So thanks everyone for joining today's virtual Hyperledger Meetup. We have Jakov Menević speaking about Byzantine Fault Tolerant Consensus Library for Hyperledger Fabric. If you have any questions throughout the presentation, please do feel free to add your questions in Zoom chat and we will get to those and we welcome your comments, questions, feedback and with that I will hand it off to Jakov. Thanks. All right, so let's start. So first of all, a few words about me. So I'm a senior research software engineer at IBM Research. My current interests and also the stuff I currently work on are central bank digital currency and BFT consensus. And also I do some applied cryptography and implementations, for example, threshold cryptography like threshold signatures and stuff like that. Also I've been a maintainer of Hyperledger Fabric Core, meaning the order and the peer components since early 2017, really since the inception of Fabric. And lastly, and this is what this talk is about, I led the development and integration of the BFT that Fabric currently has into Fabric. And it took, it started mid 2019 and you will see during the presentation where we are today. So what I'm going to talk about today. So first of all, what is Byzantine Fault Tolerance? Also I'm going to cover a history of consensus in Fabric. And by the way, this talk is for technically oriented people. So I assume you have some familiarity with Fabric. I assume you know what is consensus. I'm not going to define these things, but feel free to open a new tab and read while I'm speaking. Also I'm going to talk about, of course, the library, the BFT library that we have integrated into the official Hyperledger Fabric version. And how did we integrate it? What are the various nuances? And I'm going to give some deployment tips in case you actually want to run it in a pre-prod or production eventually. So what is Byzantine Fault Tolerance? So the scientific literature and also reality, it identifies two failure models. So we have the most simple failure model, which is a fail stock model, where nodes, servers, they can either crash or become unreachable. Like someone cut the cable, some router is unreachable, so you cannot communicate with the node. However, there is another failure model in which basically the node can do anything it wants. What would it mean by anything? So first of all, you're not assured that the computation that this node is beginning will ever end. The node can be stuck in some infinite loop. It may return some incorrect result of a computation, and it may deliberately also return some misleading result. And lastly, the node might be so malicious that it may return a correct result to one node and an incorrect result to another node. So why is this? And also, of course, a protocol that can only work in a CFT, in a CFT model, it will not work well in a BFT model in the sense that you won't have any more safety and liveness guarantees. So we will see in the next few slides, if you take a rough protocol and you let it run with nodes that can behave arbitrarily, you might get a fork. Some nodes will agree on one value, some nodes will agree on another value. So why is Byzantine tolerance even important? From all kinds of reasons, actually, the first reason is that you may have software bugs, and software bugs may cause arbitrary behaviors. So a Byzantine protocol is somewhat more resilient than a CFT one to software bugs. Of course, if you have a software bug that affects everyone, all nodes, then, well, of course, then you have a problem, right? Another reason is that if, in some cases, you have parties that these parties run these nodes, and they may deliberately behave in a malicious manner, either to get some economic incentive or just out of spite, just because they want to crash network, for example. And lastly, of course, nodes might be compromised by hackers. So if you want your protocol to be really resilient, you might want to consider using a Byzantine fault-tolerant protocol. So let's compare some protocols that we know that are very popular. So for the crash fault-tolerant protocol family, we know where there are Paxos and RAF protocols. And in the BFT protocol family, we have PBFT, which is really the ancestor, probably, of all BFT protocols. And we have the relatively new protocol stuff. And in the CFT case, the assumption is up to a half, like up to less than a half, R40. And in BFT, up to less than a third, almost a third, R40. However, as I said before, in the BFT case, when a node is faulty, it can behave in any manner you want. But in the CFT case, it can either crash or become unavailable. Now, sometimes when a leader node, the node that usually is the node that proposes the next batch to be agreed upon, if this node crashed, for example, you need the protocol to rotate this node. So how is it done in CFT? In CFT, the leader rotation is opportunistic. Basically, a node can say, hey, guys, I'm OK. I know the previous leader crashed. Make me a leader. And the rest of the nodes, they can agree or disagree. And usually it's like the fastest node that is doing that. The fastest node that saw the previous node crashed. However, in BFT, you cannot have this because then a malicious node will always be the fastest node. So you have a round robin protocol that rotates the nodes in a round robin manner. And lastly, so in the CFT protocol, single node can dispatch requests from a client. And this single node can make sure that the transaction will eventually be ordered. For example, in Raft, the way that it works is that if the transaction reaches a leader, the leader will include the transaction in a block. But if the transaction reaches a follower, then the follower node will simply send it to the leader. However, in BFT, we cannot assume a single node will behave correctly because a single node may want to preserve its network bandwidth. So it may not forward this transaction to the leader. So in BFT, we would like to send the transaction to as many nodes as possible or to everyone. Any questions so far? Let's see in the chat. I think that no question. It's OK. So let's go on. Next, I'm going to talk about the consensus in high-plagia fabric, meaning the history. So how did we get to where we are now? So like a brief reminder, we are talking about high-plagia fabric. High-plagia fabric has two types of nodes. We have ordering service nodes and have peer nodes. So peer nodes, they process and validate transactions that appear in blocks. But how are these blocks even formed? So transactions are sent to ordering nodes and ordering nodes. They totally order these transactions in the sense that the output of the ordering nodes is that the output is blocks. And these blocks, they reach all the nodes, the same blocks, they reach all the nodes, and then the same blocks are disseminated to all peers. So at the beginning of high-plagia fabric in early 2017, we only had a Kafka-based ordering service. The way that it worked is that transactions were sent to the ordering service nodes that were that they were basically front-ends to Kafka. They would forward the transactions to Kafka and then they would all read them in the same order back from Kafka. And then they would cut blocks, each ordering service node would cut blocks in the same way.  However, unfortunately, this didn't really work out very well. Why? Because Kafka, as you know, it depends on another deployment of ZooKeeper and also someone needed to actually deploy the Kafka nodes, which is like a message broker. So this kind of deployment was complex. It was very centralized. And we cannot really say that it was distributed. Then in mid 2019, we released the RAFT-based ordering service. The RAFT-based ordering service used the ETCD RAFT library, the same library that is used like in ETCD, in Kubernetes. And their ordering service actually improved many things. So first of all, it was easy to deploy. It was only all in the single process. No more dependency on Kafka or on ZooKeeper. So we had it had no management overhead. However, it was only distributed. It was it was not really decentralized. So someone said someone asked some question about quantum mechanics. It's not really relevant to BFT. So I'm not going to read questions that are not relevant to this topic. So the good question, what is the difference between distributed and decentralized? So I will get to that in a few slides. Good question. So as I said, the RAFT was distributed, but it was not decentralized in the sense that it makes no sense that you will have several parties each running a RAFT node if these parties do not trust each other. Why? Because as I said, RAFT is only a CFT crash fault tolerant, contentless algorithm. And therefore, a node in RAFT, if it is malicious, it may deviate from the protocol and cause like a fork in the blockchain and all kinds of other problems. So it is distributed in the sense that if you run RAFT, you need to assume that all parties trust each other or that no party is malicious. However, a decentralized setting is really like what you have like in BFT or in today's permissionless blockchains where no party actually trusts another party. So as we said, Kafka and RAFT are both only crash fault tolerant and we didn't have a Byzantine fault tolerant consensus in fabric. Then in 2019, a couple of researchers, they published a research work that integrated a Byzantine fault tolerant consensus algorithm into fabric. So let's quickly go over how it worked. So it worked in the following manner. On the right side, you have fabric peers and then you have the fabric ordering service node. So imagine that if you have a client, the client sends her transaction to the ordering service node. The ordering service node, which is written in Go, the fabric core is written in Go. This node would then forward the transaction through some kind of a shim, which is like a proxy, to a set of BFT nodes written in Java, because the implementation of their paper was Java-based. So then the BFT nodes would do their consensus and the shims, these proxies, they would read all transactions in the same order. You can think of it basically as a Byzantine fault tolerant version of Kafka, because that's also how it is done in Kafka. And then each such a shim would forward the batch of transactions in the same order to the ordering service node that it came from. And then each ordering service node on its own would sign a block of transactions and the block would be disseminated to peers. So this is obviously a very big leap from what we had before. However, this deployment had some problems. So the first problem is that in order to actually maintain this and to operate this thing, it's not that easy. It's actually the same way that you had in Kafka. So imagine that now you want to add a new BFT node. You cannot actually express that in fabric terms. You cannot send the fabric transaction to this BFT node cluster and then something would happen. So this operation deployment was disconnected from fabric itself. The second problem is that if you remember, I said that each ordering service node would cut its own block. That also means that this ordering service node would also sign this block on its own. However, this also means that each block was only signed by a single ordering service node. However, we are in an decentralized and Byzantine setting. So there is no reason that a malicious node would promise to actually only cut identical blocks as everyone else because what we really had to do is somehow these ordering service nodes then communicate between themselves and compare these blocks and then cosign each other block because otherwise a single signature in the Byzantine setting, it doesn't make much sense. So in 2018, we have the BFT smart ordering service node. It is decentralized to some point. But as I said, it is not easy to deploy. It's not in a single process because we have this proxy thing and different and the BFT nodes are written in Java. The ordering service node didn't go and there is a management overhead. So then in early 2020, we released a new type of ordering service node. We called it smart BFT because it is based on the BFT smart protocol, which I will explain next. And it fulfills all these criteria, so it's easy to deploy. There is no management overhead and it is decentralized. Questions so far? All right, so let me dive into the library. So the first thing I want to say is the library itself is hosted on an external GitHub organization. It's called smart BFT-go. The name of the repository is Consensus. Can we pick any of these Consensus options when using Fabric? Yes, of course. That's what I'm explaining. Yeah, so apart from the actual library implementation, in 2021, we presented a paper about it in the conference in ICBC. The title of the paper is the title you see here. It is based on the library for Fabric. And the initial contributors for this library were the contributors that you see listed here.  So first of all, I am presenting this thing. So I want I want to give credit to other people who work with me on this. Obviously, I'm not the only one that worked on it. I did lead the development, but it is a team effort. So I want to give credit to other people. And also I want to mention that this project is, in its essence, it is an engineering project. So it's not like we didn't have some kind of groundbreaking theoretical breakthrough. So it's mostly engineering. And in engineering, in my opinion, if you didn't write any code, you didn't actually make a big contribution. So that's also why I want to show that everyone here actually contributed to this library. So the smart BFT library that we developed, it is a BFT library that it was designed from the ground up. We think with the fabric in mind. What do I mean by that? So it is located, sorry, it is embedded into the fabric ordering service process, as go routines, as a real early part of the actual code base. So you can see here, this smart BFT, if the ordering service node runs multiple channels, you will have multiple instances of this library. And this library uses all other utilities that the fabric ordering service node can give to the library in order to be utilized. In terms of tradeoffs. So you know that in engineering, there are always lots of tradeoffs. So we chose to go to the tradeoff to sacrifice throughput in order to get protocol simplicity, ease of the administration and decent latency. So what do I mean by protocol simplicity and ease of administration? So I mean, these things are not really well defined, because throughput is well defined, latency is well defined. But it's not clear what does mean protocol simplicity or ease of administration. So let me explain that. There is a question here in the chat. Is smart BFT built using Go language? Indeed, yes. Smart BFT is built using Go. So what do I mean by ease of administration? So this smart BFT library, it preserves the semantics of fabric. For example, configuring a smart BFT order is actually almost the same as you do that for raft. And as I said before, raft is very easy to maintain and to manage. It's also very easy to do dynamically configuration. So dynamically configuration is something that is considered in the consensus literature as something complex. So in smart BFT, it is really easy to do that. And I will explain in a few slides why. Reconfiguration means no additional removal, in case you wondered. And also, there is like an iron rule in fabric that configuration transactions must end up in their own blocks. So if a block contains a configuration transaction, this is the only transaction in the block. And there is a ton of code base in fabric that depends on this fact. So this library also honors this fact, despite being actually application agnostic. So the library doesn't actually understand that there is a fabric on top of it that uses it. However, we built the API in a way that allows the library, sorry, allows fabric to express its own semantics and to enforce them on the library. And lastly, blocks only contain transactions that fabric rules actually approve. So unlike the BFT smart protocol library that I showed before, you cannot send like an invalid transaction. And this invalid transaction will never actually get into a block. So what do I mean by easy to integrate and use? So I want to compare with the Raft library. So as you know, there is a Raft ordering service node and as someone that was involved in the development, sorry, in the integration of the Raft library into fabric, it was really not easy because the Raft library API, it works somewhat like this. So you have a command that you ask from the Raft instance, hey, give me the next command. The Raft instance gives you the next command. And then you need to process this command and to actually do what the Raft library tells you to do. The only problem is that you actually need to understand the Raft in order to know how to process the command. And when I say to understand Raft, so there are a ton of fields that you need to be able to go per hand and understand what they mean and to properly handle these fields when you process the commands from Raft. So this is a nightmare to integrate not only into fabric, but into another system unless you are very familiar with Raft. So this small BFT approach that we took is different. So first of all, the small BFT library, it identifies primitives that BFT protocol needs, such as communication, cryptographic operations, like such as signatures, and stage replication. And then these primitives are abstracted into interfaces that are called dependencies. And then from that point on, the job of the person that wants to integrate the small BFT library into its application, the job is done. Why? Because the entire lifecycle is managed by the library itself. So you don't actually need to understand how small BFT works in order to integrate it as a consensus engine. If we take a closer look, we have these three layers. So the topmost layer is the layer of the library itself. We have these components, which I will explain in a few slides. The middle layer is the dependency layer. These are interfaces that the application that uses the library exposes to the library. And this application that uses the library needs to implement these interfaces. And underneath the bottommost layer in case of fabric is the actual components of fabric that are used to implement these dependencies. So now I want to switch over to the small BFT consensus protocol. Any questions so far? Is adding and removing order still done by updating the consensus section of the channel config block? Excellent question. The answer is somewhat, yes. I see we have some disturbance from the participants. I just muted them. Okay, thanks. Thanks a lot. Yeah, let's continue. Yes, so the answer is, yes, it is somewhat by updating the consensus section. But there is a small difference. I will explain it in a few slides. Another question is, are transactions containing smart contracts chain code treated equally? Yeah, that's also a good question. So there are treated equally in the sense that an honest BFT leader would consider them equally. And what I mean is that we don't have any kind of fairness guarantee. So you are guaranteed that the transaction will eventually get into a block. However, you're not guaranteed when. So the smart BFT library does not provide, for example, front-end protection. So if you want to use it to build some kind of stock trading application or something like an auction, you would need to implement an encryption or commitments and the commit reveal yourself. You cannot charge the library to ensure that if one transaction is submitted before another one, then it will get into a block before the other one. But yeah, good question. So let's go into the actual protocol. So the smart BFT consensus protocol is, I would say almost identical to the BFT smart protocol. First of all, the actual agreement on blocks, it works very similarly to PBFT. However, the only difference is that in PBFT, you can agree on several blocks at the same time, which I like to call a pipeline. In smart BFT, as in BFT smart, there is no pipeline. You agree each time on a single block. Now you might think that, okay, why would you do something like that? It's very slow, right? Because a pipeline actually makes your throughput higher because you can you can send several blocks at the same time. You don't need to wait until the agreement on the current block ends and then to send the next block. So although it's true that doing only a single block at a time is slow, therefore low throughput, it gives you simplicity. And why? Because if you only have a single block at a time, you know that the state of your entire protocol is always contained, can always be contained in a single block. So in smart BFT, we actually encode the state of the protocol inside the fabric blocks, and we ride on top of the fabric blocks in order to preserve our state. So when a fabric block is committed into the ledger, so is the state of the entire protocol. There is some common case. I'm not going to talk about it. The common case is related to view changes, but almost always the entire state is encoded in a single block. And this also means that it is very easy to do a reconfiguration. Why? Because once you submit a reconfiguration transaction, you know that there are no other transactions that may invalidate it or maybe they might be affected by it, also done in parallel, also being agreed upon in parallel. The next thing I want to mention is censorship resistance. So a proper BFT protocol should be able to detect if the leader is censoring transactions. So imagine if you have a client, and the client sends its transaction to all nodes. And let's suppose that the leader is replica zero. replica zero is malicious. From some reason, it doesn't like this client. It doesn't want to order its transaction. So the way that this is handled in both in BFT smart and Spark BFT is that once the transaction reaches a replica, a BFT node, the replica starts a timer. When the first timer expires, the replica sends the transaction to the leader node. Now, why do we do that? Because it might be that this client did not send the transaction to the leader replica, or maybe it tried to send, but it failed from sending. So I want to make sure that the transaction actually reached the leader replica. After a second timeout, we say, okay, probably this replica is being malicious. It is censoring this client. And then we start doing another protocol, which is called a view change. By the way, in the BFT smart paper, they use different terms. It's not a view change. It's something else. In our library, we adopt the Pbft official terms. So we have like view and also the names of the messages we send. We also like, they're very similar to the Pbft paper. Yeah, so what is a view change? In a view change, basically, the nodes agree on the next leader. And the way that it is done is basically the nodes first all broadcast that, hey, we want to do a view change. Then every node that receives a quorum of such view change messages, it depends. Sometimes it's a quorum. Sometimes it's less than a quorum, like f plus one, it depends on the variant of BFT. Let's not get into it. Then each node, it sends its last known block to the next leader. This is called this view data message. And then this leader aggregates all this lastly known block and sends a message, which is called a new view message. And this new view message effectively contains all these view data messages. And this is the message that makes all of the other nodes switch to the new leader and then the regular BFT protocol continues. So how does this all work in the library? So let's follow a simple flow. So we have a transaction, which in the library, it is called a request, not a transaction. So a request is received by a controller. And the controller from its name, you can assume it orchestrates all the entire transaction flow. The controller then then incuses this transaction into a request memory pool. Then at some point, the controller reaches to some batcher component and asks for the next batch. The batcher component just turns to the memory pool, says, hey, do you have any transactions for me? The memory pool returns the transactions to the batcher. And then the controller has a batch in its hands. However, it doesn't actually know how to create a fabric block. Why? Because the smart BFT library is application agnostic. So it doesn't know what is fabric. However, this is when we actually use the dependencies. So the controller, this smart BFT library, it reaches into the assembler, which is a dependency, and actually assembler, the thing that implements assembler is fabric itself. So it reaches into it, it says, hey, here is a batch of transactions. Can you construct something for me? Fabric, disguised as an assembler, it actually creates a real fabric block without the signatures and returns it to the controller. Then the controller proposes this block, which is a batch, to a view component. And the view is the component that actually runs the actual BFT programming protocol. So it reaches into the communication dependency, which is fabric again, and asks it to broadcast the messages. It might also reach into verifier dependency. And the verify dependency, for example, when implemented as fabric, it will check signatures of nodes or signatures of transactions. Yes. Also, again, the view reaches into the communication dependency. Also, sometimes we need to sign some message. I will get to that a little later. So again, we reach to the abstracted signer dependency, which is done by the MSP layer in fabric, and so on and so forth. Eventually, the view component, it has in its hands a batch of transactions, which is a block, and signatures on the block. And then it gives it back to the controller, and the controller gives it back to the application, which in the case of fabric, this is the way that signed fabric blocks are written into the ledger, into the fabric ledger. In some cases, the controller might decide to abort the view, or if the controller realizes, hey, it is behind, some other nodes have a higher proposal number than itself. It may reach into the synchronized dependency, which again is implemented inside the fabric. And the synchronized dependency, it basically syncs the ledger underneath the library. While this is happening, the library is like not doing anything. And then it returns with the latest sequence. Another thing is that, as I mentioned before, if actually I want to talk about this a bit later. But I will just say we have a view changer component, that this is the component that I mentioned before, that orchestrates the entire view change here. Yes. Okay. Okay. Now, until now, what I explained to you, the Smart BFT library is very much aligned with the scientific literature. It follows the BFT smart protocol. However, there is some small difference. So first of all, in the literature, if a leader crashes, then how do you detect it?  However, what if no transactions actually happen? Maybe it's night. And at night, I don't know, maybe clients are sleeping. There are no transactions. So we obviously don't want to wait until people come in the morning, try to buy their coffee, and then the BFT notes will realize, oh, wait, the leader is actually offline. It has been offline for the entire night. Now we need to do the view change, which takes time. So can we do better? And in Smart BFT, the leader actually does something very similar that is done in RAFT. So the leader sends hard bits in a periodic manner. And if the follower notes, which are not leader notes, if they see that the leader did not send the hard bit for some time, then they also try to do a view change. Sorry, they start to do a view change. And the motivation for this is we want to detect the leader crashes proactively instead of reactively. Something extremely important is signature piggybacking. So in fabric, as I mentioned before, blocks need to be signed by ordering nodes. Why? Because a block in fabric might be transferable between different nodes. So a block might be transferred between two ordering service nodes, or a block might be transferred between an ordering service node and a peer node, right? Because peers pull blocks from the ordering service node, and they need to verify that these are actually the blocks, and there is no other block instead. Now if you are in a Byzantine environment, maybe a malicious node will try to forge these blocks. In order to prevent that, what we do is we have the nodes signed over the blocks, and each block contains also signatures from a quorum of ordering service nodes. So how do we actually do that? So during the actual agreement on the block, in the last message of consensus, in the commit message, each node attaches its own signature on the block, and then the commit step involves a broadcast. So this way each node's signature is being broadcasted to all the other nodes. However, what I want to ask you now is, is it really a good idea? Because actually what we're doing here is we're sending a signature on the block before we actually finish the consensus round, right? Because when does the consensus round finish? When can we actually commit this block into the disk? We can only commit this block into the file system once we as an ordering node receive the quorum of commit messages, right? But I just said that we sign the commit message before we, sorry, I just said that we sign the block once we send the commit message, not once we receive the quorum of commit messages. So why is it safe? And the reason that it is safe is that we know that once we actually start the commit phase, we know that we have observed a quorum of prepares. So we know that even in some case of a crash, this block is going to be the block for that sequence, in the sense that there cannot be a different block for that sequence, even if something bad happens. So that's why it is still safe to sign a commit message, sorry, to sign the block and to piggyback this block signature on the commit message. Now, we want to say that if, so we are collecting a quorum, which is like around 2f plus one, right? It depends on like what is f, but usually it's 2f plus one. So we collect 2f plus one signatures on a block. But had we done the signature collection after the actual commit, sorry, after the actual consensus phase, after the block has been persisted into the ledger, if we had done that, then it would be sufficient to only collect f plus one signatures. We would not need like 2f plus one. So it's a trade-off in some sense. Any questions so far? Before I dive into how this library is integrated into fabric, can you go through performance? Sorry. So in terms of performance, I actually, can you remind me at the end of this talk? Because so I have some backup slides. We did some performance evaluation where we submitted the paper. I mean, the paper was published. So the performance evaluation can be seen in the paper. However, the performance evaluation was conducted on a much more, I would say, ancient version of this library. So I will touch upon that in a few slides. But basically we, just to say like briefly, the performance we had when we ordered the fabric, actually like real fabric transactions, it was in a local area network, it was two and a half thousand, like 2,500. In a wide area network deployed across the globe, it was around 1,000 Chandax per second. So it's not much. However, as I would say in a few slides, there is some work being done to improve this performance. And also I would say that the fabric peer itself is anyway slow. So even if a smart DFT had 1,000 transactions per second, it's meaningless because then the bottleneck would be the peer, because the peer can only do like around 2,000 transactions per second with go level DB, maybe 3,000. With couch DB, it's much less. So it doesn't make much sense to have a very smart consensus if the actual transaction processing layer is anyway slow. So someone asks, so smart DFT obsoles to some extent both implementations wrapped in Kafka. No, it does not make, okay, so Kafka is already obsolete in the, so we, okay, I will touch about that. I will talk about it in a few slides, but in the latest version of Fabric, Fabric 3 that we released a preview of in the 1st of September, or the 1st of September, Kafka is no more, you cannot run Kafka anymore. I will not say that smart DFT obsulates Raft because Raft has a much greater throughput than smart DFT because Raft has a pipeline like it can do many batches at the same time. So if you want to run in a centralized setting, if you trust all your parties, not to be hacked, not to do malicious things, you should use Raft. If you want decentralization, Byzantine for Torrents, you can use smart DFT. Another question was, so is changing number of message passing F plus 1 from 2F plus 1 is a new development? No, so it is not, it is not, it's not a number of message passing. It is a number of signatures you need to, you need to collect in order to certify a block. It's not a new development. It's just, it just stems from the correctness of the protocol, or rather it just stems from the correctness argument. So if you collect the signatures during consensus, as we do in smart DFT, then you need to F plus 1. If you collect these signatures after consensus, after the dust settles in and after the block is in the ledger, which also means after you yourself as a node, you have assembled 2F plus 1 commit messages, if you, if you collect the signatures then, then you only need F plus 1 signatures. So it's a, it's a property of how, of when you do it, but it's not number of messages, it's like number of signatures. Is there a way for migrating from older Kafka to smart BFT? The way would be to first migrate from Kafka to Raft and then to migrate from Raft to smart BFT. How to verify that the smart BFT implementation is consistent with theory? Good question. You can read the paper and then you can be convinced. But as I said before, the actual protocol of smart BFT, it follows almost identically the BFT smart protocol. And the BFT smart protocol has been peer reviewed by theorists in academia for many years. So the protocol itself, it should be safe. Of course, you can always have implementation bugs, right? Okay, so no more questions. I will now continue to the integration to a hybrid fabric. So initially, the integration was released into a fork of fabric, not into the official fabric. As you can see here, it's in the fork of the smart BFT Go organization. Then integration into the official fabric began early in 2022. And lots of bug fixing and testing has been done during this time. So to some extent, we benefited from this being deployed in some environment. We finished the integration of smart BFT into the official fabric on the 1st of September, which is not by coincidence the Byzantine calendar new year. The main RFC that explains this can be seen as follows. And I also put the Github profiles of the people involved in this process. Again, to give credit, this is a team effort after all. In terms of RFCs, so there are three RFCs that have been merged that are related to BFT. The third RFC, the implementation of the third RFC has been completed. However, the implementation of the top two RFCs has not been completed. I will discuss it a bit later. Block validation policy. So as I said before, fabric blocks, when run in BFT, they are accompanied by a quorum of signatures from others. Now, how is this done in Raft? So in Raft, since Raft is CFT, you only need a single signature, right? And the question is, how do you verify a block signature? So in fabric, we have something called the block validation policy. In Raft, the block validation policy is the following. So it's like some technical detail. It's called an implicit meta-police, not important. And the rule here means any writers, which basically translates to, hey, any order node from the order organization can sign any block. And it is also sufficient only to verify a single signature from any ordering service node. Now, obviously for BFT, this is not sufficient, right? However, when we designed the BFT, sorry, when we integrated the BFT library into fabric, we also wanted to pave the way for other consensus protocols. So as I said before, smart BFT assumes that we collect 12 plus one signatures. But maybe other consensus protocols would collect a different number. Therefore, what we wanted to do is to be able to convey in some manner a block validation policy that can fit many types of consensus protocols. So the question here is, how can we express this policy in a consensus agnostic way? So we don't want to need to understand the consensus in order to know how to verify a block. And the solution is that we actually encode the policy as a signature policy. So in fabric, we have something called a signature policy. And when we create a signature policy for BFT, you can think of it as a tree-like graph on the right. So at the root of the graph, you have a threshold. And this threshold, in this case three, this threshold determines how many subpolices need to be satisfied in order for the top policy to be satisfied. So the bottom policies, so a signature policy is like a recursive policy. So you can have recursively other child policies and so on and so forth. But in the case of smart BFT, what we do is we put a threshold of 12 plus one or a quorum. We will put a threshold of a quorum at the root. And then the direct descendants are policies such that each policy is satisfied by a single signature from the specific node. So for example, in the policy you see here, we have four nodes in total. Assume we have four nodes in the system. So we only need three signatures, which is the quorum in case of four. We only need three signatures to satisfy the block validation policy in this case. Now, how do we encode this thing? So when we create the genesis block, which is the first block of the blockchain, we encode this policy into the genesis block. And then if we want to add more nodes or to remove nodes, then as we're doing fabric, we issue conflict transactions. And we made it that the smart BFT order itself, it validates the conflict transaction. It looks at the policy. And then if it doesn't make sense, it says, hey, this policy doesn't make sense. I'm going to reject this conflict update. But if the policy makes sense, then it accepts it. Another thing I wanted to talk about is how we actually encode this policy in a consensus agnostic manner. So in the previous versions of fabric, fabric one and fabric two, in order to verify a signature of some consensus algorithm, or in order to know how to bootstrap its communication, you would actually need the consensus specific code. Why? Because all these things, like the idea of the node, the host in the port, which are used for communication bootstraping, the identity, which is used to know how to verify the signature of the node, all of these things, they were encoded in some part of the configuration block of fabric. And this part was opaque in the sense that it is not part of the actual fabric framework, but it's consensus specific. And this creates a problem. Why? Because if you have a, I don't know, if you want fabric to support several types of consensus protocols, then you would actually need to write code that parses each and every one of consensus protocol and verifies it. So we don't want to do that, right? Because it makes integrating new consensus protocols very hard. So what we did is in version three, in fabric version three, this part is no longer opaque, but instead it is a first class citizen of the entire configuration block structure. So now it is located in another part. I will show it in the next slide. And this also means that you can configure all the nodes in the general part of the configuration. And the consensus specific parts, they only do things related to consensus. So the nodes are now found in a place in the config called the consensus mapping. And now you can bootstrap the communication and the block verification policy without actually needing consensus specific code. And this is explained in the RFCs. Lastly, how do we prevent block starvation? So I said several times by now that each block is signed by a quorum of ordering service nodes. So a malicious ordering service node, it cannot forge a block, right? Because to forge a block, it would need somehow to make a majority of ordering service nodes to sign something that they did not want to sign, that they didn't agree to. However, as I said, the peers, they pull blocks from ordering service nodes, right? And also other ordering service nodes, they also pull blocks from other ordering service nodes. So what they can do is they can simply avoid sending blocks. They can say, you know, I don't want to send you a block, or they can say, I don't have any block for you, despite the fact that new blocks have been produced. So this is like block starvation, block withholding, censorship, you can call it many things. And the way that we solve it in fabric is that when a node, like an ordering service node or a peer node, where it wants to pull blocks in a BFV setting, it connects to many ordering service nodes. From a simple ordering service node, it fetches blocks. And from the rest, it fetches block headers and their corresponding signatures. And this way, you can detect if new blocks were formed. Because if new blocks were formed, you will detect that new block, sorry, you will detect that new block headers and their corresponding signatures have been sent to you by honest nodes. Any questions so far until before, sorry, before I go into deployment tips, which is the last part of our presentation. Now the transactions must be sent to all ordering service nodes. Is the peer gateway service supporting that to achieve the transaction flow? Excellent question. And the answer is very short. Yes. There is any validations that orders do before signing? Yes, there are all kinds of validations that they do before signing. So in every step in the consensus protocol, an ordering service node does all kinds of validations. It depends on the step. So as an example, the BFT agreement works like this, right? Like the leader sends a message that contains a batch of transactions called the peer preparer in PBFT. Then each follower node goes through all transactions in parallel and verifies the signatures and also verifies that these transactions are well formed. Now in the case that this batch contains only a single transaction and this transaction is a configuration transaction, then what happens is that this follower node, it tries to simulate in its head this configuration change. If this configuration change doesn't make sense, then it will say, okay, I have received a configuration change from the leader and I don't think it makes sense, but the leader itself, that leader should have also validated it before including this configuration transaction in a batch. Therefore, the leader is malicious and then it starts a view change. So the answer is yes. There are many validations being done by orders before signing. So deployment tips. First of all, you have two guides here that you can read. The first guide is like in general, how do you manage the smart BFT order? The second guide is how you add a BFT order or how you remove a BFT order. Something that I want to mention that is very important is that in the config.tx.yaml section, you have all kinds of configuration parameters that you can configure. This might be a BFT protocol as you see here. All things here you can configure on the fly except the request pool. If you want to change the size of the maximum number of transactions that the request pool, this in-memory pool that I mentioned that contains the transactions, if you want to change the size, you will need to restart the node. Unless, of course, we or someone else implements the dynamic reconfiguration of the request pool as well. Something extremely important is that you need to be very careful when you do a reconfiguration transaction. Why? If you do a reconfiguration transaction and as a result, your reconfiguration doesn't make any sense. For example, I don't know, if you put a request forward timeout one millisecond and like extremely sensitive, extremely low timeouts, then what would happen is that you will lose consensus.  The nodes will start doing leader changes and it will never end. You cannot undo the reconfiguration because to undo the reconfiguration, you would need to send a configuration transaction, but in order for it to be applied, you need consensus. Be very careful when you actually do these reconfiguration changes. What I recommend is scripting it and automating it, that everything will be automated or scripted to eliminate any possible human error. Another thing that you might see, you might notice is that in no place here, we mention F. Like F is the assumption of how many nodes can fail. The reason is, like the whole idea behind Smart BFT is that it should make it as easy as possible for the person to use it. F is computed implicitly from N. If you have 10 nodes in your deployment, then F is three. If you have nine nodes, then F is two. There's a question. In Raft, there was a limitation of adding orders one at a time. What is the limitation for BFT besides losing quorum? Good question. This limitation no longer exists in... Sorry. I got confused for a second about some other limitation. Let me put it this way. You should only do one config at a time. Not because of the Raft limitation. Just because of the fact that you want to take it slow. When you add a new node, actually, I'm looking in the next slide, but when you add a new node, you want to make sure that this node replicates the blocks and then only then to actually add this node. Let me just jump to the new slide. When you add a new node, you first need to give it the config block through the channel participation API. You make sure that this node replicates all the blocks and all the afterwards, you actually add it to the channel, meaning to the config ticks. Why? Because otherwise, if you do it in the other order, in the opposite order, if you first add it to the channel and only then actually give it the config block, imagine that you are running in a blockchain that has two million blocks, I don't know, ten million blocks in it. It will take a while for this node to catch up. During the time that this node catches up, it cannot participate in BFT. Essentially, what you're doing is you have now one extra node, but this extra node doesn't add your resiliency. It doesn't add you availability because this node cannot replace a failed node. That is why I recommend doing it once a time. There was a problem in Raft. The way that we did config changes in Raft was not atomic because in Raft, the way that it broke is we did a Raft grid on the fabric block and then it issued a transaction of a Raft reconfiguration transaction. It was not atomic. In BFT, it is atomic. The problem that I think maybe you mentioned before, sorry, the problem I think you mentioned doesn't exist in BFT, but nevertheless, please only do it one node at a time. Don't try to add two nodes one after another. It might end bad, that's all. But theoretically, it's possible. Just don't try this. The last thing I want to say is the current status of this whole effort. Smart BFT is part of the Fabric v3.0 preview. It is not GA yet. So officially, you should not use it for production, but in my opinion, it is pretty stable that you can start like testing it, playing with it. We have public samples that you can play. We have test network and the test network on a bash. You can play with them. I tried. It actually works. Things left that are still in progress. First of all, this block on reservation mechanism that I mentioned before, this is still in progress. I expected actually most of the code is already there. It's waiting for a code review. I expect it to be merged pretty soon. Other things that we're looking on are performance enhancements. For example, the current batching mechanism, Smart BFT is very inefficient. We have a new implementation of the batching mechanism. We just need to finish integrating it. Of course, for it to be production, we need better test coverage and to do some more comprehensive system testing. So there is a question here. Does BFT also support data recovery and restoration and any limitations associated with it? I'm not sure what you mean by data recovery, but let's put it this way. If you back up, okay. So that's a good question. So in BFT, specifically in Smart BFT, I can only talk about this specific implementation. In Smart BFT, the content of the file system should be identical across all nodes. So what is this content? So, as I said before, the state of the protocol resides inside a fabric block. So each fabric block contains a snapshot of the state, except in some cases, when you have a view change, like you want to change leaders, then we write this view change into the right headlock. Why? Well, obviously, if we're doing a view change, there is no consensus because the leader is dead. So we write this into the right headlock, but this right is deterministic. So it should be uniform across all the other nodes. So theoretically, if you take this right headlock and the fabric ledger, you can use it to restore from a backup. I hope this answers your question. So data recovery, like if the blockchain and ordering service goes down at the same time because of this server, yeah, yeah, yeah. So, yeah, okay, good question.  It should support it because we actually write the decisions into the right headlock. This is, in my opinion, this question is like, this is part of the system testing that anyone should do before going to production. Yeah, it's a good question. Any other questions? Because I finished from my side, from my end. Any considerations on ordering leader election getting stuck? Yeah, sorry. Oh, actually, that's a good point. I wanted to show, so this is performance analysis that we did long ago when we submitted the paper. So in a local area network, the throughput we had is like two and a half, two and a half thousand transactions per second. In a wider network deployed all across the globe, we got like 1,000. So regarding the question, any considerations on ordering leader election getting stuck? So the leader election in BFT is round robin based. So the way it works is that you try to move to the next leader and if you fail to do that within a timeout, then like you try to move to the leader after. So it can get stuck maybe if you don't have connectivity at all between all of the nodes, right? Like if the network is completely down, you will have a view change after a view change after a view change. Eventually, the network should stabilize and then you will be able to elect some leader in some future view. Another question is, can you run separate consenter sets using Raft and some smart BFT for different channels? That's a good question. I can tell you that no, but the reason is not the reason you expect. I think that no because, okay, so the thing is it's actually mentioned in the RFCs. The communication framework that is used in Raft is currently different than the communication framework used in smart BFT. I think in the code we only initialize one of them. So you won't be able to run a channel of Raft and the channel of BFT. But you know, I mean, you can like if it's important enough, if you have an important use case, this is an operations project. So I invite you to contribute. I didn't look to deepen into the code, but the way I remember the code, it is not that far fetched to implement something like that. If you really want, I invite you to contribute to the upstream. And then, I mean, this is open source, right? So the way you do open sources, if you have use case, you are free to contribute your patch, your pull request. And if it's good enough, then other people can benefit from it. Is there a limit of the number of nodes you can run in smart BFT? I don't think there is a theoretical limit, but there is a practical limit. The thing is that in a single leader of other protocols, like smart BFT, like PBFT, the leader node is doing the heavy lifting in terms of broadcasting the transaction. So imagine if you have 100 nodes and you're trying to broadcast the transaction, sorry, a block, and the block is one is, I don't know, suppose 10 megabytes. It's a lot, but let's say the block is 10 megabytes and you have 100 nodes. So the leader would need a bandwidth of one gigabyte, I mean, one gigabyte per second, right? So it's like eight gigabit per second. It's a lot. That is why you cannot actually empirically run too many nodes with smart BFT. However, I can say that in my group, we are actually working on more scalable consensus protocols where the network load is more evenly distributed between the nodes, and these protocols are, in their nature, they're more scalable, so you can run more nodes. Yes. Any other questions? Okay, thanks. Going to ask about the mechanisms to prevent front running and if there were any use cases that you stumbled upon, were you able to solve that issue? Yeah, okay. So good question. So I would say two things. First of all, smart BFT itself does not provide any front running protection. The reason is simply we didn't have the need to implement it. What I know from the literature, the way you do front running provision is usually either you use some kind of threshold encryption scheme, right?  Yeah, definitely. I mean, it's not different, but I mean, one way of implementing it is using the computational if you have an assumption, right? So yeah, so usually you would have this threshold decryption protocol by the nodes. Another way you can do is you can use up secret sharing. It may be like you can encrypt your transaction with a symmetric encryption key, a secret share of the symmetric encryption key between the nodes, then they reconstruct the key and decrypt. That's one way of doing front running. Another way is doing like a commit reveal scheme, right? So there are all kinds of ways. We just didn't have a use case for that, but I don't know. Again, I mean, this project is open source. You can fork this project and implement it and add the implementation. If the community will see that your implementation is robust enough, good enough, maybe you will get it... What about something like smart order book routing? Again, smart order what? Smart routing for order books. Smart running for... Order books for like an exchange. Like when you have like a market making mechanism and you have the market maker and like if you have like web sockets pulling all the pricing data from the different exchanges and then the market maker that's ultimately making the decisions and then the front running mechanism which would be able to have like the proper oracles to understand like if it's a bad like what to do. That makes sense. I'm sorry. No, I understand. As I said, we don't have any kind of front running protection. It's also not in the roadmap. So I said, as I mentioned, if someone wants to implement like sorry, if someone wants to fork the project to incorporate front running protection and then to contribute upstream, it's possible. I'm not saying that I'm not against it. It's just not implemented. There is another question. Any thoughts on paralyzing leaders in smart BFT like in near BFT? So that's a good question. I can say the following thing. We are currently working on some new BFT protocol that also has something like this. But however, paralyzing leaders in general paralyzing block creations, it sounds very good in theory, but to implement it correctly with dynamic configuration changes, it's not very trivial. So I mean this project, this smart BFT project, its goal was to be to be used in production, in actual production system. Therefore, as I said, it is an engineering project. So the focus here is engineering stability and correctness. Of course, you can also have eventually a production ready mirror or mirror like protocol. Of course, I'm not saying you can't.  Any other questions? Can you share the slides? Yeah. So I will send the slides to Dave after this talk ends and he will show the slides. I am not flying the Pegasus though. Okay. I think that's enough. If anyone has any other additional question or wants to contact me, just google my name, you can reach me on either Github, LinkedIn. I'm also sometimes on Discord. My name is Yakov M. So you can also find me there. Dave, are you there? Sorry, Yakov, I've been on another call. I haven't been able to listen into the last part. Are we all set? Yeah, I mean we're done. Okay, great. Well, thanks for your time today and thanks everyone. I will send the link to the recording and the slides to everybody. So look for that in your email and thanks. Sure. Thanks for having me. Bye-bye. Bye, everyone.


Tony's just shouting over me as he should. This is your show. This is what happens when you let people drink in between events, it gets raucous. So welcome to the formal ceremony in which we will dedicate the professor Anthony J. Santoro classroom. I did some welcomes earlier, but I want to welcome, give a special welcome to Anita Barr, who is here. Anita is the wife of our first associate dean, Gary Barr and a dear friend of Tony Ann Pauline. She's been a great supporter of the law school and of a memorial scholarship that she established here in Gary's name, so Anita, it's great to see you. So I guess we all knew this day was coming at some point, but I have to say it sort of snuck up on me. It doesn't seem like 25 years ago that I first met Tony for an interview in Washington where he used his superpowers to see in me what approximately 180 other law schools could not. From there, things sort of went downhill for a little while. Between that interview and arriving here for our first faculty meeting, I went to a retreat that was organized and hosted by Bruce Cogan and while there, I almost killed Bruce and Jamie's dog. And for those of you who know them, you know that was a very bad thing. The only bigger sin I think I could commit would have been to scratch one of Bruce's cars or something like that, but I was not off to a great start. And then when I arrived to go to my first real faculty meeting where I would have the right to vote and carry on and object and be obstreperous as faculty occasionally do, Tony quit. And which to me, and maybe I was out of the loop, was both unexpected and somewhat unsettling. But he quit to become president of the university which was a good thing. And he was succeeded as dean, as you might imagine, he had someone in the wings waiting to be approved by the faculty who helped finish the job of getting accreditation for the law school in the shortest possible time. During his presidential years, we had less contact, but one interaction stands out. As many of you know, the opening of the law school corresponded with the resignation in October of 1993, not of Tony, but this time of the Chief Justice of the Rhode Island Supreme Court who was facing impeachment proceedings and criminal charges. And this was unfortunate, especially because his predecessor had also been forced to resign under a cloud just a few years before. So long story short, I had been asked by Common Cause Rhode Island to participate in a judicial reform movement and was about to write an op-ed that was critical of the status quo and the defenders of the status quo. And I was years from tenure and it dawned on me to ask Tony to meet with me so I could get his advice about whether I should take this on. He quickly agreed to see me, he listened to me, he did not hesitate, and he quickly said that's one of the reasons the law school is here by all means you have my support to what you think is best. And judicial selection became one of my long-lasting academic passions, but more importantly, Tony showed me that day what it meant to stand up for academic freedom, which is not an easy thing to do when an institution is in its infancy, when it's trying to establish roots in unfamiliar terrain and where it's trying to win over not an insubstantial number of skeptics. So I could go on and on. Tony created the institution that has become my professional home and Rhode Island has become my personal home. I was not comfortable saying this for a long time, but I am now out loud. My children are Rhode Islanders. So I will always have a personal affection for Tony and for his work, but I wanna say just a couple more things about Tony's character, about the things about Tony that bring us all here tonight. Before I became dean, I was for a time the associate dean for academic affairs, the chief cat herder. And Tony always said the same thing to me, and I think my predecessors and successors have had this experience. Whenever I asked him about his teaching schedule, he said, I'll teach whatever you need. I'll teach it whenever you need it. Just tell me what's best for you. And I'm not kidding. He always said that. And I can say with complete confidence that I never heard even a similar conversation, had a similar conversation with another one of my colleagues. So we know that Tony is generous, and we know that he is humble. Second, despite my many faults and despite the fact that I've been nominally in charge of his law school for over three years, he has never once done anything but support me. And I know he's there if I need him, but he has never inserted himself. He is gracious and he is graceful. And finally, not for nothing, look at where his law school is today. We have successful alumni from across the country, people who came here as students with a dream who are now pursuing it. Just this week I was in the chambers of Judge Roger E. Thompson in the First Circuit and I was visiting three of our alumni who are clerking for Judge Thompson. And each one of them had previously clerked for a member of the Rhode Island Supreme Court. We have become Rhode Island's law school, which creates unparalleled opportunities for our students. We take this for granted here now, but also this week the Esther Clark Moot Court competition was held in the chamber of the Rhode Island Supreme Court and our students argued before the court. The following evening in Providence we had a mentoring reception that was sponsored by two of our student groups, the Multicultural Law Students Association and the Alliance, which is our LGBTQ student organization. And there were almost 70 students, alumni, judges, non-RWU lawyers there to connect. This is a remarkable community that Tony has created. He had the vision, he had the talent and he had the energy to make this happen. So put simply, I think nobody has done more for this law school than Tony Santoro. Nobody, full stop, as they say. And dedicating that classroom in his honor, the classroom where he used to teach tax to a full house at 8.30 in the morning when he was president, seems like the least that we can do. So Tony, thank you for everything. And it's now my pleasure to welcome to the podium my longtime colleague, professor, dean, twice interim dean and live to tell the tale, Bruce Covell. So looking around the room, I see Tony's family and I see friends and I see students and colleagues. And other than his family and Anita, I think I probably know Tony the longest of anybody in the room other than family and Anita. I met Tony 35 years ago, probably this week or close to it when he came to interview for the deanship at what was then the Delaware Law School of Widener University now Widener University School of Law Delaware where I was already a new faculty member and so that was 35 years ago. And it was a wise decision that my colleagues and I made at Widener to hire Tony as our dean because he proceeded for the next 10 years to lead that school in its upward trajectory. And it was 25 years ago, probably again this week when Tony who was already in Rhode Island doing the preparatory work for the starting of this law school called me up and said, you ought to come up here and take a look at what we're trying to do up here. I think this might be a good fit for you. I came up and I'm very glad that Tony made that call and asked me to come up here because it gave me an opportunity to continue working with a colleague who I love and respect and admire. Tony has had a marvelous career in law teaching, marvelous, almost 50 years of law teaching. He has taught I think at, I was gonna say, every law school in the country but that's not true. Then I should say he started as dean at every law school in the country but Tony has taught at probably six I think law schools and has been involved in founding at least four law schools in addition to having been the consultant at many other, probably dozens of law schools and colleges and universities have sought his guidance as they prepare to either start a law school or start new programs. But one of my best recollections of Tony is because his first year as dean at Widener was 1983 and he taught tax which I taught because like Tony I have an LLM in tax from Georgetown and I was teaching tax back in the day before I got my mind straight and stopped teaching tax and Tony was teaching I think it was business tax and business planning, one or the others in the fall of 1983 and I was teaching fed tax and probably estate and gift tax or estate planning something like that and I asked Tony if I could come in and watch him teach. I was in my second year of full time teaching although I had taught as an adjunct for a little while before that and Tony was then a good dozen or more years into teaching maybe 15 years into law teaching and watching Tony teach that class in a pretty big and it was very highly tiered classroom that we had at Widener, the big one, was a pleasure just watching somebody who was clearly a gifted law teacher and at his core, at least what I've known over the last 35 years, Tony is a great law teacher. He's done a lot of other things. He's been involved with a lot of other organizations, a lot of community work. He has chaired the Rhode Island Student Loan Authority for a long, had done that for a long time. He created the MCLE system for Rhode Island out of whole cloth and I've been serving on the commission ever since he put me on the commission and that's a long time ago, 27, 24 years ago. And he wisely married the beautiful Pauline plant and has four beautiful children who I remember growing up as little kids, Lynn and AJ and Lauren and Annie. I remember following them as they progressed along. But at his core, he's a great law teacher who chose to teach tax and business law, not an easy choice. None of what we teach is easy to teach but that's clearly kind of like, if teaching law is like monopoly, then teaching tax law is like risk. It's like a much more complicated game set and that was a tough choice. Tony's students you can see from today's panel discussion adore him and for good reason. He is still, after almost five decades, excited when he walks into class. He is still trying to figure out the next best way to get students to be just as excited about reorganizations and mergers and distributable net income and all of that. And that is absolutely infectious. So he has inspired generations of people who have gone on to contribute in many, many ways to their communities and to their clients. Among his colleagues, he has been the best friend we could have for the law school while he was the president of this law school and he has been a terrific friend to me over all of these years. But it is a teacher. He is an exemplary law teacher who embodies a teaching philosophy that I've done a little bit of reading about over the years from a guy named Parker Palmer who has a book out, the title of which is You Teach Who You Are, Not What You Know. And Tony has always done that. He has always demonstrated to his students his core value of wanting them to be as excited about the work and as excited about becoming the best lawyer they can be. So I joined Michael and I'm sure all of the rest of us in saying thank you to Tony for what he has done for this law school on the dedication of the professor Anthony J. Santoro classroom. And I think it's appropriate that we recognize this man of substance who has definitely affected in the most positive way all of the rest of us. So I now will introduce my colleague, Louise Tites. I am honored to share this occasion. Notice that I carefully said I am honored. I am not happy. I, like many of my colleagues including Emily Sack, really are not happy that you're leaving Tony and we are hoping that you will drive Pauline crazy and she will banish you back to the law school. So there's still that hope. I want to talk about Tony Santoro, my boss, my colleague, my mentor, and my friend. I've now known Tony only for a quarter of a century but that sounds like a long time. I met Tony in July of 1992 right after he had become dean of Rhode Island's first law school. I am from Rhode Island. I'm from Newport and I was home from Illinois for a family event and I arranged to meet Tony. Tony, who I learned about from colleagues elsewhere, either was loved or hated. There was no middle ground. Tony, whom I dean at Illinois referred to as the Johnny Appleseed of law schools. Tony and I talked about Roger Williams and his vision and I was really excited to be part of Rhode Island's first law school since I remembered as a child when even Brown had talked about one but they never did it. We also commiserated about what it was like or in my case would be like to move back home as grown adults and live with one's mother. His was a typical Italian mother. Mine was a typical Jewish mother and I can assure you there is a great overlap of traits, especially that one called guilt. In the same conversation, by the way, he asked me, so how are you going to handle it when all these people that call you and want you to use pull Rhode Islanders to get into the law school and these are all going to be friends of my first cousin at the time who was a big Rhode Island Politico. In fact, he helped indict the first, or rather impeach the first judge, Bella Lacqua. And I said, well, I don't think I know people and he said, you'll never be on the admissions committee. That will solve it. And I have to say in almost 25 years that is the only committee I have never served on. So my mother, by the way, adored Tony. He walked on water because he could do no wrong because he was the person who got me to come back to Rhode Island and rightfully so. So I signed up and my former dean at Illinois warned me and said, you know, this is Johnny Appleseed. Tony might come and, you know, plant a few seeds and move on in five years and I thought, nah, Tony is coming home to Fall River. Pauline is coming home to Tiverton and I'm coming home to Newport. So I figured that he wouldn't just pack up and leave. And of course, my former dean wasn't totally off base because as Michael told you, at our first faculty meeting he said, I'm leaving, the smoke has risen from the chimney, the white smoke, and I'm about to be, and I being a nice Jewish girl didn't know the reference. Somebody had to explain it to me that this was the Pope. Then he was going to go across campus and he said that we would get an opportunity to choose the dean the next time but he was bringing in someone to get the job done temporarily and five years later we did get to choose our dean. Tony, my colleague, so Tony taught the basic tax course as you heard every year to our students even while he was president and chancellor. He'd teach early and he would leave early and I would stalk his parking space. And yes, parking was a problem even then after year two and I'd wait while he had his cigarette and occasionally he'd have two but I was totally thrilled when he came back after being president and chancellor and I was finally able to have him as my colleague which I had expected on day one until we got that surprise. I'm not going to say anything about his teaching because everybody else has said it and the fact that so many of his former students come back and are here and that in itself I think is a testament to his teaching and his ability to inspire passion for learning in all things tax. I mean that is not something that I could ever get passionate about. As a colleague you always knew where Tony stood if he didn't agree he would tell you and he would tell you to his face, to your face rather rather than talking about it to somebody else. I respected his and do respect his honesty and candidness traits that are increasingly in short supply. And as the years have gone on Tony and I have commiserated about changes in the legal education field in the new generation in technology and Jim Galib knows this. Tony and I as fellow Luddites are about as flustered by technology as we can be and once you leave I'm going to be the only one. So this is not good at least now they say oh yes Tony was down yesterday with this problem. Tony my mentor. Tony has been my mentor and he's been a mentor to most of my colleagues through the years. A mentor with whom you can share confidences and ask advice and you know that it will never go outside of his office. In fact he was the person I confided in and asked for advice when I was offered the appointment in the Hague. Tony also can be brutally honest. He will say I think you're crazy to do this. He said that to me earlier this week but he will also offer support and advice once you've managed to create a mess because he didn't listen to his advice the first time and he never says I told you so. And finally I guess the best of all Tony and Pauline are my friends. We've shared happy times and we've shared losses of colleagues like Gary and Esther but we are all a family. In fact I think that really is what Tony has created a Roger Williams family and it is impressive how Tony when he was president knew everyone. You heard one of his former students say that when she was an undergraduate he knew her name but he knew everyone at Roger Williams. He knew everybody who worked here who their kids were how their families were doing and he'd always asked that and so sort of the one story that to me captures who Tony is. One day I stopped by the dean's office to talk to Bruce it was in one of his interim periods and the office was being painted and Tony was asking the worker who was painting it so how's the family? And this seemed like a normal question he might ask any of the Roger Williams employees his Roger Williams family. So I was totally surprised when Tony turned to me and said oh you know AJ my son, right? Tony treated those he worked with and those who worked for him with the respect and care that he showed his own son and his family. He started with a small family here at Roger Williams and we've grown over the 25 years. The campus that you could cover in a 10 minute stroll in 1993 has become a university that now takes at least 30 minutes to cross or more. I probably walk much slower than I did in 93 too but I guess the apple seeds that you put down have grown strong roots that many have built on so we will miss you Tony. And now Tucker Wright from across the campus? Again it's an honor to be asked to speak here today and I've known Tony for 25 years let me tell you how it came about and I was proud and privileged to have a little something to do with setting up the law school. Number years ago I was having coffee with President Sikharo from the university and he was talking about how he created a medical school where he was before and I said to him you know we don't have a law school in Rhode Island and his eyes opened up. And at the time we had a paralegal program a criminal justice program under graduate so he said what do you do? I said well what you have to do is form a feasibility study with the American Bar Association and I said let me give you an idea called Justice Weisberger and thankfully Justice Weisberger agreed to share the committee. I was on the feasibility committee it met for close to two years right at the beginning Tony was recommended to be the consultant on the committee and we worked diligently we met many times we had about a 12 or 13 member committee and he put together an excellent report based on the findings that we came up with and we had to meet with the Supreme Court of Rhode Island to give the presentation and it was at that meeting that Ralph Papito was there. Now I know poor Ralph had his problems but believe me he was a driving force of this law school and I said to him where is the money going to come from? He said don't worry about the money you people get this approved by the Supreme Court and we'll go and he got together with his financial consultant Mr. Gabelli down in New York and somehow or other came up with the money and built this building within budget on time right and then you know they had decided to go ahead with the law school so now they were seeking a dean and I asked President Sarkoort I said did Tony Santel apply? and he said no so I called him I don't know if you remember this and I had done some research and realized they were from around here and I said Tony it's time you came home and of course Humble Pie said well I shouldn't really apply because I was a consultant I said that doesn't matter so he applied and that was history and you know the especially Justice Weisberg he did a great job in helping put the whole situation together the advisory committee was a little interesting too we had a couple of developers on the committee trying to build a law school up in a mill up in Providence so we had to bring the ABA down you should build it on campus which fortunately happened so the as far as the because Tony agreed to be here from law school and we've had enough comments about his teaching abilities and experience where the panel was here today the quality of the students that went through your classroom I must say that I finally got the best compliment best compliment in my life one day we're having lunch with one of his one of the admissions lady and he introduced to me he said this is Tucker Wright he's the father of the law school I you are the father of the law school okay and so that's the end of my remarks I'd like to introduce President Farage from the university well I have to confess that until today I've actually never met Anthony this is my first time in meeting my predecessor so that's not true but the point is we've had people talking about Tony Santoro for 25 years or 35 years I've only known him since the time that I arrived but I want to talk about him in a different context in his role as the president of this university you heard the story that back in 92 he was offered the job of dean and it took him only just a few months apparently to impress the powers that be that he was being wasted as a dean the president of the university and he did that for the between 93 and 2000 and then he was actually the chancellor of the university for a year he may have been the only chancellor I don't think that title has been used again so he's the first and the retiring chancellor of the university but what was really quite remarkable in addition to the fact that he founded the law school and all the work that was involved in making that happen he had quite a remarkable career as a president of this university and one of the things that presidents when they come to universities always wanted to scout out first is how many retired presidents are still hanging around the neighborhood my last job I had two and that was it took a little extra work to watch where they were at any given moment but on this university just one and the issue there is is the president still acting like he's pretty much still the president and that makes life a little difficult that is not who Tony Santoro is and I think you could assume that to be true if you know him at all he's been nothing but gracious and helpful a few times that I've wanted to speak with him about some issues that were historic in nature that I just need to get a little bit of understanding of he was right there offered any hint of criticism or anything that would sound like well I would have done it differently that's just not in his nature and I can't tell you how much I appreciated that Tony because it's a tough enough job coming in as a new president where you're inheriting a culture and a whole bunch of folks who are pretty comfortable with each other but stepping aside as you did was just made my life a whole lot easier Tony himself as the president as I look at what his accomplishments were and I should tell you this story I was at URI for four years between the years 1979 and 83 and my brother-in-law at the time actually graduated from Roger Williams and I remembered as being a very small place which was true in 1983 so coming back and seeing it in 2011 I was taken back by how much it had grown and some of you know I'm a lawyer myself or at least I went to law school and passed the bar I wouldn't really call myself a lawyer and I would always assume that I would be at a school that had a law school and I never was until I came back to Roger Williams and because of Tony Centaro I finally got to be at a place that has a law school of course by now I'd forgotten everything I ever knew about law but at least symbolically it was important but the decision to start a law school I think changed the trajectory of this institution but it wasn't enough for Tony just to do that and hope for the best think of the things that he did while he was here the Feinstein school of arts and sciences college of arts and sciences came into being the Gebelli school was renamed for Mr. Gebelli he started the honors program and we started bringing in international students there was a tremendous growth of the undergraduate population he began the first graduate program he acquired the metro center in downtown Providence which was an interesting way of kind of returning to our roots because that's where the school began back in 1956 and that metro center we've since transformed into not the same building but the whole idea of being at Providence campus manifest with our one empire Plaza building which is an even larger version of how we're interfacing with the population of urban Rhode Island my point is that presidents leave behind tangible legacies and ideally what happens is they're built in such a way that they become a foundation for the next president so that we're not tearing things down in order to build we're building on top of what was there and I'll say that the work that Tony Santoro did as president created an enormously strong foundation for this university so while I've had the pleasure of adding to the work that he did it certainly wasn't in substitution for and I think what happens as a consequence universities just get stronger and better so I want to thank you for having started that work Tony I think you as much as anybody built the university not just the law school but built the university that we are here celebrating today lots of help of course but the leadership came from you and the vision came from you and the idea that this place had something singular to offer I think is very much again a continuing part of your legacy I'm going to tell a little story about Tony he would probably tell it himself but you'll thank me for telling because I'll be shorter than he will and so I know him that well it's always a pleasure hearing Tony he's a wonderful Rockland tour but the story is that when he was down at Weidner Law School a telephone call came in and the secretary came to him and said Tony your ship has come in Malcolm Forbes is on the phone Tony said Malcolm Forbes this is remarkable for two reasons one is I didn't even know that he knew that I existed and the second is he's dead so there was that issue well it turns out as luck would have it there was another Malcolm Forbes he just happened to be the provost at Roger Williams University offering Tony a job and this was an enormous let down that it wasn't the other Malcolm Forbes but as a consolation prize he agreed to take the job and so Tony it may be that your ship didn't come in when Malcolm Forbes called but our ship did when you said thanks I'll take the job and come up to Roger Williams thank you so much for all the work that you're done and now a graduate from the first law school class and currently a member of our law school board of directors Steve McGuire I'm going to channel Mr. Coughlin from the first group and say I'm a little freaked out right now I've been around the law school for a long time and holy smokes the panel that was here today the list of speakers that just went and kind of feel like I snuck in thank you to for this opportunity I was a little heartened when I sat next to President Faris and he also had notes but show off that he left them on the desk so so I have my notes and I remember giving my mother grief when I was 22 years old and I had just come home from an epic summer in California living with some cousins and an aunt and uncle that I really didn't know I told my mother how can you let 20 years go by and you only saw your sister a couple of times I only met these guys a few times how do you do that you know and looked at you like your mother looks at you and says it goes by fast and you don't even know what's happening you'll see so here we are 24 years in two months after a hot blue sky day in August that seems like yesterday I was coming down Metacom Avenue listening to President Santoro talking to Arlene Violet on the radio about this new law school how exciting it was that they were finally coming students finally coming you know and it was about two weeks after that I brought a visual aid but I left it on the desk you can see it later we had a picnic in a softball game and it's on the cover of the Rhode Island what was it the journals Rhode Islander magazine if you see in the picture there's no grass in front of the school yet even we were in the building but there was still no grass no trees or anything and I was there with my mother my father and my wife who was my girlfriend at the time and we were walking up to the building and out comes President Santoro and I guess he was Dean Santoro still at that point it was probably two days before he quit so but he came out and he walked down the the cement paths were finally cement they weren't planks anymore and he walked down the cement path and he gave one of his very dramatic hey Steve how you doing and he chatted with us for a minute I introduced my parents and then down the hill he went to the next group to say hello and my wife Laura says Dean? maybe maybe it was Professor Worf who was just with us who went in the same door that he came out I don't know but the point is he made you feel special made you feel welcome I was one of the non-traditional students in that first class there were a bunch of us I turned 30 during my first set of exams and there were differences certainly between the non-traditional students and the traditional students that were there and young students old students and I remember one lady a couple of weeks into the classes she was in her late 50s and she was amazed, she loved the place she said just think two weeks ago the only thing I had to worry about was am I going to play bridge or golf but by the time the second year I rolled around young and old traditional non-traditional we could agree on one core principle and that was 8 o'clock in the morning is a god-awful time to try to learn tax law but when you're the president and you still fashion yourself a professor and you want to teach tax that's when you do it tax was never going to be my thing whether it was 8 in the morning or 8 at night it was never going to be my thing and in fact as great as he is really the only thing I ever learned from President Santoro is that you have to keep a dirty office he said it during one of his introductions here you have to have a dirty office a place where you can actually do your work and you don't have to clean up after yourself and I heard that you might be able to sneak a cigarette in there once in a while I enjoyed his class even though it was tax the way I enjoyed property even though it was property because of the teacher he was a great person a great storyteller a great success obviously and between him and Dean Huber they could tell stories that made even tax law even property bearable so mostly both of them were very good at and they're still good at name dropping and the names they most often drop are the folks that were sitting at the table today he always talked about his students I've been hanging around the law school a long time maybe because I'm afraid they won't let me back in if I stop coming now here I think it's that that inspires people like Brian Ali who was the instigator for this lecture series and the folks that were here today there is an actual reverence sort of for Professor Santoro everyone knows the history of the place we've heard some of it if you were here in the beginning you've heard Mr. Papito tell you the history of it several times you know and maybe four or five times I've heard the history and even Jack Palin doing push-ups couldn't shorten the history sometimes but it's a good history and it's a great history and you know it's a tremendous credit to both President Santoro and Mr. Papito that the school is even here because it was just a crazy idea for a long time if you live in Rhode Island you know it was just a crazy idea for a long time you heard that it was going to happen it wasn't going to happen PC was going to do it Brown was going to do it and then we did it so and if you've been around you know his history and this is the fourth one that he's been involved in and obviously I think he did a good job at those other places but he saved his best work you know for us um so today's you know time for recognition finally for I've been here a long time like the proverbial Bad Penny shoe which means I've eaten a lot of fancy snacks and even a lobster once with President Santoro and many of the other great people here Dean Logan Dean Logan, Dean Kogan Professor Tites and Mike Yanoski and if you see the picture later I'm the only one who still looks the same so so so anyway it was interesting to hear all of the coming home parts of this story and because it's Rhode Island you know at all of these different events and the best two events that I've gotten to attend are the last two commencements where Dean Kogan and President Santoro finally got a diploma from here and I got to meet both of their families and because it's Rhode Island I worked with somebody who works with his daughter and it's just been so great to see them both have a chance to pat each other on the back for all the hard work that they did and the great work that they did and I think it's a tribute to their friendship the depth of their commitment to each other that I caught Mrs. Santoro weeping on the side of the tent as her husband was telling Bruce Kogan stories last year so as my mom said it goes by fast and you don't even know it so I interviewed President Santoro for an article I wrote for the alumni magazine in honor of the 10th anniversary of the school which apparently was 14 years ago and here's what we said back then people who know him thought he was crazy when they learned that the law school's founding dean and president Anthony J. Santoro was planning to retire and take on the comparatively sedentary life of a tax law professor everybody said I would hate it he said that I wouldn't have enough to do but not only do I have plenty to do, I don't have any time to do it if I may be so bold I'm going to try to teach you something about the three R's and I'll do it in the form of an equation so maybe you can understand this time retirement equals rest plus relaxation it's a prize not a punishment so today is payday not only for him but for me as one of the 3,160 graduates because I get to do what I always wanted to do and publicly say thank you I give you President Santoro Professor Santoro, Dean Santoro please sit down thank you very much I really I came prepared with a history of the law school I thought I would be spending some time here but I don't think I'm going to use it and I don't think I will take very much of your time this has been a very long program and one that I have enjoyed very very much they all lied of course but I appreciate that seriously I do want to take this opportunity to express my appreciation for all the speakers for all of the very kind things that they said and while I will accept their accolades and I do very much appreciate Dr. Farrish Board of Trustees of the University and the Board of Directors of the Law School were naming the classroom after me or in my honor in fact it was my favorite classroom in those 8 o'clock 830 meetings I just enjoyed that classroom but the reality of all of this is that what was accomplished was actually accomplished by a whole bunch of people we would not have the law school were it not for the vision of the Board of Trustees we wouldn't have a law school were it not for the efforts of some very good friends of the University who formed three advisory committees remember Tucker three advisory committees to advise the University as to whether or not the law school should be established one of those of course was chaired by then Justice Weisberger and they put enormous hours in it's also true that we would not have had the right to grant a degree if it weren't for the Rhode Island Board of Higher Education stepping in thanks to the then Chairman Judge Leach and of course it's also a tiny band of faculty that came together to put together a library, a curriculum and things of that sort three of them are still here Dean Kogan Professor Tites and of course Dean Elnowski but they're getting rid of me apparently so I don't know and there were as a matter of fact others that joined us and we remember them fondly they've passed on Dean Gary Barr our first academic associate dean was mentioned Dick Huber the former dean at Boston College came in to help us and Ray Gallagher my former professor at Georgetown Law School came in to help us and we remember them fondly and played an important role in what we do or what we started but then of course there was Steve McGuire and a hearty band of law students who came and took the plunge at an unaccredited law school but we succeeded we got the accreditation I have to correct a few things though I wasn't dean when you came in you made president you had no dean I I also have to Louise Tites probably disclosed this deep secret that I have held the only reason I took the job as president and gave up the job as dean is I could move out of my mother's house I knew the president had a house so I took it and in any event I was going to talk to you about Malcolm Ford but Dr. Farrish took that over for me he says not much I can do about that but it is a true story I have had a great deal of time to this semester at least to think about retirement I've been cleaning out my office sort of separating out my books and cleaning out my files and sending old files to various people people have told me what I'm going to do in retirement I should take up golf I should take up photography I should plant a garden I should mow the lawn things that I've tried to avoid for 75 years they want me to do now and what is this rest and relaxation every time someone talked to me about retirement I'm going to tell you one single story about Justice Holmes that I remember reading about years and years and years ago Justice Oliver Wendell Holmes as you know was a Justice of the Supreme Court and acting Chief Justice for a while as well but he was on the bench until his late 80s or even 90 maybe but apparently one day when he was pretty old the train at Union Station in Washington headed north as soon as he got on the train he went to the parlor car he took off his coat he took off his jacket he sat down he pulled some papers out from his briefcase and he started pouring over these papers he was obviously engrossed in his work the conductor recognizing Justice Holmes didn't really want to bother him to get Justice Holmes's ticket so he waited a while but then he decided to interrupt and he said excuse me your honor but may I please have your ticket well Holmes fished into his jacket pocket his coat pocket his vest pocket he opened up his briefcase couldn't find it at all and the conductor recognizing that Justice Holmes was getting stressed out decided to say don't worry about it Justice Holmes as a practical matter when you sign it just send it into the main office whereupon Justice Holmes stood up glared at the conductor and said you don't I don't give a damn about your ticket I just want to know where I'm going and that's the way I feel like now I want to know where I'm going in two weeks I will be 50 years at the bar 47 years as a academic as Bruce pointed out 46 years as a husband now I don't know what's going to happen to me in the future I'm not taking up golf I'm not taking up photography but I do have one big fear after the university has honored me and naming the classroom and bestowing upon me the rank if you will of president emeritus and professor emeritus I'm deathly afraid that after two months of feeding me breakfast and lunch Pauline's going to make me husband emeritus so look without more I since the son is over the yard arm in any event so maybe we shouldn't go any further but thank you very very much for all of you who have been so instrumental in my having the best time of my life during these last 25 years especially the last few as faculty member I really enjoyed the classroom and I'm so thrilled to have that classroom named after me thank you all appreciate it so please let's continue this celebration we will be moving outside into the atrium for drinks and some food at some point during the next half hour we will cut the ribbon on what is now the Santoro classroom and if anyone is interested at 7.30 or so people will be headed to Aden's so please join us there as well thank you all very much