We Gave Away the Protocol on Purpose

Everyone told me the crypto was the moat. So we published it.

The Share Protocol — the canonicalization rules, the fingerprint construction, the audit-chain math, all of it — is an open specification at shareprotocol.org, CC BY licensed, with published test vectors and no patent claims against independent implementations. There’s a verifier written from the spec text, not ported from our code, passing every check. Two implementations agreeing is what makes it a protocol instead of a file format.

Here’s why that’s not generosity. It’s the product requirement.

Evidence has to outlive its issuer

Think about what a consent certificate is for. It gets pulled out months or years later, in front of someone skeptical — an auditor, a carrier, opposing counsel. At that moment, “the vendor’s API says it’s valid” is a weak sentence, and “the vendor got acquired and the API is gone” is a catastrophic one.

That second scenario isn’t hypothetical. This January, the two established consent-certification vendors became one company. Everyone holding certificates from either of them now depends on a single custodian’s continued goodwill, pricing, and existence. The records go where the company goes.

A PRYVC evidence pack verifies offline, from the spec, years later, whatever happens to us. If we vanished tomorrow, every certificate ever exported would still check out. I consider that the minimum honest bar for something calling itself evidence — and you can only clear it by giving the math away.

Open is also the trust model

The deeper reason: a proprietary verification scheme is just trust-me with extra steps. If only my code can check my certificates, you’re back to believing the custodian. The whole argument of PRYVC is that nobody — including PRYVC — should need to be believed. The public ledger verifies in your browser. The spec verifies in anyone’s Python. The moat isn’t the secret; it’s being the reference implementation of a standard everyone can hold us to.

Twenty years of software taught me most “proprietary advantages” are just decisions nobody’s audited. The advantage I want is different: being the company most exposed to its own verification.

The spec is short. Read it, implement it, try to break it. Every hole you find makes the thing I’m selling stronger.