\documentclass{beamer}

\usepackage{pgfnodes}
\usepackage{pgfarrows}
\usepackage{multido}
\usepackage{multirow}

\usetheme{Warsaw}
\setbeamercolor{structure}{fg=green!50!black}

\newcommand{\TODO}[1][finish]{\alert{[TODO --- #1]}}
\pgfdeclareimage[width=1.5cm]{devil}{devil}

\author{Michael George}
\title{Byzantine Techniques}

\date{November 29, 2005}

\begin{document}

\begin{frame}
	\titlepage
\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Overview}

\begin{frame}
	\frametitle{Reliability and Failure}

	\begin{quote}
		``There can be no unity without agreement, and there can be no agreement without conciliation'' \\
		\hspace{5em} --- Ren\'e Maowad
	\end{quote}
	\pause

	\vspace{2em}
	\begin{itemize}
		\item We want reliable systems
		\item Until now, we've assumed that failures are fail-stop
		\item What happens if failures are arbitrary?
		\pause
		\item \ldots or even malicious?
	\end{itemize}
\end{frame}

\begin{frame}
	\frametitle{Today's Presentation}

	We will discuss two papers that address this worst-case scenario:
	\begin{enumerate}
		\item The Byzantine General's Problem [Lamport et.\ al.\ 1982]
			\begin{itemize}
				\item Phrases the problem in terms of Byzantine Generals
				\item Shows a tight upper bound on fault tolerance
				\item Explores bounds under modified assumptions
			\end{itemize}
		\pause
		\item Practical Byzantine Fault Tolerance [Castro and Liskov 1999]
			\begin{itemize}
				\item Implements fault-tolerant state-machine replication
				\item Aggressively optimizes the implementation
				\item Layers replicated NFS over state-machine
				\item Shows performance penalty is reasonable
			\end{itemize}
	\end{enumerate}
\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{The Byzantine General's Problem}

	\subsection{The Basic Problem}

		\begin{frame}
			\frametitle{The Basic Problem}
			A group of Byzantine Generals are surrounding an enemy city.
			\begin{itemize}
				\item They need to jointly decide whether to attack or retreat.
				\item But some of them might be traitors.
				\item Want them to \alert{agree} on a decision.
				\pause
				\item Decision must be \alert{good}.
			\end{itemize}
		\end{frame}

		%
		% command to generate a general in the following slide
		%
		\newcommand{\makegeneral}[3]{%
			\pgfnodebox{#1}[virtual]{#3}{%
				\begin{tabular}{|@{~}c@{~}|@{~}c@{~}|@{~}c@{~}|@{~}c@{~}|}%
				\hline%
				\multicolumn{3}{|l}{#1} & #2 \\ \hline%
				\visible<3->{A} & \visible<4->{R} & \visible<5->{A} & \visible<6->{A} \\ \hline%
				\end{tabular}}{0pt}{0pt}%
		}

		\begin{frame}
			\frametitle{Reducing Decision Making to Information Propogation}
			If a single commander can send information to some lieutenants such that:
			\begin{description}[IC12]
				\item[IC1] All loyal lieutenants recieve the same value
				\item[IC2] If commander is loyal, then all lieutenants recieve value she sent
			\end{description}

			\pause
			\begin{center}
			\begin{pgfpicture}{0cm}{0cm}{8cm}{2cm}
				\pgfsetxvec{\pgfpoint{2.5cm}{0cm}}
				\makegeneral{Alice}{A}{\pgfxy(0,.5)}
				\makegeneral{Bob}{R}{\pgfxy(1,.5)}
				\makegeneral{Cathy}{A}{\pgfxy(2,.5)}
				\makegeneral{Don}{A}{\pgfxy(3,.5)}

				\pgfsetxvec{\pgfpoint{1cm}{0cm}}
				\only<3-6>{
					\pgfnodebox{Comm}[virtual]{\pgfxy(4,2)}{Commander}{2pt}{2pt}
					\pgfnodebox{Lieut}[virtual]{\pgfxy(4,-1)}{Lieutenants}{2pt}{2pt}
				}

				\only<3>{\pgfnodeconncurve{Comm}{Alice}{-90}{90}{.5cm}{.5cm}}
				\only<4>{\pgfnodeconncurve{Comm}{Bob}  {-90}{90}{.5cm}{.5cm}}
				\only<5>{\pgfnodeconncurve{Comm}{Cathy} {-90}{90}{.5cm}{.5cm}}
				\only<6>{\pgfnodeconncurve{Comm}{Don}  {-90}{90}{.5cm}{.5cm}}

				\only<4,5,6>{\pgfnodeconncurve{Lieut}{Alice}{90}{-90}{.5cm}{.5cm}}
				\only<3,5,6>{\pgfnodeconncurve{Lieut}{Bob}{90}{-90}{.5cm}{.5cm}}
				\only<3,4,6>{\pgfnodeconncurve{Lieut}{Cathy}{90}{-90}{.5cm}{.5cm}}
				\only<3,4,5>{\pgfnodeconncurve{Lieut}{Don}{90}{-90}{.5cm}{.5cm}}
			\end{pgfpicture}
			\end{center}

			\pause[7]
			The \emph{Byzantine General's Problem} is to send information in a way that
			satisfies \structure{IC1} and \structure{IC2}.
		\end{frame}

	\subsection{Impossibility Results}

		\begin{frame}
			\frametitle{Impossibility With Three Generals}

			Consider the following:
			\begin{center}
			\begin{pgfpicture}{0cm}{0.5cm}{8cm}{4cm}
				\pgfnodebox{Comm}[stroke]{\pgfxy(4.0,3.5)}{\alert<3>{Commander}}{5pt}{3pt}
					\only<3>{\pgfputat{\pgfnodeborder{Comm}{0}{5pt}}{\pgfbox[left,center]{\pgfuseimage{devil}}}}
				\pgfnodebox{Lieut1}[stroke]{\pgfxy(1.0,1.0)}{\color{blue} Lieutenant 1}{5pt}{3pt}
				\pgfnodebox{Lieut2}[stroke]{\pgfxy(7.0,1.0)}{\alert<2>{Lieutenant 2}}{5pt}{3pt}
					\only<2>{\pgfputat{\pgfnodeborder{Lieut2}{0}{5pt}}{\pgfbox[left,center]{\pgfuseimage{devil}}}}
				\pgfsetendarrow{\pgfarrowtriangle{5pt}}
				\pgfnodesetsepend{2pt}
				% Message from commander to lieut1
				\pgfnodeconnline{Comm}{Lieut1}
				\pgfnodelabelrotated{Lieut1}{Comm}[.5][2pt]{\pgfbox[center,base]{``attack''}}
				% Message from lieut2 to lieut1
				\pgfnodeconnline{Lieut2}{Lieut1}
				\only<1>
				{
					\pgfnodelabelrotated{Lieut1}{Lieut2}[.5][2pt]{\pgfbox[center,base]{he said ``attack''}}
				}
				\only<2,3>
				{
					\pgfnodelabelrotated{Lieut1}{Lieut2}[.5][2pt]{\pgfbox[center,base]{he said ``retreat''}}
				}
				% Message from comm to lieut2
				\pgfnodeconnline{Comm}{Lieut2}
				\only<1,2>{
					\pgfnodelabelrotated{Comm}{Lieut2}[.5][2pt]{\pgfbox[center,base]{``attack''}}
				}
				\only<3>{
					\pgfnodelabelrotated{Comm}{Lieut2}[.5][2pt]{\pgfbox[center,base]{``retreat''}}
				}
			\end{pgfpicture}
			\end{center}
			\begin{tabular}{c|c|c}
				Commander says & Lieutenant 2 says & Lieutenant 1 concludes \\
				\hline
				``attack''     & ``attack''        & ``attack'' \\ \pause
				``attack''     & ``retreat''       & ``attack'' \\ \pause
				``attack''     & ``retreat''       & ``retreat''
			\end{tabular}
		\end{frame}

		\begin{frame}
			\frametitle{Impossibility With $3m$ Generals}

			What if we can solve for $3m$ Albanian generals with $m$ failures?
			\begin{center}
			\begin{pgfpicture}{0cm}{0cm}{10cm}{5cm}
				\pgfsetxvec{\pgfpoint{1.25cm}{0cm}}
				\pgfsetyvec{\pgfpoint{0cm}{1.25cm}}

				\pgfnodecircle{AC}[stroke]{\pgfxy(4,2.5)}{.5cm}
				\pgfputat{\pgfnodecenter{AC}}{\pgfbox[center,center]{$AC$}}

				\multido{\i=1+1,\n=0.5+1.0,\iarcs=0+1}{8}{
					\pgfnodecircle{AL\i}[stroke]{\pgfxy(\n,1)}{.5cm}
					\pgfputat{\pgfnodecenter{AL\i}}{\pgfbox[center,center]{$AL_{\i}$}}
					\only<1>{
						\pgfnodeconnline{AC}{AL\i}
						\multido{\ic=1+1}{\iarcs}{
							\pgfnodeconncurve{AL\i}{AL\ic}{-90}{-90}{1cm}{1cm}
						}
					}
				}

				\only<2>{
					\pgfrect[stroke]{\pgfxy(0.03,.5)}{\pgfxy(2.94,1.5)}
					\pgfrect[stroke]{\pgfxy(3.03,.5)}{\pgfxy(1.94,3.0)}
					\pgfrect[stroke]{\pgfxy(5.03,.5)}{\pgfxy(2.94,1.5)}

					\pgfputat{\pgfxy(1.5,1.5)}{\pgfbox[center,bottom]{Byzantine Lieut. 1}}
					\pgfputat{\pgfxy(4.0,3.15)}{\pgfbox[center,bottom]{Byzantine}
					                            \pgfbox[center,top]{Commander}}
					\pgfputat{\pgfxy(6.5,1.5)}{\pgfbox[center,bottom]{Byzantine Lieut. 2}}
				}
			\end{pgfpicture}
			\end{center}

			\pause
			Then we can implement three Byzantine generals with one failure!
		\end{frame}

		\begin{frame}
			\frametitle{Impossibility With Approximate Agreement}

			Can we do approximate (within a given $\delta$) agreement?
			\pause

			\begin{center}
			\begin{pgfpicture}{-5cm}{-2cm}{5cm}{1cm}
				\pgfsetendarrow{\pgfarrowsingle}
				\pgfsetstartarrow{\pgfarrowsingle}
				\pgfxyline(-5,0)(5,0)
				\pgfclearstartarrow
				\pgfputat{\pgfxy(-4,0)}{\pgfbox[center,center]{(}}
				\pgfputat{\pgfxy(-3,0.1)}{\pgfbox[center,bottom]{A}}
				\pgfputat{\pgfxy(-2,0)}{\pgfbox[center,center]{)}}
				\pgfputat{\pgfxy(2,0)}{\pgfbox[center,center]{(}}
				\pgfputat{\pgfxy(3,0.1)}{\pgfbox[center,bottom]{R}}
				\pgfputat{\pgfxy(4,0)}{\pgfbox[center,center]{)}}

				\only<3->{
					\pgfcircle[fill]{\pgfxy(-2.1,0)}{2pt} \pgfxyline(-2.1,-0.1)(-2.1,-0.5)
					\pgfcircle[fill]{\pgfxy(-2.4,0)}{2pt} \pgfxyline(-2.4,-0.1)(-2.4,-0.5)
					\pgfcircle[fill]{\pgfxy(-3.5,0)}{2pt} \pgfxyline(-3.5,-0.1)(-3.5,-0.5)
					\pgfcircle[fill]{\pgfxy(-3.7,0)}{2pt} \pgfxyline(-3.7,-0.1)(-3.7,-0.5)
					\pgfcircle[fill]{\pgfxy(-2.9,0)}{2pt} \pgfxyline(-2.9,-0.1)(-2.9,-0.5)

					\pgfrect[stroke]{\pgfxy(-4,-1)}{\pgfxy(2,0.4)}
					\pgfputat{\pgfxy(-3,-0.8)}{\pgfbox[center,center]{Attack}}
				}
			\end{pgfpicture}
			\end{center}

			No - just have general choose points further then $2\delta$ apart.
			\pause

			Now we've solved the exact problem.
		\end{frame}

	\subsection{An Optimal Algorithm}

		\begin{frame}
			\frametitle{Oral Messages}

			Some assumptions:
			\begin{description}
				\item[A1] Every message that is sent is delivered correctly
				\item[A2] The reciever of a message knows who sent it
				\item[A3] The absence of a message can be detected
				\pause
				\item[implicit] Only the sender and reciever can read a message
			\end{description}
			\pause

			Also need a $\mathit{majority}$ function:
			\begin{itemize}
				\item If a majority of $v_i$'s are $v$ then $\mathit{majority}(\vec{v}) = v$
				\item Can use the ``majority or default'' function or the median function
			\end{itemize}
		\end{frame}

		\begin{frame}
			\frametitle{The Oral Messages Algorithm}
			\begin{description}[IC12]
				\item[IC1] All loyal lieutenants recieve the same value
				\item[IC2] If commander is loyal, then all lieutenants recieve value she sent
			\end{description}
			\begin{center}
			\begin{pgfpicture}{0cm}{0cm}{9cm}{5cm}
				\pgfsetendarrow{\pgfarrowsingle}

				% draw commander and lieutenants
				\pgfnodecircle{Comm}[stroke]{\pgfxy(4.5,4)}{.5cm}
				\pgfputat{\pgfnodecenter{Comm}}{\pgfbox[center,center]{$C$}}

				\Multido{\dx=0.75cm+1.5cm,\i=1+1}{6}{
					\pgfnodecircle{L\i}[stroke]{\pgfpoint{\dx}{1cm}}{.5cm}
					\pgfputat{\pgfnodecenter{L\i}}{\pgfbox[center,center]{$L_{\i}$}}
				}

				% step 1
				\only<2>{\pgfputat{\pgfxy(9,5)}{\pgfbox[right,top]{Step 1}}}
				\multido{\i=1+1}{6}{
					\only<2>{\pgfnodeconnline{Comm}{L\i}}
				}

				% step 2
				\only<3-5>{\pgfputat{\pgfxy(9,5)}{\pgfbox[right,top]{Step 2}}}
				\multido{\icomm=1+1,\iframe=3+1,\ileft=0+1,\iright=5+-1}{3}{
					\only<\iframe>{
						\multido{\ilieu=1+1}{\ileft}{  \pgfnodeconncurve{L\icomm}{L\ilieu}{-90}{-90}{.5cm}{1cm}}
						\multido{\ilieu=6+-1}{\iright}{\pgfnodeconncurve{L\icomm}{L\ilieu}{-90}{-90}{.5cm}{1cm}}
					}
				}
			\end{pgfpicture}
			\end{center}
		\end{frame}

	\subsection{Extensions}

		\begin{frame}
			\frametitle{With Signed Messages (or broadcast)}
			Impossibility proof assumes that lieutenants can lie
			\begin{itemize}
				\item Can be prevented with digitial signatures
				\item Also with broadcast
				\pause
				\item Authors provide $m+2$ general algorithm that thwarts $m$ traitors
			\end{itemize}
		\end{frame}

		\begin{frame}
			\frametitle{With Restricted Communications}
			What if generals can only talk to certain (nearby) generals?

			Under certain connectivity hypotheses:
			\begin{itemize}
				\item Almost the same basic algorithm works (add forwarding)
				\item Same bounds on number of traitors/generals
				\item Signed version also goes through as long as loyal generals
				connected
			\end{itemize}
		\end{frame}

		% used in next two pictures:
		\newcommand{\nonreggraph}{
			\pgfnodecircle{G21}[fill]{\pgfxy(6.0,1.5)}{3pt}
			\pgfnodecircle{G22}[fill]{\pgfxy(7.5,3.0)}{3pt}
			\pgfnodecircle{G23}[fill]{\pgfxy(7.5,1.5)}{3pt}
			\pgfnodecircle{G24}[fill]{\pgfxy(7.5,0.0)}{3pt}
			\pgfnodecircle{G25}[fill]{\pgfxy(9.0,1.5)}{3pt}

			\pgfnodeconnline{G21}{G22}
			\pgfnodeconnline{G21}{G23}
			\pgfnodeconnline{G21}{G24}
			\pgfnodeconnline{G22}{G23}
			\pgfnodeconnline{G23}{G24}
			\pgfnodeconnline{G22}{G25}
			\pgfnodeconnline{G23}{G25}
			\pgfnodeconnline{G24}{G25}
		}
		% end non-regular graph picture

		\begin{frame}
			\frametitle{``Certain Connectivity Hypotheses''}

			Definition:
			\begin{itemize}
				\item A set $N$ of neighbors of $v$ is \alert{regular} if for all $n \in
				N$ and all $v' \neq v$ there is a path $\gamma_{nv'}$ from $n$ to $v'$
				not passing through $v$ or $\gamma_{n'v''}$
			
				\item A graph is $p$-regular if every node has a regular set of $p$
				neighbors
			\end{itemize}
			\pause

			\begin{center}
			\begin{pgfpicture}{0cm}{0cm}{10cm}{3cm}
				\pgfnodecircle{G11}[fill]{\pgfxy(0,1)}{3pt}
				\pgfnodecircle{G12}[fill]{\pgfxy(2,1)}{3pt}
				\pgfnodecircle{G13}[fill]{\pgfxy(4,1)}{3pt}
				\pgfnodecircle{G14}[fill]{\pgfxy(0,2)}{3pt}
				\pgfnodecircle{G15}[fill]{\pgfxy(2,2)}{3pt}
				\pgfnodecircle{G16}[fill]{\pgfxy(4,2)}{3pt}

				\pgfnodeconnline{G11}{G12}
				\pgfnodeconnline{G11}{G14}
				\pgfnodeconnline{G12}{G15}
				\pgfnodeconnline{G12}{G13}
				\pgfnodeconnline{G13}{G16}
				\pgfnodeconnline{G14}{G15}
				\pgfnodeconnline{G15}{G16}
				\pgfnodeconncurve{G11}{G13}{-90}{-90}{1cm}{1cm}
				\pgfnodeconncurve{G14}{G16}{90}{90}{1cm}{1cm}

				\nonreggraph
			\end{pgfpicture}
			\end{center}
		\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Practical Byzantine Fault Tolerance}

	\subsection{Overview}

		\begin{frame}
			\frametitle{Problems With Lamport et.\ al.}
			The first paper was \emph{theoretical}:
			\begin{itemize}
				\item Algorithms provided only as proof of existence
				\item Very impractical; synchronous execution
				\item Assume network is reliable
			\end{itemize}

			\pause
			\vspace{1em}
			The second paper aims for \emph{practicality}.
			\begin{itemize}
				\item Algorithm is implemented as general-purpose library
				\item Assumptions model reality better
				\item Implementation is optimized and benchmarked
			\end{itemize}
		\end{frame}

		\begin{frame}
			\frametitle{Theoretical Limitations}

			Some hard limitations:
			\begin{itemize}
				\item Previous paper: need $3m+1$ generals \pause
				\item FLP result: need synchrony \pause
				\item Can't avoid failures that are correct according to protocol \pause
			\end{itemize}

			Given these limitations, the authors design a state machine replication
			protocol
		\end{frame}

		\begin{frame}
			\frametitle{State Machine Replication}
			Replicated state machines are an abstract framework for distributed
			systems
			\begin{itemize}
				\item There is a shared global ``state'' of the system
				\item Events modify the state in a \emph{deterministic} way
					\begin{itemize}
						\item Client requests
						\item Membership changes / failure
					\end{itemize}
				\pause
				\item Replicated servers maintain local copy of state
					\begin{itemize}
						\item Can act on state transitions
					\end{itemize}
				\pause
				\item If all replicas start in same state and all events propogated,
				then all replicas remain in the same state
			\end{itemize}
		\end{frame}

	\subsection{The Algorithm}
	
		\begin{frame}
			\frametitle{Normal Operation}
			The algorithm is a 3-phase commit protocol:
			\begin{enumerate}
				\setcounter{enumi}{-1}
				\item Client sends request to primary
					\begin{itemize} \item If primary is down, broadcast request \end{itemize}
				\pause
				\item Primary broadcasts \textsc{Pre-prepare} message to replicas
					\begin{itemize}
						\item Just contains a sequence number, a view, and a signature
						\item Message is piggybacked
					\end{itemize}
				\pause
				\item When a replica recieves a \textsc{Pre-prepare} it broadcasts a
				      \textsc{Prepare} message
				\pause
				\item When a replica recieves $2f$ \textsc{Prepare} messages, it sends a
				      \textsc{Commit} message
				\pause
				\item When a replica recieves $2f+1$ commit messages, it changes its'
				      local state
			\end{enumerate}
		\end{frame}

		\begin{frame}
			\frametitle{View Changes}
			Like Paxos, we maintain a view of primary
			\begin{enumerate}
				\item When a replica thinks current primary has failed, broadcasts a
				      \textsc{View-change} message
					\begin{itemize}
						\item Contains its best estimate of primary's state upon failure
					\end{itemize}
				\pause
				\item When the new primary recieves $2f$ \textsc{View-change} messages
				      it broadcasts \textsc{New-view} to all other replicas
					\begin{itemize}
						\item Contains proof that it really recieved \textsc{View-change}
						messages
					\end{itemize}
			\end{enumerate}
		\end{frame}

		\begin{frame}
			\frametitle{Optimizations}
			Some optimizations to reduce communication delay:
			\begin{itemize}
				\item Client designates single server for reply; others send digest \pause
				\item Client can accept $2f+1$ tentative replies instead of waiting for
				      $f+1$ actual replies \pause
				\item Reduced interaction in read-only case
			\end{itemize}

			Also use message authentication codes instead of public-key crypto for
			common case.
		\end{frame}

	\subsection{Performance}

		\begin{frame}[t]
			\frametitle{Micro-Benchmarks}

			\begin{center}
			\begin{tabular}{|c|lr|lr|lr|}
				\hline
				\multirow{2}{2cm}{\centering arg./res. \\ (KB)}
				     & \multicolumn{4}{|c|}{replicated}
				                                       & \multicolumn{2}{|c|}{\multirow{2}{2cm}{\centering without \\ replication}} \\
				\cline{2-5}
				     & \multicolumn{2}{|c|}{read-write}
				                       & \multicolumn{2}{|c|}{read-only}
				                                       &       & \\
				\hline
				0/0  & 3.35  & (309\%) & 1.62 & (98\%) &  0.82 & (0\%)\\
				4/0  & 14.19 & (207\%) & 6.98 & (51\%) &  4.62 & (0\%)\\
				0/4  & 8.01  & (72\%)  & 5.94 & (27\%) &  4.66 & (0\%)\\
				\hline
			\end{tabular}
			\end{center}

			For the ``worst-case scenario'':
			\begin{itemize}
				\item Tests measure null operations
				\item Without replication is just ``best-effort'' (UDP)
			\end{itemize}
			The worst is about four times as slow
		\end{frame}


		\begin{frame}[t]
			\frametitle{Cost of Replication}

			\begin{center}
			\begin{tabular}{|c|lr|lr|lr|}
				\hline
				      & \multicolumn{4}{|c|}{BFS}       &       & \\
				\cline{2-5}
				phase & \multicolumn{2}{|c|}{strict}
				                        & \multicolumn{2}{|c|}{r/o lookup}
				                                        & \multicolumn{2}{|c|}{BFS-nr} \\
				\hline
				1     &  0.55 & (57\%) &  0.47  & (34\%) &  0.35 & (0\%) \\
				2     &  9.24 & (82\%) &  7.91  & (56\%) &  5.08 & (0\%) \\
				3     &  7.24 & (18\%) &   6.45 &  (6\%) &  6.11 & (0\%) \\
				4     &  8.77 & (18\%) &   7.87 &  (6\%) &  7.41 & (0\%) \\
				5     & 38.68 & (20\%) & 38.38  & (19\%) & 32.12 & (0\%) \\
				\hline
				total & 64.48 & (26\%) & 61.07  & (20\%) & 51.07 & (0\%) \\

				\hline
			\end{tabular}
			\end{center}

			This benchmark measures the cost of replication:
			\begin{itemize}
				\item BFS-nr is the same as BFS but performs no replication
				\item It is unsafe because reports that result is stable before it is
			\end{itemize}

		\end{frame}

		\begin{frame}[t]
			\frametitle{Cost of Fault Tolerance}

			\begin{center}
			\begin{tabular}{|c|lr|lr|lr|}
				\hline
							& \multicolumn{4}{|c|}{BFS}       &       & \\
				\cline{2-5}
				phase & \multicolumn{2}{|c|}{strict}
				                       & \multicolumn{2}{|c|}{r/o lookup}
				                                         & \multicolumn{2}{|c|}{NFS-std} \\
				\hline
				1     & 0.55  & (-69\%) & 0.47  & (-73\%)  & 1.75  & (0\%) \\
				2     &  9.24 &  (-2\%) & 7.91  & (-16\%)  & 9.46  & (0\%) \\
				3     & 7.24  &  (35\%) & 6.45  &  (20\%)  & 5.36  & (0\%) \\
				4     & 8.77  &  (32\%) & 7.87  &  (19\%)  & 6.60  & (0\%) \\
				5     & 38.68 &  (-2\%) & 38.38 &  (-2\%)  & 39.35 & (0\%) \\
				\hline
				total & 64.48 &   (3\%) & 61.07 &  (-2\%)  & 62.52 & (0\%) \\
				\hline
			\end{tabular}
			\end{center}

			This test measures the cost of fault tolerance:
			\begin{itemize}
				\item NFS-std is the standard implementation of NFS
				\item Some numbers are negative (!)
				\item Best numbers (r/o lookup) not quite fair
			\end{itemize}
		\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Conclusion}

	\begin{frame}
		\frametitle{Take-home Messages}

		First paper:
		\begin{itemize}
			\item Possible to tolerate $m$ traitors with $3m+1$ generals
			\item Not possible with fewer
			\pause
			\item Signatures make it much easier
			\item Connectivity doesn't make it much harder
		\end{itemize}

		\pause
		Second paper:
		\begin{itemize}
			\item Byzantine techniques are reasonable to use in practice
			\item Can even improve performance by replacing slow disk with fast
			distributed processors
		\end{itemize}
	\end{frame}

	\begin{frame}
		\frametitle{Thoughts for Discussion}

		\begin{itemize}
			\item Are byzantine assumptions worthwhile?
			\begin{itemize}
				\item Who does $n$-version programming anyway?
				\item Does it really help?
			\end{itemize}
			\pause
			\item Can this be done better at a lower level (e.g. broadcast)?
			\begin{itemize}
				\item Lamport et.\ al.\ say no
				\item Need to be careful to avoid circularity
			\end{itemize}
			\pause
			\item What about graceful failure?
		\end{itemize}
	\end{frame}

\end{document}

%
% vim: ts=2 sw=2 ai tw=80
%
