How Gloki works, and what is open

This page is for engineers and researchers. It says exactly what the code does today, so you can decide whether to help.

How other tools decide who counts

Democracy software has to decide who may take part. Tools made for one city, country or organisation use one of these answers:

• A list of residents from a city or a government, as many city participation platforms do. It works inside one country and stops at the border.
• A list from the organiser. The people running the vote decide who is on it.
• Random selection. A small group is chosen by lot, as citizens' assemblies do. It is good for deep discussion, but most people never take part.
• Tokens. People who hold more of a digital token get more say.
• Tools that do not hold votes. Some tools gather opinions from anyone, without a check, and are not built to count one vote per person.
• Proof-of-person services that other apps can query, built on vouching, credentials or biometrics.

Each answer fits the job it was made for. None of them lets people everywhere take part, one vote each, without depending on a government, an organiser or money. That is the gap we are building toward.

The node

Gloki runs on ibc, Ouri Poupko's open-source node (GPL-3.0). It puts his research on self-sovereign digital agents into practice: software that holds one person's data and acts only for them. Repository.

In this design each person keeps a personal ledger: their own record. A contract runs only among the people who are part of it, and is copied only between them. The design paper calls this subsidiarity. It is capital-free, and it is not a blockchain in the crypto sense: no coins, no mining. If you know Solid, it is in that family.

• Each person is an agent. An agent registers on a node and acts through it.
• Rules live in contracts: small Python programs. Every agent that joins a contract is a partner on it and keeps a copy of its state.
• A write to a contract goes through an agreement step among that contract's partners (a PBFT-style protocol), so the copies stay the same. There is no single global chain.
• The node ships as a Docker image for developers who build apps on it. It serves its API on your own computer, without HTTPS.

The vouching rule in the code

Ouri's community contract picks two existing links in the trust graph at random, which gives four members. All four must approve the newcomer, and the newcomer takes a place between them, so every member keeps exactly four links. Random choice matters: people making fake accounts cannot pick each other. The design comes from Poupko, Shahaf, Shapiro and Talmon, "Building a Sybil-Resilient Digital Community Utilizing Trust-Graph Connectivity", IEEE/ACM Transactions on Networking, 2021 (free version on arXiv).

The Gloki beta tests a different version: four people who know you vouch for you. The network does not enforce that version yet. Until we settle on one rule, we make no claim about keeping out fake accounts.

Known gaps

• No signatures. The node does not check who signed a request, and anyone can deploy contract code to it.
• No authentication. Anyone who knows an agent's identity string and node address can send requests as that agent. Identity strings are visible to other partners.
• Agreement does not check signatures yet, and has no view change. It has not been run across separate machines.
• The random pick can be steered. It is seeded with a timestamp set by the node that receives the request, so whoever runs that node can influence which four members are chosen.
• Contracts are plain Python in a sandbox, not a language designed for safe contracts.
• No encryption of stored data yet.

Open problems

Closing these gaps is the core of the work, and it needs more builders than we have. The gaps above are where we would start: signed requests, signature checks in agreement, randomness no single node can steer, encryption, a safer contract language, and testing across machines.

The protections we plan

• Your phone signs everything you do.Keys made on the device, unlocked with a passkey. Planned.
• Lose your phone, and your vouchers can let you back in.Vouchers confirm you again, after a waiting period. Planned.
• Nobody can change records quietly.Signed append-only logs copied across nodes. Planned.
• Servers store your data without reading it.Encryption, blind servers. Planned.
• Prove you may vote without saying who you are.Semaphore. Planned.
• Votes counted while still locked.ElectionGuard threshold keys. Planned.
• Check that the app you run is the code we published.Signed releases, CSP and SRI. Planned.
• Nodes can hide where they are.Tor onion services. Research.
• Reaching places without internet.Reticulum over LoRa radio. Research.
• Text messages for reminders, never for votes.SMS and USSD. Research.

The research

Ouri's papers, all with Ehud Shapiro and colleagues (full list on dblp):

• Self-Sovereign Digital Agents for a Grassroots Digital Society. ICDCS 2022. What the node implements.
• Building a Sybil-Resilient Digital Community Utilizing Trust-Graph Connectivity. IEEE/ACM Transactions on Networking, 2021. The four-link vouching rule.
• Sybil-Resilient Coin Minting. arXiv, 2020. Who answers for a fake account that gets in.
• Cordial Miners. DISC 2023. A consensus protocol from the same group; the node runs a different, PBFT-style protocol today.

BrightID and GDI

BrightID also uses vouching. It lets people prove to other apps that they use only one account. Gloki is meant to be the whole foundation a democracy needs, on one network its members carry: who counts, where the record lives and, later, how votes are counted. The protections that would set it apart technically are still being built.

Licence and how we decide

The node is GPL-3.0. The Gloki app's licence is not set yet. For now Ouri and Eston make the decisions. Contributors are welcome in that discussion.

Get in touch: hello@globaldemocracyinitiative.org, or join the waitlist with "Build digital democracy" and we will send you technical notes as we build.