Bitcoin Forum

Recall that the purpose of money printing is to encourage or discourage spending. When the central bank wants to encourage spending, they print money leading to inflation. Inflation encourages people to turn cash into goods and physical assets. This increases spending in the short-run and stimulates the economy.

The blockchain makes it possible to execute more powerful monetary policy. Money printing is coarse because price increases occur with a time delay. The blockchain is precise and effective inflation can be achieved instantaneously.

Suppose the central bank controls 51% of hashing power and wants to achieve a stimulus equivalent to a 3% increase in inflation.

Simply demand a txn fee equal to 3% of coin-age (with age measured in years). This is just like instantaneously increasing the inflation rate by 3%. Take the fee proceeds and hand them out to banks. Voila. You have stimulated spending. Once the economy recovers, the txn fee can be lowered again. The inflation rate of every single block is completely at the bank's discretion. This is 100% impossible with the tools available today.

Now people might try and horde (the bank can't steal my coins... I'll just wait till they lower the fee and spend then). Ha, this would not work at all.
The bank has a historical record of its inflation policy and would bill these guys. The fact that you haven't paid yet won't help them. The seignorage will be deducted from their account whenever they finally decide to spend. [Could go through more details on calculating seignorage fee, but I think that is enough for now.]

It is pretty clear that the blockchain gives central banks unprecedented control over monetary policy. All they have to do is command 51% of hashing power. An absolutely negligible investment for such a well-capitalized institution.

I am kind of confused why we still operate with dollars. Central bankers should start issuing dollars and euros this way. Or they could just adopt bitcoin. It would make their lives so much simpler.

Hmmm, yep, you're still an idiot. Your entire idea depends on your blockchain based currency being a monopoly. Forcing a fee on spending it will just make people not want to spend or receive your money, and instead will push them to something else. And a central bank capturing 51% will result in either attempt to take that 51% away from the bank, or a quick abandonment of the currency. Who will want to keep mining if the currency, and the main fundamentals that give it value, are under threat? The bank will eventually end up with 100% mining power of a currency that's been abandoned.

I guess you are no longer using the USD then?

Monetary policy is irrelevant unless a currency serves as a unit of account. Once a currency is used as a unit of account, you cannot easily avoid using it. Just like you can't buy your groceries with gold.
Bitcoin cannot be both widely used and outside of direct central bank administration.

Gold could escape control (in theory) because there is no blockchain. Bitcoin cannot escape control.


Did you skip your meds?

There is no need for any entity to intervene in the economy. If people want to spend, they will spend. If they want to save then they will save.

Your "central bank" has no right to even exist. Its just a gang who think they can order people around and control them like livestock.

If a gang like that ever gains the power to do what you are suggesting, then users will abandon the currency and set up another one that isnt controlled by a gang of authoritarians.

And the authoritarians will control that currency as well. And the peons will know that. So they will rationally accept control.

Hence Bitcoin.

Sorry cunicula, but your seem to have turned up to a free-money-movement talking shop trying to talk about how effective it would be to try and turn it into a system that's just like the one the one we want rid of. People will vote with their feet if that came to pass, just like they are now with turning to Bitcoin.

That would be like paying a huge premium to acquire a controlling share of a company and then deliberately rendering that company worthless through mismanagement. And then repeating that process. That doesn't sound like a great business model.

You aren't increasing the money supply at all. You are just transferring existing money from consumers to bankers.

I see. So if I understand the argument correctly:

1) If the central bank inflates the currency, then people will not use it.
2) If the people do not use the central bank's currency, then the central bank cannot affect people's behavior.

Is that right? So let's apply that to USD or Euros. Do you still continue to use USD/Euros/other national currencies for over 90% of your purchases in value terms? If yes, then I guess the central bank is not inflating the currency (otherwise premise 1 is wrong). I'd be interested to hear you confirm that. If no, then please tell me what you do. I'd be even more interested to hear about that.

If this reasoning applies to you, why wouldn't it apply to others in a similar predicament?
If no, then what do you use?

My point: Bitcoin cannot succeed as a free-money movement. Full stop. If you think otherwise, you are deluding yourself.

If they haven't crushed you yet, it is because you are too insignificant to merit their attention.

True. Prices don't actually change as a result of the policy. You would be implementing a policy that is equivalent to increasing prices though. It is called demurrage. Theoretical effects on consumer behavior are (more or less) identical.

http://en.wikipedia.org/wiki/Demurrage_(currency) (http://en.wikipedia.org/wiki/Demurrage_(currency))

Note that Keynes says it won't work in the wikipedia article. True enough. An efficient technology for removing dollars from your wallet directly didn't exist then. Thank you blockchain.

Of course we are still using euros & dollars, because up to now, no other currency could overcome the bootstrapping problem of network effects, to be useful. Bitcoin is changing that. Thats why we are all here, on the bitcoin forum.

Why are you on a bitcoin forum? Just to pester and annoy people, it seems.

I am here to tell you that you are an idiot. I'm in the educational sector. It is my calling.

You are kind of missing the period when paper currencies replaced very well bootstrapped metallic ones. How did that happen?

If you don't believe it will work, then why are you here? If it's to provide us all with the motivation to help the success along, then you're doing a fine job. It can't be much fun seeking out forums whose fundamental tenets you disagree with, disapprove of, or think to be invalid, and then proceeding to try and undermine it? Are you a sadist? Is someone paying you to do this? If the answer to both questions is no, then I'd recommend taking a big step back to take a look at what is motivating you. Because you're definitely rather unbalanced, to say the least.

In stages. Metallic coin --> privately issued metallic-backed paper --> central bank issued metallic-backed paper --> central bank issued pseudo-backed paper --> pure fiat. And that series was of course assisted by government coercion. Our task is much harder. We are trying to bootstrap a new currency that can overcome both the network effects advantage enjoyed by the current system AND the government coercion that's attempting to prop that system up. And for a long time those two hurdles in combination seemed insurmountable. But Bitcoin might just be the revolutionary technology powerful enough for the job. Time will tell.

I'm sorry, what? You're a teacher? Got I hope you're not a university professor, or at least not from any place other than a diploma mill. Your "teaching" style would make you fit only for teaching theology classes, and if you are a professor, I feel sorry for your students.

Bitcoin is succeeding quite well as an example for the Free Money Movement,  the current authoritarian delusions of what 'money' should be is beginning its implosion. I'm not sure I want to watch your increasingly nasty, shrill disgusting pleas for state-violence and thuggery to defend the failed monopolistic monetary ideologies as it all progresses.

In the end, the superior technology will win the battle of ideologies as people choose "what just works".

I do not see any potential superstar crypto-currency programmers or mathematicians amongst the central banking keynesians ... so unless they can recruit the mind-share of a team of technologists needed they are dead as an implementable ideology ... and the market will probably reject it on basic economic principles even if you got one of your fantasy blockchain Inflatacoins off the ground.

Maybe you should go and learn C++, a bit of number theory, crypto, etc and try competing in the marketplace with a real product instead of spouting your failed ideologies?

Then again, teachers teach because they can't do, isn't that how it goes Mr. Economist?

All arguments to prove authoritarian central control always start by assuming authoritarian central control.

False argument alert.  Of course cunticula leaves his premises tacit, to make his false argument harder to refute.


Statists insulting?  YOU DON'T SAY!

He's totally in the "educational" sector.  Can't you tell?  He's a propagandist who seeds FUD.

Look at his rhetoric, at his signature (that overtly hints at violence against a certain set of people), at his profile image and the caption.  This man is either an agent provocateur or he is severely mentally disturbed.

I suggest ignoring him.  I will do so right after this post.

It is worth pointing out that the investment is chump change and that the investment would be highly profitable. Say bitcoin replaces all card payments in the Euro area. That is about 54.8 billion Euros in 2008. Suppose that the average fee on bitcoin payments is 0.1%. Suppose that hardware depreciate at a 20% rate [slow for computer hardware], that labor costs are negligible [labor costs make monopoly easier], and that the interest rate is 5%. Assuming a competitive market, we have

capital rental costs=flow of bitcoin payments
(0.20+0.05)K=0.001*54.8 billion
K=$212 million.

It is chump change for a large corporation like VISA (let alone the central bank). More importantly, monopoly control easily repays itself. Suppose the monopoly raises the fee to 3% (same as credit cards) and that the volume of payments declines by five-fold to 10 billion as people flee instantaneously to gold or other types of rocks or whatever you might think of as 'sound money'. VISA/ the central bank will earn $300 million from the 3% fee. That is a nice 142% return on capital.

Now let's think about the volume of payments decreasing five-fold in one year. Is that plausible? Of course not. You cannot bootstrap a new currency in one year. If you could, you guys would not still be using USD. Thus the monopolist's profits during its first year of operation will be far greater than a measly 142% annual rate of return.

You may say we will have many competing PoW currencies. If so, the payment flow from each of these media decreases accordingly. The central bank's total expenses for controlling many small competing cryptocurrencies are identical to the central bank's expenses for controlling one large cryptocurrency. Only the total flow of fees matters.

Why don't you propose a fix for the problem? Or explain why I am wrong? Why does burying your head in the sand seem like a good idea?

I made the premises of the argument explicit well before you posted this. https://bitcointalk.org/index.php?topic=125822.msg1341445#msg1341445 (https://bitcointalk.org/index.php?topic=125822.msg1341445#msg1341445).

You chose to ignore these premises. Which you are free to do. But of course it is obviously false to claim that the premises are tacit.

Ah, the usual libertarian approach. Seek Truth by ignoring facts.

Oh, cunticula answered!

Hmmm, given that I can't read his reply, what's an appropriate reply...

Cunti culi, cunti cula
cunti culi, cunti culaaaa
lie lie lie lie lie, cunti culi cunti cula

:-)

Again, I am confounded by libertarian reasoning. Such sagacity! My interlocuter has bested me. I am at a loss for words.

Cunticula:

"He doesn't believe in Godvernment and Mommy isn't around to beat him up, so I'm going to whine until he goes away".

:-)

(Note: I haven't read his comment -- ignore list -- but based on my experience, I'll wing it and suppose that's a good transliteration of what he said.)

Thanks

Not sure you correctly understand the 51% hashing power weakness.

But that aside the real issue with Bitcoin is the open-source nature in contrast to the closed-source nature of current monetary policy. The result of closed-source is greater information asymmetry amongst market participants leading to inefficiencies in the market.

If central banks attempted to conduct monetary policy through an open-source instrument, like a blockchain, then market participants would adapt so swiftly and severely via algorithms and high frequency trading that it would render the manipulations powerless because there would be no uncertainty in the market place as a result of the open source blockchain.

Statist monetary policy must be conducted in secret or it will not be successful at allowing the rent seekers to take advantage of market inefficiencies as a result of their access to power centers. Look at how vigorously the Federal Reserve attempted to defend Bloomberg (https://en.wikipedia.org/wiki/Bloomberg_L.P._v._Board_of_Governors_of_the_Federal_Reserve_System) when it came to disclosing bailout funds.

The whole "in secret" thing, I can vouch for it.  In my country of origin, there existed (some still exist) quite a few characters who had connections with the money printers (this was before they dollarized the economy).  They got rich as FUCK.  As it is to be expected from a group of official counterfeiters and their scumbag friends.

Their M.O. was, essentially, like this: the counterfeiters would tell their friends "we're about to devalue the currency by counterfeiting more money and changing the peg to the dollar", which prompted their friends to buy large amounts of dollars at the then-official price, after which they would print a shitton of bonds (which they of course eventually defaulted upon).  Which would cause the currency to be worth even less nothing (try to imagine that grammar horror in terms of currency) than it was before.  Then they would repurchase all the money they had sold, and then some, using the bought dollars.  Kickbacks, of course, were the norm.

Insider forex trading for the lose.  Many people lost their homes, cars, businesses, some even their lives, to poverty.  But that was all "okay" because these scumbags made hundreds of millions, hand over fist, until a new president (who was ejected from power in a coup) dollarized the economy.  Now they're trying to bring back galloping devaluation (a national currency they will devalue at will, of course) using bullshit "sovereignity" arguments.

Expect the same to happen with the Fed (except this time the insiders are literally inside the Fed).  I've seen it happen, The Bernank is doing the exact same moves, there is no way in hell this isn't going to happen in the U.S., because it's -- quite simply put, and incontestably so, according to the history of every single statist currency that went bust -- the natural, and malevolent, destiny of paper currencies.  What mathematically cannot continue, will not continue.

Thank FSM we have Bitcoin to hedge against that inevitable upcoming disaster.

You are wrong, because you assume anyone would use a currency with a 51% weakness already in progress, and because your formula doesn't account for the initial investment in hardware required to achieve that 51%. You are only accounting for operating expense with that $212 million.

Are you from Russia?

I am confused (as to why you would attempt to disagree with me given your limited intelligence and knowledge base).

The K value I calculated is the annual capital expense (otherwise why would I include the interest rate and depreciation rate in the calculation?).

You don't understand monetary policy. Changes in the interest rate are announced publicly. The aim is to erode the purchasing power of the unit of the account in order to encourage people to get it out of their hands like a hot potato. The market can't do shit about this (except abandon the currency). Maybe they would like to do that. Fine. That is what the central bank wants. But they have nothing widely accepted to turn to. This is what gives the central bank power.

caligula continues to caligulate on this thread?

I will just regularly send my BTC between my own accounts. Problem solved.

It's interesting to see that there are always people on the Internet who love to try to disparage a topic among enthusiasts. Some call them trolls.

I think mr. krugman brings up a very valid theoretical weakness in bitcoin. However, I do wonder about his intentions. Why would someone invest hundreds of hours and thousands of posts only to try to prove to others that their work will fail?

I enjoy the story of innovators being told that their ideas are flawed and will not succeed; yet it is those who invest their blood, sweat and tears, like Satoshi and the numerous bitcoin developers and merchants, who can achieve, not the naysayers.

The amazing thing about bitcoin is that is has already succeeded. It has survived four years and plenty of Ponzi schemes, hacked exchanges, and bad press. Maybe bitcoin will now replace the Twinkie as one of the two things to survive a nuclear war?

But all hyperbole aside, I don't think bitcoin is bankrupting visa anytime soon. As mr Anderson has pointed out before, it is more efficient to worry about the short term problems before worrying about how bitcoin will survive when it has uprooted the pillars of the global economy and obsoleted the central bank.

x^(a + b) = x^a * x^b, you know! You can't do anything about it.

Stop trolling. Delete all your messages before it's too late.

cunicula has presented a very interesting scenario and no one tried to prove it impossible except by trolling or personal attacks. I'll try to show that it's not so easy as cunicula claims it to be.

You see, the described scenario makes 51% attack very profitable (because the central bank profits off of it). This means that a third party will be very much motivated to claim this power to themselves, so the central bank will be constantly pressured to increase its hash power to compete with the third party, ideally to the point of next-to-zero returns from monetary policy. What do you think about that?

Also this: http://gavintech.blogspot.com.ar/2012/05/neutralizing-51-attack.html
Basically, it says that a crude proof-of-stake can quickly and easily be bolted upon the protocol if and when the attack comes.

Is this a threat?

Haha!

Why would you pay the central bank's exorbitant transaction fees when there are other miners willing to process your transactions for less? I suppose the bank could attempt to use its 51+% hash power to orphan blocks mined by miners not playing by the bank's rules, but couldn't the rest of us simply retaliate? If the bank doesn't play by OUR rules, their blocks aren't recognized. They might have a lot of hashing power, but so what?  They opted not to use that power to gain 51% control of Bitcoin; they instead chose 100% control of Fedcoin (which seems like a strange choice). If that scenario occurs, I think I'll stick with Bitcoin.

I see some merit in what cunicula has to say. However, I don't think any central bank could abruptly gain 51% (and thus, obviously, 100%) of hashing power - it would cause an instantaneous backlash, and there would be an immediate hard blockchain fork with the bank's servers being blockaded (caveat - what if the bank connects over TOR?).  However, in the far future of bitcoin, when many people depend on the blockchain for the salaries and groceries, then a central bank that managed to gain 51% surreptitiously could quite easily begin to levy a tax. They'd have to walk a fine line between rejecting untaxed blocks mined by others, and not arousing too much suspicion. And it would be easier as bitcoin became more accepted as a mainstream currency.

I have to say, the development of ASICs has me plenty worried. Hypothesize if you will a scenario where bitcoin mining is restricted to licensed entities only. Well, everyone can still have their GPUs for gaming, and even FPGAs have legitimate uses. But ASICs that only know how to SHA256(SHA256()) could have only one plausible, and therefore illegal, use. No-one could easily compete on mining, and since building ASICs requires big factories and investment, it would be easy enough to shut down unlicensed manufacturers. Think, the Treasury would be replaced by an ASIC factory.  I would be *very* happy to see the devs change the mining protocol to be ASIC unfriendly, if such a thing is possible; even better would be to make it FPGA and GPU unfriendly, and bring back CPU mining only -- only then will mining be truly fully distributed.

Of course, if this scenario came to pass, you'd still have other miners mining away, probably on an underground black-market blockchain - like I said before: "the blackchain":

Illegal where? Which country's treasury? I think you're falling into the old "Bitcoin only exists within one country, and thus falls under one set of laws" fallacy.

No shit

Please continue this discussion as long as possible, it makes me soooo haappy  :D

I think this hypothetical scenario is unrealistic. The cost of obtaining 51% control is so high that such an investment would be highly risky, given price volatility, especially if the plan is to implement a controversial monopoly which could cause the price to collapse.

As long as the government continues to control its own fiat currency, there's no need for it to hijack bitcoin in the near future. If some misguided policy folks thought it would be a good idea after bitcoin became hugely popular, then there would be a public outcry which would be a costly risk to any politician.

What is more realistic is that a government could hijack bitcoin in order to introduce massive volatility and cause panic selling, in an effort to undermine crypto currencies. However, we have already seen bitcoin survive a massive crash, so I don't know if that would work anyway.

You need to be really careful with terminology when explaining that attack. It isn't "equivalent to a 3% increase in inflation" in any way except that it encourages spending. You'd do better to phrase your argument like,   "Governments use inflation to encourage spending. They could also encourage spending by charging tax on movements of old coins".

I think this is an interesting academic exercise. I don't believe it has any impact on the real world.

As noted by others, this wouldn't be implementable because if a government wanted to try this, there would absolutely be some kind of warning that it was coming. Users would then start bouncing transactions around to keep their apparent age low. It'd be impossible to keep such a plan secret, if only because governments and central banks are set up to be at least a little bit transparent. Meeting notes from the UK MPC for example, are publicly available:

   http://www.bankofengland.co.uk/publications/minutes/Pages/mpc/default.aspx

Anyway, if a government decided it monetary policy was more important than Bitcoin it would simply ban usage of Bitcoin and force everyone back to state issued currency. I don't believe there would be any reasonable argument for doing so, because I believe in a purely Bitcoin based economy there would be no business cycles and thus no need for monetary policy.

If you think about recessions in the recent past (the last 30-40 years or so), how many of them were caused by something fundamental like a natural disaster or disease? None of them. How many were caused by malfunctions of the financial system? All of them.

If you build a more stable financial system the need for centralized economic planning to try and stimulate spending would go away. There'd be no justification for it any more.

One answer: in your country!  Alternative answer: in any country. The attack I outline could be carried out by any country and its citizens could therefore be subjected to perfect financial regulation. Other countries might seek to join that blockchain, or they might have one of their own.

I disagree. Current network hash rate is ~ 25TH/s. BFL says they'll give you 1.5TH/s for $30k in a single box. You'd need only about 20 of them to gain > 50% of the hash rate, that's $600k. Six hundred thousand dollars! So let's suppose someone tries to set up this attack in the future when there are already, let's say, 10000 such boxes already running and connected. You'd still only need about $300 million (ignoring price reductions due to efficiencies of scale, and improved technology) - that'd still be small change to a central bank that's printing, what, $40 billion per month? Suppose there were 1 million such boxes running - that'd cost $30 billion, 8 months of QE3. Let me emphasize, the attack would have to be surreptitious so as not to raise suspicion. ASICs coming online would be the *perfect* moment to implement the attack because nobody will be worried at sudden massive increases in hashes-per-sec.

ASICs will be great for bitcoin if they become truly distributed, but it should be obvious to all that they'll never be as uniformly distributed as CPUs. Any argument on that point?

If civil servants get paid in a particular blockchain, then they'll use it. And if the police understand that their bitcoins become more valuable by beating on 'blackchain' exponents, then you can be sure they'll do just that.

But it is! If attack is successful, then it's equivalent to (transparent) inflation in every way except the position of decimal point.

Fail. Do you know losing 3% twice is the same as losing 5.91% once?

While I generally agree that a stricter, more predictable money supply would reduce the boom and bust cycles, I don't think we will ever eliminate business cycles completely. It seems to me that "easy money" exacerbates bubbles like the dot com and real estate bubbles, but you can still get over-investment without the government's "help."

Remember the Boston Tea Party? These servers will be easy to locate and isolate from the bitcoin network. Block their IPs, and if necessary, permanently.

What is "transparent inflation"?

The proposed mechanism wouldn't cause prices to rise. You're just sucking money out of one part of the system and re-allocating it to a different part. It's a tax that redistributes money, taking it from the market and putting it into the hands of banks. It doesn't cause prices to rise any more than income tax does.

But I don't think there'd be any justification for that. If you assume things like the distributed bond markets get implemented then individuals would probably invest money anyway when good opportunities presented themselves. The assumption behind forcibly re-allocating value to banks is that banks will lend whereas individuals wouldn't. The only plausible explanations for why that would be are asymmetry of opportunity (which can be rectified with better technology) or that the banks would make worse or riskier lending decisions than actually make sense. Hardly a great outcome.


My point was about the systems introduction. There has to be a point before this tax is applied and after it. If people learn about the tax before it is switched on, all the coins will end up with basically similar ages that won't change much and it amounts to a flat tax on savings. This is not demurrage nor inflation.

At any rate, I think this kind of argumentation is a poor use of time. It boils down to "if something external actor with great power forces the rules of the system to change, the rules of the system will change" which isn't a particularly interesting discussion. So what?

My point is that while some groups could hijack bitcoin, if the price collapsed to $1 or less, the investment would become pointless from a financial and influence point of view.

I have no idea how evenly distributed asics would be. They don't yet exist. It all depends on the price of bitcoins. If the price continues to rise, more and more people will be able to afford high end mining gear, ASIC or otherwise. If the price crashes, then ASIC manufacturers may go bankrupt and people won't care as much about hash rate anyway.

You are saying that the government would simply ban bitcoin. Does that make any sense to you at all? If you were in the treasury or a central bank is that the solution you would recommend? Did you read the ECB report? What was the ECB concerned about in order of importance (reread the document if you are confused)

1) Financial Disruption Stemming from Bitcoin Collapse (essentially bitcoin is like mortgage backed securities. There is a bubble and if it grows to big it causes problems when it pops)

2) Loss of control over Monetary Policy

Do you think banning bitcoin sounds like a good solution if the Central Bank's main concern is number 1? No that is a ham-fisted approach. You don't intentionally cause the problem you are most concerned about.

What would a sensible gov't would do? For example, a government that wants financial stability, revenue from seignorage, control over the monetary system, tax enforcement, etc.. Well, how about regulating bitcoin? How do you regulate bitcoin? You mine of course. Then you can have control over the monetary policy, seignorage revenues, control money laundering, tax evasion, etc.

This policy is theoretically more effective at manipulating the monetary system than any tool the gov't currently has at its disposal. Keynes, debating Gisell, dismissed such tools because they were infeasible, even if better in theory. You think the government wouldn't want this new technology? Why not?

Sure, the loonies here talk about collapse and flight to the secret underground blockchain and other nonsense. News for you: If bitcoin were widely adopted, the majority of users would not be libertarian crazies. They would abide by regulations and continue to use the bitcoin because it is convenient and backed by the support of government. Sure the libertarian crazy could go do their thing. No one would care about that. Just like they don't care about it now.

I agree this debate is almost certainly purely academic. Why? Because bitcoin almost certainly will never be widely used. However, if it became widely used, the government would try to regulate quite narrowly. The most obvious way of doing that is as I describe. This is actually a good thing.

There are multiple states in the world. Cunicula, do you think they will all cooperate to launch the 51% attack?

If a 51% attack is launched, and a government gets enough control of the currency to dictate where it goes, how much transactions cost, and how much of the currency is created, then how will Bitcoin be any different from the current central bank controlled fiat currency system? I think a government with your goals would be way more effective if it just slapped a unique id on every dollar, and tracked all the transactions from the central ledger it already has. End result will be the same, and it won't cost a ton in mining gear. Especially since the ONLY purpose of mining is to secure the system in a DISTRIBUTED manner. If the ledger is already centralized, there is no need for mining.

Though, I suspect the people would be a bit upset if they found out their government is planning on tracking every single dollar they spend. In much the same way Bitcoin users will be upset if they found out some entity is trying to gain 51% mining power. Also, you are still misunderstanding how Bitcoin works. 51% doesn't give you the control you claim it does. At most, the 51% holding government will be burning a ton of energy while rejecting almost all transactions and transaction fees and creating orphaned blocks, while the remaining pools will continue earning fees and creating blocks the general population would agree to be valid.

This is interesting, and it seems like a valid defence, though I can spot two weaknesses. First is that having more bitcoin-days is "easily" accomplished by having more than half the bitcoins. So you'd need 51% of hashing and 51% of bitcoins. Second is more subtle. If people get paid (e.g. civil servants) in the govt-approved blockchain, then they'll have to use that chain to spend their money. If there are lots of civil servants, then the govt blockchain will be correspondingly more important.

They'll switch to TOR. Is there any way to block a miner from participating over tor that doesn't involve compromising tor itself?

Not possible with paper money. VERY possible with a blockchain.

Depends proportionately on how many people depend on the govt-blockchain.


Let's pose the problem another way. Suppose tomorrow the US government issued a statement to the effect that they really like the idea behind bitcoin and would be commencing work on a new government-mined blockchain, complete with a new genesis block; obviously with some different mining and block verification procedures. Police, military, doctors, teachers, ALL employees in ALL branches of government would be paid in that new blockchain. How do you see that situation evolving?  Now ask yourself, how is that situation any different from executing a surreptitious 51% attack on the current blockchain?

Actually, thinking about that scenario myself, it would seem to be a much more logical path for government to follow. Hah, I just shot myself down  :o

I think you're exactly right. If the government found the *theory* of bitcoin to be better than paper fiat, it would be simplest to bootstrap govcoin with centralized components rather than try to hijack an existing crypto currency by brute force. Digital currency is a lot simpler if you replace the hashing power with centralized servers.

At that point, people wanting to avoid government inflation could trade govcoin for bitcoin after getting their paycheck.

Ultimately, if one or more governments decided to outlaw bitcoin, they could make things a lot harder for the community, but it would be very difficult to eradicate. Bitcoin won't be able to topple visa without government ambivalence or support.

Dollars are already tagged with unique serial numbers. Just track who took out the paper, and who redeemed it, in the exact same centralized ledger that tracks all the other dollars. Same as with Casascius bitcoins.
Besides, blockchain IS just an accounting ledger. The only difference between it and the central bank ledger is who decides the rules that it must follow.

Yes, any proof-of-stake system of course helps a lot. In this context, the best thing about proof-of-stake, is that it forces the state/organization to provide owners with compensation for seizure of the blockchain (i.e. they have to buy out 51%). That more or less guarantees at least 51% of owners will be made better off by state/organizational control. By comparison, proof-of-work allows anyone to seize the blockchain without compensation.

The secondary advantage of proof-of-stake is that it makes seizure an order of magnitude more expensive. Consider the example I gave before. A lower bound on a proof-of-stake currency's market valuation is the discounted sum of txn fees associated with stake ownership.


Repeating this calculation using stake is difficult because the coin will also have uses as a medium of exchange and a store of value which add to its value. We can just ignore these and focus on fee collection.
capital rental costs=flow of bitcoin payments
(0.05)K=0.001*54.8 billion
K=$1.096 billion.

If we assume a lower interest rate (like in the economy today), then the difference is much more than five-fold. Suppose the real interest rate is 1%.
Then the attack costs are $260 million for PoW vs $5.480 billion for PoS, about a 20-fold increase.

It still won't stop a large state, but it would be a non-trivial obstacle for a private organization.

1) Your formula is still missing the initial cost of mining hardware. You are accounting for 20% depreciation, i.e. cost to maintain/replace it, based on god knows what, while totally ignoring that in a 54.8 billion economy/total Bitcoin valuation, the total hardware that is mining all bitcoins will be worth a few billion by itself. If we assume that current Bitcoin market value is 110mil, and the total cost of all Bitcoin mining hardware currently working is $500,000, or that at any given moment the amount of mining hardware supporting Bitcoin is worth 0.5% of it's total market valuation, then should Bitcoin become a 54.8 billion economy, the amount of hardware that a government would have to buy initially to gain their 51% is over 274,000,000. To that you can add the 54.8 million of 20% depreciation plus your other costs. And, you're right, it's not much, but it does double your initial investment estimate, and it is using lowest estimates and assuming that the mining hardware will be readily available (a big assumption)

2) I have yet to hear a good explanation of how proof-of-stake (whoever owns the most money controls how much is printed and what rules apply) is any different from a central bank (who have stake by default, and simply control how much is printed and what rules apply). If a government entity is supposed to own the biggest stake, then I see no difference from our current federal reserve system (and it's crap like this that makes me think huge advocates of proof-of-stake are shortsighted idiots)

How about you explain your view. It makes absolutely no sense to me. I cannot even understand what you are thinking. If someone says, "all pigs can fly", I am not sure how to go about refuting their argument.
Clearly just saying "this pig can't fly" is not going to work. Perhaps if I knew how you came to the conclusion that "pigs can fly" it would help me to clarify things for you.

OK, step-by-step then:

Proof-of-work means whoever has the most work-producing hardware, decides what kind of transactions get approved, makes the most on fees, and if they get considerably more than 51% of the network, can control the rules of the currency, such as what fee everyone should pay, and maybe even who should get the money and what limits on the total amount of currency exist.
Proof-of-stake means whoever owns the most currency (has the highest stake) has all the power the 51%+ proof-of-work person above has.

Should someone get 51%+ in a proof-of-stake system, they will be able to control what kind of transactions get approved, who gets paid and how much, what kind of fees are paid on transactions, and how much currency can be printed, inflating and deflating it at will.
A Federal Reserve bank has a defacto proof-of-stake granted to it by law, which gives it the power to control what kind of transactions get approved, who gets paid and how much, what kind of fees are paid on transactions, and how much currency can be printed, inflating and deflating it at will.

Aside from having to establish proof-of-stake control by actually acquiring the currency (or starting your own blockchain where you have most of the currency to begin with), as opposed to just taking control through legal means, I don't see a difference. Especially since in the end, both systems end up with a single entity controlling a single centralized ledger that they have complete control over.

Sorry, but that's the most I can dumb it down for you.

Counter 1: The central banks of the world are honestly too stupid and short sighted to compete with the worlds largest super computer - Bitcoin.
Counter 2: The bank would not be able to use their 51% computer on a new chain using a different algorithm. We could have almost identical blocks on each chain and a hundred different chains/algorithms - they would not be able to keep up.

Final counter 3: Block IPs not trusted; all central blocks would then go into thin air - ONE update.

I'm still confused again. Can we rewrite it this way?


Ah it makes more sense now. It is just about who controls the most resources.

Krugman is a clown.  The purpose of savings is to spend.  Savings encourages spending.  A rising bitcoin encourages spending and bitcoin business creation.  Deflation stimulates the economy.

Be careful - don't naively underestimate your opponents' skills. (http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect)

tor (http://www.torproject.org)

Not exactly. POWork control is externalized, POStake is internalized. If you have a majority of currency in POStake, no one can do anything unless you sell them some of your currency. If you have a majority in POWork, anyone can buy hardware to try to take some of your power away. It's the difference between the Federal Reserve being the only one who can coin money (POStake), and anyone with enough resources being able to buy their own money printing presses (POWork).
You know what, never mind. I doubt the subtlety is evident to you.

How does cognitive dissonance apply to a distributed computing project? Better yet, how is a distributed computer incompetent? I think you're missapplying that favorite insult of yours to an inanimate system.

The important differences are

a) PoS monopoly is an order of magnitude more difficult to obtain (perhaps two orders of magnitude if bitcoin is widely used as a store of value rather than just for payments).
b) Acquisition of PoS monopoly requires buying out a majority of the existing user base. PoS attack makes the average user better off rather than worse off. A PoS attack is best described as a lucky windfall. Have you ever had a stock you owned bought out? I'm sure you were really sad to be paid a premium for your shares.
c) PoS monopolists are very heavily invested in the existing system. Charging large fees does not make sense as a PoS monopolist. Such a monopolist cares a lot about losing market share and eroding the value of his holdings. Primarily, he cares about maximizing bitcoin's market capitalization. A PoW monopolist cares about milking bitcoin for fees during the working life of his hardware. He gives nothing to the user base and takes as much as possible.

You mention a small, insignificant difference. I admit it exists. You are saying that once someone has achieved 51% control, then it is more or less permanent with PoS. Sure. But this is completely irrelevant.

If someone has 51% of PoW, you will not be able to generate blocks. Are you really going to invest heavily in worthless hardware to try and save the blockchain? If you fail the entire investment is a loss. What is to stop your opponent from doing the same? If bitcoin is still worth something, then they will have a lot of money to fend you off. Much more than you could get from mining in the normal way (e.g. monopoly fee imposition). If bitcoin is not worth anything, then what is the point of trying to recapture it. For all intents and purposes, 51% control of PoW is also permanent.

Nah, knowledge is useful for pigs as well. You get to watch them ignore it all the way to the slaughterhouse and then laugh uproariously. It is my only pleasure.

I wouldn't use a system that is under 51% attack regardless of whether it's PoS or PoW. As I said earlier, such a system would be no different than the current fiat system, where the Federal Reserve has the biggest stake, and most control.
I see where your issue is. You believe that holding 51% of all the currency in a PoS system will somehow incentivize the stakeholder to protect the value of that 51%. There are two issues with that belief.

First, that 51% is unspendable, since spending any of it would mean you lose your 51% control. Thus, it's worthless as actual money, and is only worth anything as a single "key" to control the currency. As such, you can't value it as "I own $11mil coins." You can only value it as "I own a single bundle that let's me control the economy." The value of that bundle is thus completely different from the value of the coins it contains, and thus may not be affected by the overall economy the way you'd expect.

The second issue stems from the first, which is that, since your controlling stake has a wholly separate value from the rest of the coins you use, a controlling entity is really not restricted to trying to grow the value of its stake the way we would hope or expect. As long as they control their 51%, they are free to manipulate the currency, and implement any rules they want, even if the result is short term profits at the expense of the value of the entire currency falling. E.g. they could increase their non-controlling portion of coin ownership from 50 coins to 100 coins, while decreasing the value of the whole economy to 75%, and still make a 50% profit (50*2*75%), since, again, their 51% controlling bundle is not spendable, and thus does not care what each coin is worth. In short, they can keep deflating the value of the currency, as long as they concentrate more and more remaining wealth in their own hands, without worrying about their 51% stake.

Those two issues are much bigger problems for PoS than PoW, because of what I said earlier: if someone gets 51% in a PoS, everyone is hosed. If someone gets 51% in a PoW, everyone can fire up their GPUs and buy more hardware, and at least have a chance of stopping the problem.

Your pigs are flying again. Why does it seem unspendable to you? Surely if you offer me enough money, I would sell you back your currency. That is a lot more productive an exchange than 'firing up GPUs' to take it back.

You should realize that your knife cuts both ways. If enough honest guys hold coins and refuse to sell, then the PoS currency is unassailable.

Would you willingly give up complete control of a currency? (Especially in exchange for currency you already control anyway) Would any rational sane person?
(I'm assuming by "enough money" you mean some other commodity, since you giving me 100PoScoins for 100 of my PoScoins is a wash)

Of course, everything has a price.

Moreover, I thought the currency was worthless as long as it was under 51% control. You are always saying that. If so, why do we have this guy clinging to worthless crap that becomes valuable again if he just sells half of it. It makes no sense at all.

It will not be instantly worthless. As I keep saying, it will be exactly like the centralized currency of a Federal Reserve, and thus a currency in decline. The driving incentive will be to squeeze and steal as much value out of an economy using your 51% controlling stake, until something comes along to replace you. You can make way more by controlling the currency and squeezing the remaining 49% out of the economy, than by selling 2% of it. And if you don't do it, someone else will. That's the endgame in that system.

lol... this thread was dead at the first reply.

Doesn't matter: If I see a 51% attack and set my client to only trust the mtgox IP for instance then you can fake coming from all the IPs you want using TOR, but that will never get your block on my client.

It's funny I am called the pig here when other posters are displaying such immense ignorance of basic TOR/IP/internet function.

Ever try to nail gelatin to a tree?

Yes, libertarian heads are made of gelatin and I am always trying to nail them to trees.

Are you retarded, or just stoned?

You are the one suggesting that the government will abstain from using a database to pursue taxation goals.

I am the one who is retarded or stoned.

Yes. To stimulate spending, you must increase the cost of spending money. GENIUS!

Yes, I admit that economics can be counterintuitive. It helps clarify things when you consider specific alternative options.

(i.e. in order to avoid being taxed, I will ... )
Then check if your strategy involves spending. If it does, the government has gotten its wish.

Just so I understand, you are completely serious in your belief that raising the required transaction fee will encourage spending?

I am not suggesting the government will abstain. I am suggesting that it will be futile. Like trying to nail gelatin to a tree.
Rarity, is that you (https://bitcointalk.org/index.php?topic=98804.msg1082568#msg1082568)?

I fully expect they will want #2, like with drugs, bittorrent, and illegal websites, and I fully expect they will get #3, like with drugs, bittorrent, and illegal websites.

/thread. Of course, it was /thread all the way back here...

As far as bittorent, most governments don't really care. They are kind of on the fence with this issue. Try uploading pre-screen release movies and you will see a different reaction. Some governments are even very happy with piracy. It means they don't have to pay the US for all the crap the US makes. Instead they can get it for free.

Is the full database of drug sellers available somewhere? I think LE may be interested in that one.

Wow, Rarity seems like a smart guy. Never read that, but I see the similarity in the two threads.

No wonder Rarity was banned. These are libertarian forums after all.

Rarity was banned for trolling. A fate I suspect you are rapidly approaching.

Threats are a good way to [/thread], huh? Are you trying to discuss a substantive issue in the thread? If not, why are you here?

I see no threats. And this thread was over at the first reply. There's been nothing substantive discussed since.

Okay, you are referring to this↓ as the sole substantive contribution.

If that is where you want to take the debate I will put you on ignore and resume the thread from the point where we left off.

Okay, based on this post it seems you have developed some understanding. Greed leads to monopoly because monopoly is always the most profitable option.

The government has three choices:

1) Prohibit Bitcoin
2) Extract Fees From Bitcoin; Regulate Bitcoin
3) Let People freely use Bitcoin without interference.

We can see that, provided the government is hungry for revenue and control, 2 will seem like the best option. 1 will not generate revenue and will cause financial instability. The ECB seeks to avoid this first and foremost. 3 will result in a loss of revenue and control over the monetary system. The ECB seeks to avoid this also. 2 provides control, revenue, and stability. All stuff that governments and central banks like. I understand that you do not like these things and prefer 3. That is called wishful thinking.

What can be done to prevent 2? Nothing very effective, but there are some counter measures. PoS helps to insure users against 2 (i.e. users get a payout from the state if 2 occurs). PoS also makes 2 an order of magnitude more expensive to achieve.
  

Since you're repeating posts, I guess I could, too...

/thread.

Yes

Go ahead.
https://dl.dropbox.com/u/146411/cunicula.jpg

I find that a fairly clear indication of signal to noise ratio, don't you?

I'm going to chime in as usual to point out that I think cunicula makes really insightful posts! I very much enjoy reading them (although admittedly I don't always scrutinize the details carefully).

Thanks, I appreciate your support.  :)

Cognitive bias does not apply to non-cognitive systems. Think again. To my knowledge I don't actually have a "favorite" insult - I prefer to use a variety. Feel free to enlighten me though, a dog never can smell his own scent (or so they say).

Woah, you'll have to educate my sorry ignorant ass here. What, are you gonna ask mtgox to ignore blocks coming from tor aswell? Identifying a 51% attack must needs be based in properties of the blocks mined, not which IP they come from. Andresens' crude PoS, for example, linked in this thread would work on block properties.


I think cunicula means to increase the cost of *saving* money. Though I'm not sure that a simple linear tax on bitcoin-days would do the job.

Imagine a policeman in the year 2040. The state pays him in GovCoins (thx for the name, bitcooper) over which it exerts full control. Would he accept those coins? In the case of a BigGovt, where a sizeable fraction of citizens are paid in GovCoins, do you think a majority of shops and businesses will accept GovCoins? In that scenario, could GovCoins represent a larger fraction of the economy than the (let's assume) outlawed bitcoins? In that scenario, would the government have unprecedented control over, and information of, companies' and people's spending habits? Would it be a 1984-esque situation, only more tyrannical?  If such a situation came to pass, in any one nation, or in all nations, or globally, would you say that bitcoin and blockchain technology are crucial to enabling that situation?

If it helps, I agree with you - GovCoins would indeed be little different from the current paradigm of money of which, I think you'll probably agree, most people are ignorant of the problems.

I tend to compare today's western societies more to Huxley's "Brave New World". But, really, I think of room 101 in 1984 as the "stick" and soma in Brave New World as the "carrot", both getting people to be docile citizens. Put in 2020 if you prefer, I'm sure you did realise that the actual year wasn't the important part of what I wrote.

There are many third parties that can be involved. We the People are not always motivated by profit and can make a 51% attack very unprofitable for any attacker.

TOR is an experimental network with limited capabilities. I doubt that Bitcoin will remain completely anonymous. A 51% attack would require tremendous resources that would be difficult at best to remain hidden and secret.

Cunicula does have insightful comments, and to a certain extent, I agree with many of his arguments. Unfortunately, he suffers from the Keynesian illusions of grandeur and ascribes omniscience and omnipotence to regulators.

Now, to a certain extent, his argument that the government can theoretically "hijack" the blockchain is plausible (I'll leave the economics of it by side). In order for it to work, however, two requirements are necessary which were not addressed sufficiently:

• The control over hashing power is insufficient, control over large parts of auxiliary infrastructure is necessary
• It must be uneconomical for market actors to differentiate between "govcoin" and "bitcoin"

First of all, if someone in charge of "govcoin" decides to force their own blockchain with transaction fees above the market price, the result would be that people won't be able to make payments, full stop. The reason is that the devices generating the transaction need to know about this restriction. At the moment, the transaction fees are partially hardcoded and partially left up to the end-user. The "govcoin" operators need to replace a significant proportion of this infrastructure with devices they can control. This can't be done stealthily.

Second of all, if the only action is to simply set a lower bound on fees, e.g. 3%, the operators of mining pools can simply decide to ignore all transactions and blocks that contain a 3% or higher fee. This would create a fork in the blockchain, and the resulting "govcoin" and "bitcoin" would have a floating exchange rate against each other. Even if the "govcoin" operators can maintain 51% strenght, they can't force anything they want upon others.

There are still open questions, like the exact nature of the transaction fee market price distribution mechanism (which does not exist at the moment), but in general, there are practical logistical hurdles that "govcoin" would need to handle, in addition to 51% of hashing power.

In summary, Cunicula's argument has some merit. It is hypothetically possible to do what he suggests. Therefore, my recommendation is to invest into the creation of open source block analysis tools, open source tools for analysing the transaction fee equilibrium and integrating them into mining pool bitcoind backends. These will allow to detect 51% attacks and automatically mitigate against them.

Nice idea :)  However:


I bet you'll find that most miner's motivations are not exactly that. 

Some other purposes of printing money:  greed, warfare, space program, control of population, to pay off debt (i.e. bailouts), etc.. 

I can see that, in a future with thousands of transactions per second, today's TOR network couldn't supply enough bandwidth. I've run a full node over tor for a long time, and I've never had any problems.

I'm trying to differentiate between *identifying* a 51% attack and *defending* against it. Everybody on this forum will happily wax lyrical about how hard it would be for govt to eliminate bitcoin. And yet, nobody seems to notice the contradiction in declaring how easy it would be to exclude govt from bitcoin.

Good post. I would add that some defence against a 51% attack should be implemented ASAP. If I were a central bank, I'd be buying up as many ASICs as possible to gain > 51% hashing power, or better still, > 90%. For the moment, then, I'd leave them hashing according to the standard rules and not make any hostile moves until I were certain how best to proceed.

I don't think there is a complete defense. However, you can make attacks more difficult and less damaging. You can protect against a 99.999% work attack, but if you do this, you have to allow for 51% stake attacks. There is no way of assuring that only good guys get to vote.

I'd recommend the following approaches:

1) Implement proof-of-stake [drastically increases attack costs; lowers future fee burden on user base; insures users against attack risk] (implementation details to complex to discuss here)
2) Decouple fees and block size [allocating block space based on bidding will not work; Fees are primarily there for security reasons, not scarcity of space. It makes no sense to arbitrarily link security to block size.]
          a) Allow maximum block size to grow with time (say 20% per annum)
          b) Introduce formulaic mandatory fees; enforce fee rules as a block validity criterion (implementation details too complex to discuss here)

The advantage of formulaic fees is that they would reduce the bargaining power of miners to negotiate higher fees.  Miners could still demand bribes to include txns in blocks, but these bribes would have to be separate txns. I think users would find bribe payments more abhorrent than simple fee increases, particularly if there was no user-set fee to begin with.

Formulaic fees also make the mining reward predictable and a predictable reward leads to predictable security. This holds for both PoS and PoW-based systems. Thus even if bitcoin persists with insecure/inefficient/risky PoW, formulaic fees would still be an improvement. The PoW fees just need to be 10 or 20 times higher than PoS fees in order to provide adequate security.

The current limit on block size leads to a very unpredictable security outcome (e.g. onerous fees and high security, no fees and no security, onerous fees and inadequate security, etc.). Of course, block size limits also arbitrarily restrict bitcoin's potential applications.

I guess that depends on where you believe that the power of government comes from. If Bitcoin is the will of the people, then it will happen. If drugs are the will of the people, then they will happen. Look at the prohibition of alcohol. Maybe some faction of a government will declare bitcoin illegal, but that doesn't mean they have the moral imperative. Bitcoin is here, and folks are gonna like it whether it's good or not.

I have an AWESOME idea for how to improve a Proof-of-Work system:

Instead of getting a 25BTC block reward, have everyone who mines a block automatically receive a small mining ASIC instead. Also, make it so that no one can receive ASICs other than through block mining. Want to increase your hashing power and get more mining hardware? Mining a block is your only way. The best feature is that if you manage to get 51% control and process a majority of blocks, you can improve your hashing rate, and control more and more of the blockchain, just by continuing to mine, since you will keep getting more and more mining hardware just by mining blocks. And the great thing is that no one can take control from you, since the only way to get ASICs is by mining blocks, which is something you can do at a way higher rate than anyone else; a rate that only keeps increasing. If you wait long enough, you can even get to control 99% of the blockchain, pretty much by default, and if you want some money, just sell some of your ASICs.

What do you think? In a system like that, it would be fairly easy for someone to get control and then hold on to it and become rich.

Identification is made harder as the attacker could relay blocks and appear to not have 51%.

However: IF the "attacker" is behaving nicely with reasonable fees, no reversals and even allows the blocks of competitors you are not really under a 51% attack.

Identification would be easy once you can't transact, fees are crazy, reversals happen or such.

Excellent point.

While I have many times said it would be "easy" to block a 51% attacker (such as government) it is NOT without cost. By locking out part of the network you slow things down and create forks between clients trusting different nodes.

Unless a full 51% attack is actually being executed, it makes no sense to the individual Bitcoiner to lock out anyone.

You're falling for the ECB leading with a "Think of the children" ploy?

Two points, first is that the point of mining is to reveal bitcoins. Where do you propose these mined bitcoins go? Secondly, Bitcoin is an open protocol, there would be nothing to prevent the govt supplying as many of their own ASICs as they wanted.

What I was describing was essentially a Proof-of-Stake system, where the blocks you mine and the fees you collect are themselves an increase in your stake, and thus as if you are mining for more mining equipment. It really is a piece of shit system.

Rassah. Let's consider your argument seriously. It has some valid points.

You are arguing that PoS transfers additional wealth to savers. It is actually a sound argument. Saving in PoW requires a conscious decision to reinvest mining proceeds. Saving in PoS occurs by default. A wide body of research suggests that setting up default choices for people influences their behavior. See the pop-economics book "Nudge."

Your argument also has some serious weaknesses. Look at the quotation in my signature line, "Does it contain any abstract reasoning concerning quantity or number? No. .... Commit it then to the flames: for it can contain nothing but sophistry and illusion." What your argument is missing is some 'reasoning concerning quantity or number'. In particular, we don't know if the effect you are describing could be quantitatively important. If fees are near-zero, the money given to stakeholders will also be near zero. Thus, the quantitative significance of this phenomenon could be negligible. If so, we can safely ignore the argument.

To make things more concrete let's discuss the phenomenon in terms of PPCoin, the only operational PoS system. PPCoin awards 1% interest per annum to anyone who saves. This is the PoS award. Since fees are destroyed there is no other way for stakeholders to earn money.  How long would it take for a determined saver to double their holdings with this system? 70 years. That is also the minimum possible time for the money supply to double.

I own about 0.2% of PPCoin right now. Let's ignore PoW reward and assume issuance stops today. Let's also pretend that no one else tries to save. I'm the only one. How long will it take me to accumulate 51% from my 0.2% holding? 560 years of waiting. Suppose that everyone else also tries to save. Well, then I never acquire 51% and am stuck at 0.2% for eternity. So the amount of time necessary for me to wait is between 560 years at minimum and infinity at maximum.

I'm not going to live that long and I don't think cryptocurrency will either. Your concern seems to be irrelevant in practice. It is quite silly to worry about something that takes 560 years minimum to become a potential threat. Even the proposed 560 years is silly. It is based on the premises that: a) 20 generations of my descendants save these holdings and pass them on to the next generation. And simultaneously that b) no one outside my immediate family saves at all for the next 560 years.

Dafuc?? Saving in PoW requires a conscious decision to not spend your savings. That's it!

Yes, PoS incentivizes saving, or hoarding, or whatever, but doesn't that also mean it will icentivise a deflationary spiral? Or will the 1% you make by saving be counteracted by 3% you lose on spending as in your OP? And wouldn't that 3% fee plus 1% saving reward mean that no one will want to spend their money any more ever?

I repeat.
'Does it contain any abstract reasoning concerning quantity or number? No. ... Commit it then to the flames: for it can contain nothing but sophistry and illusion.'

Yes, rewarding saving can encourage hording. But numbers are important here. Let's think about the nature of a 1% per annum reward.

You could purchase a television now for $100, or you could purchase it one year from now for $99. You think that you will live in privation for the next year for the sake of a $1 discount?

The $1 discount is an upper bound, it would be much lower than this if other people also save. If so, there will be inflation at up to 1% a year. At the limit, if everyone saves, I get no benefit from saving at all. There is some kind of stable equilibrium in between. I'm not sure where.

As far as a deflationary spiral goes, it is really no different from bitcoin. The additional 1% per annum max is pretty trivial. We could go about analyzing it, but then you need a Keynesian model. I'm not going to do that here because it would be a charade. No one here is interested in Keynesian models (including me).

[Rassah also mentions a 3% fee, but I have no idea where this comes from so I ignore it.]

When you said:


I was going to reply with, "Are you serious?!" and quote this


But now that I know that you apparently are only interested in abstract concepts, instead of real concrete ones, that explains everything about your weird posts. It even (almost) explains you promoting the 1% savings reward, and saying things like even though this reward will make a $100 TV cost $99 a year later, that deflation isn't a bad thing, which is really weird coming from Mr. "Krugman is tired of trying to reason blahblahblah" Keynesian like you.

The linked post is about the central bank and does not mention PoS at all. Sigh, so you weren't asking questions about proof-of-stake? Do you even know what you are asking?

Your argument about deflation is a red herring. If the rewards are arbitrarily small, any type of deflationary effect associated with the reward system is also arbitrarily small. Regardless of whether you think deflation is bad or good, the effect can be negligible. If you want to argue that something is worthy of consideration, you need to make a case that it has a non-negligible effect. You don't seem to understand this.

Also, I am a bit confused. Is your argument based on a dislike for my avatar? I understand that you are a furry. As is referenced in your avatar. I don't have a problem with that at all. More power to you. Do you think it is reasonable for me to base my argument on the picture of the cat in your avatar?

Nope. My argument is based on you being a rude asshole who thinks your specific flavor of Keynesian economic theory is the only correct one, and your belief that anyone who questions it must be an idiot not even worth talking to. That's pretty much been your entire argument on the whole forum. So my entire counter-argument to you will always be, "No, you're the idiot *sticks out tongue*."
Other than that, I honestly can't imagine getting anything substantial or informative out of you. Debate is give and take, point and counterpoint, where each side considers the merits of the other side before refuting them. It's a skill you sadly lack. Either that, or you're trolling.

I find that to be entirely likely. The level of statism in his posts exceeds even the most brainwashed posters I've talked to, and approaches Colbert Report-style parody.

I concur. That is why I added him to my shitlist and he gets no more replies from me. My time is far too precious to squander on the likes of that fool.

Rassah,
If you made some effort to understand cunicula's posts, you'd have realised that the mining business with PoW is very similar to saving in PoS: you invest money into it and are rewarded with newly-minted coins for that.

The differences are strongly in favour of PoS though:
* With PoW minting wastes power, with PoS it doesn't.
* With PoS mining returns are predictable and fair (proportional to the capital invested), with PoW it's more like a gamble (some people make a lot, others take a loss).

I don't know why you must resort to insults instead of making your point clear.

cunicula, I salute your patience!

Rudd-O, myrkul, bad, bad trolls.

If such a patch is coded, how would we know it is applied benevolently and affirm that it is genuine? If a 51% attack is overt, this might work, but it's more likely that such an attack will be covert and not immediately noticed. It would be better to simply guard against it by adding more hashrate. That is not a matter of how, but who will do it?

Cunicula is honestly the only person I blatantly insult like this, and I only do it because that's what he often does to others. I have no problems with stooping down to other people's levels if I feel they deserve it.
PoW separates the functions of saving/spending and mining, while PoS makes them one and the same. Mining returns are just as predictable in a PoW system as they are in a PoS system, but I'm not sure how you believe PoS is more fair. With PoW, you put in more of your own money, you earn more from mining. With PoS, you concentrate your wealth, and the wealth gets concentrated with you even more. PoW allows anyone to buy a small mining device and try their luck at mining, while PoS concentrates mining power among the most wealthy, and makes them even wealthier simply for being the most wealthy. It's about as fair as a tax system that makes everyone who is poor or middle class pay taxes, while giving money to the richest few just for being rich.

Not sure why one needs to make them distinct. Is there a reason?

Well, can you predict what will the buyers of the coming ASICs earn? Will they cover their costs? How large will be their margin? Neither can I.

And here, I invert this statement for you so you see it makes as much sense inverted as the original:


You see, however "fair" you try to make your wealth-distribution system, the rich will always be able to claim their proportion of distribution because they have the proportional amount of power. That problem is not to be solved by cryptocurrencies, and, in my opinion, is not a problem at all!

By the way, I'm not sure about this: do you realise that if everyone mines in a PoS system, the proportion of one's wealth does not change? For example, if I owned 1% of all the coins and you owned 30% and everyone was mining, after some time I would still be owning 1% and you would still own 30%, not making me any poorer, nor you any richer.

I don't even bother insulting him anymore.  An insult is far too precious to waste on that angry shithead.

When the idiot of the forum insults you, remember: that's god's way to tell you that you're right.  ;)

Decentralizing and separating as many functions as possible is a good thing. Easier to upgrade and fix a piece if it's separate, for example.


Yes, I can. We know close to how many ASICs were ordered and how much hashing power we are expecting to have within a month after they start shipping. Yes, they will cover their costs. A Mining Rig SC will earn about $6,000 a month at first, which will taper down to about $2,000 a month after about a year if sales continue to increase. We can't get exact predictions, but we can calculate that if the hashing power is such and such, and the difficulty is at a specific level, the payout will be a certain specific amount. You didn't think miners were just throwing dice in the dark, did you? I know on a certain other forum the general con census is that miners have no idea what they are doing, and are burning more electricity than they make, with the hose that maybe they'll get lucky and make a profit, but that's not how it works. Everything is very precisely calculated and accounted for. For example, I am currently earning exactly BTC5.43BTC a month, and am spending close to $45 for electricity (plus a few pennies).

On the other hand, in a PoS system, those with the nighest savings are the ones who generate blocks. I'm guessing who gets to process a block is chosen at random? How would people pool block mining? How can you tell whether you'll be the one to generate a block? How can you tell if you even have enough money to generate a block? Or is the hypothetical system totally ignoring the concept of blocks to secure transactions, and is just paying everyone 1% or whatever for just having money?


The difference is that I have to go through the effort of taking my mining profits, and actually use it to buy new mining equipment. I also have to compete against others to set up the most efficient miner possible. Or I can let it mine at the same rate, and use the money on other things. And someone who isn't a miner can use their BTC to buy mining equipment and join the mining as well. With PoS, I get a new "miner" every time I get paid. It's automatic. You don't need to work for it, you don't need to compete, you just keep getting richer from simply being rich.



Again, this is assuming everyone mines. I'm not sure that can be the case. Who creates the blocks, whoever has the most at stake? Or is everyone just getting paid?

Oh, just thought of another major problem with PoS. Mining has two purposes: securing transactions, and distributing coins. Anyone who wants to make coins can buy mining equipment, and thus coin generation is available to anyone with money. PoS, on the other hand, only gives coins to those who already have them. That's not a very good method of distribution I don't think.

I actually agree with this point. The PoW distribution is an effective marketing device (although ASICs kind of break that; scrypt is better for this reason). There could be other free hand out mechanisms that work however. I don't have a problem with initially distributing all coins to PoW miners. I just would like to get this over with quickly, say in the space of 1 year. I also propose that PoW function solely as a mechanism for free handouts, not as a txn verification service.

If you want to bootstrap a network, you should initially give some handouts to consumers. You should also initially give handouts to businesses. PoW mining gives handouts to consumers, but fails to give any handouts to business. To solve this, I would propose that PoS miners select businesses for initial handouts through a majority voting procedure. As it stands now, we have lots of people threatening to 'money bomb' businesses to accept bitcoin. Unfortunately, these are empty threats. Voting would make the threats enforceable.

Here is a paper on a closely related issue. It discusses efficient provision of subsidies for technology adoption in commercial banking:

http://www.u.arizona.edu/~gowrisan/pdf_papers/netstruct.pdf (http://www.u.arizona.edu/~gowrisan/pdf_papers/netstruct.pdf)

Well! This thread has certainly got us all thinking about the robustness or lack thereof of various cryptocurrency designs! Cunicula's opening post paints (possibly provocatively or tongue-in-cheek?) a central bank's hypothetical successful 51% attack as a good thing. I think most of us on this forum would disagree. We want our cryptocurrency to stop any would-be central bank / central planner from saying "you can only spend your coins in a style approved by our macroeconomic policies". (In just the same way as we want it to stop a present or future PayPal from saying "you can only buy what we think you ought to buy, and donate to who we think you ought to donate to". - Or, more precisely, they can say it, but we can reply "we don't need you any more".)

That's what we want. How do we get it?

For attacks falling short of 51%, there's some mileage to be had in changing the "proof-of-..." choice from one thing to another. Proof-of-work, proof-of-stake, proof-of-activity... they all have interesting advantages and disadvantages and are all debated vigorously in various corners of this forum. Indeed, I'm planning to add to the list myself real soon now, with something I call "proof-of-burn". But they all crumple under a 51% attack. (That includes my proof-of-burn too! It's not immune!) So, when facing an adversary wealthy enough to acquire and use 51% of whichever "proof-of..." resource is being measured by the network - hashing work, stake, burn rate, signature activity, you name it - we need new techniques to stand up to such an attacker.

I think the good news here is that a 51% attacker's chain has to behave visibly strangely when excluding "technically fully sensible but politically unapproved" transactions, such as the "no, I'm not going to pay your coin-year-demurrage level of fees!" transactions Cunicula's example central bank would like to exclude. Such transactions sit in every node's memory pool. Then, every time any such transaction gets into a block (mined by an honest miner who's perfectly happy with its "ordinary" competitive-mining-market-clearing level of fee), the winning chain always ends up building on the previous block, orphaning the honest block and orphaning the transaction back into the memory pool. Whereas, every time no such transactions get into a block, the winning chain always ends up building on that block - it being a block produced by the 51% attacker (or by an honest miner who happens to have inadvertently followed the attacker's policy by happening not to have included those transactions for whatever mundane reason).

This behaviour is visibly strange in a statistical sense. It may not seem strange the first time, or the second time, or the tenth time, but as the politically-unapproved transactions hop in and out of everyone's memory pool more and more often, it becomes ever more absurd to ascribe their exclusion to bad luck.

(Contrast this with an attack whose motive is double-spending, rather than political control of the cryptocurrency. In the double-spending scenario, the network has no real opinion about which of the incompatible transactions ought to succeed and which ought to fail. An attacker can choose whichever one profits them and hurts the recipients[-until-later-reversed] of its double-spending sibling(s). Recipients just have to learn to wait long enough that even the attacker loses interest in further reversing their own chain - their own reversal-attack upon some earlier apparently winning chain - to that block-depth extent. But in the transaction-excluding scenario, the network's honest users do have an opinion about which treatment of the single [no double-spending siblings] transaction ought to succeed and which ought to fail. Namely: the transaction's presence is what ought to succeed, and its absence is what ought to fail!)

This visibly strange behaviour opens up the possibility of a "heuristic defence". I'm certainly not claiming I have such a defence in polished form ready to implement; but in broad outline, nodes would try to compute a "probability (or plausibility) rating" for each new block they encounter. How long has an in-again-out-again transaction been in (and out and in...) my memory pool? What fraction of my network neighbours agree it's been stuck like this for ages? (And recursively, can they report the statistics of their neighbours' opinions, in cheap aggregated form?) If it's ever more obvious that essentially the whole network knows about it, it becomes ever more ridiculous (exponentially so, I'd suspect) to believe that a whole sequence of miners can have not heard of it. Even more so, since it was sitting there inside an expensive object to produce - namely, a later-to-be-orphaned block produced by an honest miner - and a thousand websites could spring up, listing (unfakeably! the orphaned blocks are expensive things to produce!) all the transactions therein that are compatible with, but mysteriously excluded for ages by, the current winning chain.

The naive height-strength (difficulty or its proof-of-whatever equivalent) of a block would then be multiplied by that probability or plausibility rating, and it would be the sum of such plausibility-adjusted height-strengths, not the sum of the naive strengths, which would be used to judge a winning chain.

Yes, this does have the danger that different nodes would compute somewhat different plausibility ratings to multiply naive strengths by; and network consensus convergence could be placed in jeopardy if their opinions were too divergent. So, one would not want to be too eager to deprecate a block by a large factor. Still, in really extreme cases (say down into one-in-a-million territory for a transaction to have been excluded by bad luck - the power of exponential shrinkage means we get down there quite fast!), a sizeable deprecation becomes sensible (e.g. if we deprecate by the sixth root of plausibility, the attacker's blocks are deprecated by a factor of 10 in the one-in-a-million example - enough that 10% honest miners win out over a 90% attacker).

So... there's hope for us yet! Even with a billionaire central bank as adversary!

(A final note: who's running those "thousand websites" [or tor-sites... whatever] listing the suspiciously excluded transactions? Well, anyone can set one up; and serious, big full nodes, such as those run by serious professional miners, should be eager to subscribe to such sites, for a micropayment or subscription fee or the like if necessary. After all, if you're a miner, and you know that other nodes are going to deprecate your block if you don't make an effort to include that gaggle of suspiciously excluded transactions, that's a powerful incentive to keep yourself up to date with the general state of play! - And yes, we should of course aim for the network itself to achieve such functionality, without external sites' involvement. Perhaps nodes could report to their neighbours a standardised-mathematical-language set of reasons why they attached such-and-such a deprecation factor to such-and-such a block? The challenge would be to handle one's neighbours' reasons-descriptions in a way that, while stopping short of naive slavish agreement therewith, still encourages a helpful consensus to emerge.)

This seems to be yet another example of a fundamental moral flaw in the understanding of game theory. It's called Proof of Work, not Proof of Entitlements. The block rewards are not a hand out, they are earnings for the work put into the network. No individual or business is guaranteed to make a profit and they shouldn't, but the rules still have to be fair for everyone.

I'm not sure how an ACH subsidy scheme for large and small banks relates to Bitcoin. The analogy is lost on me. Bitcoin is a fully automated ledger. Network management is a well established art. Mining businesses are able to work transparently. Network administration determines the profitability of mining. No subsidies required. Bootstrapping notwithstanding, few miners are currently in business to make big profits and instead are speculating on the growth of network capitalization and probably will do so for the next several decades.

I'm kind of skeptical of these types of voting rules.

My concerns are:
a) If the voting rule is explicit and fixed, it can likely be exploited by the attacker. He will just need 51% of something or a combination of somethings.
b) If the rule is implicit and flexible, it will be hard to reliably generate consensus.
c) Complex rules are hard to model reliably.

If you are interested in these kinds of schemes you might check out the recently updated:
https://en.bitcoin.it/wiki/Proof_of_Stake (https://en.bitcoin.it/wiki/Proof_of_Stake)
I added proposal which I believe to be more promising than anything else I have suggested so far. It is based on the PoA discussion with iddo.

Game theory is amoral. I don't understand how it can have a moral flaw. If you prefer to call handouts a work subsidy, that is fine by me. If a business got a work subsidy, it would be because 51% of coin owners voted to give them one.

Example: Suppose 3% of all block reward was sent to newegg. In exchange newegg agrees to adopt bitcoin as a payment method. Your BTC balance would decrease by 3%. However, the worth of your BTC in USD would probably increase by much more than 3%. This would make you better off. The 'handouts' for business are just mechanisms to enable bribery. Does this seem morally wrong to you?

I know 'taxation = theft', etc., etc. 'I shouldn't be forced to pay newegg'. Seems like stuff & nonsense to me.

What's so special about newegg? I would prefer (as most probably would as well) to do business with a company that chose Bitcoin based on its utility, not for a subsidy. Herein lies the morality of game theory you don't get.

Nothing is special about newegg. It would just be a large merchant that accepts bitcoin. It is a common place to spend money among the bitcoin community. So there is a strong possibility that adoption would be self-sustaining after the subsidy is withdrawn. That is the goal of these subsidies. To enable something good to happen that might not occur otherwise.

Okay, it is true. I am trying to maximize success probability. I do not care whether the means through which success is achieved are moral or immoral. Even if I did I probably don't agree with you about morality.

Hello Iain,

great insights from you as usual. I just have one addition. I think that on a theoretical level, it is easier to distinguish attacker's blocks from normal ones than you portray, because the attacker has a particular goal in mind, which is by definition distinct from that of the "good" participants. He cannot reach the goal without exposing the method by which he is reaching it. So theoretically, it is always detectable, and can be mitigated against by the genuine nodes, irrespective of the exact mining algorithm (PoW/PoS/PoB/...).

The question is then more practical, the defence needs to be sufficiently quick, and sufficiently effective to allow the "good" blockchain to continue. It does not need to be immediate or 100% successful, or outcompete on mining. A fork is also an acceptable solution, indeed, it might be a better one than trying to outcompete the attacker on mining. The result would be two competing blockchains, mutually incompatible, which will economically lead to a floating exchange rate between them.

In order to avoid ideology in the block assembly mechanism, my personal recommendation is then to detect deviations from the market equilibrium. This results in greater predictability, as well as providing a reason for people to continue preferring Bitcoin. Even if Cunicula has other plans, all other things being equal, people do not choose a medium of exchange which they themselves would be prevented from using the way they want. If he wants to implement features that screw people over, as long as it is distinguishable from the legitimate Bitcoin (and doesn't have sufficient other advantages, such as liquidity or transaction costs), it would not be able to replace Bitcoin. Some masochists or luddites might use it but that's about it.

My alt-chain scheme is detailed here:
https://en.bitcoin.it/wiki/Proof_of_Stake  (https://en.bitcoin.it/wiki/Proof_of_Stake)

If you read it, I think you'll find that it is not a Keynesian scheme at all. If you think otherwise, please let me know why.
 
My hope is simply to reduce effective transaction fees to near zero for users that maintain active nodes. No inflation tax. Negligible transaction fees. Blockchain secure against 99.999% PoW attack. Many active nodes. Limited losses in the event of private key theft. Those are my hopes. I don't think bitcoin can give us these things. If I did, I would not have bothered to make a new plan.

I don't work for a central bank. That is not my job. I'll let them worry about Keynesian stimulus. I could really care less. I'm just letting you know how I think central banks would regulate the bitcoin system.
Central bank intervention will only happen if cryptocurrency grows sufficiently to compete with national currency systems. If that is your goal, then you should have some sort of plan. Good luck.

I am more concerned about cryptocurrency growing to effectively compete with PayPal, Western Union, Visa, and Mastercard. I think the developers may not believe that bitcoin is capable of doing this.
http://www.reddit.com/r/Bitcoin/comments/13jj0d/in_favor_of_not_increasing_the_block_size/ (http://www.reddit.com/r/Bitcoin/comments/13jj0d/in_favor_of_not_increasing_the_block_size/)←This worries me. I think they are at least partly hamstrung by an absurd attachment to PoW.

The fear about a Central Bank monopoly on Bitcoin is irrational. Central Banks power has waxed and waned, but it only happens when they appeal to people's fears about macro economics. We don't have powerful central banks when money is backed directly by gold. The problems with central banks enter when they have the power to print fiat money. They have done this in the past by appealing to stupid politicians that were elected by their public popularity. Somehow, there is a notion that central banks will find a way to aggregate computer engineers to develop a bulletproof bitcoin monopolization network. Here's the thing: nobody likes these guy and people smart enough to put this together would not do it for those assholes. CENTRAL BANKS WILL SOON BE HISTORY. Bitcoin is their extinction level event. It's time for money and politics to evolve beyond keeping the public ignorant about how things work and time to make information about money and commerce transparent. If there is ever a threat to bitcoin, it will not come from old money or central banks. It will be from civilization no longer needing money.

Some more PoS concerns:

Fees on keys that do not maintain active nodes? How will "active" be determined without exposing the key to being traced to its IP address?

Right now, if I'm one of the wealthiest Bitcoin owners, all I need to do is keep my private key safe, and pay a fee to whoever wants to do the mining to be able to spend my money. I can mine myself, but mining for coins isn't the main reason for cryptocurrency, and I would much rather leave that to professionals. With a PoW system, I would be almost obligated to mine using my large wealth, with means also keeping a copy of the whole blockchain, and making sure my private key, which would otherwise be stored on a paper somewhere, is exposed to the web so it can keep mining.

The idea that to gain 51% of control in PoS is very expensive is quite wrong.
PoW has mining pools. A pool operator makes money by providing a central mining point, but if he proves to have bad intentions, or his pool gets over 51% hash rate, miners point their pools elsewhere.
In a PoS, the wealthy owners have a higher chance of signing a block and earning a reward. People will likewise pool their resources together into a single account in hopes of getting a more steady reward, and the pool operator will likewise have incentive to set up a pool and make money off of it. However, if the pool operator turns out to have bad intentions, or gains 51% of the hash rate, the owners are at the mercy of the pool operator, and only hope to get their coins back.
I think recent Bitcoin history has proven that people are quite willing to give their coins to someone if they can give them a good return, and when you pair that with the mining pool idea, I think it would pretty much be a guarantee.

Your IP is just as exposed when you send coins using bitcoin. If you are paranoid, there are mitigation strategies for this:

Connect to large numbers of nodes simultaneously. Use a VPN. Buy a VPS and run a node from it. Potentially use Tor. Share your stake signing key with an online service that maintains a node for you. The service would takes a cut out of your interest (likely very small).

If you are really paranoid, then just eat the tax and lose 5% of your stored balance annually.

The network is bleeding from loss of nodes right now anyway. P2P doesn't work without peers. You need incentives to be a peer. If you are going to be selfish and allow the network to deteriorate, you need to be punished. Otherwise, the network will continue to decay until it cannot support robust transaction transmission anymore.


I guess you didn't read this part:
If you missed it, this means your theft risk is limited. The root key can be kept secret from the pool operator and used to reclaim coins if the stake signing key gets stolen. You don't need the root key to run a node.

The online storage service could steal up to 10% of your coins if you have a tiny balance. Much less if you are storing a significant balance. For example, if you are storing 1% of all extant coins, then you will get an opportunity to sign about once every 34 blocks on average. This limits your potential loss to about 0.07% of your balance, provided you detect the theft instantaneously.  0.3% if you detect the theft within one day.

Anyways, widespread use of online services is bad for the network. It should not be encouraged. Most people I have talked to perceive the decreased attractiveness of online services in this system as a feature, not a bug. The theft risk is there for to discourage the unnecessary use of online services. You could get rid of theft risk entirely. That is not a good idea. It will lead to very few nodes and would facilitate acquisition of signing keys for attack purposes.

Whether I have set the theft risk too high or too low is open to debate. What would you suggest as suitable parameters for k and t?

This wasn't the topic of your thread. I made no comments on PoS, because I haven't analysed it sufficiently to make up my mind. I prefer to refrain from commenting on something I don't understand.

I just have one minor comment, I like PoW because it makes sure that the marginal costs trail the market price. Without this, I think the system would not be stable. Maybe PoS does it too, maybe it doesn't, I don't know. But to object to PoW on account of the costs being too high (as I deduce from your random remarks) has no economic foundation.

Also, PoS isn't the only alternative, there's also Iain's "Proof of Burn", and Andrew Miller talked about a yet another mechanism during his talk at the conference in London.

I'm not so sure. If a large stake-holder could ruin the value of the current blockchain, they might increase the value of their own blockchain or their own fiat currency as the case may be. It would remain to be seen whether they would enjoy a net surplus in the process. Of course, this would require bitcoin's market cap to be comparable to (e.g., if we're talking about fiat US$) US GDP. At that stage, presumably, the bitcoin network would be unassailable by any earthly economic power.

Cunicula, I don't entirely understand your proposal. Correct me if I'm wrong - you're suggesting that people that run a full node *AND* engage in heavy mining get to preserve their stake. In your scenario mining contributes to the network security, as does running a full node with full blockchain history. So then, what about people that only maintain a full node without running a mining op? I'm sure I misunderstood.

You referred to me having some vague but wicked Keynesian plan. This is baseless speculation. My plans are explicit and public (see wiki). They are not Keynesian plans. Read them. Your speculations are completely unjustifiable. If you don't want to hear 'random remarks' about what my plans are, then do not spread false rumors.

Yes, you misunderstood. PoW miners need to run nodes. This part is right. But these guys are unimportant. The most important part is that coin owners run nodes. The coin owners don't need to mine at all. Here is a greatly simplified rundown that may clear things up. There are extra details in the wiki, but this captures the core idea.

1) Guy with his mining rig finds a hash that meets the difficulty target. The hash provides a hard to manipulate random number seed. Creating this seed is the PoW miner's only real contribution.
2) The random number seed is used to draw five lottery winners from the universe of coin owners. Your chance of winning the lottery is proportional to your coin ownership.
There is no practical way for the miner to control who wins the lottery. He could maybe pick one winner, but not five simultaneously.
3) The miner says, "Hey, I've got this block, but it isn't valid until I get the go ahead from these lottery winners. Without their permission my block is just useless garbage. It can't go in the blockchain."
4) The miner sends a message through the network announcing that he needs to make contact with the five lottery winners.
5) The lottery winners hear the message if they are running nodes. If all five respond with their sigs, then the miner can proceed to put a block in the chain. If not the block is invalid, go back to step 1.
6) The miner puts the block in the chain together with sigs from the five lottery winners.
7) We have extended the blockchain by one block. The lottery winners get some meaningful rewards. The PoW miner receives some table scraps. Back to step 1.

Why do this? How does this arrangement help?

This procedure makes double-spending impossible even with an ungodly hashrate (say 100000 Terahash). This means that a tiny hash rate suffices for the entire network. To double spend you have to mine a sequence of blocks in secret. With this system you can only mine if you announce your block in public first. You can't double-spend if you announce your double-spending publicly. It does not work. The random lottery winners are not going to sign your funky old attack blocks, so you cannot construct them.

How could you double-spend? Well, first you have to find a hash that meets the difficulty target. Then you check if this hash won the lottery five times in a row. If yes, you can use this hash to construct one secret block. If no, then keep looking. How many valid hashes do you have to find to identify attack blocks? It depends on how many coins you own. If you own 1% of all coins, then you can make one attack block for every 10 billion blocks you find. Good luck with that. If you own 10% of all coins, you can make one attack block for every 10,000 blocks you find. Of course one attack block is not enough. You need to find 6 attack blocks before the main network does. This is hopeless unless you own a near majority of all the coins AND have more hashing power than the rest of the network.

One more "key" issue: Where do the rewards come from? How is this safe from theft?

1) There is a system for tracking keys that are not associated with active nodes. [People who fail to report as lottery winners when they are supposed to]
2) These guys get taxed at a rate of 5% of their balance per annum. The tax continues until they associate their key with an active node.
3) The rewards from taxing these people generate the fees that are distributed to people who keep their nodes up.
4) You can avoid the fees and keeping a node up by keeping your coins in an online wallet.
5) If your key gets stolen from an online wallet (or your home computer) you lose up to 20 BTC max or 10% of your btc balance, whichever is smaller. The rest can be reclaimed as soon as you learn of the theft.

Yes, the central bank has to be the richest person in the room in the case of PoS. More than this, they have to personally own the majority of all wealth. Yes, this (almost) guarantees honest behavior.

Don't just worry about the central bank. This is only a legitimate concern if bitcoin gets big. In the near future, worry about any person or group that wants to make some money and has the means to purchase some ASICs.

Under PoW, if you want to make things difficult for entrepreneurs, you have to bleed the user base with fees. i.e. you have to become paypal to stop paypal from buying you. If you are already operating a paypal like regime, then there will be no returns at all to corporate raiding. If you are not operating your regime like paypal, prepare for a corporate raider to introduce Paypal style management. PaypalStyle (someone should make a GagnamStyle parody)

BTW: A corollary here is that double-spending is not a realistic problem. If someone has 51% of hashing power and they use it double-spend, that person is a complete idiot. The revenue you can gain from milking accounts for demurrage is much greater. [This does not apply to alt chains. The time horizon is much shorter in this case.]

PoS means that the corporate raider loses the incentive to operate like paypal. He will care about market share and long-term growth, not about margins. With PoS you maximize your returns by growing the network and benefiting from appreciation. What is good for the proof-of-stake monopolist is also good for his user base.

As a thought experiment, suppose there are two competing cryptocurrencies, one based on proof-of-work and one based on proof-of-stake. Both currencies are controlled by monopolies. They would like to attack each other to gain market share. Assume they have equal market cap. The proof-of-stake monopoly can simply sell some coins to finance mining investment, 51% attack, and then tax the proof-of-work currency to destruction. The proof-of-work currency holders will lose their entire investment. The proof-of-stake monopoly will gain market share. The proof-of-stake monpolist's coins will approximately double in value. By contrast, the proof-of-work monopoly is impotent. They could buy out the proof-of-stake monopoly and shut it down. In either case, the proof-of-stake monopoly profits.

Now ask yourself, in this setting do I want to be holding the proof-of-stake coins or the proof-of-work coins?

First of all, look at the title of this thread, which you wrote yourself. Second of all, you made several comments in the past where you said that this or that person need to be forced to behave this or that way. You bitch all the time about "libertarians". This type of thinking permeates through your anti-libertarian pro-statist ramblings.

Even though I consider myself an anti-statist, I typically go at great lengths to not formulate my arguments in a way that their validity depends on the hatred of the state.

Many of your arguments, however, fail on this neutrality. Their validity pre-supposes that the activities of the state are economically beneficial or at least ethically permissible. Your very first sentence in this thread is


This is keynesian pseudoscience, akin to the argument that the purpose of blood letting is to cure disease.

Similarly, your last paragraph in the original post


indicates that you approve of this.

That's why people say you have a Keynesian plan. Your mistake is that you believe the monopolist will actually know what is good for himself and for everyone else, and won't fuck up. Also, I STILL don't see a difference between a monopolist using some convoluted blockchain mining scheme to control and distribute currency, and a central bank just running a single centralized ledger to do the same.

I think part of this is that economics is a positive and not a normative science. Economists are trained to talk and think like we are indifferent between outcomes and make predictions based on economic theory. This scares people who are not accustomed to it.

My plan is not for the central bank to own all the coins. I just predict that, if bitcoin et al. are too successful, it will end up that way no matter what we do.

I am a realist and a pessimist. These two characteristics go hand in hand. Blablablah for example understands what this means.

Also, I don't think the central bankers will know what is best. They are fuck-ups just like the rest of us. However, if they are going to make choices for us, I would much rather that they also lose something when they fuck up. Thus PoS as opposed to PoW. Same goes for companies that many take us over.

It is very frustrating talking to idealists. If I don't think your ideals are practical, then you think I am plotting against you.

You should look and think strategically before you leap. You should also learn how to analyze situations from the perspective of your opponent. Otherwise how will you get good at chess?

Look over in this thread for example: https://bitcointalk.org/index.php?topic=127087.msg1349225#msg1349225 (https://bitcointalk.org/index.php?topic=127087.msg1349225#msg1349225)

Is promoting that a good idea or is it unwise?

Perhaps in that case the issue is that you are too much of a defeatist. You think, "well, all this crap will happen anyway, so let's just let it and figure out what to do when it does," while others think, "all this crap has a damn good chance of happening, so let's figure out what we can do to prevent it in the first place." Very subtle difference.

Ah, but I am telling you what should be done. You just don't want to listen because it is unpleasant to hear.
I'm not promising that it will work against any possible opponent because I am not a snake-oil salesmen.

Consider BFL for a moment.

They claim to be able to construct "mini-rig SC" that has a 1.5 Terahash output. They plan to sell these at retail for USD $30,000. I would guess that the marginal cost of each unit is at most USD $10,000. Most of the expenses are all the R&D and prototyping that needs to be done to manufacture the first unit. Once those steps are complete manufacturing costs will be very low.

What does this imply? It means that after they have a working prototype, BFL will have a lot of power over bitcoin and strong incentives to expropriate bitcoin owners.

They could decide to pump out 20 of their units at a cost of about USD$200,000. That $200k will be enough to 51% the bitcoin network. Say they do this and use their power to implement a 1% tax on all txn inputs.

Now, you will say that doesn't matter. If bitcoin gets 51%'d then bitcoin's value will drop to 0 instantly. Are you sure, what if there is a 2% chance that value only drops to $5 and a 98% chance that it drops to 0.

Okay so now consider the scenario where bitcoins are worth $5. Total output volume is over 1 million BTC. So BFL could earn 10000 BTC a day doing this. And that is on top of the 3600 BTC a day they would earned through mining. With our new value of $5 that is USD$68,000 a day in revenue.
Say then keep this up for 1 year. Will they want to 51% bitcoin? Yes.

Their expected profit will be 0.98*(-200,000)+0.02*(-200,000+68,000*365)=USD$296400. That is a 150% expected ROI. Not bad. And this is assuming a 98% chance of complete and total loss.

Now, you will say that doesn't matter. BFL can earn more from selling rigs. I agree completely. But they don't have to pick one or the other. They can have their cake and eat their 51% attack too. They can sell $2 million dollars in rigs. If they do this, then they will be able to produce rigs en masse. As they expand production, marginal costs will fall certainly fall below $10k per rig. Let's say they drop to $5k per rig. Now BFL made a bunch of money from selling rigs. However the market is saturated. Mining is not profitable. What should BFL do to turn a profit now? They certainly can't sell any more rigs. A 51% attack of course.

If they have sold $2 million worth of rigs at retail, then the aggregate hashing power will grow to at most 125 Terahash. To take over, BFL will need to make 83 rigs for themselves to operate. At the reduced marginal cost, this will require USD$415,000 of investment. Use the scenario from above. Should BFL 51% the network?

Their expected profit will be 0.98*(-415,000)+0.02*(-415,000+68,000*365)=USD$81,400. A 19.6% ROI, not eye-popping but still worthwhile. And this is assuming a 98% chance of complete and total loss.

What do we learn from this? If we think there is even a very small probability that bitcoin will retain positive value after it gets 51%'d, then greedy hardware manufacturers should 51% it. Is it reasonable to think that bitcoin will retain positive value? Sure. You yourself said that 51% PoW attacks are reversible. If so, bitcoin price dropping to 0 will be a superb opportunity to buy up cheap coins for you. Think of it, USD$0.10 bitcoins.  Wouldn't you be a fool not to buy them? Even if you don't won't someone else? A year later when the 51% issue is fixed, you could be a rich man. (Of course you will have helped BFL get rich in the process)

Well, if instead we use the scenario that a 51% attack causes bitcoin price to drop to USD$0.10 with certainty, all the numbers are exactly the same as before. Attacks are still profitable.

Maybe BFL are altruistic. Fine. Maybe they are. The convicted felon CEO who defrauded the elderly out of millions of dollars may have turned around. It is certainly possible. This isn't a one time thing though. Will the next hardware innovators be good guys to? What if they are a state-owned company in China? Do you know how amoral those guys are. They seize children from their poor families for sale on international adoption markets. No joke. Do you think they will bat an eye at expropriating bitcoin owners in the US? Do you think the US gov't will care if this happens. I sure don't. You should also keep in mind that as the block reward drops the profits from selling hardware on the open market will fall. The profits from 51% attack however will remain approximately fixed. That is not good. Not good at all.

That is why I suggest PoS. With PoS, the average coin holder makes a profit when a 51% attack occurs. That type of insurance is a very good thing. Also, attacks aren't possible without spending say USD$60 million and up. That's a good thing too. Yes, attacks can still happen. That's too bad. However, just because you can't fix everything does not mean you shouldn't try to fix as much as possible.

If someone has a better suggestion, I am all ears. However, I will not listen if someone says we can wait until the attack occurs to worry about the issue. That is ridiculous. You won't be able to fix something like this on the fly.

cunicula: having 51% doesn't imply they can make a 1% tax on all sends. They could enforce it by not including transactions with a fee less than that, but that would have the net effect of blocking transactions that didn't conform rather than keeping activity as normal and adding a fee on top of it. In other words, they would have to be very explicit about what they were doing, and we users of bitcoin would have to be complicit in accepting this new tyranny. I think we wouldn't be, and this is one case where if it happened, blockchain activity would be interrupted and we would be forced to add on something like a proof of stake or checkpointing or web of trust block publishing approach. I don't think value of bitcoin would go to 0 in this case, and I think any serious analyst of bitcoin views this exact sequence of events as likely sometime in the next 5 years of bitcoin's evolution.

As far as the thread title go, great trolling. You're a confusing dude, I had thought you were mostly a troll until I read your PoS proposal.

-bgc

Yes, bitcoin users would have to be complicit. True. The problem is that if 50% are complicit and the other 50% just refuse to send coins out of protest, the attacker still makes money. It makes sense to be complicit if you care primarily about your own personal welfare. I think we have a different worldview. I was under the impression that most of the community is selfish.

Watch the protesters break ranks as the exchange rate tanks. (sounds like a fitting rhyme, for my signature line, what do you think?)

Yes, bitcoin users would have to be complicit. True. The problem is that if 50% are complicit and the other 50% just refuse to send coins out of protest, the attacker still makes money. It makes sense to be complicit if you care primarily about your own personal welfare. I think we have a different worldview. I was under the impression that most of the community is selfish.

Watch the protesters break ranks as the exchange rate tanks. (sounds like a fitting rhyme, for my signature line, what do you think?)
[/quote]

I believe everyone acts selfishly, so while I am sure we have different worldviews, thats not a point of difference for us. Here, I think we disagree on how to maximize our personal gain in the event of a 51% attack. For me, my money in bitcoins is half speculative investment and half aiming towards time-value-of-money benefit for recurring costs like cell phone bills, etc. In the event of a significant drop in exchange rates I would simply not spend bitcoins and use dollars instead. Bitcoins have 100% downside potential and probably 100,000% upside potential, and I treat them exactly like I would any other investment with those properties, with the added strange liquidity of being able to sell them for goods and trade fractional amounts.

In the event of a 51% attack as you outline, there would probably be a blockchain forking, the 'old' or 'real' bitcoin chain would keep the same rules but have the meta-rule of transaction fee requirements to the PoW monopolist. The 'new' blockchain fork would have some new concrete rule that would work against the simple PoW monopoly attack. In this case, the exchange rate for the new blockchain would likely be 1/20th of whatever the rate at the time of the attack was, but it would retain the upside potential that the 'old' chain lost in the monopoly attack and after proving itself viable to attack for another 2-3 years, would most likely acquire similar or even greater exchange rate viability than the current bitcoin network.

Bitcoin at the conceptual level is a transparent network of trust exchange. Past history doesn't lose its value because of present difficulty. The data in the blockchain can and most likely will support iterations of attack/defense wargaming when/if it ever becomes big enough for powerful people and institutions to feel truly threatened.

-bgc

If there is a good rule like this, why wait until the attack occurs to introduce it? I think the answer is that there is no known rule besides full centralization. If there was one, we would be working on it already.

Your own PoS system is an example of one such rule. The reason to wait is that you have to have a migration of trust to enact such a rule in a distributed, non-auto-updating system. Things like PPCoin/Litecoin/whatever may indeed have good ideas that are marginally or even significantly better than bitcoin, but the network effect is what matters most in any discussion of shared value, and bitcoin is what wins there for cryptocurrencies currently.

Additionally, I doubt that there is 'THE' rule. I view this as more of an arms-race kind of thing, where there's arms-racing within a ruleset (e.g. building of PoW, or PoS), and there's the meta-arms race of building and breaking rulesets.

-bgc

Okay, suppose there was an attack. It was suddenly announced that bitcoin was shifting to a rule, suppose that is my own PoS system. How many people do you think would side with the attacker who was legitimately using PoW? How many people do you think would adopt my PoS system? How many people would adopt some third alternative consensus system? How many people would adopt full centralization using Gavin Andresen's client as a Solidcoin-style "trust node"?

Each of these different systems would create winners and losers. For example, PoW miners lose almost everything from a system like mine. Their claims on rewards would be completely expropriated.  

Suppose the monopolist just rules with a light touch and buys off some of his opponents. For example, he can share proceeds with any miners that comply with his rules. The miners will actually benefit from the monopolist's cartel enforcement. Just like the monopolist they will prefer the new monopoly regime to the old competitive regime. Why should they voluntarily shift to a chain that doesn't enforce a cartel arrangement? (It would be equivalent to leaving OPEC just because Saudi Arabia controls OPEC. )

Clearly the new chain can't work based on PoW. It has to do something else. What is that? How could you get people to agree on it?

I do not share your optimism. A successful response to a crisis situation seems implausible. I see something more like civil war. There will be the legitimate monopolist chain and a bunch of small rebel chains that aren't worth much.

Such a crisis is an obvious time for someone to make a decent amount of money. In such a case, the monopolist and other competing derivative chains are making bids based on their implementation (even the 51% based 1% tax is implementation based, as the miner implementation would be what is forcing it). These bids are for the network to operate outside the parameters it used to, in exchange for some kind of continuity of value. Whoever did the best job of this would win, and that COULD be the monopolist. I see nothing confusing about that or even particularly optimistic. I'm just saying that a 51% monopolist would motivate me to make and/or find a competing implementation, and that perhaps others who appreciate the lack of unconstrained central control would be motivated in a similar way.

This is not true. You are pretending that the best man wins. That is not how network effects work.
Whether you win depends on two things: 1) How large your network is to start with. 2) How good of a job you do.

The monopolist starts with the whole network. That is a tremendous advantage. His implementation can suck ass and he will still win. Just like paypal is winning right now.
Suppose that most bitcoin users were like the guys who use paypal now? Do you think they would lift a finger to thwart the monopolist? No they would just be like: "Bitcoin fees went up by 1%. That sucks. Oh well."

There is another, unrelated point that you are ignoring. Under PoW, an attack makes the userbase worse off. It is essentially expropriation.

Under PoS, an attack makes the average user better off. What does an attack look like under PoS? It looks like a fucking tsunami of a bid wall on Mt.Gox.
The attacker can only succeed if the majority of coin owners find it profitable to sell to him. The attacker can't possibly profit here. He has to have some special motivation (e.g. he is a government, or he thinks that coin is grossly undervalued at its current price). Under PoS, users profit from an attack. Under PoW, attack is a complete disaster.

What the hell is the point of the consensus system anyway? Isn't it just to help protect the user base from financial loss. PoS does that extremely effectively, regardless of whether it succeeds or fails.

I meant best in a way that included the network effect, not in a moral or technical sense. Substitute 'most effective' there. On a side note, I think you're not realizing that a 51% attack like you describe would be a simple denial of service from all of the current software clients perspective. The user experience WOULD be disrupted and users would have to choose what to do if anything. The no-op choice would be have unspendable coins.

Not necessarily. Ultimately, the users just have to attach larger fees to their txns. This won't be unusual at all. Remember the plan is to jack up fees progressively as the block reward falls. It is not a disruptive change if the fee increases somewhat more rapidly than the initial plan.  A wise monopolist would introduce his fees gradually. He might even allow no-fee txns at first and just increase their delay in entering blocks over time. There is no need for any discontinuity from the end users' perspective.

Anyways, if there was still block reward you can just start by not screwing with fees at all and simply expropriating other miners. This does not affect users in any way, but could be highly profitable.

Compare these changes to finding a new client to download and starting to use coins that are not accepted anywhere.

Finally, you are still ignoring that attacks are not harmful to users under PoS. This perhaps even more important than the fact that PoS makes attacks more expensive to pull off. (Of course the two facts are related)

You (Peter) completely destroyed cunicula and his FUD here.  Well done.

You're absolutely right. This should be implemented sooner rather than later.

I already presented one possible rule: follow the market equilibrium and reject blocks that deviate too much. And what makes you think noone is working on it?

Link to evidence that work is being done on this topic. It is not trivial to estimate market equilibrium.

Otherwise, explain how secrecy helps to improve the quality of this work. Or, if secrecy doesn't help with quality, explain how secrecy helps the author to achieve some other aim.

If not, then I think it's reasonable to assume that said work doesn't exist as of now. I also doubt that such highly doubt that such work will exist in the future.