在区块链之前，已有状态机复制

DARPA早就意识到这个问题很严重，就是恶意攻击的问题，所以一直在寻找这方面的研究。

DARPA had recognized that this was a serious problem, the problem of malicious attacks, and was looking for research in that area.

我有个学生，叫米格尔·卡斯特罗。

I had a student, Miguel Castro.

他来找我，问我：我们能不能想办法设计一种能应对恶意攻击的复制机制？

He came to me and he said, why don't we see whether we can figure out a way to do replication that handles these malicious attacks?

这个想法听起来特别棒。

And that seemed like a great idea.

问题是，一旦主节点宕机，也就是运行协议的那个节点，整个系统就会彻底瘫痪。

The problem, if the primary failed, the primary that was running the protocol, the whole thing came to a crashing halt.

我们设计了一个协议：一旦主节点表现异常，备份节点就会启动另一个流程，让另一个副本接替成为新的主节点。

We came up with a protocol that if the primary seemed to not be doing its job, the backups then carried out another protocol in which a different replica became the primary.

我们当时觉得，总有一天会有人用上这个方案，结果区块链突然就出现了。

We thought that at some point, people would start to use this, and then along came blockchains.

这事儿真是挺搞笑的。

And so that was very funny.

如果你热爱计算机科学，热衷于研究，想做有意义的工作，也希望产生实际影响，你会建议怎样的心态或方法呢？

Someone who loves computer science, loves research, wants to do important work, wants to have an impact, What would you suggest as kind of a mindset, as an approach?

如今，随着人工智能的兴起，计算机科学正处在一个非常特殊的状态。

Computer science is in a very strange place right now with the advent of AI.

我觉得从研究的角度来看，

I think that as far as research is concerned

在我们的夏日系列播客中，今天带来的是a16z加密货币节目的另一期内容。

As part of our summer feed drop series, we're sharing another episode from the a16z crypto show.

如今所有的区块链都依赖于上世纪80年代开发的复制技术，那时人们还没想到加密货币这回事。

Every blockchain today relies on replication techniques first developed in the 1980s, years before anyone imagined cryptocurrencies.

在这期节目中，蒂姆·罗奇加登和伊泰·亚伯拉罕对话图灵奖得主芭芭拉·利斯科夫，她的开创性工作——包括分布式系统、状态机复制和实用拜占庭容错——为当今许多区块链协议奠定了基础。

In this episode, Tim Roughgarden and Ittai Abraham speak with Turing Award winner Barbara Liskov, whose pioneering work on distributed systems, state machine replication, and Practical Byzantine Fault Tolerance laid the foundation for many of today's blockchain protocols.

无论你是刚接触加密货币，还是已经在这一领域深耕，这场对话都能帮你更深入地理解现代区块链背后的计算机科学原理。

Whether you're new to crypto or already building in the space, this conversation offers a deeper understanding of the computer science behind modern blockchains.

如果你喜欢这期节目，别忘了关注a16z加密货币播客，获取更多类似内容。

If you enjoy this episode, be sure to follow the 16 z crypto show for more conversations like this.

大家好，欢迎收听《第一性原理》，这是a16z加密团队推出的一档系列节目。

Hi, everyone, and welcome to First Principles, a series by the team at a sixteen z crypto.

我是蒂姆·罗格斯加登。

I'm Tim Roughgarden.

我目前担任a16z加密团队的研究主管。

I'm the head of research at a sixteen z crypto.

今天，我们要探讨分布式计算中的一个核心问题。

And today, we're exploring a core challenge in distributed computing.

当系统中部分组件出现故障或行为恶意时，如何保证整个系统的可靠性？

How can a system remain reliable when some of its parts fail or behave maliciously?

在这期节目中，我们将对话一位图灵奖得主、计算机科学家，她的研究为解答这个问题奠定了基础：利斯科夫博士。

In this episode, we're going to speak with the Turing Award winning computer scientist whose work helped answer this question: Doctor.

利斯科夫。

Liskov.

她成就卓著，而今天我们重点聊聊她为现代区块链系统奠定基础的那些工作。

She's famous for many things, but today we're going focus on her work that laid the foundations for modern blockchain systems.

比如，从上世纪80年代的视图复制，到十年后出现的实用拜占庭容错协议。

For example, from viewstamped replication (from the 1980s), to Practical Byzantine Fault Tolerance a decade later.

今天我和a16z加密研究合伙人伊泰·亚伯拉罕一起，和利斯科夫教授展开对话。

A16z crypto research partner Ittai Abraham joins me as we talk with Doctor.

我们会聊到她如何从编程语言转向分布式系统，实用复制协议的发展历程，区块链底层的状态机复制范式，以及AI等新兴技术如何改变系统研究的方向。

Liskov about her path from programming languages to distributed systems, the evolution of practical replication protocols, the state machine replication paradigm underlying blockchains, and how emerging technologies like AI are reshaping systems research.

下面是我们今天的对话。

Here's our conversation.

利斯科夫教授，非常感谢您今天抽出时间参与我们的对话。

Professor Liskov, thanks so much for joining us for the conversation today.

真的很感谢您拨冗前来。

Really appreciate you taking the time.

我想我们可以先聊聊，您是怎么开始进入分布式系统研究的——据我了解，大概是在1980年左右。毕竟在70年代，您已经在操作系统、编程语言和数据抽象等领域做出了非常重要的贡献。

I thought maybe it would be fun to start to discuss a little bit about how you got into distributed systems research, which from my understanding was maybe around 1980 or so, especially given that, you know, throughout the 1970s, you did a lot of extremely important work on other topics, operating systems, programming languages, data abstraction.

那是什么促使您在那个时期转向分布式系统的研究呢？

So why this sort of segue into distributed systems around that time?

当时我刚做完 Clue 这个编程语言，是我和团队一起开发的，目的是通过数据抽象的方式来构建程序。

So, what happened was I had finished working on Clue, which was the programming language that, I developed with my group to provide access to data abstraction as a way of building programs.

我一度想过要不要创办一家公司来推广这个语言，但后来发现，我真正感兴趣的还是科研。

And I had thought a little bit about maybe starting a company to market the language, but I realized that, I was much more interested in research.

而且我觉得，关于编程语言的研究，我已经差不多把能做的都做完了，没什么新东西可挖了。

And I also thought that I had sort of, done as much programming language research as I had anything interesting to do at that point.

于是我开始留意其他方向，读到了鲍勃·卡恩的一篇论文，他在里面谈到了分布式计算的梦想——未来会有分布在不同节点上的程序，通过网络通信协作，但当时没人知道怎么实现。

And I started looking around, and I read, a paper by Bob Kahn in which he talked about the dream of distributed computing and how there would be distributed programs that had components at different nodes in a network and communicated over the network and only nobody knew how to build them.

我觉得，这真是个了不起的问题。

And so I thought there's a great problem.

于是我就一头扎进了分布式计算领域。

So I jumped into distributed computing.

太厉害了。

Wow.

太棒了。

Fantastic.

这确实是个明智的决定。

And it was a great, yeah, great move.

真厉害。

Wow.

这件事对计算机科学来说太重要了。

It was great for computer science that that happened.

毫无疑问。

No doubt about it.

我想问问，当时你有没有觉得这是在转方向，彻底换了一个研究领域？

I'm curious, did it feel like a pivot at the time, like you were really changing your research field?

还有一个相关的问题是，你在职业生涯中形成的抽象思维和方法，在转向新领域时有多少是能直接沿用的，又有多少是得从头建立新工具的？

And maybe a related question would be, you know, how much did sort of the mindset and the approach to abstraction that you developed during your career, how much did that port over versus how much did you need to really have a new sort of toolbox for working on those problems?

其实我可能觉得这是个转折，但我在新领域做的第一个项目还是个编程语言。

Well, I may have thought of it as a pivot, but my first project there was a programming language.

那个编程语言其实是对之前我开发的语言的延伸。

And that programming language was really an extension of the language I'd already developed.

我们当时开发了一种叫 Clue 的语言，支持抽象数据类型和对象。

We had this language called Clue which supported abstract data types and objects.

而在新的语言 Argus 里，我们保留了抽象数据类型，还增加了一个新特性，叫守护者（guardian）。

And in Argus, which was the new language, we had abstract data types, and then we had one additional feature, this new kind of object, which we called a guardian.

守护者驻留在网络中的某个节点上。

And the idea with the guardian was it resided at one node of a network.

它提供了一些方法，可以被其他节点调用。

It provided operations that could be called from other nodes.

所以，分布式程序其实就是由许多这样的守护者组成，每个都在自己的节点上运行，彼此通信。

And so the idea was a distributed program consisted of all these guardians each running on its node communicating with each other.

所以，这其实根本算不上什么转向。

And so really it wasn't that much of a pivot at all.

准确地说，我只是重新拾起了在 Clue 里不得不放下的东西——并行计算。

It was in fact picking up something I'd had to leave behind for clue, which was parallel computing.

在开发 Clue 的时候，我决定把它做成一种顺序执行的语言，因为我觉得已经够复杂了，不想再把并发机制加进去。

I had decided in clue that that was gonna be a sequential language because I felt we had enough stuff going on that I didn't wanna complicate it by adding concurrency as well.

所以我现在终于能重新关注并发问题了，但这次是在一个更有趣的世界里——并发不只是简单地开几个线程并行跑个循环，而是多个用户同时发出请求，类似这样的情况。

And so now I was able to pick up concurrency, but in this more interesting world where concurrency wasn't just that you had a for loop where you ran a bunch of threads in parallel, but instead you had multiple users and they might be making requests in parallel and stuff like that.

Argus 有趣的一点是，我们不仅要处理并发，还得应对各种故障。

And one of the interesting things about Argus was that we had to worry not just about concurrency, but also failures.

我们的计算任务会访问网络中的多个节点。

And we had computations there that would visit several nodes of the network.

最后，我们必须确保这样的操作要么完整执行，要么完全不产生任何影响。

And then at the end, we had to make sure that such a computation either happened completely or had no impact whatsoever.

于是我们借鉴了数据库系统的事务机制，把这些操作当作原子事务来执行。

And so of course we picked up transactions from database systems and we ran those computations as atomic transactions.

我们还用上了两阶段提交协议。

And we had a two phase commit protocol going on.

这感觉像是在更复杂、更成熟的环境下延续了之前的工作，也让我能去探索更多新问题。

It seemed like a continuation in a more, evolved or complicated environment, so which allowed me to look at additional problems.

对。

Yeah.

说真的，从个人角度讲，读到这些背景故事让我特别兴奋。因为我给本科生讲区块链执行的时候，总是用面向对象编程来帮他们理解——把系统不同部分之间的交互，想象成对象之间的协作。

Was I mean, just on a personal note, it was it was very cool for me to sort of read all that backstory because when I'm explaining blockchain execution to sort of undergrads in my class, you know, I had taken to using object oriented programming as kind of the mental model they could kind of fit it into as far as the sort of interoperability between different parts of the state.

所以当我发现，你们当年在早期系统里的思路，居然和我用的这个模型一模一样时，真的觉得特别有意思。

And so then, you know, to see that indeed that's exactly sort of the roots of of sort of your thinking about it in those early systems, I thought was really, really cool to see.

对，确实如此。

Yeah.

我觉得，模块化是构建大型程序的核心。

Would say that modularity is everything in building large programs.

很多年后，我才开始意识到，模块化和数学定理其实很相似。

And it was only many years later that I started to think of modularity and theorems as being similar.

但现在看来，这很明显：定理一开始就会明确陈述它要证明什么。

But it seems very clear that they are because in a theorem, you start off with a statement of what is supposed to be true.

你当然不能一股脑儿全堆在一起推导——顺便说一句，六七十年代的程序就是这么写的。

You want to reason about this, but of course you don't do it as one big blob, which by the way, was kind of how programs were written back in the sixties and seventies.

相反，你得拆成一个个引理，每个引理都有自己的声明，然后独立证明它的正确性，这样就能把定理的每一部分当作独立单元来分析。

Instead you have to have lemmas and the lemmas each have a statement of what they are, and then you prove their correctness independently and you can reason about each piece of the theorem as a separate unit.

这正是模块化程序的工作方式。

And this is exactly what's going on in a modular program.

每个模块都有自己的职责。

You know, you have each module.

它有明确的规范说明。

It's got a specification.

你可以独立证明实现模块的代码是正确的，完全不用看其他模块的代码。

You can do a proof of the correctness of the code that implements the module without having to look at any other module's code.

你只需要参考其他模块的规范就行了。

You just look at the specifications of other modules.

这和定理加上引理的结构非常相似。

And that's very similar to a theorem with lemmas and so forth.

回想起来，因为我大学时主修数学，这种思维方式对我来说特别自然，即使当时我并没有刻意想到它，但我在做模块化最初研究时，其实已经在用这种方式思考了。

And, I just think looking back that since I was a math major in college, it was just a very natural way of thinking about things to me, even if I hadn't had it at the front of my mind, what I was working on the original work on modularity.

所以你早期在分布式计算方面的工作，比如视图复制，其实是在尝试把面向对象的方法和处理故障结合起来。

So your, your, early work on distributed computing viewstamp replication, you were kind of, trying to, to merge this object oriented approach with handling failures.

所以我想知道，当时推动大家思考分布式系统中如何处理故障的主要动力是什么？

So I wonder what, what was kind of the main motivation for thinking about, you know, handling failures in, in a distributed system?

我觉得这跟面向对象没什么关系。

You know, I don't think it had anything to do with object oriented.

那时候，系统领域的人普遍对这个问题特别感兴趣。

I think it was a question that was a great interest in the systems community at that time.

我们都觉得，要是能有个文件系统，多个副本同时运行，很多人都能访问同样的文件，那该多好。

We could all see that it would be really nice to have a file system that was, you know, implemented at many replicas and where lots of people could be using the same files.

那时候，如果你想和别人合写论文或者协作做点别的，只能靠传文件。

In those days, if you wanted to write a paper or do other work with somebody else, you had to use file transfer.

你根本没法直接访问对方的文件系统。

And, you know, you couldn't access their file system.

你唯一能做的，就是通过邮件交流，但这种方式实在不太方便。

What you could do is communicate by email in a sort of a, you know, not terribly attractive way.

当然，还有一个问题：只要你的电脑一宕机，文件就全访问不到了。

And of course you had the problem that if your computer was down, you had no access to your files.

要是有个复制系统，东西一直都在，那该多好啊。

And wouldn't it be nice if we could have a replicated system where the stuff was always there and so forth.

所以当时系统领域里，这个问题就摆在那儿，很多人都感兴趣。

So this was a problem that was sitting there in the systems area that people were interested in.

于是我也开始对它产生了兴趣。

And so I got interested in it.

我当时有个学生，叫布莱恩·奥基，正在找论文题目。

And, I had a student, Brian Okie, who was looking for a thesis topic.

所以，构建一个复制文件系统的想法，看起来是个特别棒的论文选题。

And so the idea of a replicated file system seemed like a really interesting thesis topic.

那是八十年代中期的事了。

This is in the mid-80s.

这可能有点跑题了，但我很好奇，那时候系统研究圈子里的整体氛围是怎样的。

So this is maybe a little bit of a digression, I'm just curious, which is a little bit about what systems research was like at that time as a community.

我的职业生涯大概是2000年左右开始的。

So my career started kind of around 2000 or so.

在我的职业生涯中，系统领域太大了，感觉有点支离破碎。

And for much of my career, the field of systems is so large, it feels a little bit fragmented to me.

比如，有专门搞数据库的会议，网络方面的会议也不止一个，操作系统领域更是好几个。

Like you've got conferences devoted to databases, multiple, multiple on network, multiple in operating systems.

但你之前提到，那时候系统圈子里的人好像都属于同一个整体。

And meanwhile, you've already talked about the idea that it was obvious throughout the systems community as if it was one community.

你还说过，因为各个领域离得近，像两阶段提交、事务这些概念，一听到就知道在分布式系统里肯定用得上。

You also talked about how just, you know, the proximity of the different areas meant that, you know, two phase commit protocols and transactions and animosity, you recognize that immediately as things you were going to need in the distributed systems context.

那当时的情况到底是怎样的？

So what what were things like back then?

那时候氛围特别好。

They were very nice.

那时候SOSP是最重要的会议。

So it used to be SOSP was the main conference.

我记得去参加SOSP的时候，系统领域的大牛，比如巴特勒·兰普森，都在那儿，还有吉姆·格雷、布鲁斯·林赛也都来了。

And I remember going to SOSP and the people you think of in the systems area like Butler Lampson and so forth were there, but so was Jim Gray, so was Bruce Lindsay.

当时顶尖的数据库专家都来了。

Well, the top database people were all there.

会议规模小，我们通常在阿西洛马举办，那地方是

And the conference was small enough that we used to have it at a Asilomar, which is

在蒙特雷。

In Monterey.

蒙特雷的一个场地。

Site in Monterey.

是的。

Yeah.

那时候会议规模很小。

But the conference was small.

虽然可能还有其他专门的会议，但大多数时候我们都聚在一起。

In those days, there may have been other specialized conferences, but mostly we were together.

所以我们很容易把整个领域看成一个整体。

And so it was easy for us to to see the sort of field as a whole.

听起来真是段美好的时光。

Sounds like a magical time.

太让人羡慕了。

Sounds amazing.

那确实是个不错的时期。

It was a good time.

那我们回到你的研究上来吧。

So to bring it back to kinda, your research.

你最早进入分布式系统领域，研究Argus，那是八十年代初。

So so entering distributed systems, working on Argus, beginning of the eighties.

后来你决定专门聚焦在复制问题上，对吧？

And then at some point, you decided to focus specifically on replication.

对。

Right?

还有，Ittai提到了视图戳复制协议。

And, you know, Ittai mentioned the viewstamp replication protocol.

那你能不能说说，当时是什么原因让你决定专门研究这个问题的？

So, could you talk a bit about what led you to focus on that problem at that time?

这问题看起来特别有意思。

It just seemed like a really interesting problem.

我一向喜欢挑那些看起来很重要的事情来做。

I always like to work on stuff that looks important.

那时候很明显，这事儿迟早要来，而且我们也非得解决不可。

So it was clearly something that was coming, and it was clearly something we needed.

但我们根本不知道该怎么实现这样的系统。

And we really didn't understand how to implement a system like that.

当时系统领域普遍的看法，是用加锁的方式来处理这个问题。

The view in the systems community at that point was mainly to think about this using locking.

他们的想法是，用户得给副本加锁，这样才能掌握控制权。

So the idea was you had the users and they would lock the replicas so that they could have control.

这样就能确保不会出现并发冲突。

That way you were going to make sure that you didn't have concurrency problems.

在我看来，这个方案太糟糕了，因为你得依赖远在各地的其他用户按时完成任务，但他们可能根本不会做。

And to me, that seemed like a very bad solution because that means you have to depend on these other users at far flung sites to do their job and they might not do it.

所以我想到，不如把工作交给副本本身来处理。

So I thought, let's switch the work to the replicas.

回头来看，这可能跟我之前在Argus项目中的工作有关，那时候我已经在用原子事务了，所以自然会想到让一组副本来负责这些任务。

And I think in retrospect, this is because of the work I did in Argus where I was already using atomic transactions, transactions and it was already sort of natural to think of having a group of replicas that were in charge of things.

虽然当时我并没有明确意识到这一点，但直觉上就觉得这个思路挺不错的。

Although I didn't have that insight at the time, it just seemed like this looked like a good approach.

于是我和布莱恩深入研究了一下，发现理论计算机科学领域其实已经有相关工作了。

So Brian and I dug into it and, there was work in theoretical computer science.

那时候人们已经明白，要应对F次故障，至少需要2F+1个副本。

I mean, they understood then that you needed two F plus one replicas to survive F failures.

可能当时也已经有协议了，但我们的关注点不一样——我们始终想设计出真正实用、高效的协议。

And there may even have been a protocol, but our focus was different because we were always interested in practical protocols that you could really use that were efficient.

我们的工作是基于两阶段提交来展开的。

And we based our work on two phase commit.

但显然，两阶段提交并没有真正解决问题，因为它有个很尴尬的停顿期，或者叫漏洞窗口——只要负责协议的主节点挂了，整个系统就会彻底停摆。

But of course two phase commit didn't actually solve the problem because two phase commit had what was in it called the embarrassing pause or the window of vulnerability where if the primary failed, the primary that was running the protocol, the whole thing came to a crashing halt.

而且当时还有人担心，它能不能再正确地重启起来。

And there was even some concern about whether he'd get it going again in the right way.

所以我们得想办法解决这个问题。

And so we had to figure out how to solve that problem.

而我们在复制机制上的贡献，就是提出了这个方案。

And that was the contribution of use to have replication.

我们设计了一个协议，里面有个我们称之为‘主节点’的角色。

We came up with a protocol that it had what we called the primary.

主节点负责告诉各个备份节点该做什么。

And the primary was telling the backups what to do.

我们执行的协议和两阶段提交很相似，用来实现这个过程。

And we were carrying out a protocol that was similar to two phase commit to make this happen.

但如果主节点看起来不再正常工作，备份节点就会启动另一个协议，切换到我们所说的‘新视图’，让另一个副本接替成为新的主节点。

But if the primary seemed to not be doing its job, the backups then carried out another protocol where they moved to what we called a new view in which a different replica became the primary.

当然，这个过程必须确保前一个视图中所有已提交的操作都能完整迁移到新视图中，历史记录和主节点故障前完全一致。

And of course, this had to happen in a way that guaranteed that everything that had reached the commit point in the previous view made it into the new view with the history was exactly the same as what it had been before the primary failed.

从这个角度看，我们其实是在构建一个账本。

And so in that sense, were building a ledger.

不过当时我们没用这个词。

We didn't use that terminology.

我们更倾向于把它看作日志，因为在系统领域，我们一直把单机上持续写入的记录叫做日志，这样一旦机器崩溃，重启后就能从断点继续。

We thought of this more like a log because that's what we used to call it in the systems community when we were talking about a single machine where you were always writing stuff to the log so that if the machine failed, you could come back up again and pick up where you left off.

现在，这个日志被应用到了分布式系统中。

So now it was a log based in a distributed system.

我们当时脑子里想的是文件系统，但这个协议本身和具体应用毫无关系。

And we were really thinking in terms of a file system, but the protocol didn't have anything to do with the application.

我们真正构建的是一个账本，并且确保向前的历史记录始终完整保留。

We were really building a ledger and doing so in a way that guaranteed that the history going forward was always preserved.

但有一个非常关键的点是，我们当时只考虑了所谓的‘温和故障’。

But a very important point is we only thought about what we referred to as benign failures.

这些故障指的是机器要么正常运行，要么完全静默，消息可能收到，也可能完全收不到，或者收到的是损坏的，但如果是损坏的，我们能立刻发现。

These were failures where machines were either running or they were completely silent and messages might arrive, They might not arrive at all or they might arrive corrupted, but if they were corrupted, you could tell.

所以我们没去担心拜占庭故障。

So we didn't worry about Byzantine failures.

我们只关注这些简单的故障，而当时最常见的也正是这类故障，毕竟那会儿还是ARPANET时代，大家都是朋友。

We only worried about these simple failures, which were in fact the main failures that happened at that time, because it was just the days of the ARPANET and we were all friends.

那时候还没有九十年代互联网普及后出现的那种恶意攻击。

And we didn't have the malicious attacks that showed up in the nineties once we had an internet.

我觉得这真是对视图复制机制非常贴切的描述。

I think this was like a really great description of of viewstamp replication.

从一个带有主节点的视图切换到另一个新主节点的视图，这个想法催生了视图变更协议，我觉得这些协议。

And and so in some sense, like, this whole idea of of moving from one view with one primary to a a new view with the new primary gave this, birth to these view change protocols, which I think are.

是的。

Yeah.

现在人人都在用，但回过头看，它们其实早在八十年代初就出现了，这真挺了不起的。

Now everybody's using them, but it's it's it's quite amazing to see that, you know, basically, they they come from the early eighties, in in a way.

对吧？

Right?

这可能又有点跑题了，但利斯科夫教授，您提到当时在理论层面其实已经有一些研究，探讨了理论上可能达到的最佳容错能力。我很想听听您对理论与实践、理论与系统之间关系的看法——无论是当时还是后来的发展，以及它们之间如何相互影响。

And this is maybe another little bit of a digression, but, professor Liskov, you mentioned, that there was sort of in the background, there had been some work on the on the theory side, just identifying what is the in principle kind of best possible fault tolerance one could perhaps And so I'd love to just hear your thoughts on kind of theory versus practice, theory versus systems, you know, maybe both at that time and how it's evolved over the years and how you see the flow of influence.

理论研究在哪些方面影响了您的工作或其他实际工作，反过来，实际工作又如何反哺理论？

Like, in what ways is kind of the work on the theoretical side informed your work or other work on the practical side and vice versa?

我不太确定自己是否该谈实践如何影响理论。

Well, I don't know that I should talk about the practical side and how it influences theory.

但在我的团队里，我总是告诉我的研究生们，一定要选修理论课程。

But, in my group, I always told my, I always told my graduate students they should take theory courses.

理论计算机科学是我们这个领域的基石。

You know, theoretical computer science is the backbone of our field.

我们一直密切关注理论界的发展动态。

We always wanted to track what was going on in there.

对我工作影响最大的，始终是理解理论界在做什么，还有像密码学这类技术——虽然当年还没那么重要，但后来变得至关重要。

The main thing that was impacting my work was always understanding, you know, understanding what they were doing and also, things like cryptography and so forth, which came to be so important in not in those days so much, but in later work.

当然，我很幸运能待在一个有罗恩·里维斯特和他的同事们的地方。

And of course, I was fortunate to be at a place where Ron Rivest was and his colleagues and so forth.

我本来就想问这个问题，MIT的环境对你的工作有多重要？

And I was going to ask about that actually, was how important was the milieu of MIT for the work that you did?

你觉得，如果你在别的顶尖院系，结果会不会也差不多？

Do you think if you'd been in another strong department things would have played it out in a similar way?

还是说，MIT的印记在某些方面特别鲜明？

Or is the MIT imprint very strong in some way?

这个问题我没法回答，但我相信，世界上有很多优秀的研究机构。

Well, I can't answer that question, but I really think, you know, we have many strong places.

我觉得，任何顶尖院校都完全有能力做出这样的工作。

And I think all the top institutions could have done this work.

不过，MIT确实是个很棒的地方。

But, MIT is a wonderful place.

而且，我们一直非常重视教学。

And we also took teaching very seriously.

我觉得教学和研究是紧密相连的，因为真正教得好，就得从基本原理讲起。

And I do think teaching or research are very closely connected because when you teach well, you teach from first principles.

而做好的研究，也必须真正理解透彻。

And when you do good research, you have to truly understand.

所以，其实研究也是从基本原理出发的。

So you're really doing research from first principles.

在研究中，特别重要的是要清楚自己哪里还不懂。

And it's also very important in research to understand what you don't understand.

我常对学生说，正是在这些地方，你才能找到突破的方向，绝不能对某个东西为什么有效只停留在半懂不懂的状态。

I always tell my students that there's where you get the insight into where you have to move and you don't wanna have an incomplete understanding of why something works.

你必须彻底搞明白它。

You know, you have to really understand it completely.

我们一直努力去证明这些方法的正确性。

And we always tried to prove the correctness of these.

随着协议变得越来越复杂，你就得仔细推演，确保它们真的能成立。

As we got to these more complicated protocols, really you have to reason about them carefully to make sure they really work.

听到你这么说，我很高兴。

I'm glad to hear you say that.

我完全同意。

I I I couldn't agree more.

说到教学和研究，我有时会把教学形容成让更多人理解某个东西，从少数几个人扩展到更多人。

You know, when you're talking about teaching and research, I sometimes describe teaching as increasing the number of people who understand something from a smaller number K to a bigger number N.

而研究则是K等于零的特殊情况。

And research is the special case where K equals zero.

或者说是第一次真正深入地理解它。

Or for the first time, are understanding it so deeply.

这个视角很好。

That's a good way of looking at it.

所以我觉得，我完全同意你的看法，这两者是高度协同的。

So I view them, I completely agree with you, very synergistic activities.

这其实正是教授角色的两大支柱，说到底就是这样。

And that's kind of the twin pillars of the professor's role, think, really.

回到研究这边，视图认证复制技术是在80年代末推出的。

So returning to the research side, so viewstamped replication came out in the late '80s.

之后有一段时间，我觉得你们团队的关注点稍微偏离了复制方向，但还是在分布式系统领域内。

And then there was sort of a period where I think the focus of your group turned away from replication to some extent, still partly distributed systems.

我们完成了视图认证复制的工作。

We finished viewstamp replication.

我们在80年代后期发表了这项成果。

We published it at some time in the late '80s.

那会儿我提出了后来被称为里氏替换原则的东西。

That was when I came up with what came to be called the Liskov substitution principle.

但当时我们把它放一边了。

But we had put that aside.

当然，那会儿还处于早期阶段。

Of course it was early days.

那时候还没进入任何商业环境。

It was not in any commercial, environment yet.

还有，你知道吗，Leslie Lamport 当时在研究 Paxos。

And also, you know, Leslie Lamport was working on Paxos.

我八十年代还听过他讲 Paxos，但完全没听懂他在说什么。

And I actually heard him give a talk in the eighties about Paxos, I didn't understand what he was talking about.

我当时根本没想到那和我们做的是一回事，其实双方都存在理解上的隔阂。

And I had certainly no idea it was the same thing, but this was a mutual lack of understanding.

对。

Yeah.

我听说的故事是，到了九十年代末，Google 文件系统的论文发表了。

The story I heard was, well, in the late in the nineties, the Google file system paper was published.

那篇论文用了复制技术，还提到了 Paxos。

And that paper used replication and talked about using Paxos.

我有点不爽，因为我的一个学生就在那里工作，我觉得他本可以提一下 Viewstamped Replication 的。

And I was kind of peeved because one of my students was working there and I thought he could have talked about viewstamp replication.

但我听说的是，Bill Weil——他八十年代曾是我的学生——刚好在 Google，正在研究 Google 文件系统的情况。

But the story I heard was that Bill Weil, who had been a student of mine in the eighties, happened to be at Google and he was looking at what was going on in the Google file system.

他说，哦，那是视图戳复制。

And he said, oh, he said, that's viewstamp replication.

其实这两个协议是各自独立开发出来的，但本质上是一样的。

And they really were the same protocol developed in two different places.

那时候我们居然都没意识到这一点，真是挺有意思的。

It was just funny how we kind of couldn't see that for that period.

太有意思了。

Fascinating.

有时候，某些研究恰好在特定的时刻变得水到渠成，这挺奇妙的。

It's interesting how there there's sometimes just moments in time where it feels like the right time for certain work to be done.

这种情况其实经常发生。

And often it happens.

往往好几个团队会不约而同地同时做出类似的工作。

It's sort of multiple different sort of groups And do it at the same

同一个想法被不同的人独立发现，其实并不罕见。

the same idea does get discovered more than once.

是的。

Yes.

这真是一个很好的例子。

So that seems like a great example of that.

但到了90年代末，你又重新回到了复制技术的研究，对吧？

But then you did get, in the late 90s, you did get pulled back into replication, right?

就是那个著名的PBFT协议。

In the famous PBFT protocol.

据我了解，这个协议至少部分是受到DARPA一项招标公告的启发。

My understanding is that was at least in part inspired by a DARPA, a BAA, a sort of request for proposals.

我很想听听这段故事。

So, would love to hear a little bit about that story.

另外，想聊聊学术界之外的合作，比如和政府资助机构或产业界的协作，这对你的工作是否重要，又是怎么影响你的？

Then maybe relatedly, just perhaps the importance of collaboration outside of academia, whether it's with kind of government funding agencies or industry and how maybe that's if that's been important in your work, how that's been important.

PBFT，也就是实用拜占庭容错协议，是这么诞生的：我有个学生叫米格尔·卡斯特罗，正在找博士论文的方向。

Well, the way PBFT came about, Practical Byzantine Fault Tolerance, is I had a student, Miguel Castro, who was looking for a PhD thesis.

我就建议米格尔去看看DARPA发布的那些征询提案，看看有没有什么引起他兴趣的。

And I suggested to Miguel that he look at the RFPs that DARPA had put out and see if anything interested him.

他发现有一个提案正在寻找应对互联网上恶意攻击的方法。

And he found an RFP that was looking for ways to handle the malicious attacks that were going on on the internet.

于是他来找我，说：我们能不能试着设计一种能应对这些恶意攻击的复制机制？

And so he came to me and he said, why don't we see whether we can figure out a way to do replication that handles these malicious attacks?

我觉得这个想法非常好。

And that seemed like a great idea.

我不是说这件事迟早会有人做，但DARPA已经意识到恶意攻击是个严重问题，并且主动寻求相关研究，这确实推动了我们团队当时去开展这项工作。

I mean, I'm not saying it wouldn't have happened anyway, but the fact that DARPA had recognized that this was a serious problem, the problem of malicious attacks and was looking for research in that area certainly was something that caused this work to happen in my group at that time.

我认为DARPA和NSF都非常重要。

I think that DARPA was a very important between DARPA and NSF.

正是它们多年来持续资助研究，才让这些工作得以进行。

I mean, they were the reasons that research was getting funded all those years.

它们是我们今天拥有如此互联网的重要基石之一。

They are one of the very important backbones of why we have the internet that we have today.

如果没有这些研究经费，要完成所有这些工作会困难得多。

Without that research funding, it would have been much more difficult to have done all that work.

这就是我们开始研究拜占庭容错的由来。

So that's how we got started on Byzantine Fault Tolerance.

接下来，我们直接从视图复制入手。

And then what we did was we simply started from viewstamp replication.

我们团队的人都熟悉视图复制，但我觉得其他地方的人并不了解。

My group all knew what viewstamp replication was, and I don't think it was understood at other places.

所以我们有别人没有的起点，而且我们充分利用了它。

And so we had that stepping stone that other people didn't have and we used it.

这看起来简直是顺理成章的事。

It just seemed like it was a natural thing to do.

我们已经有了一个能应对普通故障的算法。

We had this algorithm that worked for benign failures.

那好，我们就试试加入拜占庭故障，看看会怎么样。

Okay, let's add Byzantine failures and see what happens.

而且我们从理论研究中也知道，需要三个F加一副本，而不是两个F加一。

And we also knew from the theoretical work that we were gonna need three F plus one replicas instead of two F plus one.

但归根结底，我们想找的是一个真正能被大家实际采用的协议。

But again, we're looking for a practical protocol that people will really use in practice.

所以我们从视图复制开始，但一旦引入拜占庭故障，问题就完全不一样了，因为你得应对那些会撒谎的副本。

So we started from viewstamp replication, but it's a very different problem once you add those Byzantine failures because you have to be prepared for replicas that lie.

当然，你还得担心消息内容遭到恶意篡改。

And of course you also have to worry about malicious attack on the content of messages.

为此，我们立刻采用了密码学技术，这样才能确保消息安全传输，知道发件人是谁，也能确认内容是否正确。

For that, of course, we immediately started using cryptography because that was the way to make sure that messages can get from here to there and you knew who they were coming from and you knew whether they were correct or not.

我们真正要解决的大难题，是那些会撒谎的副本。

The bigger problem that we were dealing with was the replicas that lie.

这也就是为什么你需要三个F加一副本，而不是两个F加一。

And of course that's why you need three F plus one replicas instead of two F plus one.

而其中最大的问题，就是主节点可能会撒谎。

And the biggest problem you have there is that the primary might lie.

那时候我觉得我们就像走进了一个满是哈哈镜的鬼屋，得用特别古怪的思路才能理清头绪。

It felt to me like we were in a fun house full of these distorting mirrors and you had to really think about things in an odd way to come to grips with this.

但最终，我们的解决方案还是建立在视图复制协议的基础上。

But in the end, the solution was a protocol that was strongly based on viewstamp replication.

这个协议在复制流程中多了一个阶段，因为解决问题的关键是：绝不信任单个副本，只相信整个群体。

It had one more, phase in the replication protocol because the way you handle the problem is you never trust an individual replica, you only trust the group.

而这个群体必须包含足够多的副本，才能证明事情确实发生了。

And the group has to consist of a sufficient number of replicas to be able to prove that this is what really happened.

当然，我们还需要一种方式，让这个证明能在以后随时拿出来验证。

And of course, we need a way that this proof can be offered at a later point in time.

为此，我们用了证书。

And for that, use certificates.

一个证书就是由 2f+1 个签名消息组成的，内容全都一致。

So a certificate consisted of two f plus one signed messages all stating the same thing.

这就能证明你已经走到了协议的某个特定阶段。

And that would be a proof that you got to a particular point in the protocol.

多出的这一步是因为主节点只能提议下一步操作。

And the extra step happened because the primary could only suggest the next step.

然后，需要 2f+1 个副本共同达成一致，确认接下来要执行的操作，并将它写入账本。

Then two F plus one replicas together have to produce a protocol that says we're doing this next and putting this next in the ledger.

接着还得再走一步，才能真正提交这个操作。

And then you have to do another phase to actually commit that step.

这就是这个协议的由来。

And, that's how you get this this protocol.

但说起来容易，回头再看确实清楚多了，当时可没这么简单。

But, you know, it's easier in hindsight to see it than it was at the time.

我们花了大量时间才想出这个方案。

It took quite a bit of thinking to come out with it.

不过，这仍然是我们设计 PBFT 的核心基础。

But that was still, it was the underpinning of how we, came up with PBFT.

对。

Yeah.

为了让听众更好地理解，这种由 2f+1 个签名组成的证书概念，影响非常深远。

And just for the audience's benefit, I mean, this idea of sort of certificates of two f plus one signatures, I mean, has been a very, very influential idea.

在如今许多主流区块链协议中，确实就是靠这种方式向其他人证明交易的顺序。

And in many of today's major blockchain protocols, indeed, this is, this is how they prove, you know, the ordering of their transactions, to to others.

当然，证书并不是我们发明的。

But of course we didn't invent certificates.

它们源自一些理论研究。

They were coming out of theoretical work.

没错。

That's right.

如果我没理解错的话，对我来说，PBFT 就像是把那些理论研究连接到实际系统的一座桥梁。

Correct me if I'm wrong, but PBFT to me felt like the bridge from that theoretical work to practical systems.

对吧？

Right?

我读过 PBFT 的论文，也看过当时各方的反应，感觉那时候确实出现了一个关键节点。

I mean, my sense just, from reading a PBFT paper and all of the reactions around it was perhaps there was this moment.

等等，有点不对劲。

It's like, oh, wait a minute.

这不只是为了证明定理。

This isn't just to prove the theorems.

我们其实可以构建一个系统，让这个方法真正落地运行。

Like, we can actually sort of build a system where this is really how it's gonna work.

是这么回事吗？

Is was that what happened?

或者

Or

我们只是从理论计算机科学里挑出需要的东西，拿来就用。

I mean, we were just, you know, picking up stuff from theoretical computer science and using it as we needed it.

对。

Yeah.

但也许你说得对，当时大家觉得这研究挺有意思，但谁在乎呢？

But it you you may be right that it was thought of as this work is interesting, but, you know, who cares?

那些理论工作。

The theoretical work.

现在你能看出来，它如何完美地融入了实际系统中。

And now you could see how it really fit right into a practical system.

我们很高兴，有人已经开发出了一些正好能满足我们需求的技术。

We were happy that there were techniques that people had developed that served our needs.

但你还是能清楚地看到理论与实践之间的联系。

Still, you can see the bridge between theory and practice.

如果我们当时不了解这些理论，肯定会被困住，根本做不下去。

We hadn't been around the theory, then, you know, we would have been real, really stymied in what we were doing.

是的。

Yeah.

我想补充一点，有时候，那些有真实测试数据支撑的优秀系统，真的能改变人们的看法。

I I wanted to add that sometimes, you know, good systems work that have benchmarks that show, you know, good actual practical results, they change people's mind.

他们会说，哦，这项技术原来真的能用。

They say, oh, this this technology can actually be used.

理论论文说某事可行，和看到实实在在的优秀基准测试结果，这中间是有区别的。

There's a difference between having a theoretical paper saying it's possible and seeing, you know, good benchmarks-

我明白你的意思。

Oh, I see what you're saying.

然后说，这个文件系统确实运行得很好。

And saying that, you know, file system works well.

我从来就没为这个担心过。

I was never worried about that.

不过，我那时候只是想找出能让系统跑起来的东西。

But of course I was just the one who wanted to find the stuff that would make the system work.

这很难，但特别有意思。

And it it was hard, but it was a lot of fun.

说到证书，其实过去五到七年里，分布式计算领域出现了一项很酷的研究，就是关于问责机制——当系统出问题时，能不能判断问题出在哪里，以及该由谁负责。

Speaking of certificates, actually, there's been a very cool line of work in the last maybe five to seven years or so in distributed computing around accountability, which is when something goes wrong, can you tell if it went wrong and who might be responsible for it?

举个例子，如果你在考虑拜占庭容错系统，那如果真的出现了太多恶意节点，会发生什么？

And so, particular, if you want to think about Byzantine Fault Tolerance Systems and say, well, what would happen if actually you did have too many malicious actors?

会发生什么情况？

What could happen?

可能会出现一致性被破坏的问题。

And you could have a consistency violation.

但问责机制指出，造成一致性破坏的唯一方式，就是签署大量相互矛盾的数据。

But accountability says the only way to create a consistency violation is by signing lots of inconsistent things.

通过审查，就能找出那些在不同冲突状态上重复签名的恶意节点。

And then through inspection, you can actually identify bad actors who double signed on different conflicting states.

这种想法可能早在二十年前就有了，但真正的发展主要集中在最近五到七年。

I could imagine this being developed maybe twenty years ago, but it's mostly been developed in the last five to seven years.

所以，要分析PBFT这类协议，不能只看故障节点数量较少的情况，还要考虑它实际超过阈值的情形。

So, analyzing PBFT style protocols, not just in the regime where the number of faulty nodes is small, but also where it's actually bigger than the threshold.

我之前没听说过这项研究，但听起来确实很有意思。

You know, I'm not aware of that work, but it does sound interesting.

是的。

Yeah.

这太棒了。

It's very cool.

我还想跟你聊聊PBFT，我读这些论文时特别有帮助的一点是，不仅在于我们之前讨论过的、带有证书和2F+1机制的复制协议，更在于一个洞察：一旦你有了共识协议或复制协议，就可以运行各种不同的执行引擎。

The other thing I wanted to ask you about PBFT, one of the things that I really, was very helpful for me when I read these papers, is not only the, replication protocol itself that has certificates and 2F plus one that we talked about, but also kind of this observation that once you have a consensus protocol or a replication protocol, you can actually run different types of execution engines.

你提到过文件系统作为例子，但其实你还能运行其他类型的服务。

So you mentioned a file system as one example, but you could run other types of services.

所以，你能稍微讲讲，把通用服务看作一个复制服务的这种思路吗？

So maybe you could talk a little bit about kind of this, view of a generic service, as a replicating service.

我觉得这一点从一开始就很明确了。

Well, I think that's, I mean, that was there from the start.

当然，我们在做Viewstamp复制时想的是文件系统，但我们都清楚，我们本身并不是应用本身。

Of course, we were thinking about a file system when we did viewstamp replication, but it was always clear that we really weren't the application.

我们真正做的是为应用提供正确无误的信息。

We were actually the piece that gave the application the right information.

所以我们其实并不关心具体是什么应用。

And so we didn't really care.

我们只是把请求的操作记录到账本里，至于这个操作具体意味着什么，我们根本不在乎。

We we just wrote into the ledger, you know, what the operation was that was being requested, but we were not in the least bit interested in what it meant to execute that operation.

这看起来就是一个很好的职责分离。

So it just seemed like a good separation of concerns.

我想从一开始我们就明白，这样看待问题很重要，因为你不想把自己局限在某一个应用上。

And I think even in the beginning, we understood that you wanted to look at it that way because you didn't want to limit yourself to one application.

你希望找到一个通用的解决方案，能适用于多种不同的应用。

You wanted to find this generic thing that would work for many applications.

这其实和你之前提到的模块化原则是另一种表现形式，或者说是类似的思路。

It's another variant of the modularity principle that you were proposing earlier perhaps, or think some

这其实挺明显的，你在我收到的邮件里提到了状态机复制，而我们也知道自己正在做状态机复制。

it was just sort of in a way obvious that you wanted you know, you mentioned state machine replication in the in the email you sent me, and we knew we were working on state machine replication.

状态机复制的核心思想就是，不管你具体做什么，那都只是内容本身，你只需要关心顺序，比如这是第25个操作之类的。

And state machine replication has the idea that whatever it is that you're doing, that's just the thing, you know, and you instead just think about the order and this is operation number 25 or something like that.

所以我觉得，这种思路从视图复制一开始就是我们工作的根本。

So I think it was very fundamental even in viewstamp replication to what we were doing.