Bitcoin Forum

If you reverse PoS and PoW in your post, then your post would be 100% accurate and correct :)

Doesn't it cost nothing to attack a PoS coin? While you must use actual resources to attempt to attack a PoW coin?

Exactly, I thought attacking PoS coin is much more cost free (next to nothing) than attacking PoW coin.

Exactly, I thought attacking PoS coin is much more cost free (next to nothing) than attacking PoW coin.

Some people think that POS is to save energy and more environmentally friendly. In fact, POW consistent with the principles of input and output.

If you reverse PoS and PoW in your post, then your post would be 100% accurate and correct :)

There is a false perception that somehow bitcoin price goes down by the cost of electricity needed for PoW.

Also...Global warming whackos.

Doesn't it cost nothing to attack a PoS coin? While you must use actual resources to attempt to attack a PoW coin?

Exactly, I thought attacking PoS coin is much more cost free (next to nothing) than attacking PoW coin.

um, if Bitcoin eco-system isn't paying for the electricity, then who is? Also, it's not limited to the electricity, Bitcoin eco-system is also paying for the hardware, pool fee and miner profits.

If Bitcoin eco-system pays these expenses, then it's value transferred out of the system, of course Bitcoin price will go down. Unless there's new money inflow to equalize it.

There is a hard limit on the amount of money the Bitcoin economy can lose via mining expenses. Currently that is 25 bitcoins every 10 minutes. That is the max.

If electricity and hardware costs double....people will not need to open their cold storage wallets to subsidize the cost.

Not really, you are confusing coin supply with paying for mining expense. If your theory were true, then when coin supply go to 0, mining expense will also be 0? that's obviously not the case, therefore your theory is wrong.

In a PoS system, acquiring enough stake to attack will cost you astronomical amount of money

Well it didn't cost the government an astronomical amount to obtain those massive amount of bitcoins from the silk road bust.
Lucky bitcoin isn't POS or it'll be screwed.

Governments have noticed it, powerful people have noticed it, *banks* have noticed it. Right now we are in a perfect storm of the aftermath of a huge overshoot on the purchase of mining equipment - this is *fact* as evidence by the hash rate/difficulty.

This will take time to unravel. It surely will though, as irrational as people are, they will eventually stop flushing money down the mining drain. That money will turn towards the supply. As it becomes obvious the bottom is in, that is when people will start the next run up. Only this time it isn't going to be just neckbeards, redditors, hipsters and anonymous, it will be institutions. That have pretty much unlimited buying power by virtue of them essentially being able to print their own money, because they are TBTF and will just keep bankrolling each other whilst nuzzling the teat of QE washing away their toxic assets.

So the move will be unprecedented.

Unprecedented to you and I and all the other peons around here. To those behind the move, they just spent a few hundred millions to acquire assets they can now assign book values of billions. Selling into this only makes you weaker in the end game, and selling is what they want you to do because those dollars you are acquiring get more worthless the more bitcoin they have. Who here though has the constitution to hold as they see the price double repeatedly. We are still at the end of the day all hardwired for fiat. As much as anyone pretends they are not.

Nope, just the contrary. In a PoW system, once you own the hardware, it cost nearly nothing to attack any eco-system that uses the same algorithm. As shown by many PoW altcoins attacked to death.

In a PoS system, acquiring enough stake to attack will cost you astronomical amount of money, (you can't really hack the stake, since it's illegitimate stake and can be rolled back by community action). Then once you acquire the stake, you could only attack one particular PoS system (which you own a majority stake in, why would you attack it? it's illogical).

Therefore, ZERO PoS system has been actually attacked so far.

I'm not sure why people ignore the fact that tons of PoW altcoin has been attacked, and ZERO PoS altcoin attacked so far, and still have the audacity to claim PoS is less secure.

Really? PoW supporters are resorting to conspiracy theories now? well that's understandable, since the reality has shown
PoS is superior in every way.

Well it didn't cost the government an astronomical amount to obtain those massive amount of bitcoins from the silk road bust.
Lucky bitcoin isn't POS or it'll be screwed.

Yep, all government needs to do is to blackmail ghash and another pool and Bitcoin is theirs.

So much for the famed decentralization.

the amount they acquired wasnt even more then 1-2%? you would minimum 51% of coins to attack the network..

I really like POS. I do. But there's an issue.. I won't go into the details, we all know what they are, but to break it down to it's simplest :

POS needs 1, just 1, TRUSTED number to start with, when you log in to the network. Then it's good to go (BASICALLY). However the POS coins wrap it up, NXT, blackcoin, DPOS systems etc etc.

That's the bottom line. Whatever ANYONE SAYS.

If you can handle that fact and don't mind, go for POS.

POW has flaws, yes, BUT there is no TRUST required at any stage. If this matters to you, POW is the only way to go.

For the most complete breakdown of the issues :

https://blog.ethereum.org/2014/07/05/stake/

and then

https://blog.ethereum.org/2014/10/03/slasher-ghost-developments-proof-stake/

I honestly don't follow what you mean by that?

Did you know that for some PoS coins, a single exchange is the major holder? The coin will be forever under the control of that exchange because they maintained stake majority at one point in the past.

It costs NOTHING to attack the network once you held a majority of coins.

Did you know that for some PoS coins with PoW distribution, a single miner is the majority miner? The coins he generated passed through his wallet and he can forever control the future of the network. I know such a coin where a friend is the biggest miner.

It costs NOTHING to attack the network once you held a majority of coins.

Did you know that some coins with a small market cap can be completely bought up by a single entity without raising suspicions? The coins will forever give the owner an attack vector in the future even if he sells them away.

It costs NOTHING to attack the network once you held a majority of coins.

PoS changes the attack timing from a single point in time to a whole timeline. You can sell or trade or give away your coins, or even destroy them, you can still resurrect the coin.

Correction: it costs ~5$ a month to attack the network once you held a majority of coins...

can you show me the math to prove this? or give a technical explanation of exactly how you would do this.. so far no one has been able to do this.

Once you control 50%+1 of the votes, you vote for forks that give you equal or more voting power.

Once you control 50%+1 of the votes, you vote for forks that give you equal or more voting power.

Check-points can help guard against this, but can be a central point of failure if not carefully implemented (possibly leveraging the Bitcoin PoW blockchain).

Except nobody has done this yet. Other than that, you're mostly right :D In theory you can do a lot of things.

what you are explaining is a 51% attack not a "history attack" which is what BombaUcigasa was trying(and failing) to explain and what you have just said does not answer the question i asked.

see this is what im talking about.. no one can provide the math to prove this? or give a technical explanation of exactly how you would do this

show the math and the technical explanation or its pure tripe.

You can't mathematically prove it, because the other stake-holders can roll back to any point of time of their choosing.

In other words, PoS does not actually form a consensus.

Do you think this frivolous answer addresses the fundamental problem? This is why people find PoS supporters so tiresome.

Do you think billion dollar companies are going to put their weight behind "nobody has done this yet"?

Maybe if you said, "We're a centralized cryptocurrency run by technocratic overlords, if our currency does something wrong, we'll unilaterally modify it. If you don't like it, you can suck our balls." we would be less critical of you.

You can't mathematically prove it, because the other stake-holders can roll back to any point of time of their choosing.

that does not mathematical proof is impossible. also the nxt blockchain cannot be rolled back past 12 hours. for any reason. so instantly you have proven you do not understand the tech and that you do not know how PoS actually works. the white paper and the "math of nxt forging paper" prove that what you are saying is not true..

what you say could be true for other variants of PoS but it does not have a leg to stand on when discussing nxt.

Then you are introducing trust assumptions and new attack vectors. There are no universally trusted parties to provide checkpoints.

It's worth noting that by writing a well-defined security model and working toward it, it is possible to create a "working" PoS which is only broken when the assumptions of the security model are violated. If one were to do this, it would then be easy to point out how the security model is not applicable to the real world. But Vitalik's posts --- and no PoS writeups that I'm aware of --- actually do this.

As you already know, our devs released an update that would adjust the blockchain in such a way that only the BTER account would be affected. As it stands, the majority of NXT forgers has opted not to support this fork. The new version has already been rescinded and the rollback will not happen.

Of course, this whole discussion strikes at the core of what a crypto platform is about. Is there a point where a blockchain can be rolled back, or not?

I understand that the Vericoin devs have decided to do this in their case, because 30% of coins were involved.

Our situation and proposed solution were very different. The main difference that I see is that our core devs have left the decision completely up to the forgers. They could have taken the decision to not even propose a fork at all, but decided to put this in the hand of where the decision power in a PoS system is: the stakeholders.

Given the extent of the damage, the vericoin development team opted to hard fork the coin’s block chain in order to reverse the theft transaction. This was performed, they said, in order to both prevent the loss of roughly $2m in investor funds and stop a fraudulent actor from holding 30% of the coin’s proof-of-stake network capacity.

The fork is now complete, with new wallets now available for download, the vericoin development team told CoinDesk.

If the block-chain can't be rolled back past 12 hours, why was it the subject of debate after the BTER Exchange compromise?

can you show me the math to prove this? or give a technical explanation of exactly how you would do this.. so far no one has been able to do this.

The breach resulted in the loss of roughly 8 million vericoins (VRC), or about 30% of the total coins in existence

At no point could one of the entities take complete control over the blockchain by themselves and they had to agree to switch lanes together by majority vote.

That is quite the rose-colored view of the situation. From my remembrance, it was the one or two major pools on the "correct" chain that had to be persuaded to move to the forked chain to preserve the network unity. In doing so they were giving up all of the blocks they had mined, so this was not a no-nonsense decision. The decision was in the hands of a couple of people--that is not the bastion of decentralization that you make it out to be.

What I was pointing out is that doesn't always take an astronomical amount of money to acquire a large amount of coins. It's just a long running myth.

I'm not anti-pos by the way.

Why should I buy PoS coin when I can mine them cheaply? Everyone will just mine PoS coin while no one will buy them, the price will be as low as PoS stake holder can hold on an exchange  :D

With  PoS coin, on the other hand you can potentially sell your "investment" in the coin prior to your attack being discovered by the rest of the network, which would result in you having a zero net cost to an attacker

This is not possible with bitcoin. Last year there was a hard fork caused by different bitcoin-core versions.

The developers and mining pools as well as the users (exchanges and payment providers) were working together to allow a hard fork against the orphaned chain.

At no point could one of the entities take complete control over the blockchain by themselves and they had to agree to switch lanes together by majority vote.

If the block-chain can't be rolled back past 12 hours, why was it the subject of debate after the BTER Exchange compromise?
Official NXT Decision: No Blockchain Rollback (https://www.cryptocoinsnews.com/official-nxt-decision-blockchain-rollback/)

That is quite the rose-colored view of the situation. From my remembrance, it was the one or two major pools on the "correct" chain that had to be persuaded to move to the forked chain to preserve the network unity. In doing so they were giving up all of the blocks they had mined, so this was not a no-nonsense decision. The decision was in the hands of a couple of people--that is not the bastion of decentralization that you make it out to be.

Who told you that non-sense?

Me.

Or anyone else with an IQ over 100 whom can infer this algorithmic conclusion.

Assume my IQ being 97ish, could you provide a concrete but simple step by step guide?
I would like to try such a zero-cost attack myself.

Thanks in advance.

you know, if somebody would just attack a PoS coin like NXT then we could end this debate. seems like it's all just masturbation at this point

Go here: https://bitcointalk.org/index.php?board=159.0
Pick one new coin with PoS that hasn't been launched yet. Find the best options to acquire as much as possible of the coins cheaply (mining, IPO, market). In 2-3 months build your own little network corner with 2+ nodes, keep collecting the coins. Monitor the network for active nodes count (there should be pools and exchanges at least). Scale up your network before the attack to have more nodes than the network (even on the same IP). Power down clients, edit peer list, ban seed peers (maybe edit the source to exclude them). Start staking across your nodes and increase your chain's difficulty while separated from the network. DDoS the fair nodes and release your network to most peers (except seed peers maybe). Be sure to read the rules on chain reorgs and stake limits.

[...]

For a coin not yet launched the initial financial risk (acquire a lot of coins of a coin with maybe no future value plus building a substantial personal network) seems like a no-go to me. What about an "established" PoS coin? Costs of the way described could be astronomical?!

You can reduce costs by trading in wait time. As long as you have some coins and sit on your wallet and stake them, as time goes by major stakers will "trip over" or get out. You can attack the coin.

Now you might think that it costs a lot to buy a whole coin. But in reality, after the top 300 altcoins, it costs less than 1000 USD to buy one completely: http://coinmarketcap.com/4

you dont seem to understand the first thing about pos?

legendary member they said... knows his stuff they said... ::)

Another problem is, PoS coin consume much less energy, so the cheapest way to get the coin in fact is to start another PoS coin, it is much easier to clone the PoS coin, while you can't clone the bitcoin network hash power

Starting another PoS coin works just as great as starting another PoW coin trying to replace Bitcoin has worked (Litecoin and other failures, maybe only Doge has a small chance to make Bitcoin share some of its success).

Just take a look at all the NXT wannabes (pure NXT clones and those with modifications and even original PoS code cryptos), none has been able to reach the activity and market cap of NXT and that even with all the criticism on NXT's poor initial distribution - people tend to buy NXT regardless (granted all cryptos are in a bear market), because you can't easily clone core developers, infrastructure, network of nodes, vested interest, the spirit of innovation.

That's why I said that PoS 1 != PoS 2 != PoS 3. There is at least one PoS implementation where what you just said is not possible.

The NXT prohibition on deep re-orgs just makes such re-orgs a manual process if/when they they happen.

Can you explain exactly what you mean by deep manual re-orgs? There is no such thing in NXT. As far as I know the re-orgs are fully automatic, based on the rolling checkpoints 720 blocks deep maintained by each node's software as a distributed consensus.

Pretend you are in China and the "great firewall" cuts Chinese "forgers" from the rest of the network for 3 days. What happens when they reconnect with the rest of the world? Obviously, somebody has to force the re-org manually.

Pretend you are in China and the "great firewall" cuts Chinese "forgers" from the rest of the network for 3 days. What happens when they reconnect with the rest of the world? Obviously, somebody has to force the re-org manually.

The chinese nodes would be on a permanent fork. Each node owner could still delete his copy of the blockchain individually and the node would eventually download the "right" chain. There is not a single "somebody" that triggers the re-org though.

Pretty sure that's the definition of consensus failure. I guess they think this is ok, and people will naturally(somehow?) decide which fork is "right".

OTOH I call that "broken".

What would happen in Bitcoin in the same situation when you have Chinese miners cut off from the rest of the world and mining their own fork with their PH/s for 3 days?

Since the Chinese miners would still have less hashing power than the rest of the world, their chain will get "orphaned". When their nodes rejoin the network, they should automatically choose the fork with more "work" in it. Many transactions would have to be rebroadcast, and such nodes will likely enter "safe mode" (http://bitcoin.stackexchange.com/questions/14160/what-is-safe-mode-and-how-does-it-affect-rpc-commands) if that happened.

Edit: Somewhat relevant (https://en.bitcoin.it/wiki/Alerts)

stuff

Either way PoW/PoS doesn't really differ much

https://download.wpsoftware.net/bitcoin/pos.pdf (https://download.wpsoftware.net/bitcoin/pos.pdf)

That paper explains why Distributed Consensus from Proof of Stake is Impossible

Mining was never fair.  Today after 5 years of learning resources and how-to-guides many people still can't figure it out.  I'm sure someone here will come at me with an ad hominem ("lol ur stewpid") but it doesn't change the fact that PoW is indeed this complicated thing which most users and upcoming users will never understand.



Maybe your laptop or a dusty Windows 95 could had mined Bitcoin in 2009 but doesn't do any good if the user in control of the hardware did not know where to begin and back then there was virtually no learning resources to consult.   There was a reason why millions of the first Bitcoins were mined by a very small exclusive group of people with backgrounds in computer science and this scarcity was why they were able to manipulate the price and make it valuable enough to had been appropriated as a payment method on websites like the Silkroad.

https://download.wpsoftware.net/bitcoin/pos.pdf (https://download.wpsoftware.net/bitcoin/pos.pdf)

That paper explains why Distributed Consensus from Proof of Stake is Impossible

*snipped*

In PoS, it isn't the majority that decides, it's the majority stakeholder entity which once appeared can't be erased from history. Once the majority condition has been achieved ONCE, it will be available as an attack vector FOREVER. In PoW, a majority condition achieved ONCE will provide temporary reversible benefits and is very easy to spot and eliminate.

The cost to fork and keep up a hidden PoS blockchain is less than 5 USD a month for ANY coin.
The cost to fork and keep up a hidden PoW bitcoin blockchain is 30000000 USD a month.

Do you still need to compare the two?

*blahblah snipped*

2. It does not bother to mention how many calculations are needed to secretly build a valid longer chain with a small stake in a specific PoS system. This is like saying sha512 algo can be cracked, without calculating how many tries one needs to crack it...

I wonder why noone mentions the 2 huge flaws the paper has:

1. It throws all PoS implementations in one pot, while there are huge differences between them.(centralized checkpoints vs. decentralized ones, unlimited reorg vs. 720 block reorg limit etc. etc.)

2. It does not bother to mention how many calculations are needed to secretly build a valid longer chain with a small stake in a specific PoS system. This is like saying sha512 algo can be cracked, without calculating how many tries one needs to crack it...

I'm eagerly awaiting a revised version that calculates needed computing power to n@s-attack, let's say current version of Nxt.

It's worth noting that by writing a well-defined security model and working toward it, it is possible to create a "working" PoS which is only broken when the assumptions of the security model are violated. If one were to do this, it would then be easy to point out how the security model is not applicable to the real world. But Vitalik's posts --- and no PoS writeups that I'm aware of --- actually do this.

You just have to buy 51% of the currency or track down majority of stakeholders and compromise their private keys. Much cost free

lots of people seem to believe this (I think it's even mentioned in Sunny King's PPC paper), but it's not accurate: you need 51% of the actively staking coin-age. That's much, much, less than 51% of the currency.
I had some ideas to help fix this, I'm working on it.

Peercoin PoS is not the same as NXT PoS, the latter doesn't use coin-age.

tokens must be stationary within an account for 1,440 blocks before they can contribute to the block generation process

it doesn't matter, it has the same probblem, just replace "coin-age" by "coins".
form their "whitepaper" (actually a wiki):


this means all coins that are used for transfers cannot be staken and do not count toward the total of which you need 51%
moreover, lots of holders do not stake, so it's not 51% of coins, it's 51% of coins being actively at stake

lots of people seem to believe this (I think it's even mentioned in Sunny King's PPC paper), but it's not accurate: you need 51% of the actively staking coin-age. That's much, much, less than 51% of the currency.
I had some ideas to help fix this, I'm working on it.

How do you fix the past?

If someone had 51% stake share at one point, what can you do to prevent him forking the chain?

...and it get worse if you consider NXT has punishments for not staking...

How do you fix the past?

If someone had 51% of a Proof Of Waste coin's hash power, what can you do to prevent him forking the chain?

DPoS

You would need to buy up 51% of the currency supply to use this attack vector.

The same way as with Proof of Shit coins. So why are we discussing this aspect?

We are discussing PoS versus PoW here, and why people support PoS specifically.

Just as it happens for many coins an exchange owns more than 51% of the supply. They paid NOTHING to obtain it. You are entrusting them directly (or indirectly when they get "hacked") to not fork your coin.

The same way as with Proof of Shit coins. So why are we discussing this aspect?

We are discussing PoS versus PoW here, and why people support PoS specifically.

Just as it happens for many coins an exchange owns more than 51% of the supply. They paid NOTHING to obtain it. You are entrusting them directly (or indirectly when they get "hacked") to not fork your coin.

Besides theoretical attacks on PoS, which have been posited and acknowledged by many prominent developers/cryptographers, does anyone know of analyses conducted on PoS attacks that have actually occurred?

More discussion about NaS attack: https://bitsharestalk.org/index.php?topic=6638.0

POW systems resolve the forks by agreeing to build on the chain with the most work done (the sum of the difficulty values at each block up to current head block in the blockchain). If everyone follows this rule, eventually all the nodes will come to a consensus on one particular chain, thus resolving the fork.

Peercoin-like POS systems can resolve the fork by building on a chain with the most amount of some other metric, like the total amount of coin-age consumed. Again, as long as everyone follows the same rule, the network will eventually naturally converge to just one of the forks.

Although, DPOS is able to randomize the order of delegates within a round, the order of the delegates in a given round is known prior to any of the delegates producing blocks in that round. For this reason, block production order can be considered deterministic. Nevertheless, very small forks could be possible because of network issues. For example, if block N is delayed by the network for too long, the producer of block N+1 might assume that the producer of block N was not available to produce his block at his designated time slot, so instead will chain off block N-1. The producer of block N+2 may have seen block N and/or block N+1. If he saw both, he always chooses the one that is supposed to come later in time, on the other hand if he sees only one or the other, he builds off of the one he saw. Thus, the chain is built with either block N or block N+1 considered missing, but the network is able to quickly get back to a consensus on the true chain because of the deterministic ordering of block producers.

POW resolves this issue by using the same method used to resolve short forks: pick the chain with the most work done. Attackers have no way of faking the block acceptance criteria. They need to put in the work necessary to match the difficulty requirements at that point in the blockchain. Attackers can create a fake blockchain history by putting in the necessary work, but if they have less than <50% hashing power, their accumulated amount of work will be less than the accumulated work of the true chain. As long as the true chain is made visible to the resyncing user, he can easily pick it over the fake chains.

POS tries to resolve this issue by also making it difficult for attackers to fake the block acceptance criteria. In the case of Peercoin-like POS systems, it needs to be difficult for attackers to get coin-age (which is ultimately dependent on the amount of stake in the attacker's control). In the case of DPOS, it needs to be difficult for the attacker to get control of the delegates. Because of the way delegates work, the attacker would actually need to control nearly all of the 101 delegates to fake the blockchain history (see here and here for details). However, if the attacker controlled more than 50% of the stake, he could vote in all of his own delegates. So all POS systems are ultimately vulnerable if the attacker is able to get the majority of the stake. For a POS system to be secure from fake blockchain history attacks, the majority of the stake in the system needs to be kept away from the control of an attacker during the time a user is offline. However, if an attacker was able to capture only a small minority of the stake while the user was offline, the attacker cannot create a fake blockchain that the user would accept as valid.

POW supporters like to point out that the attacker does not need to control >50% on a live system; as long as an attacker controls >50% of the stake at any point in time t on the blockchain, that attacker could easily build a fake blockchain from that point forward that would fool a user's client if its last resync point was before time t. For a completely new user synchronizing from the genesis block, this means the attacker only needs to control >50% of the stake at any point in time in the history of the blockchain. This is the meaning behind the Nothing-at-Stake name. The users who owned >50% of the stake in the system in the past, may no longer own any stake in the system in the present. While it would be foolish for a present-day >50% stake holder to harm the network, someone who held >50% of the stake in the past but holds nothing at stake in the present has nothing to lose with an attack attempt.

As bad as this may look for POS systems, with more careful analysis, it is clear it is not actually a problem. A user in a POS system will always have a checkpoint in the not-too-distant past. This checkpoint either comes from the last block of the locally-saved, trusted blockchain (or perhaps just the locally-saved hash of the last seen block), or it can be hardcoded into the particular version of the wallet. As long as that checkpoint is in the not-too-distant past, users would not be vulnerable to fake blockchain history attacks in realistic scenarios. If the checkpoint is older than some threshold, then other measures are needed. This threshold can vary depending on the circumstances of the network and the paranoia of the user, but I think a threshold of 6 months is sufficient in most realistic scenarios.

Resyncing after being offline for less than 6 months should not be a cause for concern of fake blockchain history attacks. The only way such an attack can successfully work is if the attacker obtains ownership of >50% of the stake existing at some point during that 6 month period. The attacker would like to buy old private keys at very low cost from users who had stake in the system in the 6 month period but now no longer do. They have to no longer have stake in the system otherwise they would be foolish to sell old private keys to someone whose only purpose for buying old keys is clearly to attack the system and thus reduce the value of the seller's existing stake. But the attacker will not be able to find enough private key sellers that match that criteria, because it is extremely unlikely for stakeholders with >50% of the stake to completely exit out of the system within a 6 month period. The attacker is forced to legitimately buy into the system at a high cost if he wants to attack the network. But an attacker who grows his stake over some period of time until it reaches >50% would likely not attack the network while still holding the stake, otherwise they would cause the most damage to themselves. If the attacker is able to begin and finish selling their >50% of stake during that 6 month period, then the attacker has the opportunity to carry out a fake blockchain history attack against the victim who was offline for 6 months. However, the price one pays trading assets depends on how quickly they need to finish the trade. The attacker can take his time building up the stake to not have to overpay in order to incentivize stake holders to sell, but he is forced to sell at a discount to incentivize enough people to buy to quickly sell off his stake before the 6 month deadline. Pulling off this kind of buy-sell cycle is going to cost the attacker a lot of money. It is only rational to do this if this one buy-sell cycle provides him with enough opportunity to recover his costs through double-spend attacks. But the only people he can attack are people who were offline for about 6 months. Most people would be resyncing at much higher frequencies than that, which would be really hard to attack. Trying to sell >50% of stake in one week would cause a flash crash of the price of the coin (hurting the attacker the most). Also, from a practical manner, the attacker doesn't have any good way of knowing who has been offline during the same time period they set up the buy-sell cycle to actually target these individuals. So, even if there are a decent number of people out there that the attacker could target to make his money back, it isn't trivial to identify them.

So what about resyncing after being offline for more than 6 months? With the exception of resyncing from a genesis block on a new computer, it would be a very unusual circumstance to be doing this. The vast majority of people would be resyncing on a much more frequent basis. Nevertheless, in these rare cases, users would follow the same procedure that users who are resyncing from a genesis block on a new computer would follow. First, if the user already has an up-to-date blockchain on one computer and they just want to set up their wallet on a new computer, the clients could provide an easy method for the existing trusted client to communicate a hash of a recent block to the new client. Since a user obviously trusts himself and the client he has already been using, he can carry over that trust to the new device. What about a completely new user who has never been part of this network before? Or someone who lost their hard drive (but still has a backup of their private keys) and wants to reinstall the client from scratch on their computer? In these cases, the users would rely on the snapshot hardcoded in the latest version of the client software (which would be <6 months old). A new user needs to download the client software anyway; and, they need to have some way of trusting the software they download. If the attacker was able to provide a fake client with a fake snapshot, they would again be vulnerable to the fake blockchain history attack. But if the attacker was able to provide a fake client, the user would be compromised in so many ways. The fake client could just steal the user's private keys! Or if they are using a hardware wallet, the fake client could present a false view of the blockchain to make the user think he got paid when he didn't.

The tedious details that would go into trying to figure out precisely how NxT would be attacked don't resolve the problem that the paper is talking about, and more importantly, it's not the responsibility of us to put forward the security model.

Besides theoretical attacks on PoS, which have been posited and acknowledged by many prominent PoW developers/cryptographers, does anyone know of analyses conducted on PoS attacks that have actually occurred?

So.. you are going to cherry pick the version of PoS that best fits your argument? DPoS is PoS, it is just a variant of PoS.

Let's consider Proof Of Waste for a second. 51% of Bitcoin's hash power is on 2 to 3 mining pools. The paid NOTHING to obtain it. You are entrusting them directly (or indirectly when they get "hacked") to not fork your coin. By the way... this statement I can back up with facts and readily available data. ;)

Besides theoretical attacks on PoS, which have been posited and acknowledged by many prominent developers/cryptographers, does anyone know of analyses conducted on PoS attacks that have actually occurred?

After having several farms of significant size for the last few generations of mining, I have finally switched sides and much prefer PoS now. I took a deeper look into the tech behind it and have been convinced that staking is a better idea as long as distribution was fair from mining

[...]
I am entrusting the miners that need to collaborate and play fairly to profit.

[...]
otherwise you are "relying on the good will" of humans again.

you got it wrong little buddy - there needs to be continual PoW.

there can be PoS to supplement that.

otherwise you are "relying on the good will" of humans again.

 :D :D :D

Here are two charts for you:

Nxt block generators
https://i.imgur.com/HbXIPW5.png

BTC block generators
https://i.imgur.com/GPdcRKN.png

Quiz of the day:
1. How many accounts/mining pools would be needed for each network to perform a 51% attack
2. Which one is more decentralized?  ;D

And don't bring up that "All stakes belong to the same person" argument again, because you can't prove it and it can also applied to bitcoin mining power.

How do you fix the past?

If someone had 51% stake share at one point, what can you do to prevent him forking the chain?

The tedious details that would go into trying to figure out precisely how NxT would be attacked don't resolve the problem that the paper is talking about, and more importantly, it's not the responsibility of us to put forward the security model.

Seems like a contradiction, could somebody please clarify?

so you are no longer a miner? should have known this kind of Epiphany wouldnt happen while mining was profitable ::)

either way, welcome aboard the PoS train..

now you should look at PoI instead of waiting 6 months to find out its better than pos.. lol

https://medium.com/@xtester/the-new-economy-movement-fb9bb67eb9fe

There is no good will or bad will, just economic will in PoW. If you do the right thing to obtain maximum profit possible from mining, you are actually obeying and enforcing the protocol rules. It's that simple. Do the wrong thing and you lose.

The 'tedious detail' is what your argument is and relies upon. Until you provide this and show there is a problem, then there is no problem as it hasn't been articulated. It is in the same camp as stating categorically "The numbers 3 and 5 can never be used to give a sum of 23" and then not even attempting any calculations to check you are correct, as it isn't your "responsibility to put forward summation models".  



Below is paraphrased from Come-from-Beyond and is a question that was posed in May 2014. It has still gone unanswered (publicly at least, the silence of the initial Nothing at Stake zealots is telling I think).



Alice wants to attack the blockchain.
She owns private keys of 400 accounts totalling to 75% of the stake.
She is planning to rewrite the history from block 5'000.
Legit chain is at block 5'300 (less than 720).
Cumulative difficulty at block 5'000 is 8'000'000.
Cumulative difficulty at block 5'300 is 9'000'000.
How many SHA256 operations in average it's necessary to do to find a branch where cumulative difficulty at block 5'300 is at least 9'000'001?
Hint: Blocks from 5'000 to 5'300 were forged by 100% of the stake.



Without a detailed further explanation of the so called Nothing at Stake 'problem', further discussion is quite useless.

Bump.

I am genuinely interested in the answer,  I can only assume you are all busy with your calculators right now. I can wait.



My follow up question would then be...

Would doing this many SHA256 operations be at no cost?


If you still believe this would be free, check would it be possible to do. i.e. what is likelihood that you can do this many SHA256 operations to recalculate a better chain within the 720 block time limit?

There is no answer because the question makes no sense.
first answer this: why do you think there are many SHA256 operations involved? how would a large hashrate benefit an attacker?
it's not a matter of hashrate, it's 300 blocks * 60 seconds * 400 accounts = 7200000. Hashing that many SHA256 takes less than one second on a modern cpu.

The question is not clear because it talks about "the stake", but what is "the stake"? the total amount of coins? or the amount of coins actively forging at the given time? were your 400 accounts forging on the main chain at block 5000 or not?

If you control more coins at block 5000 than those that were forging at block 5000 then you can simply rewrite everything.

The better chain needs to almost mirror the honest one in terms of certain properties.

I have no idea what you're going on about.

This is what I have been repeatedly saying. As long as the Cartel controls Bitcoin, they shouldn't start arguing about vulnerabilities in other systems or claim they are decentralized. All it needs is the government or a bad actor to gain control of a couple of pools and Bitcoin is done.

At least with PoS, the attacker has to gain control of the coins through some means. Hacking exchanges won't give them enough so they will actually have to buy out the coins. Thats another key difference, anybody holding a PoS coin has a say in the network, Bitcoin holders don't.

I know  ;D Search nxtforum for "BaseTarget adjustment algorithm" thread (leads to Blind Shooter algorithm and how it interacts with the retargeting algo, in the same thread) if you are genuinely interested. I get the impression no one on BTT is, they just listen to the echo and then repeat it.

The above makes the Nothing at Stake 'problem' wishful thinking. At least in Nxt it does.

Block generation time is targeted at 60 seconds, but variations in probabilities have resulted in an average block generation time of 80 seconds, with occasionally very long block intervals. An adjustment to the forging algorithm has been suggested by mthcl and modeled by Sebastien256 on NxtForum.org[9].

A bank such a JP Morgan with a FPGA super computer can conceivably do it (without figuring out how many operations are actually required).

A bank such a JP Morgan with a FPGA super computer can conceivably do it (without figuring out how many operations are actually required).

Some thoughts about the BaseTarget adjustment algorithm, described here (https://nxtforum.org/proof-of-stake-algorithm/forging-2088/msg35543/#msg35543). In more mathematical terms, this algorithm dynamically readjusts the rate of the Exponential random variable which is approximately the time until next block, to ensure that #[blocks per period of time] remains constant regardless of how much stake is actually forging.

The algorithm currently in use can be described in the following way (R_n stands for the rate of that Exponential random variable at time n):

__________________________________________________
R₀=1;

Let X be an Exponential random variable with rate R_n (one may put X=(1/R_n) ln U, where U is a Uniform[0,1] random variable)

if X ≥ 2, then R_n+1=2R_n

if X ≤ 1/2, then R_n+1=R_n/2

if X ∈ (1/2,2), then R_n+1=XR_n  (note that XR_n = ln U, so  XR_n is an Exponential(1) random variable)
___________________________________________________

The idea was R_n should fluctuate around 1, so we'll have one block per minute in average. In fact, it turns out that this is not the case. Additionally, with this algorithm the rate occasionally becomes rather close to 0, leading to long intervals between the blocks (note that the expectation of an Exponential(r) random variable equals 1/r). The first problem (average rate is not 1) is easy to correct by a simple rescaling, but the second one (occasional very long block time) is more serious, since it is an inherent feature of this algorithm.

So, I propose a modified version of this algorithm. Let γ ∈ (0,1] be a parameter (γ=1 corresponds to the current version of the algorithm). Then (abbreviating also β=(1 - γ/2)^-1)

_________________________________________________
R₀=1;

Let X be an Exponential random variable with rate R_n (one may put X=(1/R_n) ln U, where U is a Uniform[0,1] random variable)

if X ≥ 2, then R_n+1=2R_n

if X ≤ 1/2, then R_n+1=R_n/β

if X ∈ (1,2), then R_n+1=XR_n

if X ∈ (1/2,1), then R_n+1=(1-γ(1-X))R_n
___________________________________________________

In words, we make it easier to increase the rate than to decrease it (which happens when X is "too small"). This is justified by the following observation: if Y is an Exponential(1) random variable, then P[Y<1/n]=1-e^-1/n≈1/n and P[Y>n]=e^-n, and the latter is much smaller, than the former. In other words, the Exponential distribution is quite "asymmetric"; even for n=2, we get P[Y<1/2]≈0.393 and P[Y>2]≈0.135.

Now, to evaluate how does the modified algorithm works, there are two methods. First, one can do simulations. Otherwise, we can write the balance equation for the density f of the stationary measure of the above process in the following way:

(1)   f(x) = e^-xf(x/2)/2 + β(1-e^-βx/2)f(βx) + e^-x ∫ f(s) ds + γ^-1e^-x/γ  ∫ e^(1-γ)s/γ f(s) ds, where the first integral is taken from x/2 to x, and the second one from x to βx.

Here, f(x) is positive for x>0 and ∫f(s) ds (from 0 to ∞) = 1 (since f is a density).

The problem is that I don't know, how to solve the equation (1). I mean, most probably there is no closed-form analytic solution, and I'm not able to provide a numerical solution because of my lack of knowledge how to do it :(   But, provided that the solution of (1) is available, the quantities of interest may be obtained in the following way:

mean time to next block =  ∫s^-1f(s) ds (from 0 to ∞), and
probability that the rate becomes less than ε equals  ∫ f(s) ds (from 0 to ε)  (observe that if the rate is ε, then one should expect the next blocktime to be roughly 1/ε).

Hopefully, with some reasonable γ (say, γ=1/2), this algorithm would perform much better than the current one. So, I think that it would be important to investigate this (either by doing simulations, or by solving (1) numerically), since we'll probably need this retargeting algorithm even after the TF is in place.

I wouldn't be wrong to suppose no math will follow to back this statement, would I?

I say as much in the quote. Though, an FPGA should be an order of magnitude faster than a General-purpose computer (or even PoW hasher) for that type of problem.

why do you think there are many SHA256 operations involved?
That is what is required to calculate a longer chain that stands a chance of being accepted as legitimate.
The retargeting algo in Nxt plays an important role in this.

how would a large hashrate benefit an attacker?
See above.

    MessageDigest digest = Crypto.sha256();
        for (Transaction transaction : newTransactions.values()) {
            digest.update(transaction.getBytes());
        }

byte[] payloadHash = digest.digest();

"Short fork" differences;
Since "if he saw both, he always chooses the one that is supposed to come later in time", stakeholder 101 could choose not to include any of the previous 100 blocks because they were "too late".

There are only 101 stakeholders that matter in bitshares, I suppose the rest can all suck on a salty sausage? In which case, you really don't need anywhere near 51% of the stake, you only need enough so that you are wealthier than the next 50 wealthiest combined stakers. (Or had it within six months in the past.)

Basically, I have no idea what's going on here, it sounds pretty unworkable.

"Long fork" differences;

Bolded favorite parts.
Not-too-distant-past = 6 months.
All the delegates in a given cycle = 101.

I think this is a great illustration of how much simpler and easier it is to reason about the security of Bitcoin, and how all the complexity of PoS gives the illusion of security (Bitshares in this case).

I look forward to casting off the yolk of Congress and the Fed in favor of my 101 overlords. /sarcasm

There should be no confusion here. Please don't claim PoS has some features that are present only in DPoS as a supporting argument for PoS. When the title shows DPoS I will consider it fair to use those features as part of the discussion. I don't think PoS is the same as DPoS. What do you think?

First, it's not "waste". It's a highly specific impossible to forge or reuse effort to ensure security while also fairly converting value (energy) into tokens, bridging the outside and indise economy seamlessly.

The pools and their costs argument is only temporarily valid. The pools paid nothing, but they have nothing long-term. If they fuck up, miners will move quickly, miners paid A LOT of money for their power and have not usually recouped. I am entrusting the miners that need to collaborate and play fairly to profit.

You see the difference now?

It is waste in that it wastes electricity and processing power unnecessarily as has been proven by PoS. This is something Bytemaster (Bitshares main dev) came up with, for the Bitshares community to refer to PoW as Proof Of Waste to point out the fact that it is unnecessary to expend these resources simply to secure a block chain, as is proven by PoS and all of its variants.

I will concede you have a point as to the pools only being able to mount an attack temporarily before everyone switches pools. However, I stick to the fact that you simply made up "as it happens for many coins an exchange owns more than 51% of the supply", and you have no proof of this and it is not true. The point was that there are different attack vectors for PoW that exist other than achieving 51% of the hash power. Both PoW and PoS variants have vulnerabilities and different pros and cons. There is no perfect solution, and I believe that PoW is often touted on these forums as being a perfect solution when in actuality it is not.

Myriadcoin's multi-PoW framework helps with the decentralization of mining that some of you may be concerned about. More than you think, actually.

I have been touting Myriadcoin as one of the biggest innovations in the PoW cryptocurrency world. It is definitely a step forward. Unfortunately, it still doesn't change the fact that a lot of electricity and processing power is wasted in the process.

I disagree again.

It is not waste, it is a conversion of energy value into coin value. PoS coins (various types as you mentioned) also use a method to get value into the coin itself:
- PoW stage: it's the same as a fully PoW coin, just that coin emission ends very quickly and is unfairly distributed with regards to future investors.
- gib muny: just "devs" ripping off investors and collecting pots of bitcoin (the irony) to give price decaying coins to them

There can be only one instance of proof when an exchange owns 51% of the supply, when all depositors account for all deposits in various known addresses and reach a 51% sum, otherwise it's not ensured that you can detect a 51% ownership.

Again, PoW attack vectors are valid for mere HOURS, while a PoS attack vector can be used FOREVER once it opens up. This is a very HUGE difference in the security model which reduces the effect of the attack.

Going back to the PoW "waste" which you pretty headed PoS supporters don't seem to understand not even 6 years after Bitcoin was invented. This is not "waste", it is a cost that is converted into new coins (scheduled or fees) from block rewards. The approximate cost to generate a block is found in the value of new tokens. This cost is real and significant, this gives value to Bitcoin.

The cost of generating PoS blocks is basically zero (5$ a month for electricity on donated hardware or a VPS bill). The value of the block rewards is thus zero, this gives no value to new PoS coins, the market cap remains the same, but new coins are added. Price per existing coin will be lower.

What does this mean? Let me show you:

PoW
Bitcoin: 0.7% price growth every day for 6 years, 5,678,828,589 USD market cap
Litecoin: oscilating but stable parity with Bitcoin for 3 years, 138,439,389 USD market cap
Namecoin: oscilating but stable parity with Bitcoin for 3 years, 10,064,647 USD market cap

Hybrid
Peercoin: oscilating but stable parity with Bitcoin for 2 years, 18,474,609 USD market cap
Novacoin: down the shitter in 2 years, 640,582 USD market cap
YACoin: down the shitter in 2 years, 37,320 USD market cap

PoS
I'll let you pick the best examples older than one year

https://i.imgur.com/VFbXPCE.png
PoW or not, it doesn't use that much electricity now, it's basically useless... You can relax knowing that less than 200 USD worth of electricity is wasted daily to sustain this coin.

Basically, I have no idea what's going on here, it sounds pretty unworkable.

What I wrote about Bitshares was obviously not some security analysis. I was demonstrating the clear overwhelming complexity that PoS brings in order to "solve" a problem that is solved very well and very simply with PoW.

Nope, just the contrary. In a PoW system, once you own the hardware, it cost nearly nothing to attack any eco-system that uses the same algorithm. As shown by many PoW altcoins attacked to death.

In a PoS system, acquiring enough stake to attack will cost you astronomical amount of money, (you can't really hack the stake, since it's illegitimate stake and can be rolled back by community action). Then once you acquire the stake, you could only attack one particular PoS system (which you own a majority stake in, why would you attack it? it's illogical).

Therefore, ZERO PoS system has been actually attacked so far.

I'm not sure why people ignore the fact that tons of PoW altcoin has been attacked, and ZERO PoS altcoin attacked so far, and still have the audacity to claim PoS is less secure.

You are missing the point of PoS. The point of PoS is not to be better at achieving decentralized consensus than Proof Of Waste. The point of PoS is to achieve sufficiently decentralized consensus without wasting a ton of electricity, therefore harming the environment, and/or wasting a ton of processing power that could be used to benefit society in one way or another. If you insist on PoW, then make the PoW beneficial to society like Primecoin or curing cancer... otherwise it is a waste of energy and processing power.

1. The creation of money. Anyone can create money by broadcasting the
solution to a previously unsolved computational problem. The only
conditions are that it must be easy to determine how much computing effort
it took to solve the problem and the solution must otherwise have no
value, either practical or intellectual. The number of monetary units
created is equal to the cost of the computing effort in terms of a
standard basket of commodities. ...

Furthermore, it is unclear whether Proof Of Waste will work once the block reward halvings stop and no more currency will be printed. Currently PoW coins are diluting their shareholders to pay for miners to secure their block chains.

PoW coins can not use computations that are otherwise useful. If the computation is otherwise usedful, it can be pre-computed: weakening the security PoW is supposed to provide.

Edit: Interesting to note that Bitcoin does not follow this algorithm long-term because, as CoinHoarder points out, money creation eventually ceases.

This dilution helps spread coins around to new users.

It lowers the barriers to entry if some organization manages to take control of the majority of the coins/hash-power for some reason.

Put another way, scarcity will make the price rise, which will encourage somebody, somewhere to plug in a miner.

In a PoS coin, I am not sure why anyone would sell enough stake to lose control over the "forging". The whole point is that stake costs almost nothing to maintain.

I agree the question of miner fees for securing the network is an open one. As somebody in another thread pointed out: we can switch to PoS if it becomes clear that fees are not sufficient to secure the network. That won't happen for decades.

Edit: Ideally, once coin creation ceases, mining fees will settle on an amount sufficient to secure the network. It is not clear that there is any stable feed-back mechanism to ensure this. Limited block-size may have to act as an approximation.

I'm not sure what you're getting at here. I think it depends on the value of the PoW coin on the free market and the amount of transactions that are occurring on its block chain. If the value isn't high enough and there aren't enough transactions then the network will possibly not be very secure as people will shut down their equipment. Someone could probably buy up that equipment for pennies on the dollar and mount a 51% attack on the less secure network. There are a lot of entities that would have incentive to do this.. banks, central banks, competing cryptocoins, governments pissed at dark markets and tax evaders, etc..

Yes, it may not even happen in our lifetimes if at all, but I see it as being a possibiliy. There are some ALT coins that have quicker emission curves, so we will see how they are able to deal with it. We all know how Dogecoin went.. Monero is another one with a fast emission curve. If the crypto markets crashed really hard it could happen sooner than you'd think. I realize a PoW coin can switch later, but I think it is important that PoS be tweaked and improved upon now rather than later. That way if Bitcoin does have to switch it can switch to the best possible solution that has been "battle tested".

Well - in a POW chain, you see which chain has the most WORK put into it. This is independent of anyone. You just sum it up and choose the one with the most.

Well - in a POS chain, you see which chain has the most STAKE put into it. This is independent of anyone. You just sum it up and choose the one with the most.

simple as that.

I'm sorry - It's not.

My INVALID chain has just as much stake put into it as the VALID one.

I bought accounts that are empty now but were full of coins sometime in the past.. (Or hacked an exchange to get the keys to their now empty wallets etc..)

I'm sorry - It's not.

My INVALID chain has just as much stake put into it as the VALID one.

I bought accounts that are empty now but were full of coins sometime in the past.. (Or hacked an exchange to get the keys to their now empty wallets etc..)

No need. I'm afraid I'll be forced to reveal the last anti-clones trap to explain why "nothing-at-stake" is just a buzzword and doesn't actually work. Feel free to sell historical passphrases. I'm just waiting for D&T's reply on the problem about Alice with 75% of the stake. I was always asking for details of such an attack, coz when one is trying to explain the details he sees that such the attack requires enormous computing power.

then my node would ignore your chain because it's invalid.

As for Economic Clustering.. Just 'Trust' wrapped up in a more complex way..

any NEW user would download MY CHAIN.

As for Economic Clustering.. Just 'Trust' wrapped up in a more complex way..

One of the advantages of PoW over any PoS variant is that it encourages innovation.

New generations would be welcome to come up with advancements in science, new technologies and even attempt to crack SHA256 or Scrypt in order to gain an advantage with PoW systems and get into the money flow.
PoW encourages hacker mentality (in a positive sense), with PoS however, if you don't own a stake in an entrenched system, you are out of luck.

Would you like old, filthy rich psychopaths to run the society in the future?
Choose PoW, protect the children! :)

With PoW you need to invest to "get into the money flow", the same holds true for PoS.
PoW and PoS have a tendency to favor early adopters assuming that a coin is successful.
No real difference, is there?

Yes, you need to invest in both cases, only with PoW you can invest your intellect and time to create a breakthrough in mining technology (basically in your garage), while in PoS system you need to convince the incumbents to sell their stakes to you. See the difference?

I'm now thinking that something like proof of activity or proof of importance might be more relevant in the long term. Considering the decline in the number of Bitcoin's full nodes, if you're rewarded for just running a node that's already a step in the right direction, however the exact algorithms need to be studied more closely.

The fact that POS encourages holding alone dooms any POS coin imo. For any coin to succeed it need adoption, which implies actual spending. At least with POW there's often a better distribution of coins which leads to a decently sized community working for adoption, as opposed to POS when there's like 3 whales staking 70% of the supply spamming posts about how amazing a coin is...

Sure you can argue that POW coins can have a similar situation with insta/pre mine but assuming a fair coin reward system, once the mining community matures for a POW coin the coin distribution will always be fairer than a POS system, which is the first step towards adoption.

just my 2c ofc

Bob has a client that only downloads valid chains.
He sees 99 nodes with invalid chain and 1 node with valid chain (more stake involved).
Which one does he download?

My node knows which chain is valid, the one with more stake involved.

You need to build a valid longer chain without majority of stake. Which, as we are discussing, requires extreme amounts of computing power (calculations pending).

What calculations?
Look, if stakeholders can calculate an appropriate chain in real time right now without PoW on their PC's, why in the Seven Hells would it be impossible to do the same thing in a 51% stake attack? At most it would require an additional PC, and it probably doesn't even require that.

And you keep saying things like "My node knows which chain is valid, the one with more stake involved." even though if a reorg attack happens, the wrong chain would be specifically built to have more stake involved, that's why it's a 51% stake attack. (Or could be a N@S 51% stake attack.)

Hell, I could boot up a brand new NxT coin tomorrow and build a chain that looks like it had more coins moving around on it, and had more stake involved because I would just give myself all the coins. The only reason this attack isn't going on right now is because of the centrally managed checkpoint system.

And I guess that's fine, if that's what you want out of your currency, but it is absolutely not a blanket improvement on PoW. The beauty of PoW, and the reason I ever bothered with Bitcoin to begin with, is that it requires zero trust to reach consensus all around the world. As far as I've seen, PoS is light-years behind PoW when it comes to decentralized consensus.

If you're willing to give up decentralized consensus, then it begs the question; Why bother with PoS? Why not use something similar to the battle-tested Public Key Infrastructure that we use today to secure internet communications? Then it would be a real technocratic currency, and you wouldn't have to worry about what exchanges, governments, hackers, or the wealthy elite do with the large wallets they have (or had), you'd just have to trust the root authorities.

PoS doesn't encourage hodling any more than PoW encourages hodling. For example, profits from forging with your NXT stake is less than 0.5%/yearly, anything gives better return that that, NXT assets in the first place. But to buy NXT assets on the asset exchange you need to actually spend your NXT, which goes against the idea of hodling.

So if you suddenly learned that there is no centrally managed checkpoint system in NXT, which reason for this attack not going on would you be able to come up with? The sooner you'll start thinking of this new reason, the better, because someone will be sure to say soon enough that there is no centrally managed chekpoint system in NXT )

I'm not familiar with nxt assets, I was referring to POS in general. Having ANY POS whatsoever discourages spending and thus kills adoption. Having no POS encourages spending, because your money will be worth less than it is tommorow. Alt-coins are supposed to be just that, coins, a currency. If you dont want your currency to devalue you invest it somewhere(get interest at a bank, buy stocks w/e), you shouldn't expect the act of holding to be rewarded.

Oh please. It's all well and good to have a built-in rolling checkpoints, but that doesn't help a new client figure out which one is the right blockchain. Again, I could boot up a new NxT tomorrow that could do rolling checkpoints, that can't help new clients figure out which blockchain is correct, unless you erroneously suppose that the majority of nodes will always provide the appropriate checkpoints. (See Sybil attack.)

Here is the genesis block;
https://github.com/Blackcomb/nxt/blob/master/src/java/nxt/Genesis.java

And here is where it defines the "MileStone Block" (A rose by any other name...)
https://github.com/Blackcomb/nxt/blob/master/src/java/nxt/BlockchainProcessorImpl.java

So I'm just going to call your bluff on that one.

It doesn't make sense to talk about PoS in general, because PoS 1 != PoS 2 != PoS 3. When you talk about PoS, you must mention a specific implementation of PoS you refer to. While PoW cryptos are all the same, copies of Bitcoin code (except Bytecoin/Monero cryptos which have the same basic flaws of PoW that Bitcoin has), PoS implementations are all different (Peercoin != NXT != Bitshares != NEM != Qora, NODE, etc.), their flaws would also be different, you can't put them all in the same group if you are serious about your claims.

Actually I called your bluff, as apparently you're not familiar with what crypto has what and only parrot other people's opinions, not based on math.

           String lastMilestoneBlockIdString = (String) request.get("lastMilestoneBlockId");
            if (lastMilestoneBlockIdString != null) {
                Block lastMilestoneBlock = Nxt.getBlockchain().getBlock(Convert.parseUnsignedLong(lastMilestoneBlockIdString));
                if (lastMilestoneBlock == null) {
                    throw new IllegalStateException("Don't have block " + lastMilestoneBlockIdString);
                }
                height = lastMilestoneBlock.getHeight();
                jump = Math.min(1440, Nxt.getBlockchain().getLastBlock().getHeight() - height);
                height = Math.max(height - jump, 0);
                limit = 10;
            } else if (lastBlockIdString != null) {
                height = Nxt.getBlockchain().getLastBlock().getHeight();
                jump = 10;
                limit = 10;
            } else {
                peer.blacklist();
                response.put("error", "Old getMilestoneBlockIds protocol not supported, please upgrade");
                return response;
            }

I'm not familiar with nxt assets, I was referring to POS in general.

lol! I'm pointing at the damn source code.
Here is where getting the MileStoneBlockId's is defined;
https://github.com/Blackcomb/nxt/blob/master/src/java/nxt/peer/GetMilestoneBlockIds.java

Who do you suppose provides these MileStones every 1440 blocks to ensure an improper reorg doesn't occur before them? Hm?

I'll give you a hint;

Who?

What happens after 10 1440 block "jumps" and it hits the "limit"?

That vote is directly proportional to the amount of tokens they own. Technically (assuming all stakeholders vote) you need 51% of the currency supply to have total control of which delegates get elected.

Bob has a client that only downloads valid chains.
He sees 99 nodes with invalid chain and 1 node with valid chain (more stake involved).
Which one does he download?

My node knows which chain is valid, the one with more stake involved.

You need to build a valid longer chain without majority of stake. Which, as we are discussing, requires extreme amounts of computing power (calculations pending).

wtf? No! Nothing requires extreme amounts of computing in POS. That's the point of POS

No, don't ask me. You claim that there are centralized checkpoints or whatever you claim there is, prove the flaws, it's your job.

wtf? No! Nothing requires extreme amounts of computing in POS.

building otherwise useless hardware can hardly be the reason to call pow superior

It's not a "flaw", it's a checkpoint every 14400 blocks, which equates to 10 days. So if your server goes offline for longer than that, then you need to download the chain from a trusted party, which usually comes from nxtcrypto.org or nxtbase.com. Did I read something wrong?

Alice wants to attack the blockchain.
She owns private keys of 400 accounts totalling to 75% of the stake.
She is planning to rewrite the history from block 5'000.
Legit chain is at block 5'300 (less than 720).
Cumulative difficulty at block 5'000 is 8'000'000.
Cumulative difficulty at block 5'300 is 9'000'000.
How many SHA256 operations in average it's necessary to do to find a branch where cumulative difficulty at block 5'300 is at least 9'000'001?
Hint: Blocks from 5'000 to 5'300 were forged by 100% of the stake.
Without a detailed further explanation of the so called Nothing at Stake 'problem', further discussion is quite useless.

Well, first of all, if Alice has 75% of stake, then the simplest attack would be in the future:
just fork and keep both branches as equal in cumulative difficulty as possible, never letting
one get too far ahead of the other. Thus, there will never be consensus. In fact, for this attack,
one needs only 51%. Or even much less if other stakeholders work on both branches.

But for argument's sake, let's  consider the original challenge. The math is pretty tricky, but let me
sketch the rough idea of an attack.

The regular history developed by picking, at each block, the minimum delay among the stakeholders.
This delay has some probability distribution and some expectation which is the average block interval.

If you reduce the stakeholders to 75%, then the distribution will shift to longer delays.
BUT, Alice is not limited to single-step extensions. She can compute a huge tree of all possible
k-step extensions. With 400 accounts, this tree will have 400^k leaves, and require roughly that
many SHA256 computations. But for large enough k, one would expect one of these leaves to have
a path with an unusually small sum of k delays, less than k times the average delay for all stakeholders.

The question is, how big a k do you need. And this obviously depends on both the number of accounts,
and percentage of stake held by Alice. For the given numbers, I expect a small k like 4 would suffice,
but this needs to be worked out in detail.

In that case, to cover 300 blocks, you'd need to compute 75 trees of 400^4 leaves each, for a rough
total of 75*400^4 = 1.92*10^12 SHA256s, well within the realms of feasibility.

For k larger than 6 this attack would become quite infeasible, but it's not clear to what percentage of stake
that corresponds, unless one goes through the math...

I'm not familiar with nxt assets, I was referring to POS in general. Having ANY POS whatsoever discourages spending and thus kills adoption. Having no POS encourages spending, because your money will be worth less than it is tommorow. Alt-coins are supposed to be just that, coins, a currency. If you dont want your currency to devalue you invest it somewhere(get interest at a bank, buy stocks w/e), you shouldn't expect the act of holding to be rewarded.

Well, first of all, if Alice has 75% of stake, then the simplest attack would be in the future:
just fork and keep both branches as equal in cumulative difficulty as possible, never letting
one get too far ahead of the other. Thus, there will never be consensus. In fact, for this attack,
one needs only 51%. Or even much less if other stakeholders work on both branches.

But for argument's sake, let's  consider the original challenge. The math is pretty tricky, but let me
sketch the rough idea of an attack.

The regular history developed by picking, at each block, the minimum delay among the stakeholders.
This delay has some probability distribution and some expectation which is the average block interval.

If you reduce the stakeholders to 75%, then the distribution will shift to longer delays.
BUT, Alice is not limited to single-step extensions. She can compute a huge tree of all possible
k-step extensions. With 400 accounts, this tree will have 400^k leaves, and require roughly that
many SHA256 computations. But for large enough k, one would expect one of these leaves to have
a path with an unusually small sum of k delays, less than k times the average delay for all stakeholders.

The question is, how big a k do you need. And this obviously depends on both the number of accounts,
and percentage of stake held by Alice. For the given numbers, I expect a small k like 4 would suffice,
but this needs to be worked out in detail.

In that case, to cover 300 blocks, you'd need to compute 75 trees of 400^4 leaves each, for a rough
total of 75*400^4 = 1.92*10^12 SHA256s, well within the realms of feasibility.

For k larger than 6 this attack would become quite infeasible, but it's not clear to what percentage of stake
that corresponds, unless one goes through the math...

Please explain.

Why do you read the code from a few months ago by the way?
Here is the latest release for analysis:
https://bitbucket.org/JeanLucPicard/nxt/src

All 400^k possibilities are very very likely to have less cumulative difficulty than the main chain, because 75% < 100%

N.B. just so I know, are you familiar with the Nxt Forging algo at all? Doesn't matter if you aren't.

I think more correct assessment is that by holding PoS coins you are eligible to receive interest, while PoW coins don't give you any interest explicitly, but rather from scarcity/inflation mechanisms, which may vary from one coin to another.

EDIT:

Even though on the surface two schemes might seem somewhat similar, they are fundamentally different:
PoW - neutrality, freedom of innovation, hacker mentality, equality of opportunity, game of skill
PoS - entrenched interests, corruptible humans, oppression, inheritance of wealth, game of luck

Pick your flavor of the future.

I didn't know there were two repositories. But anyway, it's the same damn thing;
https://bitbucket.org/JeanLucPicard/nxt/src/88073b26bd65e89ddb074181c5f50f6701e7b177/src/java/nxt/peer/GetMilestoneBlockIds.java?at=master

Did I incorrectly describe the purpose of Milestones?

You're not appreciating how the statistics work out here.

75% being less than 100% just means that the delay distribution is shifted to the right.
But sampling from a huge number like 400^k means you'll get much further into the left-tail
of this shifted distribution, so you can easily beat the unshifted average.

The purpose of this milestones code is "an optimization to speed up finding out what is the last common block you share with a peer." (c) JeanLucPicard

But requesting milestones from peers only checks back 1440 blocks for 10 "jumps", so if the closest common milestone is further than that, then it would just be unable to find a common block. That would happen either because it had forked 14400 blocks ago, or because the peers had gotten 14400 blocks ahead.
At which point, as far as I can tell, the client needs to start over with a node that is passed to him from the NxT domains. That seems like a pretty clear "checkpoint" in all but name.

Although, the server "won't allow" forks after 720 blocks, so I guess it only looks for older milestones in case the server was just offline for less than 10 days. I don't really understand the point of that rule, since all it seems to accomplish is making forks permanent.

I need to see how this thing isn't getting drowned in orphans. Ostensibly it's because no large stakeholder has bothered to try to mess with it. That's the goal, I know, but good grief, if I wanted to trust rich people that much I'd stay with fiat.

There are no NXT domains, there are peers which all share a copy of the blockchain. If you think all the blockchain is downloaded from one centralized service, well, you need to check your facts again. Installing the client, downloading the blockchain, and looking at the peers tab would be one simple way of doing it.

But requesting milestones from peers only checks back 1440 blocks for 10 "jumps", so if the closest common milestone is further than that, then it would just be unable to find a common block.

At which point, as far as I can tell, the client needs to start over with a node that is passed to him from the NxT domains.

Wrong. This happens in a while(true) loop. It will just request the next 10 milestone blocks, and keep going back until Genesis if no common block is found.

If it cannot download the blockchain from the current peer, it will switch to another peer. Peers exchange their known peers lists with each other all the time, there is no mechanism that will lock your node to only download from certain peers, let alone from hardcoded Nxt domains.

???
https://bitcointalk.org/index.php?topic=303898.msg3372610#msg3372610

What are you talking about? Sucess is not binary here. You don't need an exact match, just the ability to select a match that is better than average.

Even if it takes 1 complete second to do one interation of 4 and 5, the system is still in deep trouble.
Suppose there are two coinholders, one with 90% and the other with 10%.
Without manipulation, the guy with 90% will find blocks once every 67 seconds on average and the guy with 10% will find blocks once every 600 seconds.

Suppose the guy with 10% has time to test out 9 different addresses per minute. Each address will have a different waiting time. Picking the best among these nine candidates is sufficient to boost 10% stake up to the mining power of 90% stake.
If you can do 90 iterations per minute, then you can attack with 1%; 900 with 0.01%

Your estimate of 0.01 ms per iteration suggests that a successful attack could be pulled off with 1.67×10^-9% stake. What is that? 100 or 200 satoshi.

Obviously, this is not acceptable. Attackers should have to hold more than a few satoshis in order to mount a successful attack.

For new people downloading the blockchain, you have to allow them to designate trusted sources manually. Otherwise,  some asshole can send them a long irreversible chain, preventing them from catching up to the rest of the network.

...
A few posts later...
...

This is not accurate. All decentralized consensus algos are vulnerable to 51% attacks whether it be PoS or PoW. Someone with enough hash power to 51% a PoW network can do so forever, or until the PoW network forks and changes PoW algos. Someone with 51% stake of a PoS coin can 51% the coin forever, or until the PoS network forks and burns the attacker's stake.

Even though on the surface two schemes might seem somewhat similar, they are fundamentally different:
PoW - neutrality, freedom of innovation, hacker mentality, equality of opportunity, game of skills
PoS - entrenched interests, corruptible humans, oppression, inheritance of wealth, game of luck

http://www.truthcoin.info/blog/pow-and-mining/

http://www.reddit.com/r/Bitcoin/comments/2miytv/long_live_proofofwork_long_live_mining/

and be sure to read Vitalik Buterin's comment.

PoS means the rich get richer automatically. Sounds great... if you're rich.

PoS means the rich get richer automatically. Sounds great... if you're rich.

In NXT power belongs to stake holder and it yields + 0.5%.
In BTC power belongs to third parties and it yields -10.0%.

I disagree, the whitepaper showing otherwise is in my signature. :P Although it depends on what you mean by "51% attack". Reversing a secured transaction - 0% probability as long as one stake is honest. Delaying transactions - can be delayed 2x the average while controlling 50% of the stake, hardly impressive.

Answering the question in the title: it's easy - no one wants to spend their money on mining equipment that is constantly getting cheaper.

Another reason is - few people already have A LOT of hashing power and they get an advantage compared to a regular folk. And regular folk is not happy with this fact at all :)

... there is always an entry into the economy.

It doesn't really matter if you cannot enter at all or if you can enter and receive only a marginally low share (close to zero) at extremely high costs.

There's better options for both cases and in the long run both cases will be solved by the market.

Let's call it a draw.

If Bitcoin remains PoW, they can still buy that vast majority of coins, but everybody will have a trump card.

SCammers advocate PoS because they cannot secure their blockchains.

With Proof of Work is is blatantly obvious they will never be able to secure their blockchain, so instead they obfuscate about Proof of Stake, pretending that somehow Proof of Stake will let their garbage scamcoin be secure even though it of course will not be secure.

It is all about the scam, selling people insecure garbage. The more people become aware that Proof of Stake is not secure, the more newfangled scammy "secure the blockchain" methods get made up, all in the attampt to sell yet another insecure pile of crap by obfuscating the fact it is insecure crap.

TL;DR it is easier to fool idiots into thinking your garbage-coin is secure if you use Proof of Stake so scammers prefer Proof of Stake when creating new scamcoins.

-MarkM-

Shining example of how financial interest messes up judgment. Keep sticking to it and you will remain wondering how the PoS coins are getting more and more marketcaps.

PoS means the rich get richer automatically. Sounds great... if you're rich.

PoS means the rich get richer automatically. Sounds great... if you're rich.

^
Could you elaborate: What would be the final goal of the banks?

If that mischievous financial policy which had its origin in the North American Republic [debt-free money] should become indurated down to a fixture, then that government will furnish its own money without cost. It will pay off its debts and be without a debt to the International Bankers. It will have all the money necessary to carry on its commerce. It will become prosperous beyond precedent in the history of the civilized governments of the world. The brains and wealth of all countries will go to North America. That government must be destroyed or it will destroy every monarchy on the globe!

We have in this country one of the most corrupt institutions the world has ever known. I refer to the Federal Reserve Board and the Federal Reserve Banks. They are not government institutions. They are private monopolies which prey upon the people of these United States for the benefit of themselves and their foreign customers. This evil institution has impoverished the people of the United States and has practically bankrupted our government, and it has done this through the corrupt practices of the moneyed vultures who control it.

The drive of the Rockefellers and their allies is to create a one-world government, all under their control. Do I mean conspiracy? Yes I do. I am convinced there is such a plot, international in scope, generations old in planning, and incredibly evil in intent.

For more than a century, ideological extremists at either end of the political spectrum have seized upon well-publicized incidents to attack the Rockefeller family for the inordinate influence they claim we wield over American political and economic institutions. Some even believe we are part of a secret cabal working against the best interests of the United States, characterizing my family and me as ‘internationalists’ and of conspiring with others around the world to build a more integrated global political and economic structure – one world, if you will. If that’s the charge, I stand guilty, and I am proud of it.

We are grateful to the Washington Post, the New York Times, Time Magazine and other great publications whose directors have attended our meetings and respected their promises of discretion for almost forty years. It would have been impossible for us to develop our plan for the world if we had been subject to the bright lights of publicity during those years. But the work is now much more sophisticated and prepared to march towards a world government. The supranational sovereignty of an intellectual elite and world bankers is surely preferable to the national auto-determination practiced in past centuries.

It is a complex question, but the main thing is this.

In POS, wealth becomes more concentrated at the top over time and there is no way to break your way into the economy without the 'permission' of existing stakeholders.

In POW, although mining costs can and usually become prohibitive, there is always an entry into the economy.

In the orchestrated bank take-over scenario (https://bitcointalk.org/index.php?topic=848440.msg9461010#msg9461010) I outline up-thread, it makes a huge difference.

If Bitcoin is converted to PoS, the banks can take control by printing unlimited money. If Bitcoin remains PoW, they can still buy that vast majority of coins, but everybody will have a trump card. If the price gets too high, you can simply start mining instead of buying on the open market.

It may be that mining becomes so expensive that only nation-states can do it. That would still be an improvement over what we have now (https://www.youtube.com/watch?v=tGk5ioEXlIM).

Edit: added link to the "The American Dream" animated short film about the history of Central Banks in the USA. They briefly mention Great Britain as well.

You know perfectly well, that the overwhelming majority of people will never mine any bitcoins and will never be able to compete with professional miners, just like majority of people don't compete with professional miners of natural resources. What matters for the majority of people is unique use cases. How the crypto currency came into existence doesn't matter for them if they have to buy it anyway, as long as it's a decentralized blockchain, distributed consensus and secure network - that's all that matters.

The overwhelming majority might never feel the need to mine, but knowing that they can if they want to without permission, makes all the difference between PoW and PoS.

There is no difference, who would prohibit them from forging in NXT PoS and get a profit from fees? Do they somehow get mining equipment for free to mine Bitcoin? I'd like to get me a few free ASICs then, oh and free electricity too ;)

Unless I am mis-understanding, anybody with at least 50% stake can do that.

With PoW mining, a 51% attacker can not force you to stop mining (short of seizing or bombing your equipment).

Please explain.

And the most important feature:
The network can detect which miners don't take part in block generation and act accordingly.

The last point deserves to be described with more details.

Imagine someone is going to do a "51%" attack against Nxt and he owns 90% of all coins. The adversary must stop generating blocks for legit branch coz he won't be able to compete against 100% mining power with his 90%. So he decides to "skip" his turn to generate a block. The rest 10% of the network detects this and penalizes the adversary by setting his mining power to 0 and distributing it among other miners. Now the network is back to 100% power coz everyone got 10-fold increase. The adversary can mine other branch in a secret place but it won't be able to replace the legit branch. Of course, the 2nd branch will have 100% "hashing" power tied to it as well, coz the attacker will get his 90% bumped to 100% but this can be counteracted by some mechanisms of advanced consensus (still not revealed).

Why do you have status "Sold 50% due to mining concentration." then below your username?

There is no difference, who would prohibit them from forging in NXT PoS and get a profit from fees? Do they somehow get mining equipment for free to mine Bitcoin? I'd like to get me a few free ASICs then, oh and free electricity too ;)

PoS is better.

Why?  Because money, greed and power take the path of least resistance.
PoS is easiest to obtain and generate, with little additional cost (ie. electricity to do staking)

lol that is the perfect plan.

In short: power.
They can print all the money they want.

[quotes removed]

The overwhelming majority might never feel the need to mine, but knowing that they can if they want to without permission, makes all the difference between PoW and PoS.

... Because PoS is a POS. ;D

PoS means the rich get richer automatically. Sounds great... if you're rich.

It is a complex question, but the main thing is this.

In POS, wealth becomes more concentrated at the top over time and there is no way to break your way into the economy without the 'permission' of existing stakeholders.

In POW, although mining costs can and usually become prohibitive, there is always an entry into the economy.

People are advocating DPoS, not PoS ;)

Read something about BitShares DPoS!

http://wiki.bitshares.org/index.php/DPOS_or_Delegated_Proof_of_Stake

I agree with you regarding the PoS situation, but strongly disagree with PoW.

Mining costs are ramping up with a speed of lightning and reward for block finding is going down. At some point there is no way to enter this economy since there are "top miners" who will simply outmine you.

Just wait until SPOW launches next year from the Uro team, then everybody can be happy  :)

Mining costs are ramping up with a speed of lightning and reward for block finding is going down. At some point there is no way to enter this economy since there are "top miners" who will simply outmine you.

I fail to understand why an attacker has to choose which chain to participate in.

Seems Nxt and other Proof-of-Stake currencies are suffer from lack of trust to the distributed consensus algo. There are some "threats" described e.g.  Nothing-at-Stake, "weaker consensus properties"  ??? and so on. To clarify all claims around proof-of-stake currencies, investigate consensus properties and make the research widely accessible via executable parametric simulations we've started Consensus Research group with  crowdfunding via Nxt AE https://trade.secureae.com/#5841059555983208287 . First results will be published soon including the most clear and formal definition of Nothing-at-Stake to the moment!

Daedelus, once kushti posts his papers it's guna put that friggin stupid pdf about pos to shame lol

Cunicula was most open and convincing with his criticism of the so called nothing at stake problem 10 months ago...

Unconvinced.

Everybody can never be happy and you can bet your last dollar on that )

Just wait until SPOW launches next year from the Uro team, then everybody can be happy  :)

I agree. I have been touting Myriadcoin as one of the biggest innovations in the PoW cryptocurrency world. It is definitely a step forward. Unfortunately, it still doesn't change the fact that a lot of electricity and processing power is wasted in the process. Pretty much all scientists agree global warming is real and PoW only accelerates that. I see PoS or a variant of it as being the ideal solution for consensus mainly for this reason. Why increase emissions unnecessarily simply to reach decentralized consensus when it is not needed because PoS is sufficient at performing the same job? Also.. all of the processing power could actually be used to do something useful to society instead of simply securing a block chain, such as solving cancer or assisting other scientific research. Primecoin is a good example of a PoW algo that is actually useful to society.

These are my biggest concerns about PoW, not the centralization of it. All systems.. PoS and PoW.. inevitably tend towards centralization eventually. PoW tends towards centralization in mining pools and large farms setup with cheap power which utilize the economies of scale ASICs provide. PoS tends towards centralization with the need for check points to prevent certain attacks (or at least in the current variants of PoS.) DPoS works on the realization that all systems inevitably tend towards centralization, ad it gives you a way for stake holders to control that centralization. Stake holders choose who becomes a delegate, with PoW you cannot choose who secures the block chain.. whoever buys mining power can do it. This helps keep nefarious actors out. Also, you can vote in developers and people creating important core services for the coin as delegates to compensate them for doing so. Therefore, a DPoS coin can hire employees that work for the cryptocurrency... PoW can obviously only do this via donations. The use of only 101 delegates allows block times to be reduced to a little as 10 seconds and process many transactions a second.. something that is very hard to achieve (maybe impossible) with PoW. There are many benefits of DPoS over PoW in my mind which far outweigh the highly unlikely attack vectors, and that is why I support it over PoW alternatives.

Question: How much energy is used to keep all the banks in the world operational? Keeping the computers running, building the banks, people wasting gas driving to the banks to take out money, keeping the lights on 24/7 so cameras can record people trying to break in at night, etc. I bet you it's a fuckton. What if a world existed where no banks existed but money was transacted on a PoW blockchain? Does the energy concern matter as much in this context?

As the purpose of life is to live, the purpose of all the energy in the Universe is to be wasted.
Fighting for freedom with PoW might take a lot of energy, but the end result is worth every joule.

Darkwallet's coinjoin works with two parties. One party will wait around with bitcoins they wish to mix. Another party will connect with them whenever they want to do a transactions and the two parties will do a coinjoin. By analogy with exchange matching engines, I will call the first party the coinjoin maker and the second the coinjoin taker.

The idea is that there will be people acting as makers who will slowly mix their coins for the benefit of the takers who want to immediately mix.
...

Proposal: Pay the coinjoin makers. They will put up offers to do coinjoin along with a fee they ask. The coinjoin transaction would be built up in a similar way to the above example, with the coinjoin maker fee being added to the associated change address and taken away from the coinjoin taker's change address.

An implication of this is that darkwallet coinjoin mixing will become like an almost-riskless savings account. We already see that holders of bitcoin are willing to earn just 0.006% per day by lending btc on the bitfinex exchange, and that contains a substantial risk that bitfinex will go disappear or be hacked taking all the bitcoins with it.

That's not the point. Of course it's worth it. But what if you didn't need to waste it in PoW? what if you could use it to aid your fight in other way? I say that would be better.

This may be true, but that does not mean that there is no merit at all to Proof-of-Stake.  There are many people who believe that one-man-one-vote is not the best system, that instead, a system where the more educated or resourceful have a greater say is better.

Well it didn't cost the government an astronomical amount to obtain those massive amount of bitcoins from the silk road bust.
Lucky bitcoin isn't POS or it'll be screwed.

DPoS doesn't suffer from this problem. You would need to buy up 51% of the currency supply to use this attack vector.

Also the Bitshares community believes DPoS is immune to a NaS attack. No one has been able to prove us wrong yet.

More about DPoS: http://bitshares.org/delegated-proof-of-stake/
Even more about DPoS: http://wiki.bitshares.org/index.php/DPOS
Old discussions on DPoS: https://bitsharestalk.org/index.php?topic=4009.0
Discussions regarding "nothing at stake" attacks: https://bitsharestalk.org/index.php?topic=6584.0
More discussion about NaS attack: https://bitsharestalk.org/index.php?topic=6638.0

"Free Entry" does not mean "low capital requirements".

http://yadayadayadaecon.com/concept/free-entry-and-exit/

The built-in fundamental premise of PoS is that the stakers will mostly behave themselves because they have a lot of stake. Ultimately, if they misbehave the "trustworthy" will roll it back to their preferred chain.

The mechanism by which this roll back takes place in NXT is through trusted peer lists and a 720 block fork limit. (Not through formal "checkpoints" like I expected.)

So PoS does not achieve trust-free globally decentralized consensus, which is the entire point of the N@S criticism.

http://download.wpsoftware.net/bitcoin/pos.pdf

Though I think I'm preaching to the choir...