I mean, for sure, they took proprietary tech to get a jump on the market. The need to pay a license fee to DFINITY at the minimum to resolve this. But they also caused colossal harm.

Someone just drew this to my attention. It's a post from NEAR, presumably in response to my previous post, and in fairness it must be shared. xitter.cf/NEARProtocol/status/21… Among the findings they have a dashboard that shows their server cluster now has 16, not 8 nodes as I was informed, and they are run by different parties. This does not, of course, reduce concerns about backdoors, the ability of NEAR to upgrade the software of those "MPC" nodes directly and the ability to use such software updates to extract the key shares if they wished, the use of a trusted dealer to distribute the private key shares in the first place, and all of the other things that a truly decentralized setup addresses. That being said: 1) Sharing keys over 16 nodes is much better than over 8 (we prefer around 50). 2) They state that the operators of these nodes include Sovereign AI, Bitwise, Nansen, Greenfield, Everstake, Near One, and Luganodes, which is good. It's not clear if there are 16 different operators though, which is what you want. 3) They reference a strong technical description of their TEE architecture github.com/near/mpc/blob/mai…. So long as this is implemented on the nodes, and the node operators are actively using attestation to check the software NEAR is running on these nodes, that reduces the risks involved. I am not aware of when they moved from 8 nodes to 16. None of this reduces our key concern that their system has been powered by our proprietary tech all this time. Further, their post also talks about another thing they have released in 2025: CKD, or Confidential Key Derivation. This is basically vetKeys, an Internet Computer technology that does exactly the same thing, and it works the same way too!! We published how to do this in 2023: eprint.iacr.org/2023/616 However, this isn't protected afaik, so they have no worries there, but they should have contacted us first AND referenced our work. That's the respectable way to work in the fields of computer science and open source. We wish NEAR well, but they cannot just steal proprietary DFINITY tech.

This is craazy. I asked one of our PhD engineers to look into NEAR *Confidential* Intents wondering how they designed their system. Unredacted, word-for-word, this was his answer 😱😱😱 "Everything I found out about the privacy claims and confidential intents is so bad that it seems almost comical and I cannot believe what I am seeing. Apparently they run a completely separate instance of the protocol, which is called FAR (as an opposite to NEAR), and that has a permissioned operator set. The entire confidentiality claim seems to rest upon the fact that it is a permissioned chain and the nodes are trusted to keep things private, there doesn't seem to be any deep technology behind it and it also does not seem to be open source. The entities running the nodes are also not publicly known. I almost feel weird writing this because it is so absurdly bad that it feels like ... I don't know ... a simulation? I know the usual level of overpromising in Web3 but this is so many levels beyond believable that it still feels unreal."