tackling the problem from a different angle. One response is to say "stop dreaming big, we need to hunker down and accept that finance is our lane and laser-focus on that". But this is ultimately hollow. Financial freedom and security is critical. But it seems obvious that, while adding a perfectly free and open and sovereign and debasement-proof financial system would fix some things, but it would leave the bulk of our deep worries about the world unaddressed. It's okay for individuals to laser-focus on finance, but we need to be part of some greater whole that has things to say about the other problems too. At the same time, Ethereum cannot fix the world. Ethereum is the "wrong-shaped tool" for that: beyond a certain point, "fixing the world" implies a form of power projection that is more like a centralized political entity than like a decentralized technology community. So what can we do? I think that we in Ethereum should conceptualize ourselves as being part of an ecosystem building "sanctuary technologies": free open-source technologies that let people live, work, talk to each other, manage risk and build wealth, and collaborate on shared goals, in a way that optimizes for robustness to outside pressures. The goal is not to remake the world in Ethereum's image, where all finance is disintermediated, all governance happens through DAOs, and everyone gets a blockchain-based UBI delivered straight to their social-recovery wallet. The goal is the opposite: it's de-totalization. It's to reduce the stakes of the war in heaven by preventing the winner from having total victory (ie. total control over other human beings), and preventing the loser from suffering total defeat. To create digital islands of stability in a chaotic era. To enable interdependence that cannot be weaponized. Ethereum's role is to create "digital space" where different entities can cooperate and interact. Communications channels enable interaction, but communication channels are not "space": they do not let you create single unique objects that canonically represent some social arrangement that changes over time. Money is one important example. Multisigs that can change their members, showing persistence exceeding that of any one person or one public key, are another. Various market and governance structures are a third. There are more. I think now is the time to double down, with greater clarity. Do not try to be Apple or Google, seeing crypto as a tech sector that enables efficiency or shininess. Instead, build our part of the sanctuary tech ecosystem - the "shared digital space with no owner" that enables both open finance and much more. More actively build toward a full-stack ecosystem: both upward to the wallet and application layer (incl AI as interface) and downward to the OS, hardware, even physical/bio security levels. Ultimately, tech is worthless without users. But look for users, both individual and institutional, for whom sanctuary tech is exactly the thing they need. Optimize payments, defi, decentralized social, and other applications precisely for those users, and those goals, which centralized tech will not serve. We have many allies, including many outside of "crypto". It's time we work together with an open mind and move forward.

English
0
2
9
369
Slice retweetet
WGW ☂️ oss/acc
WGW ☂️ oss/acc@wgw_eth·
Oh man, ERC-8128 is so good... it was the final piece of the puzzle.. Eating OAuth & JWTs alive. Thanks @slice__so for this contribution, i've been following you for years. erc8128.slice.so
WGW ☂️ oss/acc tweet media
English
0
2
4
204