Request for Comment: Public & Private NNS Neurons

Governance NNS Governance
71

*Correction edit: this should say “among unique neurons.” *

For full transparency and to avoid misunderstandings I wanted to point out that I fixed this typo in my previous message. The rest of the message is still unchanged.

72

Hi all,
thanks again for all the feedback and questions above! Since this discussion has been open for three weeks now, we think a good next steps is to submit a motion proposal to better understand what the full NNS community thinks about the idea.

We plan to submit the motion proposal next week on Monday (July 1st).
Let me already share the motion proposal draft with you here:

Proposal Title:

Public and private neurons & neuron index

Proposal Summary:

TL;DR

Introduce public and private neurons and a neuron index

  • Public neurons provide more transparency to followers
  • Private neurons keep ballots confidential
  • More transparency by revealing all neurons’ IDs and their stake

Current situation

For a neuron whose neuron ID is known, there is some information that everyone can get about the neuron, including:

  • The neuron’s stake and voting power

  • The neuron’s voting power bonus in the form of the dissolve delay and age (and the neuron’s creation time)

  • The neuron’s ballots

  • Whether the neuron is a member of the Neurons’ Fund

Not all neuron IDs of neurons in the NNS governance are known today.

The reason for this is that whenever a new neuron is created, it gets a new random neuron ID. This neuron ID is only known to the user that created the neuron and to the NNS.

This has the following consequences.

  1. If a user would like to hide information about their neuron, they can keep their neuron ID secret. This is an important feature to some users who would like to keep their ballots private, in order to vote freely and not fear consequences. For these neurons whose IDs are kept secret, no information is publicly known.
  2. It is not possible today to build an index of all neurons. The community has adopted a proposal to build a neuron index in NNS governance (https://dashboard.internetcomputer.org/proposal/48491). Once implemented, this allows users to get a comprehensive overview of how much each neuron stakes, allowing for example to get more insights with respect to how much stake is locked for how long.
  3. If a user would like to show details about their neuron to the public, there is no easy way to do so. This means for example, that followers of a known neuron cannot easily query the NNS to learn settings of the known neuron, such as who the known neuron follows on different topics.

Proposed new design

This proposal suggests a new design that addresses all needs above. For all neurons, it provides more transparency with respect to the stake. At the same time it maintains the users’ choice how much they would like to reveal with respect to their ballots where this is requested. Finally, for users who would like to reveal more information about their neuron, the new design provides an easy way to do so.

Details of the new design

  • For public neurons, everyone can read all fields of the neuron, except for the ICP ledger account ID. The reason for this exception is that this is particularly sensitive and can be used for in-depth ledger tracing.
  • For private neurons, everyone can read the following fields
    • Neuron ID
    • The neuron’s stake and voting power
    • The neuron’s voting power bonus in the form of the dissolve delay and age (and the neuron’s creation time)
    • The neuron’s type indicating that the neuron is a seed or ECT neuron
  • A neuron index in NNS governance lists all private and public neurons.
  • Neuron can choose to be private or public and change this at any point in time. The known neurons are public while all other neurons are set to private by default.

This design has the following consequences regarding the above mentioned user needs.

  1. If a user would like to keep their voting behavior confidential, they can set their neuron to be private.
  2. The neuron index provides more transparency by listing all neurons and important information about them, such as how much they stake.
  3. If a user would like to show details about their neurons to the public, they can set their neuron to be public. This allows any neuron, but especially known neurons, to provide additional transparency about their behavior to their followers.

Resulting properties

  • This design increases the transparency with respect to the neurons’ stake and voting power.
  • This design maintains the main verifiability properties of the voting process.
    • As is the case now, each user can verify that their vote was submitted (individual verifiability) and all users and outsiders can verify that the tallying process is correct by verifying the code (universal verifiability).
    • With respect to ballot visibility, the new design can make some ballots visible which are not visible now (unknown neuron IDs that chose to be public) and vice versa (neurons who choose to be private).
4 Likes
73

Thank you for posting this proposal in advance @lara. It seems very reasonable to me.

1 Like
74

So why do we need private neurons? As you said, it’s not clear who the user behind it is. Why can’t the system be fully transparent, and why is there a need to hide how neurons voted?

Don’t be a known neuron and don’t expose your Neuron ID – problem solved. I seriously think this is one of the biggest mistakes since the majority of the community, as seen in this topic, is against it. If, before making an official proposal, DFINITY wants to get general feedback first, why is it completely ignored in this case?

As an analogy with real-world voting, we have anonymous ballots, but now we are basically allowing those anonymous ballots to hide information how they voted and how much voting power they have.This clearly does not make any sense.

If already exposed neurons don’t want everyone to see how they vote, then make a proposal so that, one time, the same Internet Identity can generate a new Neuron ID and remove the feature after a month.

Who are these different users, and where is the support for this proposal?

Besides DFINITY, only three more people support it. After three weeks, it is clear that the vast majority on this topic is against it.

Why push a proposal with so little support? This situation seems like insider manipulation that will cause more harm than good. What exactly needs to be hidden? There are other solutions available. Either garner more support or delay the proposal.

I am asking again: Will DFINITY vote on this proposal? or this is also something that need to be hidden ???

Could we get @dominicwilliams stance on it?

2 Likes
75

I will certainly vote against this proposal. I remain entirely unconvinced that partial transparency has any place in blockchain governance. I have not read a single strong argument for why this is a good idea, while the evidence suggests that everyone in the community wants full transparency. Whom are we trying to protect? There are places for secrecy, but governance is not one of them.

5 Likes
76

Thanks Lara. A more granular permission would be needed, apps that simply want to let you keep track of which proposals you’ve voted on do not need or want full hotkey levels of trust.
Giving users the choice to set a permission that allows them to just view their ballots in an app would be ideal.

1 Like
77

So why do we need private neurons? As you said, it’s not clear who the user behind it is.

One example that was pointed out by others in this thread is that it could be useful for a user who is contributing to a known neuron at some point (in which case the information should be public), but later they prefer to keep the information private as they are not contributing anymore to a known neuron.

If, before making an official proposal, DFINITY wants to get general feedback first, why is it completely ignored in this case?

To me, this forum conversation demonstrates that we are not ignoring the feedback. We listen to the counter-points and take the time to understand it and to engage in a discussion. This time, it was just the case that in the end there are different preferences with respect to which properties are more important. We have taken into account the feedback but haven’t changed our view.

After three weeks, it is clear that the vast majority on this topic is against it.
Why push a proposal with so little support?

As much as we understand that not everyone agrees, we believe this feature brings value to many NNS DAO participants that are not necessarily active on the forum. Therefore, we propose to follow with a motion proposal to be able to take into account not only the voice on the forum but from the full NNS DAO.

With respect to DFINITY’s preferences: I shared the above view and motion proposal as the view of DFINITY and not just my personal view. So DFINITY likes the proposal.

2 Likes
78

So does this mean Dfinity will vote yes on this proposal and therefore automatically pass it with aggregate voting power?

1 Like
79

Absolutely, any DFINITY vote all but guarantees that a proposal passes.

80

The motion proposal has just been submitted: https://dashboard.internetcomputer.org/proposal/130832

Inviting everyone to vote & share with others who might be interested!

4 Likes
81

Will DFINITY be abstaining in this case? (to avoid drowning out the sentiment DFINITY is seeking to gather with this proposal)

82

Thanks for the end state of this proposal.

Think it makes sense, it’s balanced and addresses the needs voiced for several years.

I personally also like the respect for privacy in the voting ballot.

Thanks to all who worked on this hard change and keep up the good work :clap:

1 Like
83

Do I understand correctly that you can only follow public neurons? I think this is a big consequence that may not be sufficiently clear to everybody.

What happens when I follow a public neuron that then chooses to become private? Would I not follow anymore?

If we make all non-known-neurons private, does that mean all following for neurons that are not registered as known neurons is reset?

3 Likes
84

Do I understand correctly that you can only follow public neurons? I think this is a big consequence that may not be sufficiently clear to everybody.

This is not included in the feature we are discussing in this motion proposal. It is something that we were brainstorming about as a future step, but then we would of course present a more detailed design and discuss this feature again with the community.

Independently from this features, it is suggested to work on periodic confirmation of following (see the current idea here). I think a better moment to discuss whether following should be limited to public neurons is after we have periodic confirmation and learned how this would work (which will already reset some following).

What happens when I follow a public neuron that then chooses to become private? Would I not follow anymore?
If we make all non-known-neurons private, does that mean all following for neurons that are not registered as known neurons is reset?

To avoid misunderstandings, let me repeat that the current feature would not influence following at all and nothing would be reset.

2 Likes
85

This might be a late question to ask, but I’m curious about the answer if there is one. In the quote above, to achieve transparency, it is necessary to unhide all neuron IDs with neuron index.

My question here, is the goal of this transparency for accountability? If the goal is for accountability, can this be achieved using some kind of cryptographic technique (perhaps something similar like zero knowledge) to verify the validity of the data and show them as aggregate/summary, and not necessary to expose all neuron IDs? The goal is to achieved the objective without tinkering with the privacy that is currently in place in the system.

1 Like
86

Throwing in my summarized thoughts:

  • Decentralized networks must primarily focus on earning trust
  • Trust is earned by being public, not private
  • Therefore I join @Ajki, @Sormarler, and others that governance should be public
  • Verifiable privacy is a difficult, long-term endeavor to work towards once trust is earned
9 Likes
87

I expect that DFINITY will vote.

88

Thanks for the question.
You mean whether it would be possible to show the same information but without the neuron IDs in a trustworthy way?

The governance canister already has aggregated data, e.g., how much stake is in neurons that are locked 0-6 months, 6-12 months etc.
One could imaging doing the same in a more fine-grained way, up to the neuron-level.
Because the governance canister can be verified, this information would be trustworthy.

I think there was just a decision to be made what info is and isn’t included to achieve a balance of the requirements: As there were no voices raised wrt keeping the neuron IDs private (only the ballots), but some that would like to have as much as possible public, this is just the tradeoff that was proposed.

89

In my understanding (CMIIW), the main goal of “neuron index would ensure that neurons cannot be ‘hidden’ anymore” is to build trust using traditional methods, allowing people to reproduce the number in a granular way to verify the ‘correctness’ of the information displayed by the governance canister.

Although, as you mentioned, “because the governance canister can be verified, this information would be trustworthy,” but the neuron index is still requested, this suggests there is still some level of distrust.

If this level of distrust is what is being addressed, could the objective be achieved with some form of cryptographic verification / Zk proving without the need to create a neuron index ?

However, if the purpose of the neuron index is indeed to enable data intelligence practices to track down the owners of specific neurons, then this is a different matter.

In my opinion, hiding the neuron ID in the neuron index alone is not enough, because the unique figures of staking amount, maturity, and voting power of each individual neuron could already provide enough information to track down the owner or behaviour of the neuron.

90

The main difference that I see between public and private neurons is the ability to keep your vote confidential or not. Everything else is transparent and it seems like the indexer will be able to reveal ALL neurons with even more details. I’m on board with this, I don’t see any wrong unless I’m missing something.