This issue is a great example of the kind of problem I spoke about in my post on Decentralization and Alignment. We’ve been aiming for this ideal of decentralization, but we’ve been heading towards a kind of decentralization that misaligns us, creates inefficiencies, and stalls progress.
In that post, my first point was that our decentralization gives us multiple single points of failure. Here, that’s ZF forbidding ZCG to enter into this contract, and also ECC refusing to support the code due to a lack of funding (after it’s been divided in support of “decentralization”). My second point was that we’re misaligned. Is a hardware wallet a crucial part of our adoption strategy? If it is, ZF and ECC should be prioritizing it, and if it isn’t, those organizations own the burden of explaining why they think whatever is on their roadmap will be a greater benefit. My third point referenced Rogaway’s “The Moral Character of Cryptograhpic Work”; getting this app deployed is an excellent example of what he calls “boring cryptography”—making stuff useful to real people, not just doing flashy things for show.
Regardless of the outcome of the next dev fund vote, ECC and ZF are responsible for Zcash’s success now. If there are good arguments that this project is safe to defer, or that those organizations have better things on their roadmaps, then I’ll agree with their decisions. But if there aren’t, we need to seriously reconsider who we’re funding and instead find organizations who will prioritize needed features or at least publicly explain why and how they think their roadmaps will lead to success.
I’ve audited this thing, it’s really not that hard to maintain once it’s in a stable state. At worst, get another audit from NCC, do internal reviews, and then the code won’t have to change until you want to get clever and make further performance improvements or you break it in a future network upgrade.
Edit (after I’ve slept on it): The language I used above strongly suggests I’m blaming ECC or ZF for this outcome. That’s not what I mean, I think both orgs are making their own best decision from their point of view given their funding and capabilities. More justification would help, and it’s a huge red flag to me that we’re unable to coordinate as a community to get such an important feature shipped in a timely manner and we need to consider how to fix that.