This is why I don't see total hashrate as a Tragedy of the Commons:
In a Tragedy of the Commons, each additional sheep grazing the field has a negative effect on the supply of the public good. The long term result is total depletion of grass, ie. supply drops to zero.
In the Bitcoin network, each additional transaction has a positive or at least neutral effect on the supply of the public good (hashrate). In the long term, hashrate might decline but it's unlikely that it will ever drop to zero.
In my opinion, a better analogy than a public grazing field is lighthouse construction. This is the key difference: Even if a fraction of altruistic shepherds refrain from sending their sheep to the field so that the grass can recuperate, it will still be depleted because the remaining selfish shepherds will take as much as they can. In the lighthouse case, a fraction of altruistic lighthouse builders will ensure a non-zero supply of lighthouses, even if everyone else leeches.
There is an aspect of this which is textbook tragedy of the commons, but it's kind of abstract. The scarce public good being consumed is the bargaining power of miners. As long as miners have that power, they can demand enough fees to fund the mining required to secure the network. If a miner accepts low-fee transactions, he consumes this bargaining power (since then senders will have no reason to include fees) for his own benefit, making everyone worse off (miners who are now unable to collect fees, and Bitcoin users who will now not have a secure network). |
|
|
|
a) lack of incentives for stakeholders to contribute signatures in Meni's system (perhaps only a small minority will contribute and therefore small, but active stakeholders could be too powerful.)
There can be signature fees. Since signing is cheap, there needn't be very big incentives. b) whether disruptive attacks are possible between stakeholding checkpoints (txn fees will still be quite low, so double spends may be easy to pull off and simple attacks like messing with difficulty are possible)
Double-spending will be relatively easy between checkpoints, but still too hard for everyday transactions. Large transactions will wait a day or so for a checkpoint. c) how signatures are collected from stakeholders (which stakeholders sign the checkpoint, can anyone sign?)
Basically anyone can sign, their weight depends not only on the number of coins in the address but on its recent history. Signatures are broadcast and probably included in a block like transactions. d) if there is a fork, how do stakeholders coordinate on which branch to sign
They don't. You could do sanity checks like waiting to see that the block looks undisputed (eg, 6 confirmations with no alternative branch), to make conflicts an exception rather than the rule. But in the end everyone just picks one. The safety is then a function of the difference in signatures between the two blocks - if a receiver considers the current block not safe enough, he will wait for the next signature block. This could be an opening for DoS, but I think that's also solvable. I also feel that my proposal has a side benefit, however. Most mining investment would be reallocated to purchasing currency under my system. I feel like the current arrangement where bitcoin users spend a lot on GPUs, ASICs, FPGAs, and electricity instead of buying bitcoin is profoundly wasteful. The market capitalization of the currency would be higher under my system. Higher market cap should be associated with reduced price volatility. This seems like significant enough of an issue to merit consideration.
I think any PoS design would greatly limit the focus on mining hardware. Right now, I am looking for a proof-of-concept implementation and therefore I am trying to make things as simple as possible to prevent confusion/intimidation among would-be implementers.
I think it will be counterproductive to have a proof of concept which is not thoroughly thought out. This is difficult to get right and if it's not carefully designed it will not work, and then you'll have to face all the people saying "see, PoS doesn't work!". |
|
|
|
[
In Cunicula's system, voting power is determined by combining (multiplicatively) your hashrate and stake. To be effective you need both to be high (which IMO is very problematic because small players cannot contribute effectively. It's not linear.)
I will re-examine this when I have time. What you want is constant returns to scale (aka homotheticity of degree one). If there is a function f determining how s (stake) and w (work) affect the mining rate, we both are looking for the following property: f(as,aw)=a(f(s,w) That is, if we double our coin holdings and our hashing power, then our generation rate also doubles. If this condition holds, then efficient mining can take place at any scale. Right. I am using the well-known Cobb-Douglas function which would certainly have this property if s and w were deterministic. q = (s^0.  (w^0.2) However, I need to think more carefully about it because w is a poisson random variable, so I need to make sure that the constant returns property is preserved in expectation. I'll probably just simulate it, but I have too much to do over the next few days. Please postpone this question. I think you're not clearly thinking about the dynamics of this. A target which goes by difficulty^0.2 is not the same as scaling effectiveness with work^0.2. If you have twice the hashrate (with fixed stake), you generate twice as many hashes, and since each hash independently has a given probability to be a valid block, you have twice as much chance to have the next block yours - thus, you have as much weight as 2 players each with the same stake as you and the undoubled hashrate. If you have 2s and 2w, you are much more effective than 2 players with s,w each. Doing what you want would require a more fundamental change than just a formula for the target. |
|
|
|
But for sure I would not trust the wealthiest people on this planet (in $$$) to care much for my interests, so why should I trust the persons who hold the most BTC more than that?
Oh, no need to trust them to care for your interests. You should trust them to care for their own interests, that usually works. And it is to your advantage to have your interests aligned with theirs - for example, if you both care about the health of Bitcoin at large. And as you already hinted in your statement (at least it can be deducted from it), "being able to invest in huge mining operations" and having the "most stake in the current financial system" can easily produce players that have large stakes in Bitcoin too.
So these two don't exclude each other, just one takes more time than the other.
Yes, one of my points is that obtaining a majority of bitcoins should be significantly harder than a majority of mining. It's not supposed to be bullet-proof, just significantly better than the current solution, and it should at all times maintain the invariant that the cost to launch an attack will be higher than the incentive to do so. Why would I trust a large miner to act in the best interest of BTC as a currency? Large miners are in it for the profit, their support of the currency ends where their profit ends (the whole discussion here https://bitcointalk.org/index.php?topic=67913.0 is centered at that thought. If they're using Bitcoin-dedicated hardware, they're interested in the health of Bitcoin to maintain the value of their investment. Why would I trust a large speculator holding a lot of BTC to act in the best interest of BTC?
They will sell as soon as they think there's nothing more to gain.
As long as they're holding bitcoins, they'll want them to have a high exchange rate (a product of ecosystem health), at least short-term. If and when they cash out, they no longer have a say in voting. Sure, that's why weight should be linear. Addendum: The concept that someone has a stake in BTC because they hold a lot of it, becomes even less important when BTC will approach it's goal of being a competitive currency to currently established currencies. Because then according to free market principles anyone who is out for profit would just choose the currency that provides the most profit. Having a lot of bitcoins, even if correlated now, is not an effective gauge for loyalty of an individual to that currency .
By that time it will be that much harder to obtain a majority of bitcoins. Also, once again, as long as they're holding bitcoins, they'll want them not to drop in value. Long-term loyalty isn't really required. |
|
|
|
What was with the 0.000000 dividend payment yesterday?
marked
It was a test to see if I can work around GLBSE's limitations in handling payments by using multiple accounts (which seemed a better idea than trying it out on a real payment, and risking yet another excessive coupon). It succeeded. It was actually 1 satoshi per bond, but GLBSE's Javascript rounds the displayed amount. |
|
|
|
In theory this sounds intriguing, but to me the "Proof of Stake" concept is just another way to introduce the ShitCoin (aka SolidCoin) concept into Bitcoin and attempt to establish a BTC version of the Money Power (like a BTC Rothschild or so). It seems one only has to find the right dialectic to talk people into something that doesn't fully agree with the original mission. Even if you don't immediately go as far as SC and trust the nodes with more coins more than anyone else, that is another logical consequence of the concept, and in the end: Hurray, we took monetary control away from feds and establishment and give it to someone we can trust.
People who own a large amount of BTC will most likely agree with the concept, others that like the dialectic will be sold into it without owning a large stake, and we are back to yet another Money Power controlled currency.
That's like the end of the "Animal Farm" by George Orwell.
1. Under a PoS system like my own, stakeholders will not have ultimate power to control the universe (at least, not any more than in Bitcoin currently). Stakeholders cannot conjure new coins or confiscate coins. Their abilities are very limited and very technical - they can mark a block to signify that transactions in it can be safely assumed not to be double-spent. Attacks that are now possible with a majority of hashrate (such as rejecting transactions), will only be possible with a majority of hashrate and bitcoins (maybe not even that, depending on the system). 2. Who would you rather have some limited ability to mess things up - those who have the most stake in the Bitcoin system, and thus have the most to lose from doing so, or those who have the most stake in the current financial system and can afford to invest in huge mining operations? 3. Stakeholder's weight is linear in their stake. A small player is not cut out. 4. As far as I can tell, the idea of introducing PoS to Bitcoin predated the creation of Solidcoin and its trusted nodes. 5. Just because SolidCoin did something doesn't mean anything that is remotely reminiscent of it must be banned forever. |
|
|
|
Also, can someone please add a tl;dr on what are the key differences between the PoS systems proposed by Meni & Cunicula? I haven't followed this entire discussion. I did place a small placeholder in the wiki for this.
In Cunicula's system, voting power is determined by combining (multiplicatively) your hashrate and stake. To be effective you need both to be high (which IMO is very problematic because small players cannot contribute effectively. It's not linear.) In my system, there's a skeleton based purely on hashrate, and superposed on it are occasional checkpoints set by stakeholders. You can contribute PoW without having stake, and you can contribute PoS without having work, and in both cases your voting power and reward is linearly proportional to the resources you have. |
|
|
|
Meni, you might want to consider describing your own system in this wiki as well.
Sure, as soon as I have the time. |
|
|
|
Proof of Stake?
Is this SolidCoin ?
No, the ideas under discussion here have nothing to do with stupid nonsense done by SolidCoin. |
|
|
|
The meetup will take place tomorrow. |
|
|
|
I have issued 300 new bonds, for a total of 500. They are offered at 0.32 BTC. I can now also disclose that my obligations are backed by an agreement with Inaba to run mining hardware for me in his datacenter. So far I have ordered 13 BFL single units, which are sufficient to cover about 10,000 bonds. (Since this partnership was originally conceived as part of my own desire to invest in mining, this should in no way be taken as an indication of the number of bonds I intend to issue.) ROI projections: Issue price - 0.32 BTC Difficulty - 1496979 Block reward - 50 BTC Daily return - 672 uBTC (0.21% ROI) = 86400 * 50 * 10^6 / (1496979 * 2^32) Weekly ROI - 1.47% (linear, non-compounded) = 7 * 0.21% Monthly ROI - 6.40% (linear, non-compounded) = 30.5 * 0.21% Annual ROI - 114% (compunded weekly) = 1.0147 ^ (365/7) - 1 |
|
|
|
It depends on how well we can identify the monopoly's blocks and whether we choose to penalize it if it misbehaves. But in principle, as long as the monopoly is in power, it can simply reject any blocks by competitors. Therefore, nobody will try to mine. Which also means the total network hashrate (and hence the difficulty) is its own hashrate, which is as low as it pleases - as long as it's not so low a single entity can easily overthrow it.
But... with a 51% attack..... Fuuuuuuu!!!...  Is this really how this works? 51%, reject any blocks but your own, and the whole network is screwed?? Pretty much. You could argue for some heuristics to detect which blocks are the attacker's and reject them, but those are unreliable and go against the spirit of the blockchain. Of course, the network is screwed only if the monopolist is an attacker, rather than a benevolent, ruthless dictator. But the latter isn't too good either. Which is why I think overtaking the network should be harder than obtaining 51% of the hashrate. It should require obtaining 51% of the bitcoins. (And, I recently had an idea how in a proof-of-stake system, even someone with a majority of coins can't overtake the network. I'll need to think about it). |
|
|
|
volunteer mining
That's my point, mining should be incentivized rather than volunteer work. The assumption that bitcoin payment processors would rely on volatile, thrid party, volunteer mining and take the risk of losing their business is just plain wrong.
They will mine the hell out of the network because they will want to keep it secure.
At equilibrium, processing 1% of the bitcoin tx will entail x% of the hashing power. With more bitcoin tx (in 40 years ?), the value of processing 1% of the bitcoin tx will exceed the cost of x% of the hashing power.
I give up. Monopolies form because when you're the only one selling a product, you can demand whatever price you want. In Bitcoin mining, if you're a monopoly you can require high transaction fees, and you can keep difficulty artificially low thus lowering your cost. If you manage to get 51% and force a protocol change that makes only your blocks valid, yeah. If you capture 75% of the mining market, there is still nothing to prevent a small mining business from entering and mining all fees, including ones the monopoly doesn't take. As those unaccepted small fee transactions add up, mining for them becomes profitable as well. If there is something that can give a miner monopoly power and prevent new entrants, I'm not aware of it. Also, how can mining difficulty be kept artificially low? It depends on how well we can identify the monopoly's blocks and whether we choose to penalize it if it misbehaves. But in principle, as long as the monopoly is in power, it can simply reject any blocks by competitors. Therefore, nobody will try to mine. Which also means the total network hashrate (and hence the difficulty) is its own hashrate, which is as low as it pleases - as long as it's not so low a single entity can easily overthrow it. |
|
|
|
Monopolies form because when you're the only one selling a product, you can demand whatever price you want. In Bitcoin mining, if you're a monopoly you can require high transaction fees, and you can keep difficulty artificially low thus lowering your cost. |
|
|
|
[...]
For example, suppose DeepBit changed policy to only include tx that had fee >= .01BTC. Some people will not care because they can with high likelihood get in a block within 10 blocks anyway. But the few people who need near certainty of getting in within an hour now attach a .01 fee. All miners profit from this in proportion to their hashing power except DeepBit. DeepBit profits (or maybe not if they pick the wrong price) by less depending on how many of the .0005 fees they no longer get.
[...]
I thought this was the whole point of the tragedy of the commons: that each miner for himself has no benefit from dropping tx with very low fees. So all tx fees would go towards one satoshi. Yes, but FreeMoney's point is that if the miner is big enough, his own impact on the equilibrium by playing hard-ball is enough to justify his costs. There sure are solutions to this problem.
Like a network enforced minimum fee determined by a somehow balanced vote.
That's certainly a possible solution, but deciding on the minimum fee is not trivial. Alternatively you could limit the block size, but again there's no clear way to decide on the limit. |
|
|
|
Electricity is the major cost of a long-term mining operation.
This is true for GPU:s but not for FPGA:s. The more energy efficient devices we see, the less true it will be. Using FPGA for mining is a phase. ASICs currently have high cost/power ratio because of scaling. Once mining-dedicated ASICs are mass produced, they'll have similar cost/power to GPUs (GPUs are just chips dedicated to graphics). But hardware will still be the major cost. |
|
|
|
You're overlooking what "tragedy of the commons" means. As you said yourself, the payment processor will make 325 € per block whether he mines or not, so he has no incentive to mine himself - he would much rather have others mine instead.
Besides, if payment processors and banks are the only ones doing mining, it means Bitcoin has become fairly centralized.
You are missing the point: the payment porcessor will make 325€ ONLY if the network is functionnal and secure. So the value add fees are his/her incentive to mine (not the bitcoin mining fees). I'm sorry, but you are. The contribution of the payment processor's own mining to network functionality is negligible, since he's only a small part of it. It's in everyone's best interest that everyone will mine/pay for mining. But then it's also in everyone's interest to personally cease mining, since the network will be just fine with everyone else mining. The contribution of a miner / mining sponsor is shared by everyone, but the cost is all his own. I can't explain this any clearer, I can only direct you to Wikipedia. Miners are all different sizes, this gives some of them pricing power in terms of selling "get my txs into a block soon". If all miners are very small and all use the "accept all with fee rule" many may indeed drop out lowering overall power and difficulty. This will make it easier and more likely for someone to gain a pricing power ability. The existence of someone with pricing power ability raises the profitability of all miners causing more small players to enter the mining biz and reducing the possibility/ease with which one party can get >50% (which may not be disastrous anyway, but still makes me uncomfortable).
For example, suppose DeepBit changed policy to only include tx that had fee >= .01BTC. Some people will not care because they can with high likelihood get in a block within 10 blocks anyway. But the few people who need near certainty of getting in within an hour now attach a .01 fee. All miners profit from this in proportion to their hashing power except DeepBit. DeepBit profits (or maybe not if they pick the wrong price) by less depending on how many of the .0005 fees they no longer get.
This makes sense, but I think that quantitatively it will only be enough if power is concentrated with a few (where "few" could be 100) strong players. |
|
|
|
 A miner IS a payment processor I meant a payment processor like Bit-pay. |
|
|
|
It seems that this thread overlooks the fact that merchant acceptance is what determines success or failure of just any currency, including bitcoin.
If bitcoin is accepted by major retailers or by a large number of retailers, certainly third party services (like bitcoin-central merchant API) will add value by mitigating the exchange rate risk or the double-spend risk.
In other words, transactions fees in the future will be made of bitcoin network transaction fees (very low fees, hypothetically zero fees) and value add service fees (more competitive than today bank card fees but non zero fees).
Those who will collect the value add fees have a strong incentive to mine even for zero bitcoin network fees and zero block reward.
Just a sanity check: in France today, 1% of the bank card transactions amounts to 65 000 € in 2000 transactions per block (every ten minutes).
If I command just a 1% share of that market with my bitcoin payment app and charge merchants 0.5%, I am making 325 € per block (with zero reward and zero tx fees, whether I mine the block or not), roughly the same as all the miners combined today.
If I charge mechants 25 cts per transactions (à la Dwolla), I am making 500 € per block.
Hence I am afraid this thread is addressing a dilemma that wo'nt exist.
You're overlooking what "tragedy of the commons" means. As you said yourself, the payment processor will make 325 € per block whether he mines or not, so he has no incentive to mine himself - he would much rather have others mine instead. Besides, if payment processors and banks are the only ones doing mining, it means Bitcoin has become fairly centralized. |
|
|
|
Perhaps your most important statement is the Difficulty != Security, which is true. Security derives from the cost of mounting an attack. If all miners today used FPGA boards and were much more efficient per Gh/s, then difficulty would be much higher... but if these FPGA boards are just as cheap as the GPU's which preceded them, then the cost of the attack hasn't increased and thus the higher difficulty is irrelevant.
This is completely banal. It's all about invariants. If the type and technology level of the hardware used is invariant, then the "difficulty" number very strongly correlates with security. If not, then of course the difficulty correlates more than anything with the hardware technology. For discussing the issues in the OP, it is perfectly acceptable to assume the hardware technology (as well as the value of the Bitcoin system) is invariant, so "hashrate" is interchangeable with security. The OP's main point (which I don't really agree with) is that it is not the continuous hashrate that matters, but the reserve hashrate. |
|
|
|
|
Show Posts
