Comment by jcranmer
11 hours ago
> Web of trust has been working between humans for over a million years.
I'm not sure that's really true. Human social organization has, until around 10,000 years ago, been centered on small groups of people where everyone literally knew each other. The ethnographic studies on non-state complex societies generally tends to show a lot of kinship-based networks that developed, and even in state societies that are facilitating long-distance trade, trade patterns and introduction into new areas is heavily reliant on membership of these kinship groups. State societies generally deemphasize these kinship groups, eventually doing away with them like in modern society, but the mechanisms for developing social trust are based on a very centralized development of the legal system--the government essentially enforces that people have to be trustworthy, or they face the wrath of government otherwise.
Essentially, in short, the idea that humans have regularly been trusting people based on asking their close compatriots who they can vouch for doesn't seem to accurately model how trust develops in societies for most of human history--you either have vouching based on direct observation (in small societies), vouching based on identity (larger non-state societies), or centralized authority vouching for people (state societies, including today).
I don't think people do trust others on the basis of the government vouching for them. The government may like to think so, but when Dr. Fauci told us to wear a mask we didn't do it because the government said he was trustworthy, those of us who did so (if we didn't have the education to validate it ourselves) did it because we have a friend or a relative who works in healthcare and they said that Dr. Fauci was right on this one. People don't trust what they see on Facebook because a root certificate indicated that it was served on a page that Facebook controls, they do so because their friends liked the thing. We don't trust that the food in the supermarket has been kept at a safe temperature because the health department claims to have inspected the facility recently, we do so because we know somebody who works at the grocery store and we know that person would tell us if it were not safe to eat the food there. We rely on the grapevine heavily.
That's not to say that we can dispense with these institutions, but they are not whence the trust comes, rather they're a sort of nucleation site around which the peer to peer trust we've been relying on for hundreds of thousands of years can coalesce. The institutional structures are an index of things that we may or may not trust, their utility is that the index lowers the information processing burden of doing so in either case.
The friend-or-foe decision started to become computationally burdensome as populations increased, and it has indeed failed to scale, but it's still in there doing its best, making it look like the centralized attempts are working because often they're aligned.
But when the people in charge decide that they no longer care to protect the people who they're in charge of, that alignment slips, and suddenly the most powerful organization on the planet can't win a war against pond scum.
The trust has always been peer to peer. We can find ways to improve it, so it works better for us, or we can continue the charade that it's replaceable with a central authority, to the peril of those who embrace the substitution.
Ultimately this is a synchronization problem. EMudhra has lost their standing in the web of trust we've been using all along, and because the path between them and the average user is so circuitous, third parties need to step in and revoke that trust in the centralized trust stores that we're using to approximate that web. If our technology better aligned with how our actual trust worked, those paths would be short, blast radii of this kind would be small, and the urgency of action could be assessed more accurately because the actors would be protecting themselves from risks they understand, rather than acting to protect users that they don't know and who don't know them.