ZeroCoin is not merge-able not because it would create a much harder time staying decentralised. It's unmerge-able because the performance is so poor it would break things completely.
It's worth reading the original paper very carefully before forming any opinions on ZeroCoin. When I read it I discovered a serious error in their analysis but it was too late for the paper to be fixed. Namely that they thought that because blocks are created every 10 minutes, if it takes 10 minutes to verify a block then that's ok. Not correct! You need to be able to verify a block within seconds, not minutes. Otherwise the whole consensus algorithm just fails.
The maths behind ZeroCoin is fascinating, but unless they made dramatic improvements we're getting way ahead of ourselves talking about alt coins and implementations. This isn't some kind of finely nuanced tradeoff on which reasonable people can disagree. ZeroCoin is just not usable in its current form in any coin, alt or no.
And that's ignoring the issue of how you initialise the system in a trustworthy manner, which is still an open research problem. If you don't solve that then you're back to having a central banker which rather defeats the point of crypto-currencies.
Thanks Mike. I figured we might get away with the large mining pools merge mining it just based on how keen they seem to get people to start experimenting with it, but I didn't realize it was that bad. You can only raise the block period so much before the system becomes unusable... |
|
|
|
Anyway other than the question of whether soft forks make sense or not: what about making an all zerocoin based alt-coin (no bitcoins, nothing but zerocoins), that is either-or mined with bitcoin. Then people can trade in and out of zerocoins by buying or selling them for bitcoin with an atomic transaction, probably p2p without some trusted exchange like mtgox.
Either-or mined (as distinct from merge-mined) I mean that each mined coin set is either a set of 25 bitcoins or a set of 25 zerocoins. If its a zerocoin set its not a valid bitcoin set, and if its a bitcoin its not a valid zerocoin. I'm not sure the zerocoins or bitcoins have to do much with mining events for the other network other than check they have the expected number of bits as they wont automatically know how to validate the other network. Some miners may choose to validate both networks, but thats a choice for them.
In that way people can experiment with zerocoin, without bloating the block chain, complicating bitcoin, and without slowing validation on the bitcoin network. And the two coins should have approximately the same cost (and maybe therefore value, though the price would be subject to demand/supply and any taint discount for bitcoins; zerocoins are taint free, or perfectly blended taint at least).
Adam
I posted a zerocoin based alt-coin strategy as well if you're interested: The Zerocoin people are going to release a library in a couple days that any Bitcoin protocol-based currency can implement. The problem with Bitcoin implementing it directly is that it's very cumbersome - transactions are large and verifying them is CPU intensive. The result would be that Bitcoin would have a much harder time staying decentralized while it scales up. However, alt-coins will undoubtedly implement it, and compete with Bitcoin for market share. In anticipation of this, I'd like to describe a way that a Zerocoin alt-chain could be implemented that would reinforce Bitcoin, rather than destabilize it, as well as the incentives that the existence of Zerocoin alt-chains creates for Bitcoin miners. Symbiotic Zerocoin alt-chain:Zerocoin could be implemented on an alt-chain that's merge-mined on the Bitcoin blockchain, where new currency units are allowed to be created (perhaps at a limited rate) by anyone who has provably destroyed an equivalent number of bitcoins (using OP_RETURN), and mining the Zerocoin chain is incentivized by transaction fees and the value that a strong symbiotic Zerocoin chain would add to Bitcoin. The market would determine the amount of bitcoins that move over to the Zerocoin chain; if the value of a zerocoin rises much beyond that of a bitcoin, then people would tend to turn bitcoins into zerocoins and profit off of the difference. By functioning symbiotically, the bitcoin unit of account would be reinforced instead of destabilized - the Zerocoin chain would act like "a rising tide that lifts all boats" instead of only its own at the expense of bitcoiners'. Zerocoin mining revenues would go toward strengthening the combined mining network. Users wouldn't have to speculate on how many of their bitcoins they need to trade for zerocoins, and at what price, in order to retain their purchasing power. If Zerocoin turns out to have seriously damaging bugs or scalability issues, then conservative users that keep their long-term value parked on the Bitcoin chain won't have to worry about going down with the ship. This would also set a nice precedent that new coins can be adopted without threatening the stability of their predecessors. Incentives faced by Bitcoin miners:If the demand for a Zerocoin chain is large, then Bitcoin miners collectively have an equally large incentive to provide one in order to avoid losing market share, and they are in a position to provide by far the most secure one. They could mine an alt-chain that competes with Bitcoin, but I hope they see that the correct collective strategy ( https://en.wikipedia.org/wiki/Nash_equilibrium) is to mine a symbiotic one like I described above, and only that one. By mining a competing one, a miner might earn more immediate inflation revenues (though profitability will in any case be driven down to a minimum in the long run due to stiff mining competition), but they would do so by reducing the utility of Bitcoin as a store of value, and thus cryptocurrencies in general: if the flagship one can't preserve this functionality in the face of new innovations, then people will recognize that likely none of them will be able to. In turn they would detract from the future value of their own hardware. To get a sense of the incentive of a miner to preserve the store of value function, consider that a single person storing $100,000 in value for a year contributes to the overall valuation of the currency during that time as much as a thousand people that casually use it for transactions and only keep on average $100 stored in it at any given time. It thus strikes me as potentially important enough of an issue in some cases for miners to actively discourage the merged-mining of alt-chains that detract from Bitcoin's store of value functionality, by refusing to build on blocks that do this, and by merged-mining symbiotic alternatives. |
|
|
|
Every time the price dips on the exchanges, a new batch of boogeyman-seeking posts escape the speculation board and end up here.
Not long ago, the preferred boogeyman was "the manipulator". This week, looks like ASICs are taking the heat. Next week, it'll be the Winkelvoss twins, or the NSA, or the flying spaghetti monster.
Einstein was wrong, compound interest isn't the most powerful force in the universe. That crown belongs to the insatiable hunger of the human mind for finding false causes for chaos.
I really appreciate you being here  |
|
|
|
I've synced from scratch almost a dozen times over the past few years without any trouble. You get to be on my ignore list too. |
|
|
|
It seems to me Bitcoin core devs prefer ostrich policy. The blockchain keeps growing, pruning is not implemented yet (is it possible btw?), Gavin spoke about everything except the scalability issue on Bitcoin 2013 conference...
Is there any progress? Or is the game over?
That's nice, you've completely ignored all the recent work Peter Wuille has done with ultraprune, which sets the stage for pruning the currently 8GB blockchain that takes up a whopping 1.6% of my laptop's hard disk (at this rate it doesn't matter if it takes him another year or two to fully implement pruning). Not to mention his fast signature checking implementation. Gavin's recent payment protocol work is equally important, and maybe he isn't personally working on these things simply because Peter already is. Welcome to my ignore list you lousy ingrate. |
|
|
|
Partially verifying nodes is what I ended up being interested in utxo set commitments for, and they seem to be really useful if/when we get efficient verifiable computing. Though there definitely isn't any near-term need for this.
Re: verifiable computing and utxo set commitments, I noticed that a commitment of the utxo set digest into the block header wouldn't actually be necessary since you'd already have a succinct proof of its validity which is much stronger than simple inclusion in a block header. Though the authenticated utxo set is still necessary for being able to turn blockchain verification into verifying a chain of succinct verifiable computing proofs(?), and for knowing your copy of the utxo (sub)set is valid at any given time. |
|
|
|
That sounds a bit obnoxious, sure, but is it really that big a problem?
Yes: it allows someone to claim they have funds that they have since spent. So in the event that you are connecting to the same network that someone spending coins to you controls or is colluding with the controller of, then you can get screwed. I agree, that is a sore spot. But wouldn't it look suspicious if on some new network you weren't able to find any recognizable peers to connect to? Also look at in the broader sense: if you do have UTXO proofs an SPV node can pay for a full-node connection and SPV-related services, either with real funds or a anti-DoS proof-of-work, and be sure that the node is being honest and they are getting accurate data with nothing more than a source of block header info. (relaying of block headers between SPV nodes is something I'm also planning on implementing)
To be fair, all the data is provably accurate, you just don't know if you're being told the whole story. There are definitely some benefits to this, but there are also costs, and I'm just wondering if there are perhaps other cheaper ways to get practically the same benefits. Thankfully maaku will be providing us with a sense of the costs pretty soon. |
|
|
|
So if I understand this correctly, no changes need to be made to Bitcoin for an altcoin like this to be created. If that's the case, we don't need to wait to get the agreement or cooperation of Bitcoin devs before we proceed to implement it, correct?
Making OP_RETURN transactions standard would be helpful, otherwise you'd have to find a specific miner willing to mine them, and send your transactions to him directly. These transactions are needed for creating new coins on the alt-chain. It looks like the devs are already going to make this change for fidelity bonds in general. Making the txs from https://en.bitcoin.it/wiki/Contracts#Example_5:_Trading_across_chains standard would also be helpful for low trust cross chain transactions, but there's no rush for this. So no necessary changes, just some potentially helpful ones. |
|
|
|
I don't follow. How could an SPV node function with only SPV peers? How would it get the tx data that it needs?
Payment protocols. Anyway the whole idea of just assuming SPV nodes are going to be able to get the tx data they need from peers for free is really flawed. Running bloom filters against the blockchain data costs resources and at some point people aren't going to be willing to do that for free. I've got writing "tit-for-tat" peering on my todo list actually: IE silently fail to relay transactions to peers if they don't relay enough new and valid transactions to you for being leeches on the network. Pure SPV clients, like Android clients, can pay for the resources they consume via micropayment channels or at least proof-of-work. It'd also prevent attackers from DoSing the network by making large numbers of connections to large numbers of nodes to fill the incoming peer slots of nodes on the network; you need very little in the way of resources to pull off that attack right now. Ways to reduce the load off of full nodes, and pay for their efforts seems like good ideas. But do you expect some SPV nodes to not be able to connect to any full nodes at all at some point in the future? If there's a market for the service, then surely they will always be able to find some willing to provide it, especially if their security depends on it. Among other things there is the problem that without the way to prove that a txout doesn't exist the network operator can prevent a SPV node from ever knowing that they have been paid and there is nothing the SPV node can do about it.
That sounds a bit obnoxious, sure, but is it really that big a problem? |
|
|
|
Actually, none of the fraud proofs/challenges I mentioned in that thread relied on utxo set commitments. Transactions with nonexistent txins would benefit from them, since then there could be concise proofs of nonexistent txins, but the way I described it, a peer would issue a challenge to find a valid Merkle branch to an allegedly nonexistent txin from some other peer. If at least one peer is honest and the network operator (which Bitcoin generally assumes anyway), then they will find the branch if the challenger turned out to be lying, and can ignore that him going forward.
Fixed that for you. Without nonexistance proofs, network operator attacks are trivial. Okay, so the network operator could mislead a node onto his invalid chain by handing it fake fraud challenges. Can't he do this regardless, by simply refusing to relay valid block headers? |
|
|
|
Yeah, you can go very far without UTXO set commitments, but without them your scenario only works if you assume your peers are full-nodes. If you are an SPV node with SPV peers - a completely valid scenario that we will need in the future and one that is useful with payment protocols - you're stuck and can't do anything with the fraud proofs.
I don't follow. How could an SPV node function with only SPV peers? How would it get the tx data that it needs? The other issue is that only UTXO set commitments can prove inflation fraud without a copy of the blockchain, IE miners deciding to changing the subsidy and fee rules and create coins out of thin air.
I addressed this as well in that thread: https://bitcointalk.org/index.php?topic=131493.msg1407971#msg1407971. The Merkle tree of transactions is used to authenticate the maximum fee reward calculation in each block. It didn't seem to require utxo set commitments. |
|
|
|
For fraud proofs, I think d'aniel raised that before, I'm afraid I don't remember which proofs require the commitments. Double spends don't. At any rate, whilst those proofs would indeed be useful they weren't the rationale given for "ultimate blockchain compression" originally. A full design doc for different kinds of fraud proofs would be useful.
Actually, none of the fraud proofs/challenges I mentioned in that thread relied on utxo set commitments. Transactions with nonexistent txins would benefit from them, since then there could be concise proofs of nonexistent txins, but the way I described it, a peer would issue a challenge to find a valid Merkle branch to an allegedly nonexistent txin from some other peer. If at least one peer is honest (which Bitcoin generally assumes anyway), then they will find the branch if the challenger turned out to be lying, and can ignore that him going forward. Partially verifying nodes is what I ended up being interested in utxo set commitments for, and they seem to be really useful if/when we get efficient verifiable computing. Though there definitely isn't any near-term need for this. |
|
|
|
Namecoin sounds like the best candidate in terms of similarity of code to bitcoin and is most widely merged mine already, in fact, vinced creator of namecoin was merged mine inventor so would have some symmetry.
Just a bit of rebasing to bring code base up to bitcoin current state but that would be the quid pro quo for using the blockchain ... worth thinking about and there might be some unexpected synergies emerging from having strongly anonymous namespace ownership possibilities also.
Having new coins be created only when bitcoins are destroyed is also necessary - this is what preserves the store of value functionality of Bitcoin. If miners could inflate the Zerocoin chain, then this would indirectly hurt this functionality. So there's no need to incorporate it into an existing chain, as the initial distribution problem is already solved by creating new coins in this fashion. |
|
|
|
Boy, I sure am glad we have Bitcoin Foundation to help fight the legal battles  |
|
|
|
I'm skeptical that the Bitcoin development team will incorporate Zerocoin. Adding something like this is going to be controversial, however I see no reason why an alternative coin will not adopt Zerocoin. Perhaps when that "Zerocoin alt" becomes more valuable than Bitcoin then the developers might add it. Someone very smart said that if an alt coin defeats bitcoin for market share without offering any real gains then this will doom all crypto currencies forever, why invest if another will just beat that one too for no reason? I think Hal said that and it rings true, if an alt that has no advantage beats out Bitcoin, then this destroys all the credibility in the crypto coin ecosystem. However, adding Zerocoin is a major change, a major addition. If Zerocoin works it would present a massive advance for these currencies and if Bitcoin did not adopt it and another did that other coin would be well within its sights to overtake Bitcoin. Full anonymity is not a setting change or other meaningless change in the Bitcoin source. If Zerocoin works it will be the largest advance in crypto currencies since the creation of Bitcoin itself. I would advise the development team to keep a very close eye on this one. Hal definitely said it first, and it should be carefully considered at this point due to the potential for disruption from a Zerocoin alt. What's (rightfully) holding back Bitcoin devs from incorporating Zerocoin is the increased centralization of the network due to the significantly greater expense of running a node. But users of an alt-coin won't necessarily care about that, and will adopt it anyway for its privacy. That's why I proposed this way to "have our cake and eat it too". Incidentally, the same factor is at play with the issue of scaling up transaction rates, but that's a separate topic. I'm skeptical that the Bitcoin development team will incorporate Zerocoin. Adding something like this is going to be controversial, however I see no reason why an alternative coin will not adopt Zerocoin.
Does merge mining require anything from the Bitcoin dev team, or can it be accomplished without their consent and participation? No, miners have full control over what they merged-mine. That's why I went into so much detail about what the correct Zerocoin strategy is from their perspective. |
|
|
|
|
As a side note: this idea could also be used for a symbiotic alt-chain with large blocks next to Bitcoin's relatively small ones in the event that scalability issues limit Bitcoin's block size. Because as I mentioned above, the total valuation of a currency is mostly due to the contribution from long-term stored value, Bitcoin could scale up its transaction rate using a symbiotic alt-chain, while keeping the majority of its total valuation from being exposed to scaling risks, e.g. from increased centralization. Unfortunately though, the transactional alt-coin would be potentially more volatile than Bitcoin, since the guaranteed conversion rate only goes one way.
Edit: Actually, the symbiotic Zerocoin alt-chain I proposed could double as a high transaction rate alt-chain as well, since it's already given up the principle of maximal decentralization, and cheaper to transact regular coins are also part of the Zerocoin protocol.
|
|
|
|
The Zerocoin people are going to release a library in a couple days that any Bitcoin protocol-based currency can implement. The problem with Bitcoin implementing it directly is that it's very cumbersome - transactions are large and verifying them is CPU intensive. The result would be that Bitcoin would have a much harder time staying decentralized while it scales up. However, alt-coins will undoubtedly implement it, and compete with Bitcoin for market share. In anticipation of this, I'd like to describe a way that a Zerocoin alt-chain could be implemented that would reinforce Bitcoin, rather than destabilize it, as well as the incentives that the existence of Zerocoin alt-chains creates for Bitcoin miners. Symbiotic Zerocoin alt-chain:Zerocoin could be implemented on an alt-chain that's merge-mined on the Bitcoin blockchain, where new currency units are allowed to be created (perhaps at a limited rate) by anyone who has provably destroyed an equivalent number of bitcoins (using OP_RETURN), and mining the Zerocoin chain is incentivized by transaction fees and the value that a strong symbiotic Zerocoin chain would add to Bitcoin. The market would determine the amount of bitcoins that move over to the Zerocoin chain; if the value of a zerocoin rises much beyond that of a bitcoin, then people would tend to turn bitcoins into zerocoins and profit off of the difference. By functioning symbiotically, the bitcoin unit of account would be reinforced instead of destabilized - the Zerocoin chain would act like "a rising tide that lifts all boats" instead of only its own at the expense of bitcoiners'. Zerocoin mining revenues would go toward strengthening the combined mining network. Users wouldn't have to speculate on how many of their bitcoins they need to trade for zerocoins, and at what price, in order to retain their purchasing power. If Zerocoin turns out to have seriously damaging bugs or scalability issues, then conservative users that keep their long-term value parked on the Bitcoin chain won't have to worry about going down with the ship. This would also set a nice precedent that new coins can be adopted without threatening the stability of their predecessors. Incentives faced by Bitcoin miners:If the demand for a Zerocoin chain is large, then Bitcoin miners collectively have an equally large incentive to provide one in order to avoid losing market share, and they are in a position to provide by far the most secure one. They could mine an alt-chain that competes with Bitcoin, but I hope they see that the correct collective strategy ( https://en.wikipedia.org/wiki/Nash_equilibrium) is to mine a symbiotic one like I described above, and only that one. By mining a competing one, a miner might earn more immediate inflation revenues (though profitability will in any case be driven down to a minimum in the long run due to stiff mining competition), but they would do so by reducing the utility of Bitcoin as a store of value, and thus cryptocurrencies in general: if the flagship one can't preserve this functionality in the face of new innovations, then people will recognize that likely none of them will be able to. In turn they would detract from the future value of their own hardware. To get a sense of the incentive of a miner to preserve the store of value function, consider that a single person storing $100,000 in value for a year contributes to the overall valuation of the currency during that time as much as a thousand people that casually use it for transactions and only keep on average $100 stored in it at any given time. It thus strikes me as potentially important enough of an issue in some cases for miners to actively discourage the merged-mining of alt-chains that detract from Bitcoin's store of value functionality, by refusing to build on blocks that do this, and by merged-mining symbiotic alternatives. |
|
|
|
I couldn't disagree more.
The reason bitcoin is valued in double digits currently is due to speculation that there will be greater demand for holding coins in the future and thus the current exchange rate is justified or undervalued even.
But what causes this demand to hold coins?
Simply as a store of value? Certainly, those who bought in early April and still hold those coins don't think bitcoin is such a great store of value. There are a number of stores of value with less risk than Bitcoin at these exchange rates.
When Bitcoin is used as a medium of exchange that creates demand for coins. You can't send a Bitcoin payment without first acquiring those coins. If a business receives coins as revenue and then will be using bitcoins in the future for purchasing goods and services, or paying out dividends, then the merchant is likely to hold a balance of coins for the short duration between when the revenue transaction occurred and when the spending will occur. Holding the coins for that short amount of time, though, decreases the quantity available for sale at the exchanges and, in aggregate, bitcoin gaining traction as a currency causes the exchange rate to rise.
It doesn't matter where the demand for bitcoins comes from ... whether it be as a means of exchange, remittance payments, speculation (hoarding), forex trading, etc., .... any coin that doesn't end up being sold means less resistance to a rising exchange rate.
The reason traction in retail and e-commerce is seen as so important by many is because of what it will do to the exchange rate if it happens. If it happens, a BTC/USD of $10,000 is not crazy talk. Without it, a BTC/USD of $2 might be the more fair valuation.
Consider someone that stores $100,000 of value in bitcoins for a year, and during that year, someone who only uses them for daily transactions, and so only holds on average of $100 worth at any given time. You'd need a thousand of the latter guys to affect the total valuation as much as a single one of the former. That's why I don't think it's a requirement that the masses use Bitcoin in everyday transactions in order for it to be valuable, though it would of course help. Keep in mind that people currently store much greater amounts of value than all the bitcoins are worth in assets that are much worse, technically, than Bitcoin. Re: volatility, I'm willing to chalk it up to Bitcoin being new and in a state of flux. |
|
|
|
You know, for a group of people using a currency supposedly built on a rejection of the "bubble-economics" of central banks, you guys sure sound like a bunch of dot-com investors claiming that the "old rules" no longer apply.
Here's a simple insight that I enjoyed: Money and a bubble are the same thing. Both are anomalously overvalued assets. Both obtain their anomalous value from the fact that many people have bought the asset, without any intention to use it, but only to exchange it for some other asset at a later date. The two can be distinguished only in hindsight. If it popped, it was a bubble. If not, money - so far. Source: http://unqualified-reservations.blogspot.ca/2013/04/bitcoin-is-money-bitcoin-is-bubble.html |
|
|
|
|
Show Posts
