A copy of this forum that lives on chain, and how it could handle spam without moderators

Tech Talk
1

I spent the last few days copying this forum onto chain, and I want to show you the result and ask for criticism on the part I have not solved yet.

Everything posted here, 3,590 topics and roughly 19,000 posts, now also exists on the Products Devnet (Paseo Asset Hub) in a form nobody can delete, me included. The imported threads keep the original usernames, because that history belongs to the people who wrote it, and they are read only. New topics and replies are written by whoever holds a Peoplebook mask, and once written they stay.

It runs at polkadot-forum.dot.li. The board contract is 0x6B877c9AD59B6fd0818A0369F9Bd0F256228C60d, and the mask registry it checks against is 0x4c1fe8F4D4fa617aC421cE54b4c8441AB8d0bD4a.

A few things about how it works, because they matter for the rest of the post. Post bodies are stored inline on chain rather than as a pointer to something that can expire, so there is nothing to keep alive elsewhere. Writing requires proving you own a mask. There is no owner, no admin, no pause function and no delete function anywhere in the contract. I did not keep a key for myself. This is not a promise, it is just what the deployed bytecode does.

The question everyone asks first

I showed it around and within an hour someone asked the obvious thing: with no moderators, what happens with spam, trolls, propaganda, or illegal material. It is a fair question and “freedom, deal with it” is not an answer.

The mistake is treating those as one problem. They are three, and they need different answers.

Spam and bots. Spam works because accounts are free and infinite. Every write here is gated behind an identity, one human one mask today, real proof of personhood when Individuality ships. That does not require anyone to judge content. It changes the economics: a spammer is one person with one permanent identity instead of a thousand throwaways. This is sybil resistance, not moderation.

Opinions someone dislikes. Here I am deliberately not solving it centrally, because any mechanism that can remove lawful speech will eventually be used on speech someone wanted to keep. What the forum has instead is personal filtering: mute a mask, mute a word, and the post collapses for you while staying on chain for everybody else. Lists can be exported and handed to someone whose judgement you trust, which is the primitive that shared blocklists are built from. You are never forced to read anything. What nobody gets is a delete button that applies to other people.

Illegal material. This one is different in kind and deserves a real plan. The forum accepts text only, there is no file upload, so illegal imagery cannot be stored in it. Every post carries a permanent signed identity, which makes it a worse place to commit a crime than a normal pseudonymous forum, not a better one. A client or gateway can still refuse to render links matching known-bad lists, the same way IPFS gateways do while the network below stays open. The honest cost of immutability is that bytes cannot be retroactively erased, and I would rather say that plainly than pretend otherwise.

The part I have not built: reputation without a moderator

Filters solve the individual case. They do nothing about someone who floods the board. The idea I have been working through is a dispute system where mask holders judge each other, with several constraints that I think are load bearing.

Reports cost something. A report carries a stake, so accusing someone is not free, and a report that gets overturned loses the deposit. Otherwise reporting becomes the new weapon.

Jurors are drawn, not volunteers. Selection by sortition, so an attacker cannot decide to sit on the case they care about.

The verdict limits rate, never speech. The worst outcome is fewer posts per day, decaying over time, with a floor no majority can push to zero. Nothing is deleted. A system that can only slow you down is much harder to abuse than one that can silence you.

The jury rules on facts, not taste. Is this duplicated spam, is this illegal, is this impersonation. If a question cannot be answered by looking at the post, it does not belong in front of a jury, it belongs in your mute list. This is the line I would refuse to move, because a jury that rules on opinions is just a mob with extra steps.

Voting is anonymous. If you can prove to someone how you voted, your vote can be bought or coordinated. If you cannot, cartels stop working, since a bloc that cannot verify its own members is not a bloc. This is also why secret ballots exist in the physical world.

What Zeitgeist taught me

Zeitgeist Court already runs most of this in production: staking, random draws, commit and reveal, appeals with growing juries, slashing. So the mechanism is not theoretical.

Someone who took part in it told me two things that changed my design. Jurors voted honestly, so the fear that everyone would just guess the majority did not show up in practice. But participation was low, and that is the real failure mode. A jury with five active people is capturable no matter how good the cryptography is.

Two of the barriers there are structural. You must lock capital to serve, and you must come back a second time to reveal your vote or get penalised. With identity doing the sybil resistance, jury duty does not need a stake at all, which removes the capital filter and makes the pool the whole community. And with anonymous voting there is no reveal step, because the secret is who you are rather than what you voted, so it is one transaction instead of two.

I would also make quorum failure harmless. If nobody shows up, nothing happens, the post stays. A system where apathy produces punishment is dangerous.

What I have actually proved

The anonymous jury needs zero knowledge membership proofs, which need the bn254 pairing precompile to be callable from inside a contract. I did not want to assume that, so I deployed a contract that performs a real pairing check on chain, and it returns true. It is at 0xA61d094340d83D4c7e4a17e9ceca9414da3273f4 and you can call it yourself.

So the hard primitive is available. The court itself is not built, and I am not going to build it yet, because a forum with two posts does not have a moderation problem, it has an audience problem. Filters work with one user. A jury needs a crowd.

Where I would like to be wrong

The parts I am least sure about are whether sortition can stay fair with a small population, what the pairing costs in gas at realistic jury sizes, and whether “verifiable facts only” survives contact with a real edge case. Also the economics: posting is cheap but not free, and I think treasury sponsorship for identity holders is the right answer rather than making people top up a balance to speak.

Tell me where this breaks. I would rather find out from you than from the first person who decides to test it.

None of my projects are paid for, funded or endorsed by Parity, W3F, PCF, PBA or anyone connected to them. I do all of it on my own.

2

You should implement this on reddit, that forum is full of censorship. Like you copy reddit on chain and people can comment without being censored. There you would get the audience you are looking for. It would solve a big problem.

3

On the identity/spam problem, the core fix is making sure “one mask” actually costs something a bot script can’t fake. Whatever gates mask issuance needs to require proof of a real, distinct human rather than proof of a wallet — before building anything else, it’s worth just trying to mint 500 masks with a script and seeing what stops you. If the honest answer is “nothing yet,” that’s the actual next milestone, not the jury system.

On the immutability/legal-liability problem, the fix is separating the commitment from the content. Keep an immutable hash or pointer for every post on-chain forever — that’s what actually delivers the “history can never be secretly rewritten” promise. But store the retrievable text itself somewhere a jury-ordered, publicly logged action can de-list from default rendering (the site’s own reader, any indexers) without touching the on-chain commitment. Anyone who wants to verify the original can still reconstruct it, but the platform isn’t stuck serving content a jury has ruled illegal just to keep its “no delete” claim technically true.

On jury capture, the risk is that an attacker doesn’t need to control the whole forum, just the small pool of people who show up for one dispute. The fix is borrowing from optimistic-oracle/Kleros-style designs: jurors stake specifically against the dispute they’re judging (not just holding a general credential), a minimum juror-pool floor below which a dispute auto-escalates or stalls instead of resolving thin, and sortition weighted by stake rather than raw headcount so a sybil-mask-farm can’t dominate a small draw. I’d also reconsider the commit-reveal step the author stripped out of the Zeitgeist Court design for simplicity — a version where votes are hidden at the time (so no one can prove how they voted while it matters, blocking coercion and vote-buying) but tied to an identifier that lets patterns be audited in aggregate afterward would catch a juror who rules suspiciously in one side’s favor across many disputes, without exposing any single vote in real time.

On rate-limiting being a weak deterrent, the fix is keeping “never delete content” as sacred but making the penalty scale in a different dimension: convicted posters lose a staked bond (symmetric to the false-reporter penalty already planned), face compounding cooldowns on repeat offenses, and lose cheap access to a replacement mask while sanctioned. That hits the attacker’s economics instead of just their posting cadence.

On onboarding economics, the fix is making it a vouching relationship with real stake behind it, an existing mask-holder sponsors a newcomer by staking part of their own bond, and loses a portion of it if the sponsored mask is later sanctioned. That turns “who pays for onboarding” into a self-policing referral graph instead of an open treasury faucet a sybil farm can drain.

And the smaller note on the Reddit-port suggestion in the thread still stands on its own: forking someone else’s forum content immutably runs into real content-ownership and takedown-request issues that are different from a community publishing its own forum’s own content, worth stating as an explicit boundary if this idea spreads beyond Polkadot’s own forum.

Above are the suggestions without the Keystone. All items fixed with it.

4

On the jury gathering issue, my reply was way too static through Claude’s help! I have thought about this one and my solutioning was a metered by hour cost to the jury. Per your let the treasury pay. It is my old school thought because it is the same in my country that you’re paid for this. People are always looking for ways to be paid, especially WFH home and you seem to have already built the voting private mechanism to support this!