The point of the cryptography is not to make the audit easier for the auditor, it is to make a 3rd party auditor unnecessary. To make it that such that anybody can verify their balances and the availability of funds to cover them, continuously and without need of a 3rd party auditor. You should know that, Stefan.

The technology to do this has been described, even constructions which don't involve public revelation of total holdings (just the boolean yes/no answer to the solvency test). We as a community should be demanding this level of audit-ability from the services that we use, and refusing to use services which do not provide this level of accountability (as well as working towards decentralized, trustless solutions so we no longer need these solutions in the first place).

Please be aware that this is absolutely no different than a centralized audit. There are no cryptographic assurances at work here...

Yes you should stop telling people it's free. It's not free and never has been and never will be.

uminatsu, push it to Eligius.

mustyoshi, you shouldn't get banned for relaying non-standard transactions. If you are, that's a bug.

That is never guaranteed.

This is similar to the concept of federated servers in Open-Transactions, right? It also bears some resemblance to the private accounting servers Jorge Timon and myself are working on within Freimarkets.

As a slight reformulation of this basic idea, you can also build a skip list data structure by committing to back links in the current block, and then selecting links whose distance back is less than the apparent work of the block once you've solved it. This allows you to construct compact SPV proofs with an accurate summary of the cumulative work that went into the actual blocks, but in a non-interactive way and without having to reveal more than log N block headers (where N is the length of the chain being proven). This was recently written up in a little more detail on the mailing list:

http://sourceforge.net/p/bitcoin/mailman/message/32111357/

When DeathAndTaxes says there's no such thing as a bitcoin balance, he's not making a philosophical point. He's saying that full nodes do not have balances, or the information necessary to efficiently calculate them in their working memory. Adding capabilities based on balances would require either adding this information to the working set (thereby increasing resource usage for all full nodes), or switching to using balances only which has drastic implications for bitcoin in terms of its low-level functionality. It would be a hard-fork that breaks all infrastructure out there for dubious benefit.

Those anonymizing techniques are interesting specifically because the records of transfer are not kept on-chain.

You can't have a system interact with fiat without some degree of trust. That's just the nature of the game. You can, however, reduce the necessary trust down to something very basic, e.g. a sworn statement from a prestigious bank that has much more to lose from lying. If that doesn't satsify you, it should more than do to satisfy Lloyd's of London or some other insurance company which will happily insure those deposits against a bank theft.

Ask the bank.

You don't need host security if there is nothing to be kept secure - no client funds on the server, no personal data. With a fully trustless exchange you don't trust the server with *anything*, so why care at all of it is secure?

Because I don't assign BIP numbers. There's a process to getting a BIP number assigned, which I am still working towards.

I thought this was obvious, but perhaps not:


Downloading the rest of the block chain requires someone storing the entire block chain, no? You can't download something which everyone has deleted.

But besides that you have an even bigger problem: it costs me, or any network attacker approximately nothing to make sure that every single node you connect to is a compromised node I control. This is the problem which bitcoin seeks to solve! And the answer which Satoshi came up with, and the only answer which we have at this time is to validate the entire chain from start to finish and trust the longest valid fork.


This is an invalid assumption. Your ISP could simply block packets from honest nodes, for example.

We would rather not distribute at all and let the coins disappear through demurrage, than do so in a rushed, unfair, centralized method. If we destroyed the private keys to the foundation funds, the coins would still enter circulation at around the same rate as bitcoin.

If you peer with the merchant and miner directly, but the merchant and miner themselves are not peered, then it is relatively easy to perform a double-spend: as soon as the merchant's transaction hits the network, you send the double-spend to the miner. The merchant will not find out until it is confirmed because he already sent the first transaction to his peers, and so his peers will not relay the double-spend.

And @grau is spot on. It's the miner's freedom to mine whatever transactions they feel like, and they have no moral responsibility to include one over the other (especially because without additional information they can't tell which one is "correct"). If you are making any assumptions about how double-spends are relayed, or which transactions miners will include in blocks, you are in the wrong.

Correct, but now that there are free and fair p2p issued currency anyone issuing a new one would be trying to collect a rent - forcing everyone to switch over to a currency which benefits you when free and fair alternatives exist.

It was double-spends / rerolls against BetCoin.

"ghash.io betcoin" in google should get you some results.

Ghash.io has been caught with their hand in the cookie jar. Other cloud mining operations that are coming online soon have the capability to do this with limited risk to themselves. A further 15% of the network is not identifiable and therefore would be able to do this with plausible deniability.

"Knowingly fraudulent" is not a phrase I would use. There is no way for 3rd parties to know with certainty which transaction came first, and therefore which one is the fraud. It's the nature of the bitcoin consensus system.

There's a substantial difference between some fallible humans giving a "trust us, it's secure!" stamp of approval (what the OP is asking for), and a cryptographic receipt that can be automatically checked by your client to provide up-to-the-minute assurances of solvency (what I'm talking about in the reddit thread).