NXT has zero inflation. Miners make money from transaction fees alone.

PoS is inherently less inflationary than PoW. This is because mining in PoS does not require expensive hashpower, so miners don't need to be paid as much as in PoW. Bitcoin, for example, will be inflationary until 2140, because of the coins created to pay the miners.

Also, as the block reward diminishes, miners will still need to be paid, so the transaction fees will have to rise, so in the long run PoS can have lower transaction fees than PoW. This trend is obscured in Bitcoin by its increasing market capitalisation. Last time the block reward halved, the miners got fewer coins but they were worth more. We hope market cap will continue to rise for a while, but it won't continue rising forever.

Isn't that problem avoided with leasing? Leasing in NXT is a way to delegate your stake to a pool, which then mines on your behalf and sends you your share of the revenue. You can still spend your coins after you have leased them; the pool benefits according to your current balance so when you spend, the pool's effective stake reduces. Leasing lets you participate in mining without needing to maintain an always-on computer and the necessary bandwidth.

Leasing is similar to how in PoW you can pool your hashing power, with similar benefits and drawbacks. In both systems the pools get to wield a lot of power, which is potentially dangerous, but in both if they abuse that power then people can withdraw from the pool and switch to a different one.

Now that leasing is live, it is a lot easier to stake one's coins and a lot more coins will be staked. I think their system isn't yet perfect - you have to pay a transaction fee to lease which makes it uneconomical for the very poor - but we should end up with most coins getting staked.

Yes. That's information about the community.

Well, yes. You could go around and ask them, or you could guess that those who knew the boss longest would give more. That's not much Bitcoin can do about additional information.

Sure, there are ways to use multiple addresses. You could just choose to not remember who got which address. If all this is happening through email, then it becomes harder for the co-workers to directly verify.

In general, when someone gives you a custom address online, you have to figure they can tie it to you (or whatever conversation you are involved in). Usually that's a good thing. When ordering a pizza, you want the payment to be tied to the delivery address.

Yes, when I first read their stuff I found it terrifying. Each address is like a little computer, with local state, exchanging messages with other addresses, all within the block-chain. Nice academically, but seeming like a horrendously inefficient way to do computation. It made me think of trying to compute with 1-dimensional finite state automata, or Conway's Game of Life. I get the appeal but I don't think it's practical.

Well, suppose you are collecting donations from co-workers for your boss's birthday present. If you give them all the same address, you see the incoming transactions and the total balance, but you won't know who paid what, so they have some anonymity. If you give a different address to each co-worker, and remember who got which address, then you can tie the amount of each donation to the person who sent it. Then you can inform your boss about who didn't pay for her present. Clearly, your co-workers' anonymity has been compromised in a way that affects (some of) them adversely.

The above makes sense to me, but I can't relate it to Peter Dushenski's article, so he may have been saying something different. Quite a lot of that article makes no sense to me.

That's your choice. In the above scenario, their loss of privacy is to your benefit. If you were running something like Wikileaks, you might get more donations if you did respect your benefactor's privacy.

There's not a lot they can do in the above scenario.

That's a relatively centralised approach, though, in that the NXT core developers have to agree what the TYPE field means, and approve the code that goes in to support it. I imagine a goal of Ethereum is to allow permissionless innovation. They don't want arbitrary limits on scripts and they don't want application developers to have to get permission from anyone before they deploy. It's similar to the Bitcoin vision where you don't have to get permission from a credit card company before accepting payments.

But we do call decibels decibels. Many people don't realise the "deci" prefix means that a decibel is 1/10th of a bel (and a bel is named for Alexander Graham Bell), but that doesn't matter.

It's only tomorrow if his wallet is flawed. Since these issues are well-known by wallet authors, his wallet is probably fine. In which case, he has 128-bit security and that is pretty good. He can mitigate the risk by transferring funds out frequently, and by monitoring the news for developments in quantum computing. He probably figures his expected loss from reusing addresses is more than compensated by the donations he gets from having a fixed, published address.

No. She has a lot of influence, but not a lot of power.

Do you have a decent graphics card? If so, did you use the version of vanitygen that exploits it? Doing so can make a big difference. On my machine, generating 1Brangdon gets to 50% after 511 days with vanitygen, 310 days with vanitygen64, and 15 days with oclvanitygen. So 20 times faster with the graphics card.

Amazon already have their own AmazonCoin. Since they control it, it's effectively a gift token. It's not set the world on fire, nor is it likely to.

Credit cards are fundamentally unsafe, because the information you give to a merchant to pay them a specific amount is the same information a thief needs to steal a fortune. You may feel insulated from this, but ultimately it is the customer who pays for the lack of safety.

The obvious alternative would be for a protocol to simply require that each block have a timestamp 10 minutes after the previous block to be valid. One problem is that a miner might lie, and add a timestamp that is in the future. Nodes could reject blocks from too far in the future, but since they all have their own clocks this could get a bit hit and miss at the edges. If miners are competing to create blocks, then you'd get a rush of blocks broadcast as the deadline passes. It does feel a bit anti-consensus.

With transparent forging, as I understand it, miners aren't competing to create blocks. Instead, one miner (or a small group, for redundancy) gets nominated in advance as having the honour. I have reservations about transparent forging - it seems to be an invitation for denial of service attacks - but maybe it resolves this issue. Certainly Proof of Stake coins don't seem concerned about their block time being variable. (Although most prefer a shorter block time than Bitcoin.)

I don't see much logic behind his statements. He mentions not trusting Bitcoin because it is too young to have seen a full boom/bust business cycle. If that's how he feels, he'll have to wait another 10 or 20 years before jumping on any related technology.

If the price of Bitcoin plummets, then the real-world value of the block reward and transaction fees paid to miners also plummets, and some of them will find it is no longer economical to mine. As they drop out, profits to the remainder rise, so there will always be someone mining, but the network will be less secure. Mounting a 51% attack will become cheap. Because of this, the block-chain won't be usable to secure anything of value. So it becomes useless for coloured coins and the like.

Coloured coins won't create demand for bitcoins, because they generally only need a few satoshi to do their job. Hence they won't cause the price to skyrocket.

So he may mean (A), but that isn't really what he actually says. A lot of people see the flaws in Bitcoin, and conclude that it will fail and that some other altcoin will win, but I think they are mostly basing that on gut feel. It's a hard proposition to disprove, and it makes a good sound-bite, but that doesn't make it right.

At the moment it seems to me that the first mover advantage of Bitcoin, and the resulting network effects, make it almost impossible for another altcoin to beat. The only potential killer flaw in Bitcoin is the escalating costs of the proof of work mechanism, and therefore the only technology that has a chance of beating it is proof-of-stake, and I'm not yet convinced that PoS even works. Other features, like the choice of hashing algorithm, or the block time, or the transaction scripts not being Turing-complete - none of these seem like fatal flaws. Some economists argue that deflation is bad, and they may be right, but a kind of reverse Gresham's Law applies and Bitcoin will succeed even if the economy would be better off without it. So we're left with his vague unease about Bitcoin being 5 years old and not 25.

How about standing orders and direct debits? I could make those transfers myself, but then again I might forget. I could have some software on my home computer that makes them automatically according to a schedule, but what if there's a power cut or my internet goes down and I miss a mortgage payment?

No. Having 51% of the hashpower should not be illegal. Attempting to use that power to defraud someone should be, and probably already is. At least from a common sense point of view, issuing a transaction that pays Bob, and then issuing another transaction that sends the same coins to yourself instead of Bob, is a pretty unambiguous attempt to defraud. It's legality does not need to depend on you having 51%.

(Some people argue that double-spending can be a normal part of a payment protocol, eg for micro-payments. However, although those protocol may involve creating conflicting transactions, so far as I know only one of those transactions actually needs to get broadcast to the network. Still, it might be best to avoid naive legislation.)

If you like. It is in Bitcoin.

If that's true, it's surely true because the network is so small and lacking in features. To get the same ease of use as a credit card, Bitcoin will have to expend much more energy than it does now.

I completely disagree. PoW is primarily a way of securing the block chain. It is a way of creating coins only incidentally. In 2140 Bitcoin will not be creating any coins at all, yet it will still be a PoW currency, with even more work being done than today. Clearly, the work being done does not relate to the coins created.

PoS uses a different way to secure the block-chain. Like PoW, any coins created by PoS are incidental. Indeed, it is easier to have no money created at all because income from transactions fees will be enough to pay for the miners because their costs are so much lower. So money is not harder or softer in PoW or PoS.

The same is true for PoW. It's trival to create a PoW system with that creates coins according to whatever schedule you want. Popular opinion will determine whether it succeeds. We could make a fork tomorrow that gave every current owner a million new Bitcoins, and if it was popular it would replace Bitcoin. (It wouldn't be popular, obviously.)

Again, this is true for PoW. Many of us are concerned that someone could secretly acquire enough hashpower to launch a 51% attack. It's harder to identify with PoW because the hashpower doesn't have any representation on the block-chain. You have to know what is physically going on in a chip foundry in China to detect it. At least with PoS the cabal has to acquire actual coins, and this will show up in the block-chain.

I gather the plan is to spend several years developing the technology, proving it and building consensus. I presume one of the goals is to keep the protocol as compatible with Bitcoin as possible, so authors of wallet software etc will find it relatively easy to support.

I don't know how practical this is. The root post mentions "a sandboxed testnet that periodically forks the Bitcoin blockchain". To me that sounds like I won't be able to buy anything with the testnet coins, and any trading I do will be wiped out when the next fork happens, because the testnet block-chain will be over-written with the latest Bitcoin block-chain. So, nothing will be at stake in the testnet. Those conditions are so unrealistic that I'm not sure any system can be said to have proven itself under them.

After that, although it might be theoretically possible to gradually evolve Bitcoin into Bitcoin-PoS, with both PoW and PoS blocks being accepted as valid by nodes for a while until all nodes upgrade, that isn't what the root post in this thread proposes. Instead it proposes a "big bang", go live with one last snapshot of the Bitcoin block-chain. After which, it will be a fully-fledged altcoin which will coexist alongside the original Bitcoin.

The goal is to preserve Satoshi's social contract. Presumably this includes the rate at which new coins are created.

The miners are not the only stakeholders. What really matters is whether the users want to own the new coins or the old. I think the goal is to make it very easy for them to switch. So the authors of wallet software are important stakeholders, because they can ease the transition for users. It's also important that the new coin is a fork of the old, because basing it on a snapshot of Bitcoin's block-chain means the value of users' holdings in Bitcoin is preserved in the new coin. If the users then prefer to buy the new coins, the value of old Bitcoin will crash and the miners will be in trouble anyway, because the block reward will have less real-world buying power.

A core belief here is that PoS is simply better, and will carry the day on merit. It does seem to me that transaction fees ought to be lower with PoS. That hardly matters today because the block reward is so high. It will matter more in a few years with the block reward halves. Anyone with any foresight can see that after a few halvings, and after a few more years of the PoW hashpower arms race continuing, that Bitcoin transaction fees will have to grow a lot to cover the cost of the miners' hardware. If PoS can offer a similar system with greater efficiency, and that translates into lower transaction fees for users, then it has a real chance of winning users and other stakeholders. Basically, all stakeholders except the miners. And the great thing about PoS is that it doesn't need the miners because it's not computationally expensive. And we don't have to wait for the block reward to happen to make these judgements. The stakeholders - the venture capitalists, the people who make hardware wallets, point-of-sale terminals, Bitcoin ATMs - will place their bets based on which network they consider to have the most long-term future value. And that won't be PoW because PoW is painting itself into a corner.

(All assuming PoS can be made to work. Of which I have yet to be convinced. And as I mentioned above, I also have reservations about whether a currency can really be considered to have proven itself on a testnet.)