journalists:-stop-selling-nfts-that-you-don’t-understand-–-security-boulevard

The reason you don’t really understand NFTs is because the journalists describing them to you don’t understand them, either. We can see that when they attempt to sell an NFT as part of their stories (e.g. AP and NYTimes). They get important details wrong.

The latest is Reason.com magazine selling an NFT. As libertarians, you’d think at least they’d get the technical details right. But they didn’t. Instead of selling an NFT of the artwork, it’s just an NFT of a URL. The URL points to OpenSea, which is known to remove artwork from its site (such as in response to DMCA takedown requests).

FinConDX 2021

If you buy that Reason.com NFT, what you’ll actually get is a token pointing to:

https://api.opensea.io/api/v1/metadata/0x495f947276749Ce646f68AC8c248420045cb7b5e/0x1F907774A05F9CD08975EBF7BF56BB4FF0A4EAF0000000000000060000000001

This is just the metadata, which in turn contains a link to the claimed artwork:

https://lh3.googleusercontent.com/8Q2OGcPuODtCxbTmlf3epFGOqbfCbs4fXZ2RcIMnLpRdTaYHgqKArk7uETRdSZmpRAFsNE8KB4sFJx6czKE5cBKB1pa7ovc4wBUdqQ

If either OpenSea or Google removes the linked content, then any connection between the NFT and the artwork disappears.

It doesn’t have to be this way. The correct way to do NFT artwork is to point to a “hash” instead which uniquely identifies the work regardless of where it’s located. That $69 million Beeple piece was done this correct way. It’s completely decentralized. If the entire Internet disappeared except for the Ethereum blockchain, that Beeple NFT would still work.

This is an analogy for the entire blockchain, cryptocurrency, and Dapp ecosystem: the hype you hear ignores technical details. They promise an entirely decentralized economy controlled by math and code, rather than any human entities. In practice, almost everything cheats, being tied to humans controlling things. In this case, the “Reason.com NFT artwork” is under control of OpenSea and not the “owner” of the token.

Journalists have a problem. NFTs selling for millions of dollars are newsworthy, and it’s the journalists place to report news rather than making judgements, like whether or not it’s a scam. But at the same time, journalists are trying to explain things they don’t understand. Instead of standing outside the story, simply quoting sources, they insert themselves into the story, becoming advocates rather than reporters. They can no longer be trusted as an objective observers.

From a fraud perspective, it may not matter that the Reason.com NFT points to a URL instead of the promised artwork. The entire point of the blockchain is caveat emptor in action. Rules are supposed to be governed by code rather than companies, government, or the courts. There is no undoing of a transaction even if courts were to order it, because it’s math.

But from a journalistic point of view,  this is important. They failed at an honest description of what actually the NFT contains. They’ve involved themselves in the story, creating a conflict of interest. It’s now hard for them to point out NFT scams when they themselves have participated in something that, from a certain point of view, could be viewed as a scam.

*** This is a Security Bloggers Network syndicated blog from Errata Security authored by Robert Graham. Read the original post at: https://blog.erratasec.com/2021/12/journalists-stop-selling-nfts-that-you.html