Bitcoin Forum

The amount of money miners make from mining per year: avg transaction fee * transactions per block * blocks per year + bounties in BTC generation. Bounties will eventually go away, and the value of the currency depends on its ability to be secure even when there are no bounties, so I'm going to remove them from future calculations.

Two of those numbers are fixed, so we get a maximum of: avg transaction fee * 4000 * 50,000, or avg transaction fee * 200 million.

Assuming the amount of money miners spend on hardware is <= the amount they get paid, it follows that any individual or cooperative entity can own 50% of the network's computational power for a cost <= the amount the miners get paid.

So, the cost for any individual or cooperative entity to destroy the Bitcoin network is 200 million * the average transaction fee.

If transaction fees are the equivalent of 10 cents per transaction, PayPal can spend $20 million to destroy Bitcoin. If they are $1 per transaction, PayPal can spend $200 million to destroy Bitcoin.

Even if transactions were the equivalent of $100 per transaction, it would only cost a sufficiently motivated government $20 billion to destroy the network.

Please tell me I'm wrong, because that looks pretty weak.

Why do you think the network is dead if someone has half of the network power? Have you researched this at all?

From https://en.bitcoin.it/wiki/Weaknesses

Part 1: Don't worry, Be Happy:
Markets are really smart* when so much info is public. These are known weaknesses, yet Bitcoin keeps setting record highs.
This means "the market" strongly believes solutions will be found whenever the need is urgent enough.

Part 2:
The need is urgent enough, what's the real answer?


*Edit: Of course really smart markets sometimes have excess speculation, but that is another subject.

I don't understand that:
transactions per block = 4000
I can't find this information

This should be a FAQ question. It's not the first time I answer this.

A >50% overtake is bad, but not that bad.

It only allows the attacker to erase/rewrite recent transactions, from the point he started mining in secret on. Keep in mind that he cannot create invalid transactions, like, create more money than there could possibly be at a particular address. Nor he can spend money that he never owned. So, basically, he can erase valid transactions, that's all.

This attack can have two purposes:

• Double-spend, or "profit motivated attack". The attacker could erase transactions of his own, for which he already received the good/service he bought. That would be stealing from the vendor. Bad, yes, but how far can the attacker go with this? I hardly think he could steal more than 20 million dollars to make it worth the investment, without being caught.
• Just mess around, or "politically motivated attack". This could annoy bitcoin users, but valid honest transactions will be resent anyway, so this won't do much more than annoyance. Honestly, it's a silly kind of attack for a government to take, as it may end up getting some quite bad press for this.

An easy way to mitigate the risk: reject any "too long" block reorganization. The "too long" constant should be determined mathematically, in order to be sure that there is no reasonable chance that such block reorganization is an honest chain split.
I can't do the math on my own, but I really doubt that an honest split could last as long as a week for example.

If the attacker is PayPal or a government looking to shut down Bitcoin, isn't blocking transactions sufficient?

I don't understand how clients could detect the 'block reorganization'. Won't they always move to the longest block chain? If not, can't I create an attack without even needing 50%?

I don't want to discuss if this is right or not, I don't feel qualified, but I only want to point out that there's an obvious mix between bitcoins and dollars in the reasoning.

You don't have any unit in you text but, when you start, we can assume you speak in BTC (transaction fees are in BTC) then, at the end, you talk about dollars (a government spending 2 billions is in dollars, as there will never be 2 billions BTC).

Where happens the switch between btc and $? I don't know and, obviously, you don't too.

That's why, independently of its truth value, this first post is completely illogical. (and thus, we cannot make any conclusion from it).

(no, a simple translation from btc to dollars cannot be done as, if a government want to do that, they will start buying all bitcoins, raising the value of bitcoins in the process.)

You are jumping to conclusions, I was very careful with my units. The transaction fees are in dollars because USD is more stable and it is fair to call them equivalent in low amounts. The large amounts ($2 billion, for example) refer to the cost of buying the hardware, which can easily be done in USD.

Okay, so someone can spend $20M to pause the network. It isn't dead and can be awoken for $1.

but could they get to a point where they control the market, if they bought up enough coins? sorry newbie trying to understand.

For $20M they can 'pause' it for a year. For $40 M they can pause it for two. How long will a currency last when it cannot be traded? How long will it last with even a vague threat that it can be paused?

A how do you know which one is honest and which one is "evil"? An evil bit set?

There is no way to differentiate an honest and a bad one.

They can pause it for as long as honest people figure out a way of identifying the attacker blocks. In the case of someone really trying to pause the network completely, it is easy. A block reorganization which sets a lot of empty blocks is clearly not honest, particularly if there are transactions with fees that were discarded.
If such attack really takes place one day, full clients could set a rule saying that, if there's available block space, transactions paying more than a certain threshold in fees cannot be excluded from a block, for example.

By the length. Honest block splits cannot, probabilistic speaking, last too long.

Trying to game the bitcoin network with >50% of hashing power is not that easy, but if your goal is shutting down the bitcoin, it's trivial. You can effectively deny any transactions taking place, or invalidate past transactions by hashing your own longer chain in the dark, and dumping it to the rest of the network whenever you feel like it would do the most damage, or any number of more or less detectable and destructive attacks. With that kind of activity, people would lose faith in bitcoin really fast, making it worthless.

The longest blockchain is THE central authority of bitcoin, and if you don't want to trust that authority 100%, you have to give some of that power (choosing the valid chain) to individuals, and we know how that works out. Take your pick.

Attacker can fill the blocks with believable looking transaction by recycling their own wallets.

Take your pick:
Are you confident you know what you are talking about re: "hashing your own longer chain in the dark, and dumping it to the rest of the network?"
I'm pretty sure you will be proven wrong.   

True, but still that could be suspicious. Suddenly, the block chain changes to another one with lots of transactions which have never been seen by anyone? And then that happens again, and again, and again? People will quickly figure out somebody's messing around, particularly if the network is already rejecting "too long" block reorganizations. And once honest miners see the network is under this kind or political attack, they might figure out ways of blocking it.

And how do you know which one is honest? Maybe the attacker "invited" you to his chain and you were being fed the evil one. And now you see another chain? How do you know which one is honest? Ask bitcoin developers? Look at blockexplorer?

As Zibbo wrote above, the longest chain is the authority. If you start to decide which chain is right based on some other criteria, you need to accept some external authority. And this is the end of Bitcoin as a decentralized system.

Bitcoin is a system with rules, but no rulers. If it sounds like a contradiction, I'd say you need to think about those words more.

Also, regarding "the end of Bitcoin", extraordinary claims require extraordinary evidence.

When a government spends $20 million on a project, it needs to classify the project in the financial records and get an OK for that spending from a very high ranking official and get a sanction to it too (probably the president as it involves affect financial systems).

As we know, in this day and age of wikileaks etc... , this info goes out to the public at some time.
Once it goes out to the public, the media get hold of it and make it a headline for a week which is enough to multiply the bitcoin network by a few orders of magnitude in addition to causing bad publicity to the official/party that sanctioned it.

I think that would be enough to stop it, at least in democratic states.

What? I didn't get it... if I'm an honest miner, the attacker has no gain in "inviting" me.... I'll add honest blocks to his attempt of rewriting, basically I'll undermine his plans.

An overtake attempt must be done entirely in secret by those trying the attack, and then suddenly released, overwriting honest blocks. If this overwrite is too long, it's clear not an honest split but an attempt of exploit the >50% vulnerability.


You don't need to accept any particular authority, that can easily be a consensus, particularly if backed by good probability demonstrations. It's as much authority as the inflation control for example.

Tell me such a rule in case of chain split that does not require authority. OK, caveden says "drop anything that is longer than the current chain by N blocks". Apart from creating a whole lot of problems in normal operation (you will have the very same situation every time you had a network outage and now you client sees much longer chains), there is no guarantee you have the right chain.

And what about "stepping stone attack"? Attacker inject longer chains by one block one at the time denying all transaction confirmations?


The core idea of Bitcoin is that it is completely decentralized. If you create a "Bitcoin central bank" that decides which blockchain is right and which is wrong, it's going to be not Bitcoin but something else.

With the overflow bug, it was obviously a bug so it was fixed. In case of 50% network attack, there is no way to decide what is right and what is wrong.

Nobody is proposing this. If a rule such as "the valid chain is the longest one" is decentralized and not an authority, when why would any other rule be otherwise?


Just because you can't think of a way, and I can't think of a way, doesn't meant there is not a way.

Have you heard about "mining cartel attack"? All kind of attacks can be performed with innocent participants.


What if you had a network outage and now you see a longer chain. You drop it and your Bitcoin client no longer works.

What about a "stepping stone attack"? The attacker only injects chains slightly longer but frequently thus denying all confirmations.


Consensus based on what? One person, one vote? Currently Bitcoin operates on consensus: "1 hash/s = one vote".

It is extremely difficult to gain from any >50% network attack. It is much more profitable to be honest. That's why I don't expect we will ever see "criminal double spending" because effort required to play this trick will be larger than any potential short-term gain.  But Bitcoin is completely vulnerable to DoS by a >50% participant. It's in its core. It is the basis of all Bitcoin operations and it is clearly described in the original Satoshi paper. Bitcoin can work only if >50% of the network hashrate is cooperating.

I think that 20 000 000 USD is too much money. The bitcoin network can be harmed for much less.

When using large volume orders, for about $500 you can built a rig with 850 MHash/sec. Thus, to get 2*850 = 1700 GHash/sec, you need $1 000 000. And you will own the network (cos have more than half the power).

Moreover, with this computing power, you will earn more than half of all coins generated. That is 3600 BTC, which will soon equal to $36 000 per day. Theoretically, the network would pay-off in just ONE MONTH!!!

And once you earned a bit, you can harm.

Seeing a longer chain is different from seeing a long block reorganization. The lenght that matters in the second case is the backward length, the number of blocks who had to be discarded. Network outages won't cause you this.


Again:


??? Who's talking about anything remotely closed to a central bank here? All I've said is that it's probably possible to prove with probability calculations that an honest block chain split will not be longer than a certain constant or that it would take several thousands of years for that to happen, so you could easily classify such kind of splits as dishonest.

In the future, there will be many more than 4,000 transactions per block.

Thank you ! That is what I wanted to know.

What if you have an outage when there is a short accidental block reorganization. There is one every day or two. I've looked at reorganizations in my debug.log and had one during network outage and it resulted in 5 block reorganization. 


And what you plan to do? Whitelist honest nodes? Shutdown the network and hope the attacker goes away?


If you start to discriminate the chains, you need to have authority. Once again, I claim there is no way to decide which chain is good and which evil if both are valid chains. What if the evil one starts to write on the Forum (with a lot of puppets) that we are under attack and we have to kill the other chain?

Moreover, anything (except the rule: longer chain wins) is going to get the Bitcoin network fragmented sooner or later because there will be accidental chain splits. And then how are you going to mend this mess? Both chains will claim to be "the ones".

Today, deepbit had 5 blocks in a row. If something (accidental) prevented it to broadcast the first one to the network and made it broadcast the last one, you would have a large block reorganization.

There are only two possible successful outcomes for Bitcoin: one is that Bitcoin hashing power is so large, no single organization can match it or that it is so niche nobody will care about killing it. 

Then the short block reorganization will remain short. It's not the number of blocks added to it that counts, it is the number of discarded blocks. While you were offline, you didn't receive any new blocks in the bad chain, and people already started building on the other chain. The number of blocks that will be overwritten is small.

I think you're not clearing understanding what I mean by long block reorganization. I mean the number of blocks that will be overwritten. It's possible to mathematically determine a number for which the probability of it happening is completely insignificant. Honest block chains splits of such length will never occur.


I'm not planning into doing anything because I don't even think that will ever be needed. But I believe people would come up with a good plan if such thing happens. A whitelist of "transaction pools" to which every node could send their transactions could be a way to dodge the attack, maybe... If the attacker is only making transactions within his wallet in order to erase everybody else's and pause the network, such whitelist of transaction pools could show people which chain belongs to the attacker and which contain true transactions.


No you don't. You just need consensus, as there is consensus today that "the larger chain wins", as there's consensus today in the chosen inflation model etc.


Dude! I'm talking about a length that is impossible to happen honestly! That's surely much more than 5 blocks. In my first post I said of a week. But some good mathematician should do the calculus.

First of all, entire countries can be blocked of from the net for long periods of time during civil unrest, censorship attempts etc., so very long "honest" splits can occur. Second, I don't understand why a long chain split is a requirement for any kind of attack? Attacker can send his block chain to the rest of the network every time it's ahead of the "honest" chain, which is most of the time. A lot of nodes will change to attackers chain (because there is no way of knowing which chain is honest, if both contain only valid transactions), wasting resources trying to add blocks to the attackers chain, which attacker will never accept, taking further resources away from the honest chain.

You need to be able to be able to figure out which valid block is an attack and which isn't, and I don't think you can.


Well that's a move towards centralizing authority. And also, what's stopping attacker first "getting in" the transaction pool, before launching an attack. Making the whitelist really exclusive perhaps?

Why is that?

With a max block size of 1 MB and an average of ~250 bytes per transaction, aren't we stuck with ~4000?

The 1MB hard block limit is merely to prevent someone from spamming the blockchain. It will be raised as necessary, though probably won't be for a while.

I want to point out before I say all this, that it is written under the assumption that the code of bitcoin is as pure as it seems to be as a legitimate decentralized currency, and in no way brings to question the techies understanding of the code.

Now, IF the idea of decentralized currency was thought up originally by its ENEMIES who saw its implications, and they invested the necessary money/computers to eventually bring it down, then brought to the public as bitcoin via 'Satoshi Nakamoto'. They wait for the idea to draw in the techy individuals - like it has - who in turn spread the idea around to those who trust them as smart - like they have - this all with the aim of building up the popularity/reputation of decentralized currencies as a whole. Eventually, enough people trust and invest so that when this enemy of decentralized currency(also the creator of bitcoin mind you) pulls the proverbial rug out from under, the trusting collective loses the millions of dollars they have invested and the face of decentralized currency is now very ugly to the them, to the point where even if a new genuinely uncompromisable network were to emerge, we have the boy who cries wolf scenario on our hands (With the techies playing the part of the boy and the townspeople playing, well.. the townspeople. {For this metaphore to be truly accurate you actually have to see satoshi as the boy, and the techies would merely be the first townspeople that the boy gets to whom believe him, then themselves go on and unwittingly spread the boys lie, but potatoes, pototos, since as far as the townspeople are concerned the techies spreading the word are now untrustworthy, b/c to the simple mind, their money is gone, and their trust of the the techies is to blame}. This all having been done by the controllers of the money to keep their control of the money, by premeditating and attacking future honest decentralized currencies before their birth. This doesn't kill the idea obviously(since the idea is in essence the circumvention of gov't/banks, if these are indeed inefficient entities, efficiency (decentralized currency) wins long term, or so says evolution at least, efficiency can't be killed, its all there really is), it simply makes it harder for the future attempts to be able to take hold right away.

I have no idea if this is a valid point, or merely naive drivel which is easily refuted..

It's open source. People look inside at how it does what it does, it isn't a mystery or anything.

quote freemoney

"It's open source. People look inside at how it does what it does, it isn't a mystery or anything."


I'm aware, however, I was under the impression that both money invested and the earlier the attack began, the worse damage it could do. Is it not the case that those who have viewed and understand the code claim this?


how do you do those quote bubbles? I'm new to this..

I think the way to kill the currency is to own all or most bitcoins in existence and mined in the future.

BTC can be split down to 8 decimal places, you could have a healthy system with only like 100 BTC in existence.

yes... perfect!  You've figured out the key!

can we kill this thread yet?

I'm confused, why the rush kill it? is this your attempt at some kind of peer pressure censorship to avoid contemplating something that makes you uncomfortable? I guess it makes sense if you have counted your eggs already, or carrots, whatever it is the Kids are callin 'em these days..

Or it could be that you wish it dead because you fear the free flow of uncomfortable ideas may turn off potential investors..

I suppose it could be that you are sick of having to exerting the energy it takes to move the mouse the extra 5 centimeters past the thread when you are looking for more sugary posts that tell you everything is going to be alright and you are going to live happily ever after..

in any case it seems that you favor ignorance for yourself and others in the name of temporary bliss. sounds like we got ourselves a drinker  :D  i kid, i kid, i couldn't possibly know if you are a drinker by this one post...

perhaps you have a reason I missed?

lol, i thought of another one, maybe you think that if we hurry up and end it that the feds wont have time to check the forum and be clued in on the fact that they have the power to shut the party down. (pss.. i think they may already know)

you know, there is a way that you can assure that you come out on top no matter how/if this city gets burnt to the ground, simply convert portions of your profits occasionally to a more traditional currency so that either way at least you come out with more than you started with. granted this may just be me trying to get a dip in prices so I can get a better rate  ;)

please. let us know why you are so trigger happy.

Oh, I thought you were saying that the enemy had some advantage from writing the code. They don't so that doesn't matter.

Coming up with an awesome idea and implementing it so that you can destroy it instead of letting someone else do it and then you can destroy it is beyond me. If that's a good plan it's for reasons so subtle and amazing that I'll never understand.

I really hope this the government's kill bitcoin plan.

I know it's a long post, but theres a dick joke at the end :-)


with all respect, I beg to differ sir, I believe, of all people you would be able to understand this theory.

I'm proposing that people who have invested in btc are made up of two groups:

1)those who know the code is solid
2)those who trust people who know the code is solid, and are most likely to invest their money in such a trust

what I am saying is, most likely (1) represents 5% to 10% of the invested funds (and I'm of the opinion that this is a high estimate). group (2) represents the remainder.

What this means is, that if today we all log into our btc clients and discover that we have been the victims of a massive attack, both groups (1) and (2) will be quite pissed off, however these groups will handle their anger in two different ways, group (1) will, inspired by this idea set to work in making a system that is unattackable. If they are successful, then they are going to run back to (2) and say "ye did it! we did it! we made a super currency! its the way of the future.. revolution.. bla bla.. invest your money again group (2) we got it right this time!" and group (2) will just be reminded of that time when group (1) said something quite similar(remember btc?) which resulted in them losing their investment and its profits, thus, be much less likely to invest again. now imagine this happens when btc hits 100$, that is a massive group (2) to be disgusted by the idea of decentralized currency, they won't know the specifics, they don't think in specifics, they just know they were millionaires, now they are back to being the poor middleclass schmucks they have been since birth, all thanks to decentralized currency, good luck getting them to invest again.

I know this may seem pessimistic or paranoid, however, I am of the mindset that if I hear a proverbial noise in my closet, I go open it to see whether or not there is a monster in their instead of hiding under my sheets and letting my fear fester in in the back of my mind. By discussing it, instead putting my fingers in my ears and saying "bla bla bla, i can't hear you" or "can we just kill this thread yet?"(which i feel mcdett is by no means alone in his sentiment), we are doing ourselves a favor.

I think the chances of the scenario i propose are slim, it seems like the enemies would be better off waiting for a network to emerge and then trying to crush it. This brings up the question, at what point can we be sure that the network is large enough to not be crushed? It seems like we are in a sort of race right now to get to that size, which makes it a real shame that those who claim they believe in btc as a method of changing the world for the better, don't take this belief to almost a religious zealousy in order to win this race and actually change the world. Instead it seems they would rather just keep clicking refresh over at mtgox and patting themselves on the back for that one good decision they made months ago when they first invested in btc. It really pains me considering how easy it would be to get the word out on a much more massive scale than it now is, just look a my '"I've heard of that" post' if a mere hundred btcers commit to just 10 little pieces of paper a day, thats 30,000 new btc exposures in a month(now calculate 1000 - I think we'd win race), but instead they would rather hide under their sheets jackin their dicks with a refresh button, if the monster gets 'em it gets 'em.

Yeah, you obviously have a better grasp on this community and the projects being worked on than the rest of us. We're all just sitting around with our dicks in hand, not building infrastructure for the Bitcoin economy. Nothing to see here.

hat. Your

I'm not sure how you thought i was referring to people who are actually capable of building infrastructure, and doing it, as the ones with "their dicks in their hands" maybe you misunderstood the metaphor somehow? I wish I was already capable of making technical advancements for bitcoin, unfortunetly, until now I have had no interest in doing any sort of programing whatsoever. I was simply referring to those who, like me, currently are unable to help in that respect, due to their ignorance of the programing, so they assume there is nothing they can do to help. i was giving an option to them which could be very helpful. Looking back on my post, I suppose I wasn't 100% clear.

however, at risk of coming of as an asshole and hurting your feelings BitterTea, I would suggest that outbursts of defensiveness general come from those who feel they have something they need to defend. Maybe you feel like you could do more? It may just be that you are doing so much for bitcoin that you feel you deserve recognition for it. I havn't done any research into you personally, so I don't know.

No, it just gets old seeing a constant parade of new people who think they have everything figured out, as if we've never considered these issues before.

Indeed. That's exactly why I wrote that: http://thebitcoinsun.com/post/2011/05/31/Will-it-blend

If at least it was more in the form of a question. "But what if…?", it would show some sense of modesty.

That's not a safe assumption at all.  A lot of people who just brought mining rigs online didn't understand the ramifications of the exponentially rising difficulty level, and made "investments" that will never pay back.  Also, there are lots of people who own suitable hardware for other reasons (e.g. gaming), for whom the cost of the equipment is already a sunk cost, and any earnings are pure profit.