About Urbit, Part 1 — Ownership

All the problems with the Internet have been apparent for a while, although they seem to have metastasized lately. To a large extent, they’re baked into the way the Internet is setup. Any attempt at a solution built on top of current Internet technology is doomed to become part of the problem sooner or later.

(I wrote many thoughts about this here, if you’re interested.)

A real solution would mean rethinking computers, networks, and online identity, and then rebuilding things from the ground up. The good news is this actually exists. It’s called Urbit.

To say that Urbit “exists” is admittedly a bit of a stretch. The network is up and running. You can install the software and connect to the network. There just isn’t a whole lot you can do with it yet. Right now, you can chat with other people on the network (in text form), and that’s about it.

This essay will discuss what Urbit is, how it works, and some of the things you will be able to do once things are in a more completed state. A lot of this will be speculative, but all of it should be possible.

This is intentionally short on technical details. I will try to focus on what Urbit does and why it works like that. I will leave a discussion of how it does everything to someone else.

So with that in mind, let’s talk about how Urbit is different.

Peer-to-Peer

The primary architecture of the Internet is the client-server architecture. This architecture is a byproduct of a bygone era, long before the movie WarGames came out. Computer machinery was really expensive, so a large organization would have one big centralized computer, the “server”, and everyone connects to it via a “client”.

And this is how pretty much everything on the Internet still works: email, websites, WhatsApp, text messages, etc. all run inside servers. The client is an app on your phone, a web browser, possibly a web browser running on your phone.

The alternative to a client-server network is a peer-to-peer network. On a peer-to-peer network, you have servers, but no intermediaries. The servers all talk directly to each other.

The classic example of a peer-to-peer network is the telephone network. (A phone isn’t exactly a “server”, but stick with me here.) As far as the phone network is concerned, everyone’s phone is the same, and everyone can connect to everyone else. You pick up your phone, dial a phone number, and the other phone starts ringing. It doesn’t matter if it’s your Aunt Mabel or Uruguayan embassy, the process works the same.

Of course the phone company is an intermediary in all this. But if you are standing in your kitchen making a phone call, the only time the phone company enters into the equation was if you or the person you are calling haven’t paid the phone bill. The phone company’s role is to provide lines, switches, and infrastructure for you to make phone calls. Who you call and what you talk about are none of its business.

Planets and Stars

Urbit is also a peer-to-peer network. It’s a network of servers, calls “ships”. A ship runs on an Internet-connected computer, and sends and receives messages from other ships.

Every ship has a name, which is something pronounceable, like ~nalbar-solnyl. (The ~ is silent) It has two purposes: it's an address that you use to connect to other ships, and it serves as an identifier. There are no anonymous messages on Urbit. Every message a ship sends out will have its name stamped onto it.

Ships on Urbit have classes. The class of ships most people will have are called “planets”. Planets have four-syllable names like ~tinnyt-sigpur. Each planet is "sponsored" by one of 64 thousand or so ships at a higher-level, called "stars". Stars have shorter names than planets, something like ~dapden. And each star is sponsored by one of 256 servers at the highest-level, a "galaxy", which has a one-syllable name like ~den.

Here’s how it works:

Let’s say you want to send a message from your planet to ~bonrex-lislyt, which belongs to your friend Sidney in Rochester, MN. Maybe ~bonrex-lislyt is running in the cloud on Amazon Web Services. Maybe it's running on an old iMac in Sidney's parents' basement in Duluth. It shouldn't matter from your perspective.

Your planet asks the star that’s sponsoring it about ~bonrex-lislyt's whereabouts. That star asks its galaxy, and eventually it gets the internet address for Sidney's planet from the star that it is sponsoring it.

Once you have ~bonrex-lislyt's internet address, you planet and Sidney's planet can talk directly to each other using the same Internet protocol that your web browser uses to stream videos of people's cats.

This address lookup happens automatically. The only thing you need is Sidney’s planet name.

All messages on Urbit are encrypted and unreadable by anyone except the people you’re sending them to. The stars are just there to connect planets to the rest of the network.

This is a completely different way of doing things than Facebook. On Facebook, you first have to log in before you can do anything, and everything on Facebook runs through one of their servers.

On Urbit, you just boot up your planet and you’re on the network. Your sponsoring star should start handling requests for you automatically. All interactions with other planets happen directly.

Administration

One of the big advantages of a centralized client-server-type network — like the university computer network of my undergrad days, or Twitbook of today — is that you have people to run things for you.

Administering a server is a time-consuming job. Unix is almost 50 years old. It’s phenomenally complicated. It consists of tens of millions of lines of code. There are dozens of avenues for evil-doers to attack and compromise the system, so just keeping up with security is a huge ordeal.

I have been doing Unix system administration in some form since the 90s, when I took a shoebox of floppy disks to the computer lab to install this new operating system called “Linux” on my PC.

It’s way, way easier than it used to be. You can fill out a web form and Amazon will create a server for you. Even so, it’s not something that my dad would have the skills to do. And while I do have the skills for it, there are many other things I could do with my spare time.

Urbit solves the complexity problem by being extremely compact. The whole codebase for Urbit is 30 thousand lines of code. It does a small number of things and the developers working on it are focused on making sure those things work perfectly.

This also means it has a small “attack surface”, i.e. there’s a limited number of ways that someone can break into your system, read your messages, or impersonate you.

Also, each Urbit server can update itself automatically while it’s still running. Once it’s booted up, you should never need to worry about it. If someone discovers a security flaw, the star that sponsors you can push out a fix to your planet without your ever having to know about it.

Ownership

Getting onto the Urbit network is not unlike getting onto the phone network. If you want to get a phone line, you get one from one of the phone companies, AT&T, Sprint, etc. You pay them some money, they give you a phone number, and they handle your calls.

If you want a planet on Urbit, you have to get a ticket from a star, which you use to create a planet. Once your planet is up and running, this same star will then be responsible for connecting you to other planets and also letting the rest of the network know how to connect to you.

One big difference with getting a phone line is, there are about a half dozen big phone companies you will probably get a phone from. On Urbit, there are about 64 thousand stars, and each star will eventually be owned by a different person.

How that person decides to distribute all those tickets is entirely up to her. She could sell them, raffle them, exchange them for backrubs. She could give them to members of her Alcoholics Anonymous group after a year of sobriety. If she’s an anarcho-syndicalist, she can give them out to workers who have proven their willingness to smash the capitalist system.

There’s nothing in the Urbit architecture or in the rules (currently) that says how this should work. Once you have a server on Urbit, whether it’s a planet, star, or galaxy, it is yours to do with what you want, until you sell it.

The hope is that if you have 64 thousand motivated people trying to solve a problem, they’ll converge upon some number of good solutions, which they can tailor to their particular situation. A star owner distributing tickets for planets in Brooklyn might have a different policy than one distributing tickets in rural China.

And if a star owner makes a bone-headed decision on distributing his planets, he’ll only be messing up a very small portion of the whole Urbit network. He won’t be establishing a worrying precedent for everyone in the future.

When someone purchases a star, it’s purchasing a piece of the Urbit network. It’s like starting a very small phone company. The star is what lets the rest of the network know how to contact a planet and keeps all the planets up to date.

Thus if you run a star, you will need computer machinery, Internet bandwidth, and your time to keep things running for all the planets in your “solar system”.

A star on Urbit is not designed to be a charity, and there’s nothing preventing you from passing the costs onto your planets, along with “administrative overhead” to pay for your time, i.e. you can charge money and possibly even make a profit running a star and sponsoring planets.

(There’s also nothing in the rules preventing you from running your star as a charity. Again, this is entirely up to you.)

Abuse

In the early days of any relationship, everything seems wonderful. A star tells you it’ll always be there for you, ready to respond to your needs and handle whatever requests you give to it.

Hopefully it does this well. But if for any reason you don’t like the star that is sponsoring you, you can switch to a different star. Maybe it’s slow or doesn’t keep your planet updated. Maybe it’s too expensive. Maybe your old college roommate just purchased a star and you’d like to switch to his system. It doesn’t matter the reasons, as long as the planet and the new star agree.

The fact that a planet can switch stars in a matter of seconds should stop some of the more egregious behavior you see from phone companies. But any agreement between a star and a planet, whether it’s a contract or a tacit understanding, should forbid the planet from abusing the network.

“Abusing” can take many forms: spam, stealing people’s identities, launching a denial-of-service attack, etc. Right now, we’ll break down about how Urbit can prevent and deal with spam, but the basic mechanism should work for all manner of network abuse.

If you’re under the age of 40, you probably don’t remember a time when spam was just a trivial nuisance. But it is pernicious. Spam is why your personal email is not nearly as useful as it used to be. Spam is, to a large extent, what killed MySpace. The fact that Facebook largely solved the problem of spam is, to some extent, why they came to dominate social networking.

(They then renamed spam “targeted advertising” and started selling it, but we already covered that.)

So what to do about it?

This is more or less how Urbit does it:

To get connected, you have to get a ticket from someone who owns a star. The people who own stars on Urbit have invested their own time and/or money to the project. The more enjoyable the network is, the more people will want to join in the fun, and the more their stars will be worth.

So, if someone creates a planet and starts messaging thousands of people, claiming to be the stepson of the Nigerian Oil Minister, this is bad for Urbit. This doesn’t make the network more enjoyable.

Stars can issue a lot of tickets, but not an endless number. Once someone uses a ticket to create a planet, that ticket is gone. The star that issued the ticket can’t take over the planet after the fact if the planet starts engaging in questionable behavior.

It can, however, disconnect the planet from the network.

A star can’t read the contents of messages that planets are sending, but it should notice if a planet is sending lots and lots of messages. So when a star sees a suspicious spike in traffic, all it has to do is stop listening to the planet, stop replying to its requests, and stop updating anyone else about its whereabouts.

(Note: the small number of people who have managed to get on Urbit have all been awesome, and nobody has had to resort to anything like this. How this would actually be handled might look totally different.)

As a final resort, stars have to connect to a galaxy. So if someone running a star cannot or will not deal with spam, or worse, if he decides to spin up a bunch of spam-bots, his sponsoring galaxy can disconnect him just as easily as a star can disconnect a planet.

The Solution to Spam

A star is ultimately a business. Once a star stops sponsoring a planet, it’s effectively losing a customer and creating hard feelings. The best solution would be to make sure spammers don’t end up on the network in the first place.

This is fairly simple once you consider how spam works.

Spam is a essentially a really annoying form of advertising. If you’re considering sending out spam, it’s basically the same as if you’re considering a 30-second radio spot. How many people will this reach? What percent of them will buy the thing/send money? How much money will they spend/send? And how much will this cost?

Thus the simplest way to prevent spam is to simply charge people money for a planet. Most spam generates very little money, so a star would not have to charge that much to make spam a bad way to advertise their product/service/scam.

If people really want to give away planets, there is nothing to stop them, but they will have to find some non-commercial way to determine who will play nice on the network. I believe this would be possible, but I am not sure how this would work. I am certain it would be way less straightforward than just charging money for planets.

The Stars, Aligned

There is a governance system for Urbit stars and galaxies, but it is still very much a work in process. It is my hope that there won’t be the need for too many rules because all the pieces are aligned to keep abuse from happening and deal with it easily if it does.

If a planet is clogging the network with messages trying to get people involved in its pyramid scheme, the star that sponsors it can disconnect it.

If that star refuses to reconnect the planet, the planet can then try to get another star to sponsor it. I would imagine the first question the other star will ask is, “Why did you get disconnected from your last star?”

If the sponsoring star is being abusive to any of the planets in its system, the planets can find another star to sponsor them.

And if the whole star has become a wretched hive of scum and villainy, the sponsoring galaxy can disconnect it.

(Actually, stars can also find another galaxy to sponsor them, but they would have a similar conversation with a new galaxy that the planet would have with a new star. “Why did you get disconnected from your galaxy?”)

By Humans, For Humans

One big difference between how problems can be worked out on Urbit versus how they are worked out on the Internet of today is the scale.

Everything on the Internet is oriented toward consolidation and bigness. Any network with millions (or billions) of users will need rigid policies so it can be enforced by computers and/or anonymous employees with little discretion.

In contrast, on Urbit, a star is limited to issuing 64 thousand planets. This number is about the population of a mid-sized US suburb.

The owner might decide to hire people to help run things, but no organization running a star can possibly end up as big as Twitter. Even galaxies (which can issue tickets for 256 stars, and thereby 16 million planets) only represent 0.3% of the whole Urbit network. They will never end up as big as Facebook is today (although they might be bigger than MySpace is today).

So if there is a problem, like if a planet is sending out messages en masse, there might be a legitimate reason. Maybe a friend with a very rare blood type needs a kidney transplant.

The planet owner and star owner and maybe galaxy owner can have a discussion and decide if this should be allowable. And if this sets a bad precedent, it can be a cautionary tale for the rest of the network without ruining the whole thing.

To Be Continued

I used the extremely generic phrase “sending out messages” to describe people doing things on Urbit. But Urbit was designed to be used by people, to communicate with people. It’s a social network.

In this part, we’ve talked about the “network” piece. Next time we’ll describe the “social” part, and how that’s going to work.

UPDATE: Continued in Part 2.