I deleted the prior version of this post a few moments after posting it, because I realized I had an error and I wanted to take a moment to think about it before reposting. I didn't realize jl777 has already replied within those few moments, until I had already deleted it and saw his post when the page reloaded. This is a promise by Bob to release bob_priv_n within 2 days (or lose his deposit).
The insoluble flaw will always remain (no matter how you structure the deposit) that either Alice can refuse to do the succeeding transaction and thus Bob loses his deposit (and if the deposit is paid to Alice then she steals this amount), or if you allow Bob to refund the deposit, then Bob can refuse to do the next step after Alice issues her transaction and thus Alice will lose her funds. Or as I wrote days ago (see self quotes below), the private keys get revealed and anyone can spend a transaction to themselves. 2) ... OP_HASH160 <hash(bob_priv_n)> OP_EQUALVERIFY <bob_pub_1001> OP_CHECKSIG
[...]
3) ... OP_2 <bob_pub_n> <alice_pub_m> OP_2 OP_CHECKMULTISIG
I now understand the intent of the cut & choose that Alice is 99.9% certain (precise % depends on number of key pairs in the challenge session of step #1) that <bob_pub_n> is signable with bob_priv_n, so that when Bob releases bob_priv_n before step #4 to refund his deposit, then Alice is sure she can sign for Bob's transaction in order to spend it back to herself. At that point Bob doesn't have Alice's private key, and Alice never releases this private key, thus only she can sign back her transaction to herself. Whereas if Bob issues the reciprocal payment to Alice in step #4, Alice releases her private key (so she can claim Bob's payment from step #4) then Bob can sign using his private key (which remains private until he issues the refund for his deposit) to spend Alice's payment from step #3. But the problem remains that when private keys are revealed, then anyone can spend the payment from Alice. One might argue that Bob will wait to refund the deposit until after the payment from Alice to Bob has been confirmed spent by Bob, but an attacker with sufficient hashrate can revert the order of the transactions and steal Bob's payment. Remember you are proposing to have many of these DE transactions occurring simultaneously and you are thus incentivizing someone to attack the block chain with hashrate to steal value. Normally even a 51% attacker can't steal someone else's coins (only double-spend their own coins), yet you are proposing to open a new attack vector funding 51% attacks with other people's coins! That is a non-starter, because it weakens the entire coin's security (because adds a new source of funding for 51% attacks). Perhaps you have just identified a reason that multi-sig transactions should always have their destination address hard-coded. I think you've identified a security hole in the current OP code for multi-sig. Even if it were possible to structure a Bitcoin transaction such that Bob signs for his refund instead of releasing the private key, that wouldn't help you, because then Alice couldn't refund herself when Bob fails to do step #4. As I wrote many moons ago in this thread, there is simply no way to do DE unless both block chains support CLTV. I told you the generative essence reason is because there is no reference point: And so will everyone else get Bob's private key and a miner who wins the block can spend his output before his transaction is confirmed on the block chain.
My point is that once Bob releases this private key, anyone can spend his UXTO to any payee else besides Alice. Thus I am asserting the cut & choose doesn't work, unless someone can explain to me my mistake.
|
|
|
|
|
While stoat plays a pathetic word game to deflect attention away from his inability to respond with "facts and data" per the substance of the prior page of this thread, he has been placed on ignore.
Snake oil salesmen use every possible technique to fool their victims. Eventually it reaches the point of absurdity such that even a total fool should be able to discern fact from shrilling.
The ETH price is fake due to insiders buying from themselves to fool their victims, as is the standard method of manipulation of shit coins. Their accomplices in this forum can offer no proof otherwise.
|
|
|
|
I would be grateful if you or TierNolan could actually answer my question? Stated in another way, what prevents Bob from finalizing the transaction on the block chain with Bitcoin CLTV op code, taking the funds from Alice, while also not issuing the reciprocal transaction paying to Alice on the other block chain?
I seem to never get a straight answer. In order to spend the funds from Alice, bob has to disclose the random number Alice can use to spend the bitcoins Afaics, you have not answered my question. Please read my question again. I didn't ask how Bob finalizes the payment from Alice to Bob. I asked, "while also not issuing the reciprocal transaction paying to Alice on the other block chain?". Alice can't spend Bitcoins, because Bob is issuing a transaction on a block chain that is not Bitcoin (and doesn't support CLVT). Are you implying that Bob will issue his transaction first (paying to Alice) on the block chain without a CLVT op code? Then how does Bob get a refund if Alice doesn't complete her side of the transaction and how can Bob's transaction be verified against a hash of a random number when the CLVT op code isn't supported. The simple act of spending the payment requires to disclose the information the other party needs to do their spend. Ignoring fees, at the high level: 1. bob sends in a deposit that alice verifies she can spend after a certain amount of time. However if bob follows the protocol, he can reclaim this refund before alice is eligible to. You've apparently swapped the block chains of Alice and Bob relative to scenario I described. But that is okay, I will follow your choice, where Bob is transacting on the block chain with CLTV and Alice is not. The transaction above signed by Bob I assume requires CLTV (Check-Lock-Time-Verify) since it must be refunded if it is not verified before the timeout of the lock. 2. alice verifies the above is in the blockchain so is assured that worst case she can get the deposit, which is 113% of the transaction amount, so she might actually prefer that. when assured she sends bob a payment that requires both secrets to be spent.
I don't understand how Alice can receive the CLTV output unless she already knows how to verify it. But if she knows how to verify it, then she can steal it at any time. How can Alice send a payment that requires verification of two secrets if the other block chain doesn't support pay contingent on verification of hash preimage? 3. bob sees this on the altcoin chain and sends in a payment to alice that requires a secret from alice that would allow him to spend the payment from 2.
Bob issued the deposit in #1 and now he also issues another payment to Alice, but which is spendable by Alice contingent on knowing the preimage (secret) of a hash. Only Alice knows this secret preimage at this point until she reveals it. I thus understand this step #3. 4. alice sees this real payment and then cashes in the bitcoins, but in doing so has to divulge the secret bob needs to spend the altcoins
I am disputing whether Alice can make such a transaction available in step #2 if her altcoin doesn't support pay contingent on verification of hash preimage. Edit: I understand you want to use a forfeitable deposit to ensure that Bob does step #3, since Alice has no way to refund step #2 (because her block chain doesn't support CLTV). I presume you are assuming that the altcoin supports pay contingent on verification of hash preimage. But I still don't see how the mechanics of the forfeitable deposit work? "I don't understand how Alice can receive the CLTV output unless she already knows how to verify it. But if she knows how to verify it, then she can steal it at any time." |
|
|
|
Shrill is an adjective.
It is also a verb which is how I employed it, "Justify your shrilling...". It applies to the shrill sound of overly emotional defensiveness as opposed to presentation of facts and data. Your further attempts to avoid providing "facts and data" will be appropriately ignored: Expect the shills to bury this post in more noise as they desperately try to sell you some bag holding shitcoins.
|
|
|
|
Your macroeconomic analysis is retarded.
Justify your shrilling with facts and data. I await your elaborately detailed presentation to back your claim. Otherwise you(r ignorance) will be appropriately ignored. Stop misspelling the word "shill" as "shrill" and I'll do anything you want http://www.merriam-webster.com/dictionary/shill 4. betraying some strong emotion or attitude in an exaggerated amount, as antagonism or defensiveness. Shills shrill. I see you have not been able to "Justify your shrilling with facts and data.". |
|
|
|
Actually you're wrong. That's the daily volume you've quoted there ($10m+).
Insiders buying from themselves to pump up daily volume is a well known tactic of shrilling shit coins. Welcome to the party. Seems you need to catch up on your education of how market manipulation works when the insiders control a large percentage of the float. Again 96% of all ETH volume is done on two exchanges. I don't see those exchanges sharing their KYC data on who is trading with whom. So it is impossible for anyone to refute this. Nope. That's just your personal opinion, not fact set in stone, which you will also find impossible to prove. Others have a different opinion of the ETH daily volume. Where is your proof? I've never seen a case where humans didn't take money that was sitting in front of their faces to take. The insiders always do this, unless they are worried about being caught and prosecuted. But since ETH was an illegal unregistered investment security launched from Switzerland to attempt to side step SEC (and I presume EU) regulations[1], we don't have to doubt whether they feel constrained by any regulators. [1] But they marketed it to US investors so they are still in violation of SEC law. |
|
|
|
Actually you're wrong. That's the daily volume you've quoted there ($10m+).
Insiders buying from themselves to pump up daily volume is a well known tactic of shrilling shit coins. Welcome to the party. Seems you need to catch up on your education of how market manipulation works when the insiders control a large percentage of the float. Again 96% of all ETH volume is done on two exchanges. I don't see those exchanges sharing their KYC data on who is trading with whom. So it is impossible for anyone to refute this. Nope. That's just your personal opinion, not fact set in stone, which you will also find impossible to prove. Others have a different opinion of the ETH daily volume. Where is your proof? I've never seen a case where humans didn't take money that was sitting in front of their faces to take. The insiders always do this, unless they are worried about being caught and prosecuted. But since ETH was an illegal unregistered investment security launched from Switzerland to attempt to side step SEC (and I presume EU) regulations[1], we don't have to doubt whether they feel constrained by any regulators. [1] But they marketed it to US investors so they are still in violation of SEC law. |
|
|
|
I would be grateful if you or TierNolan could actually answer my question? Stated in another way, what prevents Bob from finalizing the transaction on the block chain with Bitcoin CLTV op code, taking the funds from Alice, while also not issuing the reciprocal transaction paying to Alice on the other block chain?
I seem to never get a straight answer. In order to spend the funds from Alice, bob has to disclose the random number Alice can use to spend the bitcoins Afaics, you have not answered my question. Please read my question again. I didn't ask how Bob finalizes the payment from Alice to Bob. I asked, "while also not issuing the reciprocal transaction paying to Alice on the other block chain?". Alice can't spend Bitcoins, because Bob is issuing a transaction on a block chain that is not Bitcoin (and doesn't support CLVT). Are you implying that Bob will issue his transaction first (paying to Alice) on the block chain without a CLVT op code? Then how does Bob get a refund if Alice doesn't complete her side of the transaction and how can Bob's transaction be verified against a hash of a random number when the CLVT op code isn't supported. |
|
|
|
Actually you're wrong. That's the daily volume you've quoted there ($10m+).
Insiders buying from themselves to pump up daily volume is a well known tactic of shrilling shit coins. Welcome to the party. Seems you need to catch up on your education of how market manipulation works when the insiders control a large percentage of the float. Again 96% of all ETH volume is done on two exchanges. I don't see those exchanges sharing their KYC data on who is trading with whom. So it is impossible for anyone to refute this. |
|
|
|
A blockchain with unbounded entropy? doesn't sound very deterministic to me.
You were talking about society.  Sorry please pay attention to what I write so I don't have to repeat myself  I did. You wrote about society. I will not reply again to you. You are now on ignore idiot. |
|
|
|
A blockchain with unbounded entropy? doesn't sound very deterministic to me.
You were talking about society. |
|
|
|
Bitcoin and gold are both good in my opinion. But if you were to ask me to pick only one, I'd have to say Bitcoin.
better choose one. if the dollar strengthens both the price would be decreased right ? you will lose double Incorrect. They will both rise with the rising dollar in 2017. That is certain. They may (or may not) both crash first in 2016. Possible lows are < $850 and < $150, but this is only a possibility. |
|
|
|
Your macroeconomic analysis is retarded.
Justify your shrilling with facts and data. I await your elaborately detailed presentation to back your claim. Otherwise you(r ignorance) will be appropriately ignored. |
|
|
|
I would be grateful if you or TierNolan could actually answer my question? Stated in another way, what prevents Bob from finalizing the transaction on the block chain with Bitcoin CLTV op code, taking the funds from Alice, while also not issuing the reciprocal transaction paying to Alice on the other block chain?
I seem to never get a straight answer. |
|
|
|
Tendermint can't work. Sorry. I don't have time to respond to BS shills who can't comprehend the technological issues. Those who want to understand can dig into the following. 8. Conclusion
Tendermint is awesome. The future is now.
Incorrect! Tendermint is flawed and is a divergent non-consensus design that will crash and burn in the real world. There are a lot of things that can work in the real world but not in the ideal one. For example, Ripple. Following is written by David Mazières a PhD professor at Stanford who is the Chief Scientist at Stellar: Still another approach to consensus is Byzantine agreement [Pease et al. 1980; Lam-
port et al. 1982], the best known variant of which is PBFT [Castro and Liskov 1999].
Byzantine agreement ensures consensus despite arbitrary (including non-rational) be-
havior on the part of some fraction of participants. This approach has two appealing
properties. First, consensus can be fast and efficient. Second, trust is entirely decou-
pled from resource ownership, which makes it possible for a small non-profit to help
keep more powerful organizations, such as banks or CAs, honest. Complicating mat-
ters, however, all parties must agree on the the exact list of participants. Moreover,
attackers must be prevented from joining multiple times and exceeding the system’s
failure tolerance, a so-called Sybil attack [Douceur 2002]. BFT-CUP [Alchieri et al.
2008] accommodates unknown participants, but still presupposes a Sybil-proof cen-
tralized admission-control mechanism.
Generally, membership in Byzantine agreement systems is set by a central authority
or closed negotiation. Prior attempts to decentralize admission have given up some of
the benefits. One approach, taken by Ripple, is to publish a “starter” membership list
that participants can edit for themselves, hoping people’s edits are either inconsequen-
tial or reproduced by an overwhelming fraction of participants. Unfortunately, because
divergent lists invalidate safety guarantees [Schwartz et al. 2014], users are reluctant
to edit the list in practice and a great deal of power ends up concentrated in the main-
tainer of the starter list[i.e. centralized!]. Another approach, taken by Tendermint [Kwon 2014], is to
base membership on proof of stake. However, doing so once again ties trust to resource
ownership.
Again I maintain the Iota/DAG will only remain convergent with a centralization to enforce the trust math model. Btw, I will soon argue the same about Stellar as well.  |
|
|
|
Bringing this topic back on track, I'd like to discuss what I believe is the primary challenge in creating a decentralised, trustless, p2p cryptocurrency. Nash equilibrium for non professional miners.
Because power always centralises, if you reward miners, you create a point of centralisation so the apparent solution is not to reward them at all - instead you make it such that every user has to mine their own transaction in order to participate. And on the surface this seems fine but dig a little deeper and the nash-equilibrium is broken because the cheapest, least risky way (PoW cost and orphaning risk) for users to participate in this process is for them to ignore as much of the network as possible within the bounds of the protocol.
For example, (in a blockchain design with the LCR rule) if you require them to include as many mempool transactions as they can see in their blocks, they are incentivised to pretend they see only their own transaction because the probability of their new block being orphaned by double spend increases with every other transaction they include. This will cause the chain to become divergent because the structure of a chain doesn't permit high frequency blocks resulting from this rational behaviour; the LCR will be wildly selecting between candidate chains in an unintentional orphaning war caused by a combination of this rational behaviour, network latency and the chain structure itself.
In a probabilistic DAG design, even if you have only one transaction per block, orphaning risk still persists; submitting your transaction at the tip of the DAG is more risky than submitting it further down the hierarchy (because probability of being in an orphaned branch decreases with the number of children), so users have an incentive to widen the DAG which is the same as saying they agree not to make forward progress. In addition, users are incentivised to reference as few parents as possible, because the more parents they reference, the higher the chance of their transaction referencing a branch which will become orphaned due to a double spend which isn't apparent when they submit their transaction.
Even if you do away with orphans completely and have a deterministically ordered DAG with one transaction per block, the incentive is for users to reference as few parents as possible because every parent they reference will be given ordering priority over them, which is opposed to the timely confirmation incentive. The narrowest possible DAG is always desirable because the strength of the network decreases linearly in the number of partitions, and partitions are merged by referencing parents.
I maintain that unless there is a monetary incentive to behave in favour of the network as a whole, instead of being purely rational, the nash equilibrium is destroyed.
Thoughts?
Btw, I commend monsterer and others on finally figuring out what I was stating upthread about DAGs and even monsterer's idea for a deterministic ordering. |
|
|
|
Bringing this topic back on track, I'd like to discuss what I believe is the primary challenge in creating a decentralised, trustless, p2p cryptocurrency. Nash equilibrium for non professional miners.
Because power always centralises, if you reward miners, you create a point of centralisation so the apparent solution is not to reward them at all - instead you make it such that every user has to mine their own transaction in order to participate. And on the surface this seems fine but dig a little deeper and the nash-equilibrium is broken because the cheapest, least risky way (PoW cost and orphaning risk) for users to participate in this process is for them to ignore as much of the network as possible within the bounds of the protocol.
For example, (in a blockchain design with the LCR rule) if you require them to include as many mempool transactions as they can see in their blocks, they are incentivised to pretend they see only their own transaction because the probability of their new block being orphaned by double spend increases with every other transaction they include. This will cause the chain to become divergent because the structure of a chain doesn't permit high frequency blocks resulting from this rational behaviour; the LCR will be wildly selecting between candidate chains in an unintentional orphaning war caused by a combination of this rational behaviour, network latency and the chain structure itself.
In a probabilistic DAG design, even if you have only one transaction per block, orphaning risk still persists; submitting your transaction at the tip of the DAG is more risky than submitting it further down the hierarchy (because probability of being in an orphaned branch decreases with the number of children), so users have an incentive to widen the DAG which is the same as saying they agree not to make forward progress. In addition, users are incentivised to reference as few parents as possible, because the more parents they reference, the higher the chance of their transaction referencing a branch which will become orphaned due to a double spend which isn't apparent when they submit their transaction.
Even if you do away with orphans completely and have a deterministically ordered DAG with one transaction per block, the incentive is for users to reference as few parents as possible because every parent they reference will be given ordering priority over them, which is opposed to the timely confirmation incentive. The narrowest possible DAG is always desirable because the strength of the network decreases linearly in the number of partitions, and partitions are merged by referencing parents.
I maintain that unless there is a monetary incentive to behave in favour of the network as a whole, instead of being purely rational, the nash equilibrium is destroyed.
Thoughts?
Nash also said you win as a whole with the team and lose as an individual, therefor you must act in benefit of the entire network (team) to have the most efficient and effective system. This was his breakthrough where adam smith said the opposite. Nash equilibrium doesn't apply to society. It applies in some cases. Adam Smith did not say the opposite. In away he does.. nash argued a better global optima can ne achieved by the cooperation of a network rather than self-interest. Smiths model would achieve a local optima. Again Nash equilibrium only applies where the incentives are so aligned. It doesn't apply generally in society with unbounded entropy. Sorry please pay attention to what I write, so I don't have to repeat myself. |
|
|
|
The Ethereum Paradox, indeed. 1. The value has increased to 450M$. Meanwhile the author of the system has written 0 lines of code in the last month. https://github.com/vbuterin2. The former CEO of the project has presented the potential of smart contracts, mentions ethereum, but doesn't show running code. https://www.youtube.com/watch?v=3bY66Zgr8Cs3. The algorithm will be changed to PoS, yet its entirely unclear how the current currency can survive this. AFAIK, and I'd like to be corrected with tangible evidence, nobody uses the software for anything. All the examples I've seen were theoretical. It is, as far as I can tell a purely speculative vehicle. 3.POS is still in development and the currency will survive it just fine in fact it will probably increase in value, again. We are at the end of an Austrian "Crackup Boom" cycle globally, where excess credit has destroyed all profitable investments. Given the global collapse contagion underway which will accelerate from 2017 to 2020, the exodus from government bonds (and other conservative investments which are no longer viable) has really only one place to go (as Martin Armstrong predicted): stock speculation $450 million mcap is nothing. No where near $450 million has changed hands, rather only $10s of millions at most. So everyone position yourself to partake of the trend. Fundamentals aren't the only factor involved. Speculation follows speculation. Ethereum doesn't have a monopoly on this phenomenon... |
|
|
|
|
Show Posts
