Bitcoin Forum

Though I love the Bitcoin protocol, and it's elegant solutions to double-spending and cheating, it still bothers me that it takes a prodigious amount of energy to mine for new currency (something like 25 Megawatts are being consumed by miners right now).  So I've been trying to think of ways to substitute a less costly process for the current hashing problems required by BitCoin.

If you think of mining as a form of lottery, each computation of a nonce hash is like buying one "ticket" - the more tickets you buy, the higher the probability of your winning the 50 BTC+ prize.  Why don't we replace mining with a more DIRECT lottery?

Every 10 minutes, say, each person that wants to participate buys how every many tickets they want (using the same currency), and then the winner is chosen randomly such that your odds of winning are proportional to your ticket purchases.  The winner not only receives the 50 coin bounty in the block, but also all the tickets purchased in the block.

This has the same incentives and rewards as Bitcoin, but reduces the net cost of "mining" to near zero (all the "costs" of mining are returned to the winner of the block).  It's "fair" since your chance of winning is proportional to the amount of coin you risk in each auction.  A simplification is to treat the amount of "tip" included in each transaction as the "ticket purchase" amount (you can enter a NULL transaction with a tip in any block when you want to mine, but not sending a real transaction).

The remaining problems to solve are:

• How to fairly decide the winner of the lottery (without relying on trusted 3rd party).
• How to decide that an accepted block is "canonical".

The first problem can be solved by hashing all the user addresses of the ticket purchases in the block, and using that as a seed to a cryptographically secure random number generator.

The second problem feels non-trivial to me and still a source of possible cheating.  Any ideas?

Has this all been discussed before???

solidcoin already figured this out mostly, cpu mining

FTFY

I've seen similar proposals, but none with the lottery ticket idea. Two main concerns:
1) Currently the "wasted" electricity helps secure the network by making it equally expensive to brute force attack. You touched on this with your second bullet point, it's a biggie.
2) New users would need to buy coins from existing users. Since one on average would profit everyone would play this lottery in pools, it basically accomplishes the same thing as pure deflation but with more risk and complexity. We might as well just stop subsidizing coin generation.

Isn't the the subsidy is a useful incentive for managing/securing the block chain?

And yes, there's a big hole in the scheme until 2 is solved.  There has to be an unbiased way to decide between competing block chains (perhaps by preferring chains that have the most ticket value spent in them).  But we need the equivalent of the secure timestamping service that Bitcoin includes.

It is, but having everyone play the lotto doesn't manage or secure anything. :)

I think it's a non issue. By the time Bitcoin has a substantial user base, there will be technological solutions to energy efficiency.

This is basically the concept of mining through 'proof-of-stake' rather than 'proof-of-work'. I think 'proof-of-stake' would be superior to 'proof-of-work'.

I have some posts about it. Try searching for 'stake'.  I suggested a deterministic system rather than a lottery system. I don't think a lottery is any better or worse than a deterministic system.

Most people don't care about this or are too busy with other things. Other forum members are not capable of offering intelligent comments.

Is there something to be gained from re-opening a discussion with them?

What is really needed is for someone with serious programming skills to create the improved system.
I would be delighted to offer some input to this individual. However, if a willing programmer exists, then he will probably be too much of a neckbeard megalomaniac to accept my input.

Please describe a Lottery system that is free? How exactly does such a system work ???? What does it run on? How does it avoid the use of energy? I'm assuming that since it is free, it must be moderated by someone/something......a piece of software????

How is this managed? how does this no-cost system avoid fraud ?????

I think "free" is a beautiful Utopian idea but then again where is any useful system in the world that is ...... FREE!!!!

there are probably already dozens of fpga miners out there.  Reduced miner reward will help.

I'll look for your posts.  I'd love to help build something along this line ... but there are still quite a few issues to iron out to convince ourselves that participants couldn't cheat (or it would cost them more to cheat than to play nice).

Well, not "free" - but I'm looking for a system without the inefficiency of the Proof of Work system of Bitcoin.

Imagine something very similar to Bitcoin, except, instead of "mining", you risk some amount of your currency in order to receive some in return when you help secure the block chain.  But you risk losing your coins as well, so you won't have people gaming the system expecting to receive something for nothing.  There is no software yet, as this is just the beginnings of an idea - with many parts not solved yet.

I just posted a rather long philosophical rant about Ownership in CPU currencies, and I think that for the reasons I put forth in that post, your idea would not work. People can already "buy in" to any of the coins. You don't have to mine you can just outright purchase coins which is similar to what you're advocating. But the problem in my opinion then is that people who would rather contribute via development or mining would be cut out- and you need these people. You need the dev people to grow the software and the miners provide critical backbone support to the network. You can't really exist without those two, and if individuals can just "purchase" shares they have no incentive to really 'stay online' to provide the P2P infrastructure. They can just assume someone else will do it. Mining provides payment for supporting the P2P infrastructure.

I think you're looking at the system from the wrong direction. You're not "winning" anything when you solve a block and get coins. You're being paid for providing your CPU cycles, electricity and internet connection for supporting the P2P network. It only seems like a lottery because it's random, and it's random so that over time the payout is even. You can already have a greater "share" or chance at "winning" by contributing more processor power to the network. But each increment of contribution has the same compensation over time due to the random nature of the payout.

Besides all that- who would you be purchasing from in the first place? IE: who gets all the cash up front? I don't think *anyone* feels like purchasing Flooz 2.0

I can't think of a decentralized RNG other than proof-of-work. Does anyone know any?

Edit to clarify:


Where would this random number generator reside?

"Imagine something very similar to Bitcoin, except, instead of "mining", you risk some amount of your currency in order to receive some in return when you help secure the block chain. "

But how would that system work? Lets say for the 1st participent, to whom does he/she give their currency? And lets say they win their "risk" where does their "profit" come from? From newer people who join and give in their 'currency'?

This will amplify one of the most undesirable effects of capitalism : you can't make money if you don't already have money.

This thread is so fail, where is the "proposal"? No, saying "let's make something different" is not a proposal

Good thread, I have been wondering about the rationality of bitcoin mining, not that I expect anyone to behave rationally, particularly since I don't offer a definition of what that might be  :)

The computing power arms race seems to be headed for a place, the FPGA, where the incremental hardware cost to generate bitcoins cannot be allocated to any other use for the system. A CPU is a generally useful thing, GPU mining at least gives you a bitchin' game machine ;) , but right now there's not much else for most people to do with an FPGA.

I've built and worked on enough largish systems ( 250+ node Intel clusters, HP Superdomes, vast IBM Mainframes, Cray vector machines, you name it, I've done it ) that simply having a lot of cranking going on for its own sake does not impress me.

For that matter, I'm entertaining a thesis that the return on bitcoin mining should gravitate to near zero. I've yet to formalize an argument leading to that conclusion and I'm curious if anyone else has had this thought.

All that said, I've personally donated decades of CPU time to distributed projects like World Community Grid, and used the opportunity of a failed video card to acquire 343 Mhash/sec of ATI bitcoinage at an incremental hardware cost of $149, 2.3Mh/$, I see no reason to go further than this.

One thing I've seen done in the WCG projects is that the "payout" is based on the portion of your resources that are committed. The CPU client benchmarks the local system periodically and your return is adjusted to reflect this. I don't know the details of the scoring system, but a simplistic leveling illustration would be that the payout is the same for allocating 99% of a cell phone CPU as for allocating 99% of the bitcoin mining monstrosity du jour. Obviously there are some details to address such as mitigating capacity fraud. I do recall that being an issue with the open source BOINC client a long time ago.

If the computation actually added value such as the molecular biology work done on WCG does, then a scale that rewards gross total computing power to some extent could be implemented.

This would be approximate with respect to energy consumption. Were there benchmarks available that would let applications like BOINC or bitcoin measure the energy efficiency of a contributing system one could scale returns for that as well, but I don't know of a reliable way to do this across diverse hardware.

Based on the discussions I've seen, this appears to be the consensus. I think you're right too, but I haven't seen a formal proof... Just the intuitive explanation that more people will mine if the money is easy, and only project-supporting idealists (a minority) would mine at a loss.

Sorry thus is not a fully fleshed out idea.  Maybe "proposal" is the wrong term.  I am hoping to find others in moving this forward (or prove that is not feasible).

Here's a modified proposal that addresses "problem 1" - how to allocate reward for those contributing to securing the block chain.

In most ways, this protocol is identical with Bitcoin's, except that it relies on "Proof-of-Stake" as opposed to "Proof-of-Work" (thanks, cunicula for the terminology).  Note that the utility of mining, is to certify a block chain, so that the entire community can agree on a single version of the transaction history.  Bitcoin's protocol is designed to make it expensive for any single bad agent to out-compete the rest of the network, in order to re-write history and invalidate transactions.

About $200 worth of computation resources (electricity, capital costs) are (currently) collectively consumed in creating each block.  So, someone who wants to "re-write history", need spend more than that to replace a block with their own (which is why you should wait for many confirmations before accepting a large transaction as valid in the block chain - it costs about $1,200/hour to go back in time a re-write history).

Given the volume of transactions currently in the Bitcoin network, this is quite a high "tax" we are paying; and it will presumably only be getting worse if the value of Bitcoin rises.

So, why not use the currency itself be staked in order to ordain a block as valid?

• Someone creates a proposed "next block".
• Anyone who wants to, can sign that block, by committing some of their Coins to it.  For example, I'll stake 100 Coins over the next 144 blocks (24 hours) - for total of 14,400 "Coin-Blocks" of commitment.
• When the block has collected enough signatures (the sum of the Coin-blocks committed), the block is considered valid, and a new block can be started.
• The required block bounty can be adjusted just like the current "difficulty" is adjusted in the Bitcoin protocol.
• In return for taking some of your Coins out of circulation, you earn a proportional amount of the block payout (e.g., 50 Coins).
• Each client deducts from the balance of any address used to sign a block, until the expiration block of the commitment (thereby taking it temporarily out of circulation).
• Clients break ties in potential block chains, by accepting the one with the largest total amount of bitcoin-blocks of commitment.

I see it this way:

Bitcoin
1) Person does labor (office, construction, IT, fries & burgers, whatever)
2) Labor -> Money (paycheck)
3) Money -> Electricity (electric bill from mining)
4) Electricity -> Hashed block and 50BTC reward.

As long as reward > electricity/money/labor, repeat steps 1 to 4

Your proposition
1) Person does labor (office, construction, IT, fries & burgers, whatever)
2) Labor -> Money (paycheck)
3) Money -> Lottery entries
4) Lottery entries -> Accepted block and 50BTC reward.

As long as reward > lottery entries/money/labor, repeat steps 1 to 4

Point is that electricity isn't coming out of thin air. Labor is being exchanged for it (hopefully good productive labor). And as long as the final reward is above the value of the initial labor/money, it doesn't matter what intermediary system gets used. In either case people would create as much "waste" as possible to get the maximum possible Bitcoin reward for their labor. The only possible variable may be efficiency of the process, though in that case the only difference will be how much of the in efficiencies make the money just disappear (inconvenient transaction fees, lost time, etc). Either way the same quantity of labor/money will be "wasted" to achieve the same level of security and reward.

yOkay, but where do the coins come from in the first place? If it's "proof-of-stake" who starts it? How would it possibly work P2P? The point of Bitcoins proof-of-work is that you can go and do the work yourself, show everyone else, they check it, looks good, approved, and everyone invents 50 coins for you.

How would you get a proof-of-stake system started? There are no coins, so you can't even buy a stake in the beginning because the coin doesn't yet exist, but there's no method to make coins so you can't make them. Even if someone did make a "original coin" the next person would have to pay that original person money to create his/her 'stake'. It immediately becomes a ponzi scheme with the original coin maker sitting at the top. 

Energy isn't being "wasted" when you make bitcoins. Its the investment for which the coin is the return. Gold has historically had value because you had to 'waste' energy to mine for it in one way or another. Nearly anything that is at least relatively rare has value if it requires energy to obtain.

I haven't addressed the bootstrapping problem.  You could start with a Genesis block, and then play nice until enough other people joined in and created enough of the currency to support the block commitments in a fairly uniform distributed way.  You could also generate "New Coin" in exchange for destroying a Bitcoin (i.e., enforce a 1:1 exchange rate - at least going one direction).

All the proofs of signing are there in the block for everyone to see and independently verify (signatures just use private keys for any Coin Address) - just like Bitcoin shows the proven small hash value and nonce.

Energy *is* being wasted if you consider that the same amount of *work* can be done for a lower *cost*.

I would argue that there is a potential for Bitcoin mining to consume very large amounts of resources, on the orders of millions of dollars worth of electricity and computer capacity every day.  It's closer to $20,000 per day now.  People are fine "losing" that much, as they get at least that amount in Bitcoin in return.  But wouldn't it be better if we could have a system that had all the safety and security and decentralized control of Bitcoin, but WITHOUT the extra overhead?  I would think that would be a *good thing*.

BTW - after thinking about it, I would agree with other users here that a "lottery" per se may not be essential - I think it could be replaced with pro-rata return on investment.

Not sure I understand you correctly here, but (diminishing returns) as long as each extra bit of work can get me a bit of a return, won't people continue to exchange/waste work to keep buying lottery tickets until it's no longer profitable, the same way people continue to exchange/waste work for mining rigs rigs and electricity until mining is no longer profitable? What is the difference between $25,000 being spent on lottery tickets to secure a system, and $25,000 being spent on mining to secure a system? And if the former is less than $25,000, how do we know it's just as secure, if security largely depends on it being too costly to attack a system?
I'm trying to look at this as a series of simple math problems, and I feel I may be missing a variable that would differentiate the two systems. Maybe the whole system can be made way cheaper to run simply by lowering the rewards (already automatic) and lowering the transaction fees? People won't mine/waste electricity of the cost of mining drops below the payout amount.

I get what your saying- but it's hard to see what people would be investing into if there wasn't some sort of cost to it.

Others have mentioned the idea of the hashing process doing something "useful" IE: perhaps curing cancer or some sort of SETI signal processing, but there is a very convincing (although I can't point to where it is at the moment) argument as to why the hashing process can't be anything 'useful' in an outside sense if the integrity of the system were to be maintained.

That probably puts it most succinctly, and I haven't thought about it that way previously. The money goes into something one way or another. The spent electricity feels like waste- but even that can be useful.

A quick solution to your question would be for miners to use their waste "heat" for something 'useful'. Many heat their homes with it, and I've heard of some people drying fruit with it. Rather then redesign the coin, why not redesign the miner? Indeed if FPGA's take off there might be much less waste heat/electricity all in one go.

Sometimes the simplest solution is the least obvious. :-)

Lottery, pro-rated universal ROI, and pure deflation would have the same effect. If everyone who owns Bitcoins gets 50% interest, then the supply has moved but demand hasn't. An individual Bitcoin would be worth 66% as much afterwards. 100 / (100 + 50)

Any system that does not introduce coins at the expense of other users is de facto purely deflationary.

I've heard that switching around bits in processors uses almost no energy whatsoever, and most of the wattage used is expelled as waste heat. If true, low wattage FPGAs only have an initial fixed cost as the barrier, and long term, people will likely just buy more FPGAs, pushing the difficulty level up, and getting the energy costs (variable cost) of all running FPGAs right back up to where it isn't profitable to mine anymore. So the only effect they will have is higher initial investment and more hardware doing the work, much like the switch from CPU to GPU mining.

Simplest solution to this whole thing is already built in: decreasing reward amounts, and (hopefully) market determined transaction fees.

I'd love to hear more on this. I'm still leaning towards believing the use of intrinsically valueless computational intensity as a obstacle/control is a design flaw, maybe even an awkward and artificial hack  :)  I'm also unconvinced that the desired characteristics of a medium of exchange like bitcoin should require it.

Do I have a better idea at a detail level? Not so far, but the way various spin offs of bitcoin all seem to embrace this "feature" as part of the territory makes me wonder if bitcoin itself is a restrictive paradigm calling for the application of some outside-the-box reconsideration.

When you do folding@home, you waste a MASSIVE amount of energy and computational power on useless calculations. Most of the results are wrong and can't be used. Once in a while, someone's computer calculates the problem correctly, and that result is the only one that is useful (possible drug or whatever). With bitcoin, there is massive waste, resulting in one calculation that is useful (transactions between a bunch of people get recorded in the ledger and money can change hands). You could argue about which single correct calculation is more important/beneficial, but other @home distributed computing setups are just as wasteful.

Thank you for reminding us this fact.

The definition of waste is key here. If most of the various trial calculations in a molecular chemistry project only help by excluding non-solutions, they aren't wasted, they are necessary, otherwise they wouldn't be performed at all.

On the other hand, there's bitcoin, where the computational obstacle is an entirely artificial construct of a man-made game theory exercise, and is actually superfluous to the implementation and use of a medium of economic exchange. Various mediums of exchange that do not require such an obstacle are existence proofs of this superfluousness.

+1

This is already happening. Buttefly Labs is bringing out specialized hardware that can mine 1 Gh/s @ 20 W.

Expect energy consumption to decrease as difficulty increases.

5 years from now, most mining will probably take place in specialized complexes in Iceland comprising data centers and geothermal power plants.

Yes, a huge industry around doing nothing that actually needs to be done in the most resource intensive way possible makes perfect sense  ;)

a) It's not going to be a huge industry, in relation to the bitcoin economy as a whole, just like gold mining isn't a huge industry. 

b) If you want an example for "a huge industry doing nothing that needs to be done" then look at the marketing industry!  Both Coca-Cola and Pepsi "waste" huge amounts of energy and labor on marketing and all it achieves is to keep their market share approx. constant.    If both of them mutually decided to stop with all the aggressive marketing, they could probably keep their market share and all those resources could be used for something "useful".

Capitalism is suboptimal.  Deal with it.

I'm not sure why you say it being an "artificial construct" changes anything. It's one of the solutions to a problem we have, and other known ones do not cost less. If there is a better solution, then we could switch to it, just like folding@home would. There aren't any mediums of exchange I know of which tackles the same problem, so I didn't get what you meant there. I think the "right" results in each case is valuable enough to justify waste (almost by definition), so I don't think the definition of waste differs.

One thing worth noting is, the computational power assigned to Bitcoin is to create a distributed notary system, and as such it can be, and is, used for anything that requires such a system. So it is essentially a structure that Bitcoin requires, but useful and valuable beyond it.

Having said all this, topic proposal is very interesting. Satoshi's proof-of-work based system solves a lot of issues at once though, I'm eager to see ideas about how they can be addressed with such a system.

Yeah, that's actually not true. If they were to stop advertising tomorrow they would immediately lose market share to such obvious alternatives like, water. The industry has studied this topic to death. If they didn't HAVE to spend it on advertising they would gladly give themselves bonuses.

Marketing is critical to capitalism. It's critical to a lot of things actually.

not water, water doesn't have caffeine
what they're really competing against is tea and coffee

in fact, they're trying to supplant tea as the drink of choice in other countries by aggressive marketing

I think "wasteful" is the wrong term, because it cannot be avoided.  I think "inefficient" is more accurate.  These are problems which must be brute forced, trying every combination.  Verifying that a solution does not work is not a waste, it eliminates one possibility from a great many, but it is also not really a "success" either.

Coordination, like in mining pools, reduce waste by avoiding repeating computation.  Hopefully most @home programs coordinate their volunteers.


There are inherent challenges with using BTC network computation for something useful:

-You don't know when someone succeeds because no one knows the answer.
The way hashing works, it is very hard to find the solution, but the solution can be quickly and easily verified.  I don't know much about the @home projects, but this means a btc-style network will only work for certain types of problems.

-but for the projects that can be quickly verified-
-For a cryptocurrency to remain stable over time, it needs a constant string of problems with new ones every 10 minutes.
Because these problems are unsolved, we don't know how long it will take to solve them.  You can't trust a currency where the blocks could be 10 minutes or 10 months, it would be worthless.

-The entire network needs to be able to start working on the next one whenever a block is found.  If the problems are coming from some centralized research institution (ala Stanford), miners closer to the research would get an advantage, because some would have to wait for the problem to travel through many nodes to reach them.

However, if someone can figure out a good solution to these challenges, it would be wonderful.

Well, I said, "Like water" implying there are others. You're right though, tea and coffee are the go-to drinks of choice in most places.

Good. It's very interesting that there's a game in the mathematical sense that can be constructed called a cryptocurrency, there's all kinds of clever applications of cryptography. However, from there you went directly to how bitcoin et al. is implemented. Are you saying that spinning virtual wheels into heat on a cost basis that is open-ended ( the difficulty level ) and completely arbitrary is a functional requirement? If this was any other kind of system or machine, this would clearly be an area for improvement. What value is added by this property that is actually able to vary so much in cost?

Game wise, I do like what seems to be the increasingly self-defeating endeavor of mining as an enterprise as more and more of it takes place. It brings to mind a donkey led with a carrot on a stick, the optimal solution is to see to it that the donkey only ever gets enough carrot to continue chasing the end of the stick.

Fundamental to bitcoin's solution to the decentralized attack resistant distributed decision problem? Yes.

The POW proves that a majority of the interested holders of an forgery resistant asset (computing power/energy) have selected a particular transition history, in a way which can be independently verified by anyone without any trust at all.

This was the fundamental problem which prevented decentralized digital money prior to the invention of bitcoin.  Anyone arguing that it's not essential needs to also answer why why didn't have digital cash in the early 1990s— certainly many people were working hard on making it true then.

I'm here to quickly counter FUD from an authority. I won't get into a debate with everyone else.

The innovative concept is validity based on blockchain length. Proof-of-work is a burdensome way of achieving competition for blockchain length ;D. The longest blockchain can win with proof-of-stake just like proof-of work.

Here's a mechanism:

For proof of stake, clients sign blocks with a frequency determined by their coin holdings. Clients can sign a block every t(x) days, where t() is a decreasing function and x is the number of coin-confirmations controlled by the client's private key. Coin-confirmations are the product of the number of coins associated with a private key and the number of confirmations on these coins. Clients demonstrate control over coins by including them in an escrow address within block (k-1). In block (k), escrowed coins are returned along with a 'txn' fee; simultaneously, the signer of block (k) deposits a new set of coins with sufficient coin-confirmations in the escrow address.  

Individuals can't make a long chain without broad participation because acquiring a sufficient number of coin confirmations would be prohibitively expensive.

Ways of improving the mechanism:

Chain reorganizations and information transmission may be troublesome. One solution is to combine proof-of-work with proof-of-stake. (i.e. so that your proof-of-stake provides a subsidy for your proof-of-work)
With lots of coin-confirmations you can accompany your escrowed coins with a proof-of-work of difficulty 123 in block (k-1). With very few coin-confirmations. you can accompany your escrowed coins with a proof-of-work of difficulty of 123456789 (k-1). The scale of the subsidy can be periodically adjusted to keep blocks arriving once every 10 minutes on average. I think this may be the best model.

Benefits in terms of long-run txn fees and security:

Expenditure of scarce resources with alternative uses (electricity) leads to high txn fees and/or weak security (there's a tradeoff). Expenditure of resources without alternative uses (confirmed coins) leads to cheap txn fees and/or better security. High txn fees are far in the future, so no one cares. However, that does not mean that my logic is flawed.

Who or what holds the escrow? And what prevents the largest coin owners from colluding together to create more coins? H they hold the reserves large enough that everyone depends on their confirmation authority, what's to stop them from abusing that power? Don't forget that inflation is VERY beneficial to those dependent on loans/borrowing, so high value stakeholders could still prefer inflation (see governments and central banks)

Actually, yeah, let me summarize my last post with: what if the largest stakeholders prefer inflation and the power to arbitrarily print more money?

The blockchain holds the coins in escrow. They are not held by an individual. If the chain is extended then they are returned with a reward to the original owner. If the chain is not extended, then the record of them having been escrowed is superceded. In this case, the client would judge that the coins had never been escrowed and they would be returned to the original owner without a reward. These are the only two possibilities. As in the current system, clients will only recognize valid chains and miners will only extend valid chains because of self-interest.

Collusion. People can collude to extend invalid chains. The same arguments applies 100% to the proof of work system. Any group can collude to manipulate the blockchain. They don't do this because it's too expensive to be worthwhile. That's the point of proof-of-work. It forces attackers to spend resources to get their way. Proof-of-stake does the same thing. Control of the blockchain would require accumulation of a majority or near majority of all extant coins. This can be done, but it would be expensive.

Would you really want to spend $10 million to acquire a bunch of bitcoin, fuck bitcoin up, and then try to sell your $10 million of bitcoin back to people? No. For the same reason you wouldn't want to convert a warehouse full of graphics cards and a power plant worth of electricity into bitcoin and fuck up bitcoin. You don't throw a large sum of money into bitcoin in order to make bitcoin worthless. It is a money losing proposition. If you are willing to lose large amounts of money to screw bitcoin, then neither of the two systems can stop you. 

Please, think carefully before asking questions. You are inventing distinctions between proof-of-stake and proof-of-work. If you have a criticism of proof-of-stake, ask yourself whether it applies in the equal measure to proof-of-work. If it does, then there is a problem with your reasoning.

I'm sorry, but this is going to become tiresome very quickly. From now on, I will only respond to critics who employ structured, logical arguments.

OK, I'll try to construct this logically:

Proof of Work

Needed for successful attack: mining hardware.
Uses for attack assets: Useless for anything other than mining. No reason to acquire unless intending to mine or attack.
Benefit from successful attack: double spending. Possible inflation, though other miners can reject new coins.
Cost of successive attacks: lots and lots of electricity.

Proof of Stake

Needed for successful attack: lots of money. Will be acquired from normal business operations anyway.
Uses for attack assets: it's money. Everyone will have incentive to acquire it anyway.
Benefits of successful attack: double spending. Possible inflation, and continued inflation, since having highest stake means you continue to control the block chain.
Cost of successive attacks: nothing as long as you still have the highest amount of coins

Reasons for Inflation

Money is not wealth, it's just a measure of it. Someone with power of inflation can borrow money to acquire wealth, such as real estate, and then use their power to inflate away the debt or print money to pay off the loan directly, and keep growing their physical wealth at the expense of every other money holder suffering from inflation.
Worse, inflating your own money guarantees you can continue to hold the Proof of Stake power that lets you buy stuff with inflated currency.

I hope this was straightforward and logical enough.

No sorry. someone else will have to debunk this. Or you can remain confused.

I shall remain so, though primarily because the initial proposition was not logical enough either.

Which part needs debunking? Now I'm confused because Rassah's description seems to make sense. Could you write a similarly concise pro and con list?

Rassah: there's a problem with your reasoning
if you have 1,000,000 bitlesscoins by taking over the chain and doublespending and stuff, the price of bitlesscoins will plummet and your bitlesscoins will be worthless unless you are able to exchange them for another currency before people notice the hacking

that is, if you are able to doublespend and get more than 1,000,000 bitlesscoins and exchange all of them for BTC (at a good rate too, better than what you bought them for) to pull off an attack then it will be successful

if the volume on the exchange is not great enough, then it will be too cost-prohibitive to buy 1,000,000 BLC just to exchange 500,000 and kill the network and have 500,000 useless coins

Bingo. And if you think that the attacker has any chance of extricating himself quickly without losing money (I don't), then you could just require escrow of coins in the blockchain for 10k blocks (two months) instead of just 1 block (ten minutes). It would then be 2 months before the attacker could recover his coin horde and try to sell it off.


If the attack hasn't been discovered and reduced coin prices after two months, then can you really call it an attack?

Yeah escrowing tens of thousands of coins for months at a time into perpetuity is going to be popular. 

Got logic?

I've not seen any way to resolve the problems with my original proposal; it seems too easy to use a large amount of cash to reach back arbitrarily far in the block chain to re-write history (and hence, invalidate transactions where you spent money).

I also don't like the proposals where participants have to wage a continuous battle to reinforce a disputed block with additional escrow balances.

Unless someone can come up with a brilliant way to salvage this, it seems currently to be unworkable (to me).

But I've enjoyed the discussion and the help poking holes in my proposal.

... or, even worse, invalidate competing proof-of-stakes.

I might like proof-of-stake schemes better if somebody has a good plan for how to get them started-- you've got a genesis block, so the creator starts with 100% stake.

Now what, exactly, happens to create block number 2 for proof-of-stake systems?

http://xkcd.com/927/ ....................

Awesome although it is good enough to inline (the author approves and even supports inlining).
http://imgs.xkcd.com/comics/standards.png

I'll release a currency (not a bitcoin fork, no premining etc..., there will be a beta period) mixing proof-of-work and proof-of-stake early 2012, many problems have been solved, i'm working alone for the moment but i'll open once implementation is stable, stay tuned.

But that's exactly what the Fed does, taking over the USD chain through proof of stake, having the largest reserves and control, and just printing money to lend. Who cares if I am making my money worthless bit by bit, as long as I can keep converting it into other assets? It's not like others will just dump all their money because it's slowly losing value. They wont have a choice but to keep using it if it is sufficiently established.  They already do that with USD.

I would propose that you could destroy some Bitcoin in exchange for coins in the new currency.  It easy to create a blackhole address such that you can be certain that no one will have the private key.

Sorry for the late response. Subject to temporary ban for trolling libertarians.

Gavin's question about the initial distribution should not be a sticking point. There are many possible answers. Here is one.

I suggested that mixed proof of work and proof of stake may be a promising option.
 
In a mixed work-stake implementation, the initial distribution system could resemble other cryptocurrencies. Proof-of work could operate similar to bitcoin, with the key exception that difficulty criteria would be individual specific. An individual's target difficulty would be a decreasing function of that individual's stake. However, system rules would specify a finite difficulty target even for individuals with zero stake. Initially, there would be no stakeholders, so everyone would share the same difficulty target. Over time, people would accumulate stakes based on their historical mining and trading behavior. This would generate inequality in difficulty targets across individuals. Stakeholding would then become an important determinant of mining ability.
 

Howabout an AbacusCoin? That would certainly not take any electricity. We could just employ child labor in China to run the calculations.  ;)

I still like the idea of embedding bitcoin ASICs into mass-produced, standalone 1kW baseboard heaters, giving the heaters away for free to homes that have WiFi, then splitting the mining profits to defray the costs of the electric bills.  People are consuming GWh on electric heaters right now: might was well do something useful with those electrons.

Yeah but the H/c (hashes per calorie) really sucks.

https://bitcointalk.org/index.php?topic=49683.0

doesn't waste energy because energy isn't required to secure the network, but rather a system of merchant reputation. I have other ideas that never made it in to the wiki because of lack of interest