I found this as a good, critical view:
http://weuse.cash/2016/06/09/btc-xmr-zcash/

There are others.  I'm not totally out of it myself, but I also have my reserves for zcash, in the sense that I wonder what it brings in over monero.  I know what it brings: *total* mixing with the entire user base, instead of a randomly selected subset.  That, in itself, is good.  However, the price, cryptographically to pay, seems not in balance.  If it is really true that not every transaction is automatically anonymized (which I think is true, but I'm not sure yet) then I would say: forget about it immediately.  Anonymity must be automatic and passive, or you render those using it suspect.  If, on the other hand, there is automatic anonymity for every transaction, then one should look at the trade-off on one hand of this increased anonymity set with all the cryptographic problems that come with it, and the fact that the company is assigning itself 10% of the total amount of coins (how can the company do that ?).  The trusted setup is a risky affair, but it could be solved if they wouldn't just take a few 10 personalities, but rather a million people or so.

I make the distinction between "greater fool theory" which is, as you rightly say, a belief system where you think that you will find greater fools than you, that are willing to spend more goods and services on a token than you do on one hand, and "same fool theory" which is the basis of a monetary asset, where you believe that you will find similar fools than you, that will spend about the same amount of goods and services on the token than you want to do.

In as much as "greater fool theory" has to collapse, because not sustainable, "same fool theory" works, because it is sustainable: you can appear many times in the chain in same fool theory, while you will of course not appear several times in "greater fool theory", so you will run out of fools.

That's the difference between a speculative bubble (greater fool theory) and a monetary asset (same fool theory).

In a certain way, the origin of a cryptographic scheme shouldn't matter, as it should contain its own proof that it doesn't contain back doors (as like in using mathematical constants or prime numbers or the like), or at least, so that the mathematical race is open to anyone to discover the back door.
In good cryptography, you should be able to check everything for yourself and not have to rely on the trustworthiness of its designer.  As such, ALL THE NUMBERS in it should have a mathematical foundation, and no random number should appear.  If that is the case, then you know that there are no "undiscoverable" back doors.  There can be back doors still, but they rest on mathematical superiority of the back door designer, not about missing entropy.  Mathematical superiority is not guaranteed to last.  Missing entropy is, as long as the private key is kept by the back door designer.

For instance, it might be that the back door designer uses a special elliptic group of which he has discovered certain math properties which allow him to solve the discrete log problem efficiently.  As such, he can break all of this crypto.  But this mathematical discovery is open to anyone, and just any other mathematician may do the same discovery.  At that point, the back door is available to anyone (and the system is recognized broken), or at least is open to this other mathematician.

However, using a "random number in the code" as a public key, for which only the designer has the corresponding private key, is an entropy advantage that the designer will keep as long as he keeps his key secret.

Yes, and that demand comes from a belief system.  There is only one thing that ultimately generates demand, and that is desire for satisfaction in the broadest sense.  In as much as the offer of that satisfaction is limited, there is a tension between demand and limited offer, and that tension is called "price".  We all get great satisfaction from breathing air (so much that if we don't, we die), but the offer of air is larger than the demand for the moment, so the price is zero.  There is no tension, so the price is zero, but their is (huge) value (our life depends on it).  Essentially, only goods and services can directly help us in getting satisfaction so in as much as they are not in unlimited supply, only they are the ultimate source of "price".

However, we can anticipate, and make plans.  We can make plans to provide goods and services where there is a tension (for which there is demand, and still limited or in-existent offer) in order to be able to trade those for other things (goods and services) that give us satisfaction.  Doing so increases a demand for production capital, and hence production capital also has a price.  

And finally, there are "monetary items" which have little or no actual potential, nor to satisfy directly, or to be production capital, but for which there has occurred an infinitely recursive belief that they have a price.  Whenever such an infinite belief system gets hold, the monetary item gets a price (is hence a carrier of value).  Nothing else is needed for this belief system to take hold.  Bitcoin is an example.  Historically, gold got such a belief system attached to it, and with some coercion, fiat money also gets to have such a belief system.

Now, most people don't like the idea that their precious monetary assets are nothing but "belief", and go and look for its "intrinsic value", but there isn't any.  In as much as a monetary item also has intrinsic value (as direct satisfaction, or as production capital), it isn't used as monetary item, or its intrinsic value is much lower than its market price.  Gold has some intrinsic value (as jewels to be beautiful, or technical applications), but that intrinsic value alone is much lower than the market price of gold.

Fiat money has only the intrinsic value of the paper it is printed on.  And bitcoin has some intrinsic value as "timestamped immutable ledger" but that is much much smaller than the bitcoin market price.

A monetary asset's price is an infinitely recursive belief system: you believe it has value (and are willing to spend goods and services on it to obtain it) because you believe that Joe will accept it later against similar value (and will be ready to give you goods and services for it), and you believe that Joe will believe that, because Alice will believe that,  because she believes that Jack will believe it...
 
Nothing more, nothing less.  The belief is what makes the offer (wrt to one's desire to "cash out" and the current market price) and that same belief is what makes the demand (wrt the need to store value for the future).

Of course, you also have to believe that the "token transmission" will keep functioning, but that's about it.  All "intrinsic value, developers.... " is similar to "intrinsic value", way, way smaller than monetary belief value.

You can try to "impose the market behaviour", but if you do a hard fork, all this is automatic, without trying to force hands.  With a hard fork, the original market cap is divided over the two in a flexible way and can adapt to people's desires, without any artifice of forcing exchange ratio, time limit or anything.

In fact, this puts an actual end to the sound money doctrine of bitcoin, with a finite offering of monetary unit supply: each fork is a form of (non-fungible) inflation.

Total anonymity is necessary in order for distributed warfare to become possible financially.
Distributed warfare will be an aspect of the evolution for machines to take over without us humans noticing in the beginning.  We have to organize the Singularity with anonymity, otherwise people will notice too quickly and be able to stop it.

I think that the coming publicity of Zcash will have a positive effect on monero and DASH, as it will draw attention to the anonymous aspects (or lack thereof) in most others.    I'm trying to study zcash, I agree with most critics but I haven't understood everything yet.  My opinion for the moment is that Monero is technically vastly superior over DASH, and I think that it remains superior over Zcash, but I haven't wrapped my mind around everything in zcash yet.
My still rather uninformed opinion about zcash is that there are severe cryptographic "taboos" (trusted setup, golden keys for the developers, and most importantly, I think that zcash is not applying anonymity automatically and passively, but that you have to mix "on purpose", making you hence a targeted suspect).  On the other hand, IF one can trust what has to be trusted, then it seems that the anonymity offered by zcash is more absolute as compared to monero.  (but that sounds like an oxymoron: "if you can trust X, then Y is perfectly anonymous...".

Amen.

feel free to do so.

I don't know where there is a readily available plot with their sum.  If you have a pointer, you're welcome.
My idea was that ETH + ETC is a single market cap of ethereum, the continuation of what was ethereum before the hard fork, and to keep a rough trace of the longer-term evolution of this market cap.  A genuine fork splits the market cap, so the sum is the continuation of the former single coin.


Today: ETH: $11.22 and ETC: $1.71, sum $12.93

I think poverty is not a "problem" but a normal aspect of life: there are winners and there are losers, and within the finite boundaries of an ecosystem, a population is always limited by those that die from starvation, which is what we call "poverty".  To me, poverty is a necessary clipping of the world population, and many of our problems come from our ill-fated perception that we should fight poverty.

I think that things like renewable energy sources are a perfect way to decentralize electricity production.  I have nothing against centralized electricity production if the market is free: if your nuclear power plant can provide you with cheaper electricity, that's good, but you are free to make your own with solar panels.
I don't think there should be any voting process, as I don't think that there should be any aristocracy dictating law.   Democracy is nothing else but the dictate of the (manipulated) majority.  It is better than a sole dictator, but individual freedom is still way better.
So the only things I agree with is fighting censorship and anonymity online.  That's what crypto is about, I would think.

The problem is that many people aren't interested in that, because they are or brainwashed into thinking that the state is not a criminal organisation, or are thinking that they will get their unfair advantage out of the state in some or other way.

Hadn't seen this.  Of ETC and ETH, I'm a clear fan of ETC because it is still a block chain.  But in my opinion, ETC/ETH face the same problem: apart from some ponzi applications, and some betting contracts, what applications can be done on such a dangerous platform ?

I didn't mean "what applications that would run on ETH would also run on ETC" but rather, "who is still going to do something serious on ethereum, no matter what version ?".

Ethereum is a wrong-headed concept, as the DAO illustrated (apart for little fun things like ponzi games and betting).

Centralized exchanges shouldn't exist.  Only distributed exchanges should exist.

I don't see the use of adoption of crypto if it is to become regulated fiat.  Then I prefer sticking with fiat.  My only interest with crypto is the anarchist part, and the hope that it may be a tool that one day liberates us from state and law.  If it is to abide by state and law, I don't see what it is good for.

I prefer a $20 million market cap which is free, than a $20 billion market cap that is regulated.  I prefer fiat then.  It is more private, safer, and more stable.

Of course, you can take crypto as betting horses in speculative bets, but you could then just make bets on any random number generator, and not go through all that hassle.

Really, what are cryptos good for except anarchism ?

This is (unfortunately) what most people think, and for the moment, traceable coins seem to work as if they were still relatively private and fungible, although they aren't.   Many people think that anonymous coins are only to buy drugs, weapons and evade taxes.  Although that is of course part of it, the real deal is that with traceable coins, your bank account is on a web site visible to anyone who bothers to do some simple research.

Imagine, if bitcoin becomes generalized, that you get paid in bitcoin, and that your colleagues can see what you do with your paycheck (as they get paid by the same employer, it is not difficult to find out your paycheck from that same employer, right...).  Then people will want privacy.

For the moment, bitcoin is essentially a trader's toy where nobody cares much about who owns what, except in the case of theft.  Probably black markets are leaving bitcoin because they start to get aware that they leave traces for ever (if not, they will soon find out).  But when people will want to use bitcoin every day, they will start to realize its huge lack of privacy when uncomfortable analysis will be done on it.

Once coins will become coloured, and you get regularly to explain at the police station where you got your money from because it is traced back to a drugs dealer caught 5 years ago, and you got some of it through a mixer when you sold some stuff on a flea market, you'll start to get the picture.  When each time you try to buy something with bitcoin in a supermarket, you are taken apart to explain a few things on how you got certain coins, will start quickly to become nerve-wrecking.

No, and I think it is because with such a system, there's no way for the devs to reap in an unfair amount (see my point 5) earlier on).


If you write in the code "10 new coins for burning 1 bitcoin" then the bitcoin market cap will always be 10 times higher than your coin (assuming the same final number of coins).  If you write in the code "10 bitcoins to burn for 1 coin" you go for your own coin's superiority.  Because not all people holding BTC will burn their coins right away: some may wait 10 years to do so.  They will only do so when it is market-wise interesting, that is, when the market ratio is better for them than the baked in ratio.  Suppose that you say that, to get it started, they get 1000 new coins for burning 1 BTC.  So at current prices, this means that your coin should be valued $0.5.  If it isn't, then people will buy them on the exchanges, and not burn BTC.   Suppose now, that 1 year from now, your coin would have reached $3 and that bitcoin is, say, $1000.  Then of course, many people will burn their BTC because they only need to burn $1 in BTC to get $3 in your coin: your coin will hence never be able to get beyond 1/1000 of the BTC price, even if market-wise it would.  Until all BTC is burned in fact and bitcoin doesn't exist any more.


It would be lucrative to be that manipulating external oracle  As oracle, you go short on ETH, you announce a ridiculously high market price for ETH, tons of them get now minted, and that crashes the real market price of ETH  You reap in your benefice.

Joke: with ethereum, it is actually easier: you look for an exploit in the contract.  There surely is one :-)

Today (somewhat late...):  ETH: $11.09 ; ETC: $1.71

sum: $12.80

Applications, no.  But smart contracts could be interesting in the following sense of what I'd call distributed war fare: imagine some entity wanting to kill certain well-known people (state head, corporate chief...), blow up something, .....  They could make an anonymous smart contract with a big reward for who-ever kills him, blows up the thing ....   This could go like this:

- a contract is proposed with a big sum in it.
- a "first taker" has to lock up himself a certain amount of money (it could also be a highest bidder...)
- if the target is reached before a certain date, the first taker gets his locked money plus the big sum
- if not, the taker's money goes to the owner of the contract

This is a way to do distributed warfare (it will probably be labelled "terrorism").  There needs of course to be a way to verify automatically that the target has been attained, but that could be some processing of news paper headings.

I think there's almost no other way to do distributed warfare.  This is one of the principal usages of smart contracts I can think of.

Of course, a counter attack consists in being the first or the highest bidder to take the contract, and then not to proceed.  But it costs the locked sum.  So in a way, this kind of smart contract would put a correct market price on the destruction or killing of someone where a balance is found between those not wanting this to happen, and those wanting it to happen. 

It would be a fair price for war acts.

I don't know if I would think of this as a positive evolution, but I don't see how it can be avoided honestly.  First of all this will start off as a joke, like the DDoScoin, but I think there's an obvious and unavoidable evolution in the direction of where money really counts historically: warfare.

I think it is essential.  It is my main issue with bitcoin.  All the rest is technical, but automatic anonymity (and derived fungible money) is essential, and totally absent of bitcoin.

Satoshi *thought* that pseudonymity was sufficient, but he forgot that network analysis and all the links made by transactions make it a traceable item.  Satoshi was also missing an essential cryptographic technique (ring signatures).

I consider bitcoin dangerous for that reason.  40 years after you made a payment, it is still open in the block chain.  You don't know what happens to society in 40 years.  Imagine the Nazis analysing block chain to trace Jews and their friends.

Unfortunately, I'm part of the small crowd of geeks that thinks that way / sees this issue.  Most people don't care. 

You could, in your hard fork, exclude bitcoin UTXO before a certain block number too, so making Satoshi a poor man...

There's a difference between "burning bitcoin" because then you LOSE your actual bitcoins, and FORKING, where you give free money to bitcoin owners (in fact, you don't give free money, you pick in part of the bitcoin market cap!).


No serious person would BURN bitcoin to get a new coin in a 1:1 ratio.  And if you put in any other ratio, then you have burned superiority (and an arbitrary value ratio) in the code.  Best is to FORK, and let the market split the market cap of your fork and the original bitcoin market cap.

The biggest difficulty in starting a new monetary system is the seigniorage and initial distribution (which is in fact the same).   Ideally, you would like to give a uniform distribution over the world population. But that's not possible because there is no "original identity token" which you could use as private key.  So the next best thing to do is to take an existing distribution that HAS private keys already.   If you take bitcoin, or bitcoin minus the first year or so, you get something that gets close.


That's unavoidable if a monetary system grows, unless you allow for coin creation, but then you have to BURN the seigniorage with PoW.

The reason why you don't want monetary units to become more valuable is because you consider that the "early adopters" get unfair value for nothing.  But when you kill their value with inflation, you create seigniorage which you have to destroy.  Now, it is almost impossible to devise an automatic system where PoW will create coins and destroy value exactly that amount of value which is the growth of the market cap.  Best would be a kind of constant emission, OR starting with a fairly broad distribution and let the market do.



These money units are not anonymous, but they are FUNGIBLE.  Nobody refuses your credit card payment because you got money from a competitor for instance.   If you send 200 dollars to a web site with VISA, they know that that money comes from YOU, but they don't know WHERE YOU GOT EXACTLY THOSE 200 DOLLAR FROM. 

Imagine people getting paid in bitcoin.  Imagine you don't want employees of Apple to buy your products.  If you find out that their bitcoins were once Apple's, you can refuse those bitcoins.  However, an employee of Apple can pay you with VISA and you don't know that he got his money from Apple.

That's the problem with traceable coins.  They are coloured.


It is not about fairness between miners.  It is about miners not making excessive profits of seigniorage.  As long as they compete with one another, the most profitable miners will compete against one another and increase difficulty sufficiently that there's not much margin left.

You can write *totally different* code on a *totally different* white paper, but allow for "once-valid" transactions from the bitcoin block chain to the new chain, and take as genesis block of the new chain, a certain recent block on the bitcoin chain.

That comes down to making a totally new coin, with totally different protocol, but which is technically speaking a hard fork from bitcoin, with an initial distribution equal to the bitcoin distribution at the block where the fork was decided to be attached (the genesis block of the new chain, equal to a given block on the bitcoin block chain).

Every UTXO of the bitcoin chain before that block can be used (once) with a valid bitcoin signature (using the bitcoin secret key), but as this is a special transaction on the new chain, it would be of a special type that cannot be used afterwards.

Doing so would:

1) enable you to just implement any different protocol you like
2) have an initial distribution equal to the bitcoin distribution at a given point in time.
3) have all bitcoin owners automatically have "free money" on your chain and give it a head start
4) not need any special ICO or whatever
5) cannot be used as a scam to make money for the devs or their buddies of the first hour (like DASH)
6) is technically a hard fork from bitcoin, but with totally different code

From point 5), one can deduce that nobody will do it I suppose :-)


Why would one increase the number of coins then ?

Suppose that initially, 3 people hold the 40 coins, One 20, another 15 and another one 5.

If these people are going to exchange their coins to increase the user base, their holdings are going to diminish in coins, but the increased user base is going to increase the value of each coin.

Now, under PoS, only these 3 people are going to obtain new coins (only they can mint).  What's the gain in having them first obtain 4, 3 and 1 extra coin, so that they now have 24, 18 and 6 coins each, and THEN exchange their coins, diminished by inflation, but with a larger stash, to a larger user base ?

Under PoS, there is no increase in user base by mining.  The original stash holders are the ones getting the new coins, which diminish the value of their coins, but get more coins.

As long as there are enough "digits after the comma" (that is, each coin can be split in say, 10^8 Satoshi-like fractional parts), there's no reason to "mint", which diminishes the value of an individual coin, and increases the stash of each holder with exactly the same amount.


I think that is the big failure of any non-anonymous currency (most of them in fact).  With non-anonymity comes non-fungible coins.  You can decide not to accept coins that come from transactions in certain countries, you can decide not to have coins that have been held by the competition (if that competition is smaller), law makers can impose different taxes as a function of where coins come from (for instance, they could make tax transferrable: if you accept coins from someone who hasn't paid their taxes, YOU should now pay them in their place).

Non-anonymous coins are not fungible.
 

I didn't realize that, but that's crazy.  Imagine you get a block interval that is 1/10 of the average network  propagation time...  You make a big mess of forked blocks all the time.  


Technically, it can, but on huge chains.  Probably off-chain systems like Lightning are ways to do so.  


It is the waste (of resources) that secures the chain, because you oblige an attacker to waste at least as much on his own.  If it is efficient, the attack becomes just as efficient.  So the waste is essential.

One should burn enough resources irreversibly to secure the chain, because it is this burden that makes it not profitable for an attacker.  From the moment that the waste is useful, an attack becomes more profitable too (the usefulness is also useful to an attacker).

Even bitcoin's burning of electricity is not perfect.  Indeed, consider industries with high electric heating power.  If they can harness the waste heat from mining equipment, they become perfect attackers.  They would spend the electricity in any case, and now they can use that "for free" to attack the bitcoin block chain.  So even "heat" is problematic if it is useful.