I'm concerned this design is dangerous. It solves a (hopefully) short-term problem in a way that could expose the project to long-term risk. We'd be adding an asset class with an apparently permanent identity — meaning a user could become attached to it — that can be double-spent. Double-spends are generally considered harmful.
It's easy to say now that the price of planetoids will remain zero, and that these double-spendable assets will only last a little while until we find the next thing. The truth is, we don't know what the next system will be yet, which means we don't know when it will come online. So we don't know how long we'll be stuck with planetoids. The longer they exist, the bigger the risk from the double-spend problem.
If there were some double-spends and we lost the consistency of the PKI state, it would be difficult or impossible to get it back. If everyone using a planetoid understands its impermanence and is not upset when they lose access to it later, then this wouldn't be catastrophic.
We're at a strange sort of intermediate point right now, where not many people are running stars or selling or giving away planets, but the system is on the cusp of being "real" in a few ways it's never been real before — the UI is approaching consumer-grade, hosting is about to launch, system stability has improved quite a bit, security audit starts soon.
I wouldn't be surprised if planet demand spikes six to twelve months from now, which could very well happen before we've launched a more permanently low-cost PKI solution. At that point, we'd be asking stars to leave money on the table by giving planetoids away instead of selling them. As more stars spawn planetoids, more planetoids exist, and the more the planet price rises, the more likely double-spends become, and the higher the potential damage to trust and perceived usability.
Maybe those planetoids don't have the "confirmed on Ethereum" stamp, so caveat emptor. Are we really so confident in our messaging that we truly believe users will understand not only *all the abstruse crap they already have to understand to get onto Urbit* ("Urbit? Impenetrable" — Ted Nelson), but now also this "transaction confirmation" that costs $50 for some reason? Otherwise this thing is just a planet-oid, not a … what was it? a moon? What is a pier, again? Whatever, I know people are into this, so I'll buy one for $10, but $60 is too much.
I'm not categorically opposed to a temporary bandaid to get the network through this rough patch in a way that we don't expect to scale well a year or two from now. My concern is that planetoids introduce several new failure modes that would be impossible (or at least deliberately mitigated) in any blockchain-like system, and that the risk of those failure modes can reasonably be expected to worsen over time.
We do have to do something to get people using Urbit while the Eth prices are high. I suggest the we do the most obvious thing, which also doesn't require writing code: let them spawn a comet. We want people to be able to get onto the network for free, with a temporary address until they're ready to pony up (no ponies were harmed in the writing of this email) the cash for a planet.
The downside of encouraging comets is that it doesn't create a strong emotional binding between user and address. They'd have to buy a planet for that. Then again, we're hoping the strong emotional binding does not occur with planetoids — we really want them to formally buy the planet if they start to feel that way, but if Ethereum prices remain high, there's a good chance a large percentage of them just won't.
We could also do quite a bit to make comets a more appealing option. Right now, comets take a fairly long time to spawn. This could be remedied easily by adding more stars to the comet sponsor list, which is just a text file (and the stars have to be running). Once the userspace data import/export scripts land, that will also help smooth over the switch from comet to planet somewhat.
The other problem with comets right now is that the comet has to talk to you before you can talk to it. We should probably add a pathway, maybe in :groups, where the group owner shares all comet members' self-attestations with the group members, who store them in Jael. That way you could start a DM with a comet if you're in any of the same groups as it.
Comets aren't a perfect solution. But I'm not convinced the long-term risk of planetoids outweigh their short-term convenience.