I think Moxie's article on his First Impressions of Web3 has been making some waves lately in part because he's such a pragmatic and reasonable person and also because he actually dove in and thoughtfully considered the systems he was giving impressions on. He did a great job coming off as non-adversarial (to me, anyway). So I found his article extremely inviting to discuss a bit more about what I think he missed, mainly from my perspective, primarily the wallet/MetaMask perspective.

I'll start by briefly noting the irony that he wrote his thoughts on a self-hosted blog. I am replying from a centralized blogging provider with a history of censoring crypto content (yes, I feel the shame, but I'm being pragmatic).

Edit: I’ve now learned that Mirror no longer requires an invite. It would’ve been cooler for me to write this from there.

Things Moxie Got Right

The way Ethereum dapps today rely on hosted providers feels shy of the original promise, and if they continue this trend, it would seem to imply there was no advantage to having a full node in the first place.

NFTs should be ashamed for how often they are mutable, and as suzuha writes, wallets should help users become aware of when they are (issue opened).

The way wallets today rely on services like OpenSea for indexed data is not decentralized (although I disagree that this is the inevitable course of action, or a good direction to head).

What Moxie Missed

The Presence of Client Friendly Protocols

Moxie makes a big point of how modern wallets are doing nearly no validation of blockchain state, and are just trusting servers. This is basically needed for Ethereum in its current state, but it doesn’t need to always be so.

There are spaces in-between; protocols that are more friendly to running on-client. At MetaMask we pursued a light-client called Mustekala (now surviving in parts of TurboGeth and Laconic), and both Vitalik and Suzuha discuss other protocols that give longer term hope in that direction , so I’ll leave it at that for now.

HTTPS is signed data

I know Moxie knows this well. Maybe he’s imagining some kind of HTTPS-downgrading attack on Infura, but for a user’s wallet that is requesting Infura information via HTTPS, the information coming from it is absolutely signed. Not in a way that enables p2p gossip of that data (the way I presume Laconic will), but still I think some of his points about just how bad the status quo is were slight exaggerations.

The Right of Exit

Even nerds do not want to run their own servers at this point. Even organizations building software full time do not want to run their own servers at this point. If there’s one thing I hope we’ve learned about the world, it’s that people do not want to run their own servers. — Moxie Marlinspike

One of MetaMask’s first design differentiators from the dominant player before us (Mist) was something that Moxie described: the introduction of a trusted source of blockchain data (Infura) instead of requiring every user to self-host an Ethereum “client”. This allowed users to get started right away and without constantly draining their laptop batteries. It was a game changer for adoption, and it kind of demonstrated what Moxie said here: People don’t really want to host their own server (certainly not one that is designed to consume a full laptop of capacity).

I think this revealed a fundamental truth about what wallets are, and it’s that wallets are portable. If a full-node isn’t portable, then a full node is not part of a wallet. If no full node is portable, then a wallet is just a tool for trusting somebody else. If a wallet is just a tool for trusting someone else, then who needs a blockchain? Why not just have a bank?

I think part of the answer is “right of exit”.

The right of exit doesn’t matter when you can fully trust your provider, forever. Maybe your bank is fine, and credit cards serve you, so the notion of digital money is unbelievably stupid sounding to you. If you’ve had your account frozen because the bank didn’t like where your money was coming from, you might have a different perspective on it.

I think a lot of web3 ethos lives right in here. It springs from a patchwork of deep wounds from a lifetime of being betrayed by seemingly every centralized institution that ever gained our trust. The most extreme stance is that this means the infrastructure must trust nobody, but upon hitting the impracticalities of that approach, I think accountability is a surprisingly strong second-best option.

While MetaMask ships with Infura, we’ve always allowed users to choose their own blockchain connection instead. I would even say that I think ideally the wallet could connect into user-chosen alternatives for all of its services, and the hard-coded exceptions like OpenSea today are mistakes, written to hastily satisfy the demands of the gold-rush crazed user demands, as Moxie described. We’re working to rectify those kinds of decisions, and we keep hiring people who thoughtfully care about getting these kinds of decisions handled right.

You might ask: Why in the hell would a business choose to make it easier to opt-out of themselves? I think we can just think of it as a feature. It may not be a feature that every user demands upfront, but it’s a feature that if we can adhere to, we can try to force ourselves to increasingly make the decisions that keep ourselves honest, and keep delivering the thing that our users wanted as faithfully as possible, which is basically just a shared digital space they can trust.

There Are Viable Alternatives to the Centralized NFT Index

I love the part of the article where Moxie breaks down the exact API calls that are enabling current wallet behaviors. I think this is an excellently lucid way to discuss how it works, and OpenSea is a great example of one (apologies to OpenSea for repeatedly punching at you. It isn’t you, it’s our over-reliance on you that is wrong).

The thing is, we know that “hitting a centralized index for your possessions” is a flawed strategy. In tokens MetaMask has done much better here IMO, while other wallets are highly prone to airdrop scams where an attacker sends an asset “to the user” and it now appears in the user’s wallet (their sanctum!), and the phishing can commence from there.

Today, MetaMask is doing something similar via OpenSea, and this is no secret, and it sucks. Relying on a central detection API means that you are either missing assets you might care about (so much for equal opportunity!), or you are seeing assets you don’t (so much for safety!).

A better solution is to make asset detection a client-centric act of consent. Most wallets allow adding custom tokens. Via EIP-747, MetaMask also allows a site to suggest a custom asset to the user’s wallet, and so the user’s wallet becomes the index of assets, no central server needed. We intend to do something similar for NFTs. For the middle-space between fully user-initiated and community-curated, Uniswap’s token lists standard is another approach to allowing the decentralization of the indexing phase. As more standards like this become widespread, I think we’ll see less and less delisting of fair art projects (like Moxie’s), while actually also improving performance and reducing reliance on external parties.

The Role of the Wallet

The last thing I want to touch on (and it relates to the above points) is the role of the wallet. What the hell is this new piece of technology we’re talking about? Your article’s headline is “web3”, after all, not “Ethereum”, indicating there are other pieces here that make up the system. Until a couple of years ago, I think people didn’t take wallets seriously, and thought of them as super thin software that ideally does nearly nothing, a bit like Moxie describes in his article. I think some of us at MetaMask thought similarly when we started out.

MetaMask doesn’t actually do much, it’s just a view onto data provided by these centralized APIs. This isn’t a problem specific to MetaMask — what other option do they have?
— Moxie

I’ve come to see the wallet’s role as enormously large, instead. So large that it’s at dangerous risk of bloat and massive re-centralization if it isn’t managed carefully. In particular, while the full node may be “providing all the data”, the wallet is the tool that helps the user give informed consent.

the wallet is a tool that helps the user give informed consent.

Cryptographic consent was historically fairly trivial: You were either signing or encrypting some data, so you’d get data on one side and garbage on the other. Even with basic cryptocurrencies you’re just managing balances and transactions, and this ends up being pretty much “write once, deploy everywhere”.

The challenge for a web3 wallet is that the user can consent to arbitrary actions from turing-complete applications. This makes getting informed consent much harder. Ideally, every sensitive action would initiate a coherent, user-readable confirmation.

This would already make the wallet a significantly more complicated endeavor than Moxie described, but it’s not only the application content but the protocols they are built on are also evolving constantly, with new opportunities to reduce the cost to the user, improve developer experience, or improve cryptographic veracity.

These somewhat combine into a shared concept, the fact that what a wallet lets you do is open-ended. The things we know for sure are:

It’s cryptographic in nature. The user will have keys, even if they just authenticate to a custodial provider, or are part of a larger multi-sig.

Our primary purpose is for helping users interact with untrustworthy agents, and make informed decisions around them.

When the kinds of consent a user might give are constantly evolving, there are a few ways a wallet can compete: It can either specialize in a sub-domain of the ecosystem, and try to absolutely master it (Be the best DeFi wallet! Be the best Cosmos wallet!), it could try to be a generalist (what MetaMask does today, which can make many individual use cases feel under-served while facilitating general experimentation), or maybe there is a way to invite our vast community to help expand and define the definition of wallet, in a way that is as permissionless and free as the web itself.

That’s why MetaMask has been working on the Snaps extensibility system, which enables anyone to write scripts that can provide APIs to sites, display confirmations to the user, and perform cryptographic operations. Snaps has been in stealth development for a while (our previous docs are very outdated), but we’ve got some updates related to it coming very soon.

With Snaps, the user (or an application they interact with) is not only able to choose alternatives to Infura, but they’re also able to choose alternatives to the entire relationship of wallet-server. A snap might help a user run light clients, choose alternative runtimes like zk-STARK chains or new friendly languages, or maybe it just lets users connect to their preferred centralized service. The point is that we’re making it easier for developers to iterate and validate approaches to differently distributed applications while holding each approach accountable so that we can explore and converge on what is worth trusting faster.

The point isn’t “web3”, it isn’t “decentralization” for the word’s sake. The point is developing tools that allow us to leverage computers to collaborate more effectively. It’s about accountability and choosing for ourselves what to trust. It’s about withholding trust from strangers on the internet but holding out the belief that we can build a better way.

I agree that in the end, people want well-curated experiences. But I also think that we’ve seen enough heroes betray us that it’s comforting to maintain a right of exit, and with designs like Snaps, I think we can facilitate more experimentation while improving the accountability of the software that runs our lives. Maybe it’ll converge on a totally trustworthy centralized platform, but until then, I’m excited to be making the tools that make it easier to explore our options.

I hope that adds some depth in the wallet perspective to someone like Moxie. I think most of his criticisms are generally correct, but I also think there are some aspects of this new stack (like the wallet) that are a bit more nuanced than he represented.