enix

Someone just drew this to my attention. It's a post from NEAR, presumably in response to my previous post, and in fairness it must be shared. xitter.twitterapi.xyz/NEARProtocol/status/21… Among the findings they have a dashboard that shows their server cluster now has 16, not 8 nodes as I was informed, and they are run by different parties. This does not, of course, reduce concerns about backdoors, the ability of NEAR to upgrade the software of those "MPC" nodes directly and the ability to use such software updates to extract the key shares if they wished, the use of a trusted dealer to distribute the private key shares in the first place, and all of the other things that a truly decentralized setup addresses. That being said: 1) Sharing keys over 16 nodes is much better than over 8 (we prefer around 50). 2) They state that the operators of these nodes include Sovereign AI, Bitwise, Nansen, Greenfield, Everstake, Near One, and Luganodes, which is good. It's not clear if there are 16 different operators though, which is what you want. 3) They reference a strong technical description of their TEE architecture github.com/near/mpc/blob/mai…. So long as this is implemented on the nodes, and the node operators are actively using attestation to check the software NEAR is running on these nodes, that reduces the risks involved. I am not aware of when they moved from 8 nodes to 16. None of this reduces our key concern that their system has been powered by our proprietary tech all this time. Further, their post also talks about another thing they have released in 2025: CKD, or Confidential Key Derivation. This is basically vetKeys, an Internet Computer technology that does exactly the same thing, and it works the same way too!! We published how to do this in 2023: eprint.iacr.org/2023/616 However, this isn't protected afaik, so they have no worries there, but they should have contacted us first AND referenced our work. That's the respectable way to work in the fields of computer science and open source. We wish NEAR well, but they cannot just steal proprietary DFINITY tech.