Bitcoin Forum

There has been a lot of discussion lately on whether or not proof of stake is a feasible substitute for proof of work. I have come to believe that it is a necessary progression of the crypto currency space toward consensus systems that do not involve arbitrary work and artificially valuable resources. Proof of stake, as I see it, is a step in that direction. Of all the proof of stake coins/projects, I found three thoroughly documented approaches to solving issues associated with distributed consensus - PeerCoin, Nxt, and Bitshares. Each project has its on merits as well as shortcomings. I put it to the community to vote and discuss on which approach has the best promise.

The relevant white papers are as follows:

• Peercoin - http://www.peercoin.net/assets/paper/peercoin-paper.pdf

Abstract:

• Nxt - http://wiki.nxtcrypto.org/wiki/Whitepaper:Nxt

Abstract:

• Bitshares  (DPoS - http://bitshares.org/delegated-proof-of-stake/)

Dpos Abstract:
[/list]

answer: none

if a certain mining script was any better then the other due to efficiency, then giv it enough time and greedy miners will pile on so many rigs to get the biggest slice of the reward pie. and others will do the same to compete until its no longer efficient.

no matter what th 'puzzle' is to get a reward, people will buy as much equipment as they can to compete. so changing bitcoin with an aim of efficiency is only going to last a few weeks before the competition meets or exceeds the old mining protocols.

so the big picture is that it wont change a thing

Peercoin POS is interesting as it still allows people who want more coins to contribute more hast that cost money to get coins :D

you have no idea that in the grand scheme of things it doesnt really matter.. be honest what will the differences actually achieve, dont think of the narrow minded problem, think global and long term

Thanks clout.  Very good topic and
thanks for providing the links so
we can compare the 3 systems.
 
Here's just my 2 cents on the
matter:

I think the most important things
are how are new blocks formed,
and how is consensus achieved.
(Minting is a distant second,
and I didn't delve into that).

I'll give my summary of each
system and my conclusions to follow.

1. Peercoin:

- Instead of using the longest
chain method, they use the
chain with the longest "coin days"
of the transactions in the blocks
in the chain.

An interesting proposal, seems to work
in theory because someone
with a large wallet who sends
themselves coins goes back to
0 coin days, and thus cannot
be easily manipulated.

However, in practice is currently
relying on checkpointing... and
the whitepaper admits it
may not even work as well
as Bitcoin to prevent a 51%
attack.

2. Nxt

This uses a semi-random
deterministic protocol to
decide what node forges
the next block.

While this sounds quite neutral
and fair, the downside is this:

.

with 60-second blocks, 1440 minutes = 24 hours to fully confirm.  Not great.
If this could be improved, it would be excellent.

3. Bitshares:

Uses a "delegated proof of stake" protocol,
which is similar to the Ripple consensus algorithm
(basically a club of trusted nodes) except you
use your shares in the coin to vote for what
nodes you trust ("delegation").

The positive side of this system is faster
confirmation, but its more centralized.

They make the point that Bitcoin isn't really
that distributed due to mining pools, and
other proof of stake systems aren't really
that distributed due to people not running
full nodes...

Conclusion:

(these are just my initial OPINIONS,
which always subject to revision):

Bronze Medal:  Bitshares.

I like the Bitshares solution the least out
of all 3.  It seems far too centralized
and dependent on people rather than math,
although it still seems like it could work.


Silver Medal:  Nxt

Currently, it takes way too long to fully
confirm transactions,  but has some powerful
principles behind it, very well documented,
with smart people...and probably further
research could be done to improve confirmation
time.

Gold Medal:  Peercoin

I like this solution the most because
it is the simplest.  Simple solutions
are usually the best, which is why
proof-of-work and longest chain has
stood the test of time.

It would be nice to see if Peercoin
would work without checkpointing.

-----

There you go.  Will be interesting
to see what other folks think.

i messed up the link to the other half of the bitshares solution which is transactions as proof of stake. i think the tapos paper is probably the best of all the ones that i posted. it seems to solve all the problems that peercoin has and at a much lower cost given that peercoin is a hybrid that still issues coins to miners. the network is secured by coin days destroyed as with peercoin but instead of requiring individuals to volunteer there stake to the network and expose their private key, tapos simply uses the coin days destroyed from transactions. this shifts proof of stake from being a manual process to an automatic process. additionally, each transaction includes the hash of a recent block so as to make attacking the network by way of a secret chain unfeasible. since with pos systems the coin days destroys determine confirmation, someone with a secret chain could not leverage the coin days destroyed of the public chain. tapos uses proof of work mining only to produce blocks, not for network security. the difficulty of mining a block is inversely correlated to the coin days destroyed in that block, thereby preventing denial of service. although bitshares gets rid of the mining aspect from the original tapos paper with the delegate model, i do believe that tapos is still the underlying consensus mechanism.

here are some other relevant links:

first suggestion: https://bitcointalk.org/index.php?topic=27787.0
Wiki Page: https://en.bitcoin.it/wiki/Proof_of_Stake
Proof of Activity: https://bitcointalk.org/index.php?topic=102355.0

I like that idea. Does it mean transactions run a risk of picking the wrong recent block? As I understand it transactions can only be included in block-chains that contain the block they nominated, so if they nominated a block that gets orphaned, they will never be accepted into the main block-chain and the transaction itself becomes orphaned too.

This feels like it could have potential for double-spends worse than in Bitcoin. In Bitcoin, when the block-chain forks, both forks can contain the same transactions so most transactions are unaffected by a fork. In TaPoS, as I understand it, a fork means a lot of transactions will be reverted, and will have to be re-broadcast with a new nominated block. If the sender does nothing, the receiver will never get paid, so double-spending becomes the default result of a fork rather than something that only happens if a sender is actively criminal.

To avoid nominating a wrong block, a transaction would like to nominate a really old block, ideally the genesis block, so it can be included in either/both sides of the fork. Presumably the protocol disallows that by enforcing "recent". If so, does that mean that transactions expire? If "recent" means within 5 blocks, a transaction that fails to be included for 6 blocks can never be accepted. Transactions seem to be in a bit of a bind. They want to nominate a young block to minimise their risk of expiring, and an old block to minimise their risk of being discarded by a fork.

Is there anything to stop the same transaction (ie, same inputs/outputs) being issued multiple times, each time nominating a different block, to minimise the chances of it being orphaned? At most one of the versions will be accepted into the longest chain, so it would seem to be free. If so, isn't that the rational thing for a client to do (supposing it genuinely wants its transactions to be executed), and doesn't it make the "Transactions as Proof of Stake" thing pointless? Every transaction will vote for every block, just in case that block wins.

Is there a thread where these issues are discussed? I'm probably mis-understanding or re-inventing wheels.

The poll lacks a choice for "no proof-of-stake system will win".

Proof-of-stake will never remain decentralized:

https://bitcointalk.org/index.php?topic=558316.msg6501774#msg6501774

Send all proof-of-stake currencies to the trashcan.

Note: this poster is a troll who knowingly
tried to spread misinformation and FUD about
Bitcoin for months.

So take anything he says with a grain of salt.

Interesting that Dark Wallet just debuted.  So much
For all the "bitcoin is doomed because it will
Never be anonymous" fear-mongering.

I've heard that PeerCoin's version of POS is more vulnerable because it calculates the size of the stake using the number of days the coins have been held. This supposedly makes it more vulnerable to attack, but I can't find the post where this was discussed. come-from-beyond mentioned it on the NXT forum (I think).

I love them all. POW is doomed eventually, but it might be a few years off yet.

Nxt (Transparent forging), in my opinion.

uhhh, you don't buy mining hardware for pos

How did you forget to include Blackcoin?

Edit: Ah, misread. You are talking about systems rather than coins. I guess Blackcoin is a variation on the Peercoin system, just with pure PoS, faster transaction times, and lower fees.

As DPOS refers to Ripple consensus, here is a link:
http://bitcoin.stackexchange.com/questions/10180/what-are-the-pros-and-cons-of-ripples-consensus-as-compared-with-bitcoins-proo

interesting and educational post.

The only good thing in his post is the answer: none. From what OP listen, I wouldn't chose any of them. Also, yes he doesn't seem to know what POS is.

You can listen to someone with a low IQ or someone with a high IQ and 30 years programming experience and multi-million user commercial software accomplishments.

In short, he has no fucking clue.

I don't think you understand the economics well enough to be an authoritative voice. Dan Larimer certainly has a high iq. I go to the most prestigious college in the world. I too have a high iq. I don't know why you are trying to make it about intellectual capacity when that misses the point. Bitcoin is an expression of decentralized consensus. Capitalism is the same type of decentralized consensus through a resource-democracy. If you have missed the parallelism between pow, pos, and all other resource democracies you cannot speak intelligently about cryptocurrencies and their viability. I really wish you would add to the discussion instead of bashing things that you do not understand.

Classic ad hominem attack instead of facing the facts.  For the record, I also have a high iq but i feel no need to use fancy words or brag about my accomplishments.  You may indeed know more about math or cryptography than I do, but I still see right through your agenda.  Still think bitcoin will fail due to widespread theft and clawbacks?

I'm not saying I'm pro PoS, just saying that you are not to be taken seriously on any topic.

I think you can only build up 90 coin days at most.

Peercoin POS is not user-friendly, in my opinion. To, mint, the wallet gets unlocked, and at that stage is the wallet secure? Information and security of the minting process is limited. Plus, having set up the minting process perfectly OK on other coins, not managed to get any POS from PPC, ever, despite going through the process and waiting months, following all instructions etc. Seems that other people find the instructions hard to understand:
https://bitcointalk.org/index.php?topic=187714.100  (https://bitcointalk.org/index.php?topic=187714.100)

The new DPOS from Bitshares sounds very carefully thought out, and promises to be faster - its not released yet though. I hope its fairer than PPC.

To me it sounds almost ideal, and I am very excited to see it work. I hope there is no huge overlooked flaw in it.

The huge overlooked flaw is that it's not really distributed consensus.

how is it not?

Well, it could be argued that it is. 

But to me its not a good system because you have to trust the
supernode you voted for, etc.  You get into the whole trust
thing, almost like voting for politicians to represent your interests.
I would much prefer the whole thing be trustless and governed
by math and protocols like Bitcoin.

I was initially thinking the same and was against anything of that sort; but the process is very different and simple. The client keeps voting for delegates with good track record, which is producing blocks on time and including transactions, and doesn't let it overvote.

Its actually very nifty solution. How it works in practice remains to be seen, though.

Do you really think bitcoin is a trustless system...?

Generally, yes. 

What do you want to nitpick about?

don't waste your power (prepare for major release on monday):
https://bitcointalk.org/index.php?topic=623761.new#new

None as they don't resolve the "nothing at stake" problem.  It may be possible that some future PoS resolves this.  Yes NXT claims to resolve it via secret magical code in TF but until open source and peer reviewed it is just a claim. 

Isn't another issue is you need your wallet open to "forge/mint"...
That seems bad for security.  Not sure if that's an issue
with just NXT, or applies to Peercoin and DPOS as well.

Has there been a clear run down of what NEM's proof of importance system consists of?

You have to understand that cryptography secures your wallet not the network. The network is secured via consensus. Bitcoin as with all proof of whatever systems is a resource democracy. It is the natural structure for decision making of all distributed organizations throughout history. If you have 51% of the capital in the world you run it. This is the same phenomena with bitcoin proof of work. Your say over the network is proportional to your share of the designated resource, with bitcoin that is hashing power. Miners delegate there hashing powers to mining pools and those are the people you effectively trust to run the network. They are like the board of directors of the company that is bitcoin.

Every resource democracy works the same and is subject to the same 51% attack. The problem with bitcoin in particularly is that the capital intensive nature of mining disproportionately advantages those with economies of scale and ultimately centralizing the decision making powers. These are not trustless systems, rather you are distributing  trust amongst your peers with hopes that at the very least 51% of them are trustworthy. Regardless of the system, you are not trusting math you are trusting people.

It is an issue with peercoin not dpos.

Nxt doesn't require you have to your wallet open to forge.

Agree about the 51% thing... it applies to every system.

Disagree about the economies of scale being a problem though. ASICS and hashing power are likely becoming increasingly commoditized, scalable, and distributed.  

Website says this

That's one way to forge, but there are others. Specifically, you can lease your forging power to a pool, then it will forge on your behalf and you don't need to keep your wallet open.

I would vote for NXT but I am not allowed
it seems it is well built but the distribution is not so great !!
oh well so is BITCOIN ;-)

1) thats not true 2) even if it were true how does that justify spending $500 million a year on securing the network, when that cost is not necessary.

The watt per GhS ratio has been dropping and continues to drop
as ASICs keeps improving.

https://en.bitcoin.it/wiki/Mining_hardware_comparison

Some of the best rigs are getting close to .1 watt /gHs,
which would drop the $500 million figure by 99%.

So, overall, its going to get cheaper and more efficient
to do proof-of-work.

No it won't (or at least not for that reason).   The efficiency of GPUs was ~ 50x that of CPUs however the that just resulting in 50x the hardware and as a result 50x the difficulty.  The same dynamic played out in the form of ASICs vs GPUs.  More efficient hardware improves security but they don't reduce the cost.  It improves security because a well funded attacker would always pick the most efficient solution.  If the defenders were armed with CPUs when an attacker spent a couple million to deploy a 2 PH/s ASIC farm it would be like fighting tanks with slingshots.   The efficiency of defenders must continue to improve with technological progress to ensure an attacker can't "cheat" and simply use more efficient hardware to obtain 51% of the computing power at a reduced cost.

The justification for PoW is that it is proven to work.  In the long run hardware will be commoditized which means the miner cost will be slightly below the miner revenue.  If revenue rises then more hardware will be deployed.

I agree with DeathAndTaxes. You are also not looking at the fact that the mining cost is fixed and does not correspond to the market price of bitcoin. So if the value of bitcoin rises so does the cost of securing the network. It currently cost $500 million to secure the network, but if bitcoin is going to succeed that cost will dramatically increase even given the halving of block rewards. 

Of course PoS isn't free either.  If Peercoin was worth as much as BTC (value of money supply) then its 1% inflation rate would be about $70M a year.  To make the comparison more direct lets assume that PPC is no longer mining a meaningful number of PoW blocks is operating as PoS only.

Lets be clear on what we're talking about.  I was referring to electricity costs (not hardware costs).

Also, what you are saying is true but different than what I'm saying.
There's 2 variables:

1. efficiency, more of which drops the electricity costs,
2. hashrate, more of which increases the electricity costs.

what i'm saying is that electricty costs will drop because
of the increased efficiency.   There may be an increase
in hashrate which will offset this, but thats unrelated, and
obviously would be accompanied by an increase in security
as you pointed out.

The overall cost won't drop.  Efficiency is per hash but there will just be more hashes.   If efficiency improved 10x, then yes the energy (and thus cost) per GH would be 1/10th but there would just be 10x as many GH/s.  The network is more secure but cost is the same.

There will never be a scenario where the hashrate won't rise when more efficient hardware becomes available. Changes in miner compensation is the only thing which will affect miner cost.  If hardware is more efficient then miners would make more profit.  Other users would see that and deploy hardware to gain access to those easy profits which would drive the hashrate up.

As pointed out we say that with the emergence of ASICs.  Now the exchange rate also rose and the block reward halves which makes it not an apples to apples comparison but even if the exchange hadn't rose as the network become more efficient then miners would be producing higher profits which would lead to more hardware being deployed and the cost would eventually be the same at 100 J/GH or 1 J/GH.


Simple put baring a change in miner compensation (which is based on block reward & exchange rate) if #1 improves by 10x then #2 will increase by 10x as well.  

You're not taking into account the fact
that over time, older hardware will die.
It will become more expensive to maintain
it than simply to upgrade.  Plus it will
be cheaper to run because its more efficient.

If old hardware goes offline then new hardware will be deployed to take advantage of the higher profitability.  The network cost in BTC terms is just as high today as it was when the network was secured by GPUs.   Efficiency of the network has improved by at least 100x yet costs remain roughly the same by your logic the cost should have declined by 99% yet it hasn't.   I am not forgetting anything.  The cost expended by miners will always be within some % of the revenue paid to miners.  It doesn't matter what hardware is used.    Miner profit is the gap between costs and revenue.  The higher the profit/return the more incentive there is to deploy additional hardware. 

Fine.   :) you're basically saying the same thing I said, which is that efficiency has been increasingly tremendously, with the twist that the network is also growing tremendously.  I agree.

In any case, I don't see this as any kind of problem for Bitcoin. Do you?

Qora has a new POS system!!!!! And if its true that BCNext created it, it would be NXT's evolution - the real BCNexts project. There are many indications for this. If you wanna find out, check the relevant thread.

It isn't a "problem" but to say improved efficiency will reduce the cost of the network is an inaccuracy.  Reducing the revenue available to miners will reduce the cost expended by miners.  It would not be good for security but a 90% reduction in the block reward right now would reduce the "cost" of the network by 90%, a 90% reduction in the J/GH or $/GH would not.

Ok, not "will" for sure but certainly "could".  There's no guarantee an increase in energy efficiency will be accompanied by a corresponding increase in cost efficiency.  Right?

The cost of mining from the perspective of the bitcoin network is the block reward provided to miners. None of the costs or efficiencies within the process of mining matter because the network is incapable of taking those variables into account. The cost of security increases with value of bitcoin. If the value of bitcoin increases proportionately more than given decreases in block reward then there is a net increase in the cost of securing the network.

At the end of the day, distributing crypto-equity through fixed algorithms is fundamentally flawed because it does not consider market forces.

Of course there will be.   If tomorrow miners were earning 1000% annual ROI what do you think would happen?

Miner cost will always be within a few % of miner revenue unless you think people will simply allow 1000% ROI to exist and not deploy more hashpower to extract that profit.

That is nonsense.   If the exchange rate rises the market value of the money supply also rises.  If miners receive 1% of the money supply annually it doesn't matter if a BTC is worth $1 or $100,000.  The network isn't distributing "equity" it is providing compensation for securing the network.  The subsidy is merely a bootstrapping mechanism.  In the future users will pay for security and if they pay 1% to PoW miners or 1% PoS stakeholders they are still paying for security.

It doesn't make sense to distribute equity this way, but it is quite possibly the only legitimate way to distribute money. 

And anywayz, like OMG.  PoS was sooo last week.  Nxt's secret sauce smells bad and the nothing-at-stake problem remains unsolved. The new alt-coin narrative is protocol-enforced privacy.  Get with the program LOL!    :D

This is an oversimplification.  ROI within what time frame?  A miner expects to get his money back for the rig in a certain amount of time but there are many different rigs being sold at different times to different miners at different prices all while the difficulty is increasing.  People are making predictions on what the difficulty will be with differing degrees of accuracy.  Then there is also risk and cashflow considerations that each miner has to contend with.

Say the fyookball-1000 mining rig (a fictional machine) gives you 1TH and runs at 1000w.  Now the fyookball-2000 comes out and gives you 2TH but runs at 100w.  Well, now you doubled the hash but cut the electric bill. By 90%.  

If every miner owned 1 FB1000 and suddenly replaced with the FB2000 , each miner would be making the same when the difficulty changes anyway.....but the power consumption is down.

Except why buy 2 why not buy 10 and make even more money?  If it is profitable to deploy 2 it is profitable to deploy 10 and people will.  The sooner and the more you buy deploy the higher your return.  It actually doesn't matter if you don't do it, someone else will.  The hashrate will rise until there is no (or miminal) return available just like it was before the new more efficient tech came along.  Once again we have seen this happen on a continual basis for almost five years now.  It has always followed this trend and it always will.  If margins are high then miners will deploy hardware until the margins aren't.  More efficient tech is very profitable at the current difficulty at the time is is released however collectively miners will eventually drive the difficulty right back up to near break even when using the more efficient gear.

Yeah but the thing is the rig is the main cost not the electricity...at least for now.

I'm not trying to troll.  I think you are proving my point....it is the costs of the rigs
trying to keep pace with the difficulty.... What's this got to do with the electrical
Efficiency?  They are different things.

Anyway, I'm tired of this debate...you are the bitcoin expert here so I'll concede
The argument, I'm probably missing something. 

The important thing is the efficiency is getting better and better, and we are
Getting more security for the dollar...and bitcoin is in good shape.

Well "main" cost is kinda subjective.  At $1 per GH/s and 1 J/GH energy is pretty close to half the cost.  Margins are still high on hardware so expect hardware prices to fall much faster than energy costs and that will shift more and more towards energy.  Still it is a pointless distinction.   Miner total cost is amortized hardware + energy costs.   If the network gives miners $500M annually then miners are going to spend pretty close to $500M annually as they collectively drive the margin very close to zero (possibly negative).   It doesn't matter how efficient the tech is, miners will simply buy and deploy more gear until margins are so low (or negative) that deploying more hardware doesn't make sense.

Once again we have been seeing this continually for five years so it isn't some academic theory.   It is a classic prisoner dilema.  Sure if there is new technology and miners agree to limit the hashrate of the network then they can increase their margins but they can't and if they tried someone would cheat to make more while the margins are higher.  Economics will drive hashrate up and margins down when more efficient tech is possible.

Just updated my post above....man you are hard to argue with (mostly cause you are usually right  :-[   )
Got your points.  Thx for the discussion.

Geniuses simplify things...
While merely highly intelligent people complicate the shit out of everything...
(See Ripple, most 2nd Gen Crypto Assets, etc).

Twitter is genius... because it's dead simple.

This is why PeerShares could sweep away the Pretenders...
Sunny knows that "good enough" and "dead simple" wins.

Agreed.  It just important to understand efficiency can't reduce cost only improve security (by eliminating the potential for an attacker to reduce cost by using more efficient tech).

What you called a pointless distinction earlier is not pointless, because of the ratios of hardware to electricity. I think I almost had a good point.

It doesn't matter if it is paid for in hardware or electricity.  Also improvements in efficiency come from Moore's law.  The cost per transistor also falls at the same rate (actually power has been lagging behind transistor cost over the last couple generations).

You didn't refute my point at all.... If miners receive 1% (which is an underestimate, it is more along the lines of 9% at its current rate) when the price of bitcoin goes up then there compensation goes up regardless of added efficiency or security of the network. So if you have a spike from $1 to $100,000 the cost of securing the network went from 10 cents to $1,000. Except we are not longer in that price range which is why the cost of mining is now more than $500 million.

Thats probably one of the worst mottoes I've ever. You are right to suggest that we shouldn't over complicate things, but "good enough" never wins.

Also if Sunnys involvement in PeerShares is the clincher, you might want to reevaluate your position. In a recent chat discussion between Sunny King and Bytemaster on peercointalk it seems he was not as involved with peershares as you suggested.

Peercoin is not complete in my view and has some remaining issues, before it can be considered a viable pos-solution, most glaring one being their checkpointing requirement.

I really want to like NXT and even though it is not strictly a technical issue with their particular solution, but I do not like their cloak and dagger behavior with the source-code and only releasing it to peer review after they "feel" the world is ready.

Clout do you think adding cpos to the discussion and/or poll would be advisable or is that proposal still too theoretical?

One little addendum regarding the whitepapers by Daniel Larimer, part of the "security model" in his theories is that of many competing chains and free market choice between them, instead of the other seemingly isolated central blockchain models. While I understand the philosophical ideal of wanting security solely through algorithms, I'm not convinced that this mathematical Elysium is achievable in practice, besides it all hinges on market evaluation by humans anyway. So while not being limited to tapos/dpos I do think the free choice between chains implied in those whitepapers (ByteMaster always mentioned the competing chains when I've heard him explain his concepts) is more versatile than other models.

PS
What's up with all the references to the scores on IQ-tests and drawing conclusions from them? To me those things were more about how long can you fight the boredom and keep focus. Most of the ones I had to fill in even used multiple choice, talk about ridiculous. Multiple choice makes it just about impossible to give the wrong answer.

PoS does not intrinsically need inflation. Nxt is a PoS coin that has no inflation. There's no block reward, just fees, so the number of coins is constant.

That's true while the block reward dominates. As the block reward reduces, and transaction volume increases, transaction fees will come to dominate in Bitcoin. The cost of security will be equal to the sum of fees, and the community will get greater or lesser security by paying higher or lower fees.

This is why I care about Proof of Stake. It seems to me that either Bitcoin fees will end up very high, to pay the miners for the work they do securing the network; or else the fees will end up comparatively low, and the network will be insecure. If PoS works (a big "if", I concede), then it's inherently more efficient and will require lower fees for the same security, and that could lead users to shift over to it in the long run. (Much as lower fees is often cited as a reason for merchants to prefer Bitcoin over credit cards.)

Although there's no improvement in security in the long run. When someone designs an improved ASIC, the network becomes vulnerable to the danger that an attacker will deploy the new technology first. As the new ASIC is adopted by miners, we return to the status quo. The miners need to keep upgrading, just to stay in the same place both with regard to their revenues, and with regard to network security. As long as technology keeps improving, miners will need to pay for new hardware, and the community will have to pay for that hardware, as well as their electricity costs, either through block-reward inflation or through fees.

In DPoS, you vote when sending in a transaction. You don't have to keep your wallet open.

You should keep your client online, though as it monitors the network and alerts you in case any delegate is misbehaving.

Bitcoin uses vote by hashpower and thus everyone is trusting less than 10 super nodes (mining pools).  Try to look at the true nature of what these systems are doing rather than at the marketing spin the BTC community has put on things.

With bitcoin you cannot vote a miner or pool out.  The coin holders have no say at all and only a super minority actually mine bitcoin these days.   

The system is still governed by math, it just operates as 99 small mining pools where the users can redirect their hash power at will and where all mining pools have equal say and take turns.   

20 years from now, daily reward is still 112 blocks...should be more than enough to keep fees low.

After talking with the Nxt developers it is fairly clear that Nxt and DPOS are very similar.  They both deterministically select the next block producer, operate on a fixed absolute block production schedule and support DELEGATING your stake to others.  

The difference lies in how the delegated stake is managed.  In DPOS everyone is delegating at all times and all clients observe behavior.  In DPOS it is possible to vote AGAINST a bad actor and thus nullify their own votes.   This prevents someone from buying up 10% or more of the network and then abusing their 10% in some way.  

Where Nxt has block production proportional to balance, DPOS is 1 block per delegate with a changing slate of delegates that are voted on proportional to stake.   There are limits that prevent concentration in one delegate and the wallets automatically rebalance votes from delegates that get too much.  

Lastly the difference is that all shareholders are paid from dividends without having to do anything.  The delegates take a small cut of the transaction fees.  

I think that Nxt / DPOS will be the future as Peercoin has too many issues.

Blackcoin have announced that they are about to release an improved PoS. Details are still unclear, so not sure if it will solve the issues that the Peercoin model currently has.

The same is true with PoS.  Yes you have proven that 1% of a large number is larger than 1% of a small number.

DPOS and NXT are practically identical, the only difference is which mechanism is used to pick block producers (both are essentially by stake-vote)

It'll be 3% of what it is now. We can hope that 1 BTC doubles in real-world value at least every 4 years to compensate, and it might for a while, but that rate of increase can't continue forever. I am thinking in longer timescales than 20 years here.

https://bitbucket.org/JeanLucPicard/nxt/src

Care to elaborate?

The code as released doesn't solve the nothing at stake problem.  It also can be hard forked by creating an alternate chain longer than 720 blocks.   NXT promises there is some magical code (EC and TF) which will resolve these problems but the world isn't ready for it yet.

Gavin recently stated the network is "over secure"...meaning there is too many
miners...if later on, miners need to drop out because there is no more profit,
there may be fewer miners.  There will have to be a balance between security
and fees.   

It largely depends on how big Bitcoin gets.  If a billion dollars
a day is transacted, then a million dollars a day in fees is 1/10th of a percent.

In NXT you can also form forging pools and may lead to Bitcoin style problems.

I think it will be a battle between nxt @ bitshares
Nxt has the advantage that has released their "product" first, security wise in my mind the winner is bitshares but only on the playfield they will proove it.
Both coins are still undervalued and I am personaly invested more in favor of bitshares and I continue to invest there because I think they have a greater potential.
Hope the devs and founders from the 3 "coins" will share their good ideas and "work together" so all communities will win a share from the success of this innovative industry! We are all on the same neighborhood  ;)

As Stan (bitshares founder) said:
"Each of us will drive more awareness to each other than they will take away from each other.  It's the same reason competing car dealers and hardware stores tend to cluster on the same street.  Get the traffic to come to your neighborhood and then compete!"

Our main developer wants to answer you. But he does not use BTT anymore;

https://twitter.com/comefrombeyond/statuses/470997528604049408 (https://twitter.com/comefrombeyond/statuses/470997528604049408)

The forging pools with nxt equal the delegates in dpos. This is what makes them equal.

Bitshares and NXT are both exciting. I lean towards Dpos because the development is more open.  Bitshares also seems to have a fuller support for DACs.

Sounds like he want to pick DaT's brain.

If he had a solid solution he would be releasing without the fanfare.  Just my opinion.

Or you can visit our forum to ask about all of this;

https://nxtforum.org/ (https://nxtforum.org/)

Judging by all these PoS-revivals of old PoW coins, it seems PoS is catching on! Will be interesting to see dPOS in action.

The guy from Bitshares has a serious marketing problem.  Every time he opens his mouth, he sounds like he isn't sure of anything he is saying, and the project has been long in the making and regularly evolving so maybe he doesn't. 

NXT doesn't really have a good spokesman either, just lots of part time investors/developers.  They seem to be working hard and making it come together but the coordination/vision/message is a bit rough and unclear.

Peercoin?  What is Peercoin again?

Ethereum hasn't even released a single bit of working code, but if they did an IPO, its market cap would slaughter NXT and Bitshares and Peercoin put together.  A person might want to think that the best product wins, but that isn't often true.  Many times it is the product with the best salesman that wins.  That is why Ethereum would win and it doesn't even have a real product yet.

So you ask, which POS system is the best?  I say the one with the best salesman.  Sounds silly and isn't a direct answer to the question, but it is the real answer.  Many products on the shelves of Walmart spend far more in advertising than they spend in product development.  Why? Because they know you get to #1 not by being the best, but making people believe you are the best. 

@SomethingElse I wish you were wrong about the best marketing overruling everything, but I'm afraid I have to agree with you. Thing is marketing takes big bucks and massive manpower and time, not something most start-ups can provide unless they have big VC-backing or something like that and that doesn't help with the decentralization and low barriers to entry principles.

Crowdfunding/ipo seems to come with it's own set of problems, like an angry mob of "experts" who seem to think that harassing a small team with extra pressure, threats and rumors is a sound strategy to insure the success of their "investment". I'm seeing more and more kickstarter-projects suffering the same backlash. If anything, it looks like crowdfunding requires that the marketing and pr teams should be bigger than the dev-team.

One thing that worries me about overhyping like with Ethereum is that it could very well backfire, but then again some people just want to believe in a dream, so it might just work even if they aren't able to make true on their claims. Now that you mention it, where is Ethereum getting  the money for their marketing and travels if they haven't done their IPO yet, are they backed by VCs or something? Anybody have any info on that?

Elaborating on my remark about NXT, DeathAndTaxes answered that part very eloquently, also I was paraphrasing what ComeFromBeyond actually said on the nxt-forums as being the reason for not releasing the transparent forging code. The other part of it was referring to the code not being released for quite a while after the fundraiser and even then it had those 3 deliberate bugs in them (apart from the non deliberate ones of course). Opensource is the primary requirement for me in this space for several reasons especially when dealing with trust in anonymous/pseudonymous people.

I believe they believe they have a solution however based on what is publicly available I don't believe they are correct.  :)  Still I don't see much sense in communicating privately.  I rarely sign NDAs and I can't remember ever signing one when I wasn't being compensated.   Even with compensation I doubt I would be willing to sign one as I would find it very frustrating if the code confirms my suspicious and then I am unable to use that code to support an argument.

Eventually the code will be open sources and we can debate it in the open.   At this point I can't definitively say the NXT team and their unreleased code hasn't solve the nothing at stake problem.  My argument is more than it is dubious to claim something is solved based on secret code.  The public can't independently verify that claim, nor can they look to skeptics for a counterargument.  I believe in Bitcoin but I do read articles written by skeptics but they are an outside viewpoint and sometimes that is useful.

Where did you see the NDA demand?

It was an assumption.  I will share any "secret but open source" code I receive barring an NDA.  If they want the code public they can just post it publicly.  If they want to allow me to see the code under the condition that I not reveal it that would require an NDA.  I don't really see the point in secretly sharing code that can be released publicly, do you?

Even that is a questionable assumption.

They are most likely not sure if they are correct
and want to recruit you to their cause (not saying
that's bad or good)...

but if they were confident in their solution, they
would release it.  

To me, the (nothing at stake) problem is
not that hard to understand, after having
it been explained to me by yourself in
one of these threads.  Certainly, it is
easier to understand than the nuances of
ECDSA.

Intuition says that a solution to the problem,
if there is one, would be at least easily verified,
if not simplistic itself.  Although, that is just
my gut feeling on it.

It is also possible that certain Nxt insiders know that they don't have a solution, and simply want to delay the day of reckoning as long as possible in order to maximize the amount of pre-mine they can convert to bitcoin.

Yeah right. That's why Come from beyond wants to reach out to D&T to explain things and show him some code. Logical conclusion, genius.

If you want to delay the "day of reckoning" then you obviously should want to invite the scrutiny of an expert who doubts you. Brilliant.

Of course it is possible.  People can decide for themselves how probable it is.  For the record, I don't believe Come-from-Beyond "reached out" to D&T in a genuine way based on this logic:


What is interesting to me is that in the (IMO very unlikely) event that Nxt has technical promise, then as soon as the code is open-source it will be possible to create Nxt-clone using the spin-off (https://bitcointalk.org/index.php?topic=563972.0) mechanism and immediately bootstrap the clone with a more efficient distribution than Nxt-original.  

Good luck trying to spin-off the 100 or so devs working on dozens of Nxt projects as we speak you arrogant prick.

Maintaining a spin-off requires one part-time developer.  His job is to copy the work that your "100 or so devs" do into the clone.

NXT system blows because big stake holders can rake 30K NXT with their Mac. Why wouldn't you hoard?

Spinoffs are why nxt is trying to keep things as secret as possible for as long as possible.  We can hardly blame them for that.  Obviously the strategy would be to be far enough ahead in the innovation and adoption cycle that the rest would seen as imitators, not innovators.

I don't know if it's fair to say nxt has no technical promise.  They seem to already have created some in innovations.  Yet, the elephant in the room is the nothing at stake issue at this point.  Or seems to be anyway.
Whether they can solve that remains to be seen.

You bring up a good point about distribution though.  If nxt did create a major breakthrough, it would certainly be nice to capitalize on that with a bitcoin based distribution, rather than speculating on a new altcoin.

Would your bootstrapping protocol work with nxt even though the coins are so different?

Nothing at stake is a strawman. Include a recent block hash in every transaction and allow migrating transactions cross-chain ("invalid" block headers in tx don't count for stake-vote). There's your motive for picking a chain.

What are "migrating transactions"?

This doesn't make any sense.  Either a transaction is valid because its on the right chain,
or its invalid because its on the wrong chain.  That's what a distributed conensus
is all about.

Are you sure you understand the nothing at stake problem?

You haven't eliminated the fact that there is absolutely no reason not to sign all possible chains in event of a fork.  It is just a small step in the right direction, albeit at the expense of larger txs.  Bitcoin in it's short history had had ~40M txs. Adding 32 bytes to each transaction would have bloated the blockchain by another 1.2 GB.  If that solved the problem it probably would be worth it but it doesn't so one has to weigh if that increased security is worth that increased cost (in terms of tx size & complexity).  I think it probably is but it isn't a magic bullet and it isn't free.

Nothing at stake covers a number of different scenarios that all have at their core are related to the fact that there is no (significant) cost for failure*.  One can perform a reorg with no cost by simply acquiring private keys which at one time had (past tense) a majority of the active stake.  Accounts which have no value have worth to an attacker for what they once had.  Nothing at stake also applies to the concept of selfish mining.  There is no reason to not continue your chain when you lose a race against a superior block.  You can work on the majority chain and simultaneously attempt to extend your minority chain.  There is a small chance you will out mine/mint/forge the rest of the network.  In PoW the cost doesn't warrant the small chance and thus it is more profitable to switch when you lose but if there is no cost why wouldn't you keep trying, you have nothing to lose and everything to gain.  In NXT when you forge a block which is the best at current height but doesn't enable you to forge the next block (due to incompatible block signature) there is no reason to not use computing power to try and find an alternative which enables you to forge the next one as well.  The chance may be low but you have nothing to lose and everything to gain by trying.  With PoW there is a real cost associated with extending an inferior chain (one that has a less than 50% chance of remaining the longest chain) and that cost drives the network to reach a consensus quicker.  Inferior chains are abandoned and the network aligns around the best chain quickly.  How often have you seen reorgs more than 3 blocks deep in the blockchain?  This alignment doesn't happen out of some need to do the "right thing" but because it is prohibitively expensive to do anything else.   With no cost, forks will last longer, and reorgs will be deeper.  In any blockchain system, attackers with a minority of the stake can (infrequently) generate short lived chains that are better than the majority.  With PoW those attempts have a real cost which counteracts the gain of the double spend and unless the attacker has a high chance and profitable spend it is very likely a net loser to even try.  When the cost of an attempt is nothing there is nothing to lose by trying and thus why not double spend anything and everything.  Most of the time the attacker will fail but those failures cost nothing so any successful double spends is profit even if rare.

So saying "put a hash of a recent block in the tx and nothing at stake is a strawman" misses the larger context.  If there is no cost to attack the network there is no reason to NOT attack the network.


* Yes some will like to split words and point out there is always some cost in anything so saying there is "nothing" at risk is wrong.  Well you can split hairs all you want but if a legit node has a cost of X and an attack node has a cost of 10X it is essentially nothing.   X has to be pretty low such that non mining nodes have the resources to run a full node so 10x is still very low.  PoW doesn't require 10x the resources to solve a block than to run a non-mining node, or even 100x, or a billion times but (at current difficulty) 193,690,812,773,950,000,000,000,000,000x.
 

correct me if i'm wrong, but saying "put a hash of a recent block in the tx"
does nothing more than duplicate the mechanism already in place in
any blockchain, which is to cryptographically link one block to the next.

It prevents the tx from being included in a chain which diverges below the blockhash referenced in the tx.   It does have some use but to say alone it "solves" all aspects of "nothing at stake" is sadly not correct.

Oh ok I understand this attack better now. Two questions then:

It seems like this affects NXT but not DPOS, because with DPOS once you miss a chance to produce a block it is gone forever - you cannot use old stake-votes to produce a longer chain if at least 51% of delegates have produced a block since then. Is this right?
Also, NXT claims that having clients reject chains built on anything but the most recent block they have seen solves not only this but 51%... this is true in theory but relies on unreasonable network connectivity assumptions. Is this right?

im sure DT will give you a more complete answer,
but I think no, it affects any PoS system because
nothing is happening in real time.  Everything can
be done retroactively.  The thing about PoW is
that is simulates a timestamp server because
work actually takes time to do.



wouldnt this be prevented anyway be some other check in the protocol?

I see no reason why the spin-off mechanism shouldn't work with every alt-coin.  We are discussing the protocol details in the spin-off thread (https://bitcointalk.org/index.php?topic=563972.0) if you are interested.  Adrian-X has posted a 1 BTC bounty for source code that builds the snapshot.bin files that become Block 0 in the spin-off.  

I think in time we will see the idea of launching "new alt-coin currencies" as economically flawed: money is more about the legitimacy of the ledger than the properties of the payment system.  Important open-source payment system innovations will be integrated into bitcoin anyways, and closed-source innovations will not be trusted.  I believe people genuinely interested in innovation will be better served building new protocol layers that work on top of bitcoin, launching experimental spin-offs, or working towards side-chains or tree-chains.  But, alas, the promise of dumping a huge premine on a frenzied market seems too big a carrot.  

Interesting.  As you say, "we will see" since people can vote with their wallets.
The good thing about your idea is that is still allows for several competing
currencies even though distribution is based on bitcoin.

I wouldnt want there to be just one blockchain to rule them all.
But the distribution benefits bitcoin holders at the same time.

 

Transparent forging? What do you mean? PoW/PoS is not transparent?

Transparent means that the system will know ahead of time (subject to some uncertainty) which agent will be verifying the next block.

Transparant forging is really impressive, never seen something like that in cryptocurrencies.  :o

I find CfB self -imposed "ban" from BT forum weird, and of course DaT won't join nxtforum

https://nxtforum.org/general-discussion/some-thoughts-on-arguments-of-pow-guys/

  -- quote --

From https://bitcointalk.org/index.php?topic=584703.msg6982574#msg6982574

Can a penalty fix this problem? It seems to me it can.

So PoW guys were saying that current blockchain size was not an issue but now they want to save 1.2 GiB? It's even funnier that SPV is not mentioned.

I wouldn't use the word "simply", unless someone could show 2 cases when ppl sell their old private keys.

Sure, odds r the same as to win 1 million dollars in a lottery.

Could someone show an example? Right now the quoted phrase looks as the beginning of a Sci-Fi novel.

No cost? Right, 1 (one) SHA256 operation costs nothing, 10¹⁵ * [nothing] is still nothing. Bitcoin network spends no resources, neat.

Penalty makes it very costly to extend multiple forks.

How many times should I repeat that there will be a penalty?

PS: A bonus thought. Nxt consensus rule solves the problem of Bitcoin Fork 2013. Nxt to Bitcoin as Einstein's theory to Newton's theory.

PoW+PoS+PoT

Fluttercoin

That's the most viable PoS system.

Such arrogance many arguments..

Penalize what? One could move the coins to a new address I suppose... how do you know?

The penalty suggestion would need to be much further defined if you want a serious discussion about it.

from https://nxtforum.org/index.php?topic=1849.msg31104#msg31104

A penalty for an inactive but otherwise non malicious forgers is useful but it doesn't help in a 51% attack.

By definition in a 51% attack the attacker IS NOT mining the main chain so a penalty that doesn't allow him to mine on the chain he already isn't mining isn't much of a penalty is it?  On the other hand in the attack chain it will be the legit miners who failed to mint a block and they will be subject to the penalty.  When the attack chain is longer and the attacker broadcasts it, then it becomes the longest chain and some or all of legit miners will be penalized for up to 1440 blocks.

DPOS for sure

Not necessarily. The problem in Bitcoin pools is that they are not limited, and the same problem exists with pooled forging.

With DPoS, there is a limit to how much votes each can collect, and any delegate can not dominate; at least openly.

If GHASH split into 3 pools with the same combined hashing power but owned and operated by the same entity would that make Bitcoin more decentralized?

but does this partially solve the nothing at stake issue?

If attacks that are made on the main chain are recorded, then those miners/forgers can't attack
at any point... seems they would have to attack at a point either before the penalty existed, or after the penalty expired.

I am not even sure what you mean.  Attacks aren't "made" on the main chain.  A 51% attack involves the attacker building AN ALTERNATE chain.

In the main chain = attacker mines no block.  
In the attack chain = attacker mines all block = no penalty

When the attack chain is longer the attacker broadcasts it at which point the "attack chain" becomes the main chain and the "honest" chain just becomes an orphaned minority fork.

At no point is the attacker subject to any penalty.

https://nxtforum.org/general-discussion/some-thoughts-on-arguments-of-pow-guys/msg31104/#msg31104

---------------


In Nxt both the chains (legit and hidden) will have the same cumulative difficulties coz forging power of penalized forgers is delegated to the others and total power is bumped back to 100%. But the hidden chain won't have transactions of the economic cluster and this is where extra consensus rule becomes handy.

The attacker has ~10 minutes (may be changed after we collect stats) to reveal his chain. After 10 mins all transactions will be set in stone and 51% attacks won't be possible at all. If the attacker combines 51% attack with eclipse attack then the victim will notice that the recent blocks don't have transactions of the cluster (actually there could be some coz of time difference and corrupt participants of the cluster but the ratio will be much lower than threshold).

Original design assumes that every block there will be 2-3 forgers who have to compete at certain block height. So every block at least 1 forger will be penalized. Number of forks within 10 min window is supposed to be high and users shouldn't rely on low number of confirmations.

Some forgers will attach their blocks to dead branches but they shouldn't reforge blocks after blockchain reorgs coz other forgers may see contradicting blocks (signed by the same account but belonging to different branches) and report them by including both the blocks into their own chains.

What I mean is:

On the main chain, "attacker A" TRIES to attack
at the time block 1000 is created and fails... the network notices
and on block 1001, it is recorded in the main chain that attacker A's
stake is penalized.

He can still keep trying to re-attack at block 1000
or earlier, but not 1001 or greater... thus his
opportunities to attack become diminished.

I understand its about building an alternate chain,
but obviously it is one that diverges from the main
chain at some point... and what point that is,
is what i'm talking about here.

Over time but not instantly and thus the chain with the majority of the stake will be the longest.  If it wasn't true then someone with 1% of the stake could form a chain as long as the network with 99% of the stake (99% of the stake is penalized for not mining on the attack chain and eventually the 1% has 100% of the active stake).


This is where you get into trusted node voodoo.  The attacker can include tx from the "honest" chain.  He doesn't need to (nor can he) double spend all transactions.  The attacker can broadcast double spends which are picked up by the main chain and then include the legit tx in the attack chain. 

The idea that 100% of the nodes will always be online, and always know which chain is the best is dubious.   If that were possible then you wouldn't even need PoS or minting at all.  Nodes would simply agree which tx are valid and confirmations would be nearly instantaneous.  So what happens when there are two chains A & B.  In A BTC-E is double spent a small fortune and in B BitStamp is double spent a small fortune?  One of them is just going to take a massive loss for the team?  No in a scenario where longest chain is ignored and the EC doesn't reach 100% consensus either you have a network split or the attacker is able to double spend anyways.  Sorry BTC-E your tx was in the longest chain but the board of trusted elders has decided that the inferior chain is the "best" and you lose to the double spend. 

Why would he do that?  If the attacker has a majority of the stake he will eventually have the longest chain.  There is no reason to "give up".  All that matters is variance and time (well # of blocks) but the longer the chain the higher the probability the attacker will be head and that rapidly approaches 100%.  The exact same principle in in play when we assume the "good guys" have the majority.  In Bitcoin why do you trust a tx with 20 confirmations more than one with 1 confirmation?  It is because the probability that someone with a minority of the hashrate (even 49%) could build a longer chain to perform a reorg and "reverse" that tx decreases as the chain length increases.   In a 51% attack the attacker is the one with the majority so the roles are reverse.  The attack has a >50% chance of being ahead after 1 block but that rapidly rises to ~100% as the chain becomes longer.  The more of a majority the attacker has the quicker the confidence rises (both 51% and 70% will eventually produce the longest chain but we can say at a given chain length the later will have a higher computed probability of being ahead).

So why would the attacker just give up and try later?

1. I thought the nothing-at-stake problem applied to more than just the 51% scenario... that an attacker with even 10, 20, 30% could do some damage at no cost,
and that's why its such an issue.

2. I thought NXT's deterministic system to decide the next forger of a block is easier to attack by orders of magnitudes when the attack could come
from any block, versus being limited.  Its not that the attack would give up, but they would have to try harder (the computations should rise in
difficulty at least to some degree)

It is but then the attacker would operate differently.  Since there is no cost he would simply support both chains.  Yes he is working against himself but with a minority of the hashrate the probability of producing a longer chain of x blocks was already <50%.  Still the odds are 0% and he isn't penalized because he is supporting the "main" chain (chain most likely to remain the longest).  So he loses nothing, gets no penalty and some % of the time will be able to out mine/mint the main chain and perform a double spend at no cost.  Granted the odds may be low (they are low for Bitcoin as well) if his share of the stake is low but say you got away with a double spend once a year with no cost or risk.  Other than ethics why wouldn't you try?  Attempt 10,000 double spends and if 9,999 are unsucessful and 1 is the fact that there was no cost means you are ahead.


I have no idea what you mean by "any block".  An attack can come from any block.  An attacker can continue to extend multiple chains extending from multiple blocks all in parallel and if any of them by "luck" end up longer than the main chain they will be published.  If the attacker has a minority of the effective stake (even when boosted by computing power), the chance of success if low.  That means the chance of penalty is high and it would be optimal to build on the main chain as well.

The same concept applies to selfish mining.  A minter produces a valid block and he will be penalized if he doesn't publish it on the main chain however the block doesn't allow him the chance of forging the next block so he hangs on to it for a while.   If prior to him finding a better block another miner publishes a block at the same height that is inferior then he publishes his block as well and suffers no penalty.  If prior to another miner finding a better block he finds a block which allows him to forge the next block he publishes that instead and then immediately attempts to solve the next block to double his reward.

On point 1, yes I agree...thats what I thought but you kept saying "51% 51%" so i wanted to be clear. thx.

On point 2, not sure if you still don't get what I mean or my thinking is just convoluted...
If the main chain says on block 1001 that Jonald is penalized, then how can I diverge
from the main chain on block 1002?  I would have to have to my attack diverge from
the main chain on block 1000.  

There's some divergence point in any attack (unless we're going to tear down
the chain back to the genesis block)... up to that point, the main chain and
the false chain are the same and then they diverge.

So, what i'm saying is that divergence point must be prior to the penalty.
Because if not, (if its after the penalty), then the protocol rules wouldn't
allow it.  They wouldn't allow me to diverge from block 1002 because
block 1000 already says I'm not authorized to build any blocks.

Am I making any sense whatsoever?

There would be no penalty.  Lets look at the case of a majority and minority attacker separately.  

An attacker with a minority of the stake will optimally support ALL chains including the main chain.  He will suffer no penalty.  Yes this will (marginally) reduce his chance because it improves the effective stake of the main chain relative to his chain but the chance was already low.  In PoW the real security comes not from the fact that a double spend with a minority of the hashrate is possible.  It is very possible but it will happen infrequently and the COST for all the times it fails offsets any gain from the double spend.    For example an attacker with 10% of the Bitcoin hashrate would be able to successfully double spend a tx with 6 confirmations 1 out of 1694 attempts.   It is impossible to guarantee that an attacker (even one with a minority of the hashrate) can NEVER perform a double spend on a tx 6 confirmations deep however the cost means that if the amount being double spent is <168,000 BTC the attacker ends up losing money.  He will eventually be successful however the gain from the success will be less than the loss of coins not mined.  

With PoS, a minority attacker WILL support the main chain when required and thus he will never suffer a penalty.  His chance of success will be low (and will be lower the more confirmations that are required) but with no (real) cost and a chance >0% he will eventually pull off a double spend at no cost.  There is nothing at risk precisely because he can support all chains in parallel simultaneously.  Note: a PoS system w/ a penalty marginally reduces the profitability of the attacker when the attacker has a minority of the hashrate but it doesn't remove the nothing at stake risk because the attacker can still support all chains (he probably would anyways even w/ no penalty to collect the block rewards on the main chain).

An attacker with a majority of the stake will optimally only extend the attack chain(s) and not the main chain because he doesn't need to.  You can penalize him all you want on the main chain but once one of the attack chains are longer then it will be published, the network will reorg to use that chain as the "best chain" and all the "penalties" will be limited to an orphaned fork.  Is there an effective penalty if all the penalties are limited to a chain which has been orphaned?  The irony is that after the attack chain is published all the honest miners who did not complete blocks when required will be subject to a penalty and unable to mine for 2 days.

Gotcha.

I guess I was thinking of a different scenario, where one is penalized
on the main chain for trying to create alternate chains.

So, that's not what we're talking about?

I revised the post to be more clear.  It is important to consider the optimal behavior for both an attacker with a minority and majority of the stake.   In neither case will there be an effective penalty although how the attacker proceeds will vary (it does in Bitcoin as well for different reasons).

What are we talking about exactly when you say
"support the main chain"?

That's maybe where I'm not following you.

My assumption was the penalty was
because an attacker tried to broadcast
a chain that wasn't the best to the other
nodes, and it was rejected.

No that isn't the penalty.  The "penalty" is if a miner doesn't mint a block when he can then he is prevented from minting future blocks for a period of 2 days ON THAT CHAIN.

"supporting the main chain" = minting blocks on that chain = no penalty = doesn't prevent the attacker from simultaneously working to extend one ore more candidate attack chains at the same time.

I see.

And I assume the kind of penalty i'm talking about would
be highly impractical based on the fact that you'd be
punishing honest miners way too often.

Bottom line:  nothing-at-stake-problem still not solved.  :)

That's more or less what he said: that he wants public review of the ideas planned for Nxt. As seems sensible.

He says he's concerned about clones. Also, some of this stuff depends on a robust ecosystem, which isn't in place yet, but hopefully will grow over the next few months.

(I'm not saying I agree with this approach, but I can see the sense of it, and there's no doubt the Nxt developers have delivered in other areas.)

No he wanted to PRIVATELY consult.

If he wants public review, why doesn't he just post here.

As I understand it, the Nxt code is modular. The core, including the PoS stuff, will be open-source, but some of the services built on top will not be. The Nxt devs believe a lot of their value is in the services - things like the Asset Exchange. So the clone won't include all of Nxt.

Also, the Bitcoin distribution isn't all that fantastic. It has its whales. And the whole spin-off idea is unproven. The new clone will be neither Nxt not Bitcoin. Merchants who accept Bitcoin won't automatically accept the clone. There probably will be more than one clone, diluting attention. The idea that the clone will instantly have the same market capitalisation as Bitcoin is false. Network effects will encourage people to stick with Bitcoin and/or Nxt, because they will follow the market cap. The reasons that cause alt-coins to struggle, even when they are technically better than Bitcoin, will apply to the new clone.

I don't know. Perhaps because this is the Bitcoin forum, not the Nxt forum. The Nxt forum is public: https://nxtforum.org/general-discussion/some-thoughts-on-arguments-of-pow-guys/.

Asset Exchange is in the core and is open source.

Third party services (like muiltisig gateway for othjer cryptos)  may or maynot.

Why NXT guys are so against open culture? If someone copies it new ideas might emerge.. I dont see the reason to be secretive at all... but it is their choice..

I can relive your emotion.

With TF, the amount of consensus power is also limited.

I can't follow you. Last time I checked there already existed a bunch of Nxt clones because it is open source.

We can't control if third parties are open source or not.

The better chain needs to almost mirror the honest one in terms of certain properties.

That is because of the limits in the re-targeting algorithm and because one will not be able to borrow transactions from on branch to another. Especially the latter will make the new chain almost always "unpopular" to adapt. The former needs computational effort.

If DaT ever endorses a POS, I will take my bitcoin go all in with what I feel like I can afford to lose!  He clearly knows what he is talking about and admits what he knows and doesn't know.  I would love to have him really grind out the NXT code and know for sure just what is and isn't possible. 

I agree DeathandTaxes is an expert.
No question.

However, I think it would be foolish to dump all
your bitcoins in favor of an altcoin, and I'll
give you 5 reasons why I think so:

1.  You must be careful not to misconstrue
something he (or any expert) says to be an overt "endorsement".

He might say something is good, an idea is good,
or even a coin is good.  Heck, he might even launch
his own coin, but that doesn't mean he's
going to sell all his Bitcoins.  Why would you?

2.  A new idea from an alt may later have problems and I
would bet on 5 years and thousands of people vetting
Bitcoin over what one expert says in a short timeframe.

3. Just because a coin is technically sound doesn't
automatically mean it will be adopted by merchants.
That takes a very long time, and meanwhile other clones
may leapfrog the new coin.

4. DeathandTaxes seems to like the "bootstrap an alt
with a Bitcoin based distribution" idea, meaning that
any new coin that comes out that has promise, may
be cloned and given freely to people that hold Bitcoins.  

So if you sell your Bitcoins, you would miss out
on that.

5. There is no social proof that people
will accept a PoS coin.  Recently, Gavin Andresen
was asked "can PoS work".  His answer was: "maybe,
but is it fair?"

I recall when I first learned about Bitcoin and
being struck by the fact that the miners actually
had to solve problems to get the coins.  I didn't
even know the phrase "proof of work", but my reaction
was "wow, they have to DO something to earn the coins,
its not just something out of nothing.  This seems real
and legit".
---

Bottom line: Invest in alts, if you desire.  But you
don't have to throw out the baby with the bathwater,
even if an expert says something.

I agree with jonald_fyookball. You can let yourself being influenced by self-proclaimed experts but you SHOULD think it through yourself. Always. This does not only apply for coins but for all decisions made in your life.

DPOS is good

I think the POS/POW implementation of Peercoin has proven itself by now. Attacks are certainly not impossible, but extremely expensive. And even if you succeed, something which hasn't happened yet for more than 18 months, the checkpoint system will take you back to square one. Agree that checkpoint system as currently implemented in Peercoin is not great, but it works for the time being while the network strengthens. It is a bit like the policeman in pursuit after you went to the red light. If you know the policeman is there, you might not pass the red light. Would prefer a more pro-active approach and a more secure network though.

Peercoin is currently working hard to get more nodes out in the wild by providing Raspberry Pi images. The new Peerunity wallet (releasing v0.1 soon) will make minting easier and the wallet more user friendly. And there are active discussions on peercointalk.org about increasing the reward for minters, rewards by block and to improve the security with e.g. cold-locked minting. Once implemented this will increase the participation of the coin holders and with that increasing the security of the network. Peershares is also likely to increase the use of Peercoin which would eventually turn into increased security.

The NXT network is way younger but has some promises. The way their forging works is interesting, but I'm personally struggle with the lack of transparency they display at times. Their wallet is finally at a level that someone used to cryptos can manage. The number of mandatory protocol updates is way to high for the average person to keep up with though. This needs to change before wider adoption can begin.

On the sales/marketing argument, NXT has an active development community but is not great on sales, Bitshares also struggles and Peercoin has also its challenges (will have a new video soon  ;)). All are riding mainly on the back of the Bitcoin train if it comes to attracting new users and marketing to Joe Average. NXT has a bit of a challenge here as they are quiet different and they will need to work harder.

As said earlier in this thread the challenge is in the use of coins by merchants and the general public. NXT has a challenge as it has a different protocol and Bitcoin application can't be ported easily. Peercoin is likely to implement a couple of updates which makes it easier to port Bitcoin applications especially those directly reading the blockchain (getrawtransaction etc.). Haven't looked at Bitshares recently in this context, but thet are certainly looking at a different market.

Not sure what the answer is on the OP's original question, but I agree with other posters in this thread, the coin with the best marketing, usability and adoption will eventually win assuming that the protocol is sound and secure.

_{Disclaimer: I'm invested for 85% in Peercoin, 10% in NXT and 5% in a bucket of other coins.}

you are so biased.

POW problems that are undeniable:
-Costs way more in electricity
-Reliance on Asic/hardware manufacturers
-susceptible to 51% hash power attack
-Waste of space and resources
-Centralized mining pools
-Hardware scams everywhere
List can go on.

That argument is null and void:

https://i.imgur.com/Nwf0eJb.jpg

I think these are all valid points and is a good post.  I always like it when I see a person that puts their disclaimer on their post too.  The one part I would emphasis even more too is that almost all the POS coins are doing an absolutely terrible job at marketing.  They will need to not only be good, but find a way to even out market bitcoin if they want to be successful.  Right now that not only isn't happening, but is isn't even close to happening.  Bitcoin has a huge lead in this area.  And to this extent, I think that any other POW coin is sadly mismatched, even litecoin.  Bitcoin verses Litecoin reminds me in some ways of David verses Goliath and Bitcoin verses any other POW alt reminds me of Godzilla verses Bambi.  Those alts just aren't going to make it.  The distance they have to cover while growing at the same time is ridiculous.  They are meant to be born, pumped, and die.  And maybe just maybe one comes up with a feature that bitcoin will then just incorporate. 

I think the only real challenge to bitcoin will come from the different code/different algo/different everything camp.  And even then, I am not sure there will be a real challenge to bitcoin in the near future. 

In the far future, it is 100% that bitcoin will fall to another tech.  All first generation tech gives way to a second generation.  It is basically a law.  A person can not mention one technology that this has not happened to.

I despise nextcoin because they say "this cannot be done". People who say things such as something cannot be done are moron idiots and proven to be wrong in the future all the times. what a pathetic excuse to for the creation of a scamcoin.

Peercoin is the only PoS coin that deserves attention and respect. Others are just shady clones. You could as well as make a similar topic and allow voting between BitCoin and DogeCoin, asking which one is better by their PoW algorithm :D

What is this?

How on earth the NXT scamcoin has more votes that the best and original crypto of this system?

I guess the most voters have invested on NXT and they are making desperate attempts to raise it's value :)

Maybe because of this? http://coinmarketcap.com/

WTF? Can anyone make sense of this nonsense?

Nxt is original. I's not a clone.

Relax Eadeqa. Let him explain what he means.

nxt is far superior given its many offerings...

Peercoin is the best!

Because nxt isnt a scam coin maybe? If you havnt noticed yet nxt has so much to offer that the other 199 alt coins dont have. we have a massive community and massive dev count. Each day new features are coming to light. oh and we are at payexpo :-)

Difference is the limit is hardcoded in DPoS protocol. While the pools are free to get anything.

Would somebody be so kind as to explain to me what the difference is between Transparent Forging and DPoS?

Peercoin the best. All the other all clones.

You are so pathetic you are investing on NXT. It doesn't even have a decent website or a wallet.

http://nxt.org/
http://nxtra.org/nxt-wallet/

now back to topic please.

if you don't know anything about NXT then better don't comment  ;)

Would be nice if this was less of an advertising thread and more a discussion thread :)

The discussion was very interesting until people started writing oneliners about which coin was "best".

Very little difference. DPOS puts a hard cap on the amount of stake that can be delegated to an address, and you can also delegate your stake *against* an address.

I read this part of the OP's post:
when asked: "How would you solve problem with scam accusations according to "unfair" distribution NXT to 73 big stakeholders?", BCNext answered: "This problem can not be solved. Even if we had a million stakeholders the rest seven billion people would call this unfair. A world with the money can not be perfect".[1]

So that's their excuse for making a scam coin. This is why a PoW hybrid could be seen a more viable option. Alternatively I'd suggest making a PoS coin that makes use of PoB instead of PoW, having PoB stand for Proof of Burn and tied to some existing cool coin such as Bitcoin itself. So just about anyone could generate the stake by destroying some Bitcoins. Then there would never be a scam accusations yet the coin would be 100% PoS. God, I should make my own coin, I'm so smart with all these clever ideas :P.

Hard cap will not help Sibyl attacks?

Interesting. What is this against supposed to accomplish? What happens if everybody delegates *against*.

Of course, Peercoin has the best PoS technology. NXT learn a lot from Peercoin, even they use java, but the scenario is very important.

PoS is the innovation of Peercoin, that's the core value. For 2 years operating, Peercoin is very stable and make people believe it is worth of holding. NXT and DPOS still need time to prove their stability.

For NXT, I have to say, you buy then you raise the price for IPO holders. Big IPO holders raise up the price and spend lots of money to advertise NXT, they just want to find more to buy their NXT in high price from them.

Fair distribution of coins are very important, don't forget this is currency.

Mintcoin's implementation.

Extremely fast 2 minute transactions.

All PoS coins are backed up misinformation, hiding facts and trolls.

Unlike bitcoin which clearly states all the attack vectors and problems on the wiki. I would prefer fiat than current PoS coins.

 If you must choose one choose the one with most trolls and hype.

Not sure where you get your information from. There are multiple threads on peercointalk.org about attack vectors, weaknesses and potential solutions for Peercoin.
As other posters have mentioned the PoW threats Bitcoin and other PoW coins face may be more devastating for the value of the coin than the PoS threats which are already temporarily mitigated with checkpoints.

For Nxt. Here you go: http://wiki.nxtcrypto.org/ Everything is out in the open. Code is all open source. Nothing is hidden. New developments are being worked on to improve how it works at a core level (economic clustering, transparent forging etc.).

As the poster below me said, there's also lots of analysis of possible weaknesses about Peercoin on peercointalk as well, and lots of work towards fixing them.

The blackcoin dev is also working on strengthening that PoS algorithm.

This looks more like infomercial. No description of possible attack vectors at all like bitcoin does. NXT in particular has been all promoting but no honest discussion about the algo problems.

Feel free to start threads about attacks on Nxt.

Will you pay me?

You cry for attack vectors, provide some as everybody here does. Nobody will pay before of that. If they will find your contribution worthwhile, they will donate to you.

Btw. that is how the Nxt community grew strong.

IMO, the hard cap is very important which others doesn't seem to find a key feature. I would pick DPoS over Transparent Forging just because of that.

Wonder if it is at all possible to modify the Transparent Forging scheme to implement a limit.

Just stating attack vectors without any solution is hardly useful. How would you solve the problem of Bitcoin being controlled by 10 or so miners?

Why is hardly useful? It is very useful. I may not be smart enough to find solutions or may not exist without compromising on decentralization. Decentralization is tough and I m sure has limits.

Not sure where you get your info but recently I read somewhere there are 55000 miners. (I think it was in the recent bitcoin conference in one of the videos)  Is this what you mean? https://blockchain.info/pools?timespan=24hrs  If yes these are pools and pools are not miners and pooling will happen with both PoS and PoW. If not can you point me to your sources? I would be interested..

Thanks for the correction.

Peercoin of course. What kind of phony poll is this?

Point is, why?


Sure, if you explain the why.

I think this is over simplifying. To support all chains one *will* run out of resource (RAM or CPU cycles or fan speed or electricity bill... the whole *POW* cost) soon because the number of forks increases exponentially if you start to tend all of them. Althought the cost per fork looks low, it might just be enough to overwhelm the tiny probability adjusted benefit (e.g. you have to double spend several million PPCs to make it profitable after trying it so long). I posted something here (http://www.peercointalk.org/index.php?topic=2743.msg24350#msg24350) but like to hear feedbacks from others before going further. I think a simulation is needed to find out how exactly profitable this business is.

Miner is the one who decides what transaction to include or exclude. In effect it is controlled by 10 or so miners. 55k or whatever running their machines is immaterial. I guess you can see the problem now.

Pooling won't happen with DPoS. Sure, somebody can set up multiple delegates and keep his identity hidden, but pooling as such directly is not possible.

Besides in DPoS, anybody transacting is playing is part in securing. So in effect the shareholders has a direct say. In PoW like Bitcoin, the users don't have any say.

You need just one miner to include the transaction in block.. You may wait more though...

Dont understand DPoS (I ll have a look) but the rest of PoS are flawed in the core idea and will be controlled by the rich of the coin always... Can the hard cap idea of DPoS fight the total control of the rich over the coin? What is the advantage?

An attacker only needs to support the main chain and his own attack chains. I believe that is the meaning here.

You're missing the entire point. Effectively 10 people have the power to choose what types of transactions to include. For instance tomorrow Ghash and 2 others may decide to leave out all Counterparty transactions, which means they are screwed. Do you, as a Bitcoin user, have any say in it?

They aren't screwed.  The tx will still be included in blocks by other miners.   Also the excluding miners will lose the tx fees and that will make them less competitive relative to other pools and if the actual miners disagree with that loss they will leave and the pool (and pool operator's profits) will shrink.   Today fees are relatively small but as a % of total miner compensation they will only grow.

Interesting.

Sure. The point of mhps is that the number of "own attack chains" can get really big in order to create the best chain.

Right. It's still exponential because your own attack chains also have a non-zero probability to branch into alt-chains. It's just cancer.

You want other concurrent miners to cooperate to accept your alt-chains so you don't have to fight the main chain yourself. Or do you (grow their chains when you don't have an  direct interest in them)?  I suspect the net effect of more non-cooperative concurrent miners is just bringing more compettion against themselves.

I think you confuse linear with exponential.   y = 2^x is exponential.   y = 2x is linear.

I think people are overcomplicating it.  An attacker only needs one longest chain to attack.  Sure you could run a multithreaded application and try simultaneous attempts to build the best longest chain but that's about it.

If you have several peers who are all eager to extend every chain they see, your altchains will soon have their own altchains. The global blockchain becomes a blocktree. Every branch of the tree is the end of an alt-chain, being able to have its own branches.

It's y = some_constant^blocknumber. The constant is greater than 1.

But I don't think peers operate this way.  All chains except the best/longest are discarded.

If I'm an attacker, I wait until I have a long enough chain and then I broadcast it.
If peers think that is the best one, they will use it.  And if they don't, they won't.
Either way, nothing increases exponentially for me.

The blockchain never becomes a block tree because that is moving in the opposite direction from consensus.
Everything quickly converges onto one chain when you have a proper mechanism in place like best chain wins.

The one  longest chain is the main chain, most of the times. Most people don't bother to concurrent mine an alt-chain if they have to program it.  If you have to program it you have to think if it's worth your effort. It is not absolutely nothing at stake. We are talking about "0 divided by 0" here (very small profit divided by very small cost). I don't know how profitable to grow only one chain. It should be studied in more details. But once you decide to grow an alt-chain, because it gives you a chance to double spend, why not add yet another one? Doesn't it give you even more chance? Yes or no? It has to be yes. Then how about another...? The logical end is the end of some kind of resource. You are saying the resource is your time and that limit the number of alt-chain to 1. That is fine. I hear your opinion.


Well then the attacker shouldn't even exist.

Generally no, because you'd only be competing against yourself.  If you are an attacker, you want to put maximum resources on building one best chain.

If you're talking about separate attacks (doing a double spend and then later, doing another one) that's another story.

For Peercoin the POS mining (called minting) only happens once a second, lasting perhaps less than 100 microseconds (I guess). 99.99% of the time the computer is not minting.  Maintain a 10-block altchain (in addition to the main chain) takes less than 100KB RAM (my guess). It doesn't cost that much. But the cost is not absolute zero, either.

Its like this, you can always get a single individual/group to set up up multiple pools in PoW/PoS, or multiple delegates in DPoS and grab more share than what it seems. But the hard cap means that it is more complex to get the same control.

Say, Ghash sets up another couple of pools anonymously (or maybe even does), or makes buddies with a couple of other big pools, then it already has control. In DPoS on the other hand, he/she/they have to go through a lot more trouble (some 50 delegates in case of BTSX) to get the same control.

Besides, say, a pool offers incentives, then everybody will naturally flock to it. Sure, at some they might start getting worried and not go, but as we have seen in the Ghash case, appealing to the better sense of the mining equipment owners doesn't work to well. They might not even be too worried about the long term health as they might be just looking at it as a business. In DPoS, the hard cap means such a scenario is not possible, and you have to also keep in mind that the users of the coin are the ones who are voting.

A system like XCP which is relying on the 10 minute blocktimes (even which is slow for a decentralised exchange), will be in a lot of trouble if the biggest miners decide to exclude their transactions. Point is the Bitcoin users, or even the ones running the mining equipment doesn't have any say in it. It just requires a couple of the miners to decide to leave them out and then XCP is in big trouble.

Just look in the XCP thread here where there was a big argument about this. I am not saying XCP is right or the couple of pool owners who engaged in the discussions were right. The point simply is there is no accountability, and the actual users and miners are dependent on the whims of a few.

I agree that excluding transactions could be bad in a 51% attack against bitcoin.
I would like to see more proposals like using sidechains or something to increase
The work an attacker would have to do to maintain a malicious mining monopoly.

Yes.  Maybe we should call it the "very little at stake problem"  :D

how could that be a problem. proof of work can be considered a proof of stake system in that you are proving your stake in the collective hashing power of the network. The value comes from the stake not from the cost of proving that you have stake. Thus,  the reduced cost of pos mining is not a problem but a solution.

If you don't understand the "nothing at stake problem" aka "very little at stake problem" go back and read this:

https://bitcointalk.org/index.php?topic=584703.msg6982574#msg6982574

I think I see which direction you are coming from. But I do not clearly see how a hard-cap is going to solve the problem of a second pool under control of the very same real-world entity.

"A lot more trouble" Why? Are existing pools preferred before new ones?

There is no such thing as waiting for the best chain to show up and say hello.

You actually need to find it.

Lol.  Yep, I agree.

Probably a "very little at stake profitless non-problem" ::)

Not a problem for Bitcoin, certainly.

We will see about that https://bitcointalk.org/index.php?topic=638146.msg7120755

This attack does not apply to DPOS...

I was asking, not telling. It seems to me like it doesn't apply, but I'd like D&T or other anti-POS pros to explain if I'm wrong.

I still do not get the difference between TF and DPoS. They seem equivalent to me. Just newspeak so to say.

Very similar. DPoS lets you vote against delegates, has a cap per delegate, and and delegate order is determined once per round rather than after every block (you can't try to pick a "good" block to get you more than N blocks in a row if you don't own more than N delegates)

Not a pro (and not anti pos necessarily) but I will say this:  the extent you rely on delegation/supernodes as a security mechanism is also the extent you dilute the trustless nature of the system and erode true distributed consensus.  So depending on the implementation there will be trade offs.  You could obviously eliminate the n.a.s. Problem with a central authority but that puts us back at square one.  If  the dpos uses an automated mechanism to resolve conflicts, then it probably can be attacked by false chains in a similar fashion to the other poS systems.

Peercoin  :)

Sure, but isn't it an improvement over bitcoin which effectively has delegated-proof-of-work with about 5 delegates selecting blocks on behalf of >80% of hash power?


The fork resolution is automatic and is just determined by which chain has more stake-vote counted by delegate signatures.

Your next point is exactly what I'm asking - how would an attacker make a false chain using old keys with stake in them, if they cannot ever generate a sequence of delegates where they have more than N delegates in a row? Each round of delegate signatures is done without shuffling in between - if you only have 40% of the stake at any given time you cannot generate a round (~1 hour) where you have more than 40% of the delegates. Once an hour has passed, how would you make a false chain?

Again, disclaimer:  I'm not an expert.

I would dare to say no, it's not an improvement over Bitcoin.  With bitcoin's poW, mining pools don't have any special powers that solo miners don't also have.  So while the hashing power is "pooled", consensus isn't really "delegated" beyond the same protocol rules that affect everyone.

If you are talking about  supernodes solving the nothing at stake problem because they can check signatures in real time, that is definitely taking a step toward trusted authorities.  In contrast, proof of work acts as it's own timestamp.

Bolded part is what I believe to be a major misconception. What powers do delegates have that mining pools don't? I even advocated to call them "signing pools" because they play the same role. All they can do is exclude transactions.

(I'll tell you one: they have the ability to vote on "alerts"... but bitcoin's alert system is far more centralized ;) )

How does a mining pool not have power that solo miners do not? A mining pool can produce more blocks than a single miner...

I'm absolutely fascinated by your insistence that bitcoin is trustless network. There is no such thing a trustless transaction. You can create an environment that incentivizes a desired outcome. But at the end of the day all of these systems rely on people. Bitcoin is less of mathematical experiment as much as sociological one. We know that public key cryptography works, but what we do not know is whether or not individuals can trust no one while simultaneously trusting everyone. But this is the nature of economics and think it has been empirically proven that I do not have to trust an individual I transact with but rather I can trust society as a whole.

I'm not an expert either but I feel that your analysis of bitcoin and related systems lacks understanding of organizational theory. All organization whether virtual or not face the same fundamental constraints and the delegation of power is necessary for scalability.

NEM, beacuse its Proof of Importance

Well said.

Took another look at bitshares , you may be right.  Not sure if it means dpos necessarily immune from n.a.s....If attacker gains several delegates or has the stake to do so.  

So, it is basically the same. Thank you.

Thats because you can in PoW, say, put up two pools and grab control. Here you need to set up some 50 odd delegates. Of course, the developer may decide that its popular and its needs more and then the number of delegates can be increased.

The miners contributing to the pool doesn't have any power. The pool owner decides what transactions to include.

Also, keep in mind that the miners are not the same as the actual users of the coin. Theres a overlap, but it would have been so much better if all those using it are actually the ones participating.

IMO, the cap means its very different, as I can see the same pooling problem with TF as in PoW. But it seems not many agree with this viewpoint.

So, I ask again: what is this cap good for? Where is the technical difficulty in creating a new pool, when my first pool is capped?

Yeah the cap doesn't mean much IMO, the "downvotes" are the more important part.
The important part is that as a pool operator, you can only pay dividends to all stakeholders and not just to your voters, otherwise you will get voted out. This alleviates economies of scale which lead to centralization.

Interesting. I will think about that.

I still would like to see an answer from sumantso. :)

Id say PPC but it's 100% based on the fact I am mining it soo... ya... lol.

The poll doens't take into consideration PPC-derived Novacoin's dynamic inflation control (NVCS), which paves the way for very high inflation rate for early adopters (rewarding risk-taking).

IMO, trying to grab control with 50 puppets instead of 2 is much more difficult.

I know. You said that. But I was asking of the why? Where is the additional difficulty?

Because people have to vote for the delegates. Also in what situation would anyone profit from a manipulation of 51% of the delegates? Or for that matter in what situation do you believe that anyone would profit from Ghash.io  performing a 51% attack on the bitcoin network?

That makes no sense. Why would this make it more difficult?


I do not understand.

In order to have 51% of the delegates under your control you either have to have 51% of the stake or you have to accumulate 51% of the votes from the shareholders. If you can do that how have you manipulated the market? All actions are voluntary and people will only vote for you if you provide the best service as a delegate.

Also people that talk about theoretical attacks do not understand the practical implications of such an attack. There is no action without its cost and consequences. If you perform a 51% attack please explain how you can reasonably profit from it? I have never heard anyone making a practical argument for how a 51% attack is profitable.

The initial and still unanswered question was: why would it be more difficult to gain X% via Y hubs than to gain X% via 1 hub?

competition

Same goes for 1 hub.

Oh I think I get what you are saying, although I am not entirely sure. But the notion of using one delegate was used in early testing however it was problematic from a technical standpoint. Theoretically speaking there is very little difference as long as the single highest voted delegate or multiple highest voted delegates can be voted out easily if they do not perform their task as prescribed by the networks constitution or shareholder consensus. However, more specifically an attempt to attack the network would be carried out in different fashions given the different network structures. If there is one delegate theoretically I believe it is easier to discern an attack on the network and immediately fire the delegate. If there are multiple delegates it is harder to initiate and coordinate an attack as the order that delegates sign blocks is reshuffled after N blocks.

Thank you. I think I got what you mean. :)

They can be sued/hacked/coerced by governments, banks or other corporations. Preventing an entity from profiting from a 50% attack isn't enough.

If anything prevents a delegate from doing his job (ie signing a block at the designated time) then he will be voted out and replaced by a delegate that is not being sued hacked or coerced by governments. Delegates have a simple task and do not have that much power. Shareholders will vote for the most diverse set of delegates in order to maintain a resilient network. Global competition is the most robust solution to the problems you described.

The point made was that the possibility of attack will be there whether it is profitable or not.

Ok... so let someone incur the cost of "attacking" the network. If the shareholders are not complacent then they will just for the network and the attacker will have control of a worthless network. You simply are not considering the economic cost of attacking the network. What you consider an attack is not actually an attack at all.

No doubt
NXT is great。。。

I'm a big supporter of BitShares but in terms of who would profit from a Ghash.io 51% attack on Bitcoin...

TPTB behind the traditional banking system have $ trillions on the line, Bitcoin and crypto-currencies are a big threat, especially as I see capital controls and deposit confiscations in a lot of Western countries futures. 

Performing a 51% attack on the Bitcoin network via Ghash.io,  if it could decimate the price as well as significantly damage public faith in crypto-currencies would be extremely valuable to them imo, no?

Sure.

Nxt is so terrible at it's distribution, the ppc way is the most fair distribution model at this moment.

I dont have ppc so tell how it is fair distribution when you dont have resources to mine it but get in exchange of money!!!????

which model car has the roundest wheels ?

I see what you're saying, 'they all get you there'

but personally the car that has the lowest fuel consumption (cost), is fastest (confirmation speed), has the best safety features (Security) and looks as well as rides the nicest (user friendly) are all features that may go into my decision of buying a car. (As well as anticipating what car others will want to buy in future.)

Plus some cars aren't allowed on certain roads, so the one that's let me access the most places, will probably be important too.

I dont want to fight about whose coin is better, that is not the topic. Talking technology, NXT system is best. NEM promises POI system, who supposedly should work better , but Im not sure if it still counts as POS. But you need to hold some coins + use it.

Interestingly, Blackcoin which is based on the Peercoin PoS system decided to improve their PoS algorithm to remove some flaws (http://www.blackcoin.co/blackcoin-pos-protocol-v2-whitepaper.pdf). Their system now seems similar to Nxt (or will do once they hardfork and switch).

Lol? Peercoin - Flaws = Nxt <<< sweet

Why would I NOW switch to Blackcoin when Nxt is going to have privacy? I would say I can stick to Nxt even longer.

here is a comparison of nxt and bitshares:

http://wiki.bitshares.org/index.php/Why_choose_Bitshares%3F#Comparison_of_BitShares_and_Other_Platforms

Cool. Thanks. :)

There are some wrong facts in there. Who is the guy I can talk to in order to have them corrected?

I am actively editing the wiki. I am pretty sure those facts are correct.

If DPOS works it seems to be the answer to the topic question.

720 block confirmation times for Nxt. Where did you get that from?

http://wiki.nxtcrypto.org/wiki/How_Tx_Processing_Works#Transaction_Confirmations

technically speaking 720 blocks isn't actually the comparable confirmation time. 1440 blocks makes a transaction immutable
with bitshares when there is a delegate participation rate over 80% only 1 block confirmation is needed. worst case scenario given poor delegate participation 51 block confirmations would be need.

"Nxt transactions are deemed reliable after 10 confirmations."

That's the equivalent of 6 confirmations for bitcoin.

You give the worst case for Nxt and the best case for bitshares and claim that it's a valid comparison.

Oh cool. Let me explain:

Not sure what "confirmation time" here means, but 6 blocks of Bitcoin are a recommendation like 10 blocks is for Nxt. Maybe, the semantics of "confirmation time" is not what I think it is.

After careful consideration, Nxt also use that what you call DPoS. We have also delegates. However, we call it different. I think it would be better to have TF (Transparent Forging) in there. It is the official term for consensus finding in Nxt.
I am not sure if this row is used for concrete implementations or for classes of consensus mechanisms. E.g. DPoS is the name of the concrete name of the consensus mechanism in BitShares whereas PoW and PoS however are classes of algorithms. I would be glad if you could harmonize this row.

Maybe, two rows would be helpful for users:

Consensus Base: PoS/PoW
Consensus Mechanism: DPoS, TF, Consensus, Scrypt

This is the Wiki of BitShares. What do you expect? ;) They of course need to put their product into the right light. There is nothing wrong with that.

However, I agree that some cells need amendment. It is a Wiki and should therefore be honest as possible. But there is nothing tragic here. :)

@clout

Something more: in the next major feature release, Nxt will have anonymous transactions and dividend. Not sure what pegging means but Monetary System seems like this. This will be in the next major feature release, too.

Just to keep you up to date. :)

...claiming here (https://bitcointalk.org/index.php?topic=664146.msg7699025#msg7699025), that the wiki gives the worst possible scenario for BitShares and best possible for others, while it's vice versa :)

can you provide a source for the 10 blocks confirmation time for nxt being comparable for 6 blocks for btc. as i know, 6 blocks is immutable for bitcoin and the wiki says that 1440 blocks is immutable for nxt. what is deemed as "acceptable" for btc is 1 to 3 blocks. I was under the impression that 10 blocks was more like 1 block for bitcoin. when i use bter i think it takes 20 confirmations to go through so i would assume 10 blocks for nxt is not comparable to 6 blocks for bitcoin. i understand that this will change with TF and new release. I will use your suggestion of splitting consensus into base and mechanism. thanks for the information!

6 blocks isn't immutable for bitcoin. It's just a recommendation, because with each block it becomes mathematically harder for a fork to catch up. If you want it to be truly immutable for bitcoin, you would have to go back to the last place a checkpoint was manually hardcoded in.

720 are immutable for Nxt as we have rolling checkpoints (that is each node does not accept blockchain re-org after 720 blocks)
1440 is for having effective balance (that is you need to generate blocks)

I am not sure if 6 blocks in Bitcoin means immutable. Bitcoin does not have rolling checkpoints. I thought it was a recommendation. Do you have a link?

10 blocks are the recommendation for Nxt but I never had problems with 2 or 3 confirmations transactions. On the other hand, they are rare because I am too slow because new blocks can come in fast (because the block times are still random)

After some testing I have done, we have forks of length 1 but not longer. So, the network is pretty stable. As BitShares will use almost the same consensus algo, I can tell you that your network will be stable as hell.


I think this analogy is somewhat correct. In the future, it will not because Nxt will have constant block times of 1 minute whereas Bitcoins block times are random.


I do not know of BTER.


Sounds cool.

Do you have a link for that 10 blocks?

No. Though since you said that normally forks are no longer than 1 block high, then 10 is probably super conservative.

you guys are right to say that 6 block confirmations for bitcoin does not make an immutable transaction. it says here (http://wiki.nxtcrypto.org/wiki/How-To:Handle_Deposits) that 10 confirmations are recommended for nxt. i don't know if there is any analysis of the recommendation that would make it easier to compare to bitcoin confirmations. also bter is a chinese exchange that has 70% nxt trading volume.  

my mistake, bter uses 10 confirmations as well

I believe, for objectivity purposes, it would make sense to differentiate between 'normal conditions' and 'emergency conditions' when comparing systems. So, two sets of numbers are required for each system in the table.

This!

Not bad. That would dramatically increase the credibility of that table. +1

I believe perhaps this is the same table referenced.  It has been changed and updated.  It has NXT/Bitshares vs other networks.  I think some of the accuracy concerns have been addressed ?

http://wiki.bitshares.org/images/5/5f/POS_Table_comparison_smaller.png

Well, as long as it's impossible to include features specific to NXT into that table, which would show in red for BitShares, and as long as all the features showing in green for BitShares already work, I would say the accuracy concerns have been addressed :)

Me. :)

This table shows future features, right? Because BitShare is not alive, yet. If so, you need to mark the red cells for Nxt also green.

As I said, with the next major feature release, Nxt will provide all of them (except Cross-Chain Trading - that will be addressed in the feature release after next)

Only time will show
PPC C++ family (Nova Blackcoin… ) or NXT,NEM,NODE  java.

NXT is creating different system while PPC family is able to use in easy way solution from BTC markets.

Today you have NXT assent exchange this is BIG interesting concept
but from the other had you have Blackcoin multisign that will
allow “cold stacking” - you will be able to stake using mobile and PC – hacker will have to hack your both devices in order to stole your coins.
That currently works but you need 2 PC but mobile client is only matter of time.(will be open source after some time after full release )
Such technology is needed in crypto overall to help people start thinking that digital currencies are secure like bank accounts.

Both POS systems are improving over time but technology using between them is different I don’t know what future will be.

NXT is making nice moves forward in development (java is easier to program ) while Blackcoin PPC are improving protocols too.

There won’t be ultimate GREAT solution and all will have own + and -.
But every “–“ can be solved sooner or later like Blackcoin is solving insecure stacking problem.
NXT will develop their solutions too.

Re: Which Proof of Stake System is the Most Viable:
BitShares  DPoS

~CfA~

No the only "future" feature of bitshares is market pegged. Everything has been public tested for the past 2 months. You can join the test at bitsharestalk.org. When is this next major feature release for nxt?

I confirm what clout said. I tested BitSharesX also and I am more than impressed! Please try by yourself and make your personall conclusions at https://bitsharestalk.org/index.php?topic=5523.0 (https://bitsharestalk.org/index.php?topic=5523.0)
just ask on the forum to send you some test funds giving your BitSharesXT address... their members there are all very helpfull...

Easy money.

To be fair messaging in BTSX is still TBD.
Cross-Chain-Trading has blockchain support, but has not been demonstrated in any test network.
Market Pegged assets are going to be tested live this week on the test network.

Items missing from table:
Pay transaction fees in any user-issued asset for which there is an open ask order.

Market Matching Algorithm is a tad more complex than just saying "automatic"... can anyone point me to the algorithm used by Nxt?

Nxt has leasing... DPOS has delegation... so lets compare and contrast:
   a) leasing is for a fixed period of time
   b) does leasing require executing a transaction on the blockchain (to lease) and does this charge a fee?
   c) can your lease be revoked prior to the period of time.
   d) what happens when your leased forging power are spent to someone new?

It seems like Nxt leasing + Transparent Forging is very similar in principle to DPOS prior to upgrade to approval voting.

In NXT:
a) can lease for 32767 maximum blocks (not sure if that limit can or will be changed in the future).
b) yes, it's a separate type of tx with a fee.
c) It can't be revoked before lease expires (again, this could be changed in future releases as this feature becomes more advanced).
d) the accepting account can't lease lessor's forging power to others, they can only lease their own NXT balance to others.

On c). It can't be revoked, but you still have control of your coins so if you move them to another account, the lease is effectively broken.

Both networks were designed independently... It doesn't matter which preceded which.

when was transparent forging with leasing implemented?

Exactly, when? BitShares can run anything they want on testnet, just like NXT can test anything on testnet, it's when it goes to live net that counts as the implementation.

Ok...so when is this next feature release. And can I join the test net with transparent forging and leasing?

Currently, we are busy preparing and testing the Digital Goods Store. That is in the current release. Leasing works already on the main net.

Transparent Forging has lower priority as we do not need 1000 TPS right now. But it is planned this year.

After the current release, the next major release only includes internal improvements (DB etc.)

And after that the next major feature release will come. Roadmap is there: https://nxtforum.org/news-and-announcements/development-roadmap-update-2014-07-05/

I really like the leased forging concept.  This is something DPOS fixes by not having forging power proportional to stakes.  One of these 2 approaches is a necessity for POS systems.  The security exposure is just too high otherwise.

BTSX is live now with DPOS implemented with 10 second confirmation times and approval voting for 101 delegates.

Does anyone know if 10 second block times is the record in crypto-currencies? 

that is not the point. The point is speed * security / degree of decentralization. Although a high speed is a significant achievement in itself as well but it is not worth much by itself.
I am not saying that Bitshares x is too centralized. At the moment Bitshares X is probably more decentralized than Bitcoin.

Any new thoughts on this question? My money's still on BitShares.

is Bitshares and Ethereum going to be one system?

it'll be an epic battle of the giants to behold: NXT vs Bitshares/Ethereum. Stay tuned in :)

Trying to derail the thread, troll harder! :D

We can just choose between those 3 ?

What about all those other coins around?

Absolutely useless poll until you add all POS-coins.

This poll was set up in April. Create a new one to get updated results :)

The "penalty" is if a miner doesn't mint a block when he can then he is prevented from minting future blocks for a period of 2 days ON THAT CHAIN.  ???  ???

any updates on other POS coins? is nxt still king of the crop?

There's IOTA now, made by dev of NXT 'Come From Beyond', not sure it's POS, it's without blockchain I think. Transactions are validated, not based on how many coins you have, but based on past transactions? I don't really get it yet but it seems solid as multiple people came up with this same idea.

IOTA is actually PoW. In order to attach a transaction to the tangle, you have to do some work. Each attached transaction confirms two previous.

Oh interesting, thanks for clarifying.

Anyone knows why they chose for POW?

It's the only way for the concept to work. Remember, there are no blocks that are generated every x minutes. No need to prove your stake in order to forge a block.
But you have to have a barrier for sending transactions as an anti DDOS measure. Even more so because there are no tx fees.

Anyway, the amount of PoW you have to do is quite small, and you only have to do it when you want to attach something to the tangle. A modern GPU can do the necessary PoW for a transaction in a tenth of a second.
I claim that it's not as wasteful as the PoW in bitcoin, because in IOTA there are no fees, so there's no arms race in doing the most PoW possible. And all PoW is directly neccessary for doing transactions, whereas on traditional blockchain the miner has do to PoW even if there's no transaction in the block.

Bitcoin itself has proven PoW a failure.
As the entire BTC community completely ignores the fact that China has had the capability to 51% attack it for close to a year.
Some communities are even starting to raise the electric rates for PoW Mining operations.
https://www.americascardroom.eu/blog/2016/07/utility-rates-raised-for-bitcoin-miners-in-washington-state/
PoW is just not a sustainable solution, and already controlled by China. (Might as well just buy the Yuan.)

Proof of Stake is the only Viable Solution to the failure know as Proof of Work.
With PoS, the Value is in the Coin itself, with PoW the Value is in the constantly decreasing value of the ASICS not the coin.
Requiring no more electricity to operate than a PC per household. :D

Time will make this abundantly clear to the short sighted.   ;)

 8)

FYI:
IMO,
ZEIT PoS Specs will outshine them all.  :)

Well I'd not go that far, it's seems to be working, but with flaws and serious limitations, and a huuuge waste of energy.
Anyway, I'm still fond of PoS like you, but in general blockchains are limited (scalability, growth of the chain, fees).

The way IOTA uses PoW is totally different, because there are no blocks and you only need to do very little PoW when doing a tx, so no energy gets "wasted", and the network is already proven to handle 30+ tps without any fees (100 tps are possible right now).

Working , but ignoring the fact China completely controls it, just like the yuan.

If IOTA uses PoW, then it still has all of the weaknesses,
1.  PoW mining will be out of the reach of all but the ultra rich.
2. The coin itself is completely useless without the work provided by PoW device, which draws excessive energy and requires constant updating to stay competitive.
ASICS Arms Race

Proof of Stake the value is directly in the coin , not the PC it resides on,
As far as TPS, that is really a non issue that can easily be solved with off-chain transactions.

Example: Gift Card System (Allows Unlimited Transactions Off-Chain)
A Gas company can issue me a card , I send them ZEIT to fund the card,  (This Transactions is on-chain and recorded in the blockchain)
they record the balance and credit my gas card with that amount.  

When I buy the gas with their card , it deducts the amount of ZEIT from my balance,
and issues me a receipt from their record keeping system.
(This Transaction is Off-Chain and not recorded in the blockchain , only on their internal record keeping system.)
(Meaning there is now No Limits to Off-Chain Transactions)    ;)


 8)

You are thinking of PoW as the PoW used for regular blockchains. Your points are totally valid for blockchains and I share your view there, but the tangle works differently.

1. There is no mining in IOTA, there are no fees, there is no block reward. No need for expensive hardware as there is zero profit to be made from it. You can even use IOTA if you own nothing at all (sending data over IOTA is free).
2. The point is that running IOTA does not use much energy at all. The ONLY PoW that has to be done is a small amount of work when doing a transaction.

If IOTA is using something different , they should call it something else to avoid confusion.
Po?,  I know call it PoT , Proof of Tangle  :D

Has IOTA even been released or is it still vaporware?
Coinmarketcap does not have any listing for them.


 8)

Mainnet is live, but it's not yet listed on an exchange, only OTC trades so far.

Thanks for the discussion, let's not derail this thread further.

Damelon of the Nxt Foundation did it again, creating good exposure for Nxt in the media!  :)
An article on blockchain governance was published in the renowned French "Revue Banque et Stratégie".
http://www.revue-banque.fr/management-fonctions-supports/article/gouvernance-des-blockchains-perspective-nxt

https://i.imgur.com/Mn9IS3M.jpg

There are tons of proof of stake variants not at the list:

lowest amount of coins you had at the last X days is the stake
amount of coins you had at X days ago is the stake

amount of transactions your wallet made is the stake
amount of transactions your wallet made is the stake, transaction fees goes back to be mined after Z days
amount of transactions your wallet made at the last X days is the stake
amount of transactions your wallet made at the last X days is the stake, transaction fees goes back to be mined after Z days
amount of transactions your wallet made between X days ago and X - Y days ago is the stake
amount of transactions your wallet made between X days ago and X - Y days ago is the stake, transaction fees goes back to be mined after Z days

at any time send coins to a place that cant be traded or get back, all coins there are stake
at any time send coins to a place that cant be traded or get back, coins spend X days there before being destroyed, all coins there are the stake
at any time send coins to a place that cant be traded or get back, coins there X days ago are the stake.
at any time send coins to a place that cant be traded or get back, having coins there keep increasing variable and this variable is use to stake
at any time send coins to a place that cant be traded or get back, coins spend X days there before being destroyed, having coins there keep increasing variable and this variable is use to stake
at any time send coins to a place that cant be traded or get back,  having coins there X days ago keep increasing variable and this variable is use to stake

at any time send coins to a place that can't be traded, after X days you get back the coins to your wallet, all coins at this place are the stake
at any time send coins to a place that can't be traded, after X days you get back the coins to your wallet, all coins you had there Y days ago are the stake
at any time send coins to a place that can't be traded, after X days you get back the coins to your wallet, having coins at this place keep increasing variable and this variable is use to stake
at any time send coins to a place that can't be traded, after X days you get back the coins to your wallet, having coins at this place Y days ago keep increasing variable and this variable is use to stake

I even determine not entertain the billet between TF and DPoS. They feel close to me. Just newspeak