A few days ago, a vulnerability in xz-utils named CVE-2024-3094 was discovered, and since then the open source community as well as security pundits fall over themselves and each other to provide the best analysis of this incident. Don’t worry, this post isn’t another one of those. Because while all the speculation about what motivates such a long-term attack is fun, the underlying issue is way, way simpler. In a tweet1, Heather Adkins of Google posted an “unpopular opinion: if your hobby is now responsible for running the modern world, it’s no longer a hobby”.

Yesterday, we explored the differences between a Merkle DAG and vessel’s DAG. Today’s topic revolves around how combining wyrd’s conflict-free, replicated data type (CRDT) with vessel makes a specific kind of CRDT, namely a DAG-based one. Figure: “Fractal Structures” by SolomonVipe is licensed under CC BY-SA 2.0 Conflict-Free, Replicated Data Types A quick recap on CRDTs first. They’re data types, largely fairly simple ones, such as counters or sets. And they’re conflict-free, meaning that multiple parties can modify them concurrently, and when their respective modifications get synchronized, each party with the full set of modifications will reconstruct the same state.

One of the recurring conversations I’m having is on whether vessel is a Merkle DAG or Merkle Tree/Trie, and every time I have to start over with explaining that it is not. And this is a deliberate choice. In this post, I’d like to explore the differences – and this post will also kick off a mini series on how vessel and it’s sibling project wyrd together form a DAG-based conflict-free, replicated data type (CRDT) akin to a Merkle CRDT.

With 2023 over, and some time between now and the last update, it’s perhaps a good moment to reflect on what happened in 2023 and where the project is right now. Achievements Last year saw the closing of our grant from Internet Society Foundation, who have been excellent partners for the past two years! I don’t think I can overstate how important this grant has been for our work. In particular, a longer-running grant meant the focus could be more on actual research – trying things out and writing up the results – and less on implementation.