It really isn't, because if you either don't trust the sender or the shipping company, then your real issue is that the shipment or its contents get stolen, not that the shipping information is wrong.
Once again, crypto is trying to solve problems that don't actually exist while completely failing to address the ones that do.
> then your real issue is that the shipment or its contents get stolen
No, the chain-of-provenance use-case is to prevent people from being able to sell grey-market products while claiming that they're official products. E.g. selling iPhones built out of reconstituted parts from iPhones that were pickpocketed from their owners and then scrapped for parts. (Yes, this is a big issue — Google "my stolen phone ended up in shenzhen" and you'll get a ton of news stories.)
If you (or a retailer) forces the retailer (wholesaler) to provide a chain of digital signatures demonstrating each hand-off of the parts all the way back to the factory that produced them, then you implicitly reject any assemblage of parts where some of the parts were black-market-sourced. Which allows for legitimate refurbishing using legitimately acquired parts (i.e. it doesn't put the Shenzhen phone-repair stores themselves out of business); but destroys the demand for the electronics "chop shops" these stores currently sometimes order parts from.
In this case, a "blockchain" here is an open-public-participation multiparty ledger that tracks ownership of physical goods; with a digital signature inherent to each transfer of the digital asset representing the physical good, which should be done at time of transfer of physical goods. Unlike other use-cases, you really can't simplify the solution — to enable this use-case, you need a system with pretty much all the properties of a blockchain.
This might be simplistic or ignorant - but does the essential core of crypto boil down to having a public trust ledger? Could a use case of crypto (and NFTs) be a replacement for PGP?
This whole signing a physical product to prove it's official kind of sounds like PGP but I only have a 10000 foot view and don't know much about PGP other than you sign stuff and people can cryptographically verify that you actually signed it.
Optional follow-up because I'm curious: how do you actually track that the physical thing wasn't modified or tampered with in practice? Couldn't a bad actor repair a broken RAM chip with their own parts and it would still be officially signed? Or does it rely on the owner invalidating their device, saying their phone is broken, and then all the parts in the phone get flagged as broken?
Doesn’t have to be public (though that’s desirable) but it does have to be accessible by any user to really have value.
So you could have a ledger that was only accessible to… say members/subscribers/users of a service. As long as everyone involved can see it, it serves the purpose.
> does the essential core of crypto boil down to having a public trust ledger?
A blockchain is a public trust ledger that is uncensorable because everyone who wants to can get both a copy of a random sampling of the messages pushed to it (by p2p node gossip of the txpool) and then also a copy of the canonical state (by p2p gossip of the chain-head; the ability of nodes to fetch previous blocks by content-hash; and the ability of all nodes to independently compute block validity and canonicity.) But this uncensorability means that blockchains must solve for the problem of DoS spam attacks, that would seek to fill the chain with noise messages, to the point that it bloats to an impractical-to-store size.
That's why blockchains [that have distributed posting authority, rather than being de-facto centralized "Proof of Authority" systems] always "have" (but not "are") some form of digital money built into them. The digital money is there to be what the old proposals for eliminating email spam called an "eStamp" — a cost for posting your signed messages/transactions that regular users can afford to pay, but spammers cannot.
Without the "eStamps", you just have an unworkable, ever-growing pool of spam noise.
If you choose to eliminate the noise by only keeping the messages that nodes care about store-and-forwarding (such that you lose messages when their originator goes offline, unless at least one other node has accessed them), then rather than a blockchain, you get a system like Freenet.
If you choose to eliminate the noise by combining store-and-forward with TTLs, with push-based probabilistic gossip, then you get the original Usenet numbers groups and SMTP anonymous remailers that presaged blockchains, and were invented by roughly the same group of people (the https://en.wikipedia.org/wiki/Cypherpunk s), being used to anonymously distribute PGP-signed and encrypted payloads in much the same way that blockchains are currently used to anonymously distribute transactions.
> Couldn't a bad actor repair a broken RAM chip with their own parts and it would still be officially signed?
No, because the point is that you get to know who sold them the RAM chips that went into the device, because the RAM chip vendor digitally signed the sale of those chips to them, and their repair job "consumes" that item in their own digital inventory to convert one manifest (representing all the parts in a phone with bad RAM) into another manifest (representing all the parts in a phone with good RAM.) The provenance of the replaced RAM chips "travels within" the provenance of the repaired phone. It's a tree of component sourcing, not just a log of repairs.
> No, because the point is that you get to know who sold them the RAM chips that went into the device, because the RAM chip vendor digitally signed the sale of those chips to them, and their repair job "consumes" that item in their own digital inventory to convert one manifest (representing all the parts in a phone with bad RAM) into another manifest (representing all the parts in a phone with good RAM.) The provenance of the replaced RAM chips "travels within" the provenance of the repaired phone. It's a tree of component sourcing, not just a log of repairs.
Thank you and apologies for all the questions! I'm very fascinated by this but not sure where to start. Is this part of the chain-of-provenance you spoke about?
Also wondering if you have anything helpful to share to learn more. I'm really curious about how the "consume" part works in practice. I was trying to get at a situation where someone fixes the RAM but doesn't update the inventory? Or if you lost your phone, do you have to report it lost to invalidate the manifest? I'm also struggling to imagine what happens when the RAM goes bad? Does that phone with bad RAM get a new signature? How does the phone turn from a phone that works into a phone with bad RAM digitally?
"No, because the point is that you get to know who sold them the RAM chips that went into the device, because the RAM chip vendor digitally signed the sale of those chips to them, and their repair job "consumes" that item in their own digital inventory to convert one manifest (representing all the parts in a phone with bad RAM) into another manifest (representing all the parts in a phone with good RAM.) The provenance of the replaced RAM chips "travels within" the provenance of the repaired phone. It's a tree of component sourcing, not just a log of repairs."
Which they only do if they are already trustworthy. I don't trust them. At any point in the chain, a vendor/manufacturer can put whatever garbage they want on the chain because the chain can't interact with the real world, and for that reason, blockchain solves absolutely nothing in the space of supply-chain management.
Blockchain doesn't solve any of that. It's just coming back to the oracle issue. I still have to trust people putting stuff into the chain, and I don't have any reason to just because you say blockchain.
Once again, crypto is trying to solve problems that don't actually exist while completely failing to address the ones that do.