House repairs, and three years tuition set aside for a Ph.D program.

sigh.

I don't even know why I'm responding here.  People's minds are clearly made up, and people's lines are clearly drawn.

Full disclosure.  I yelled pretty loudly last year that I thought the block size needed to be raised.  Some agreed; others didn't.  That's okay.  It's not a decision for one person, whatever I think of the quality of my assessment.

I watched blocks start filling up, and on some days there was a very large backlog of transactions.  People were still arguing about the block size increase.  

The camps started to regard each other as enemies and accuse each other of trying to destroy Bitcoin.  Still no block size increase.  Arguments only growing hotter.

People started to openly threaten each other, with schemes to deliberately subvert consensus and plans to engage in deliberate double spends and other scamming behavior held over one another as threats.

Some asshat started blowing something like $60G per week (unless it was a miner - in which case they may or may not have broken even on the increased fees that legitimate transactions were paying) just to stuff the block chain - either because of an enormous financial need to influence the block size decision, or because hey, if we can make them compete with each other more for the fixed amount of space available, it's profitable.   Community could have had any number of constructive responses but instead just started howling and blaming each other.

At about this time I gave up on the community and sold my coins.  If the people driving the decision were functional and worked together, or even if they had been discussing the problem in good faith, I would still be a believer even if block size didn't immediately increase.  But that's not what happened, and I've seen too many other cryptocurrency ideas die horrible deaths.  Digicash, Ecash, E-gold, Beenz, etc...  All kinds of things that existed before the Nakamoto Consensus Protocol was invented, showed up and died.  Most of the centralized or owned ones wound up in court.  The few "decentralized" schemes (which still required a central authority to control userIDs because they were focused on reavealing a userID if AND ONLY IF that user attempted a double spend), died of non-participation as people didn't bother dealing with a gatekeeper.  And a couple of other systems that might have succeeded, died of toxic communities and an inability to work together to solve problems.  IE, of exactly what is happening here.

This one got further than any of the others, and a lot of non-cryptography people have heard of it where most never heard of the previous ones.   So writing it off was a real shame.  But I have not recently seen any reason to believe this community is going to start working together to reach any consensus, and in the absence of any willingness to try, it's simply a poor investment.  And the technical problem with scale is real.  I haven't seen any worthwhile approach to dealing with it - not the one I suggested nor any of the others.  

So...  I'm out.  And I'm pretty sure I'm not the only one.

It is obvious that these are scams, and there was never a time when it wasn't obvious. 

It's very simple.  The machinery's owners, even if they're honest, are losing money unless they charge you more than the machines make.  Any money you're able to make on a cloud mining contract comes out of the machine owners' pocket, because the machine owner could make that money mining himself.

QED.  If it were in an honest owner's interest to lease the machines to you, then it would not in your interests to lease them.  Your expectation of profit is less than zero.  Therefore people making this offer are not being honest. 

QED.  If they are not honest, then you should have even less expectation of profit than if they were.

Sorry if I'm insulting anybody, but my initial reaction to the very idea of leasing mining power was "How stupid do these clowns think I am?  This isn't even a plausible scam." 

And although some people took them up on it, I've never understood why, nor seen any reason to form any other opinion.

In terms of the bytes that appear in the transaction itself, there is no difference. 

The difference is all in what the snoops can infer from the bytes.  When you make that transaction you described, the snoops would look at the block chain and say,

Oh, these twenty new addresses were all funded by the same transaction.  Therefore all the funding came from the same source (because almost always it's a single source sending money).  And since this doesn't look like a purchase (purchases typically have one large output and one much smaller "change" output) it must have been a logistical or bookkeeping movement of coins.  So we're going to assume that now all twenty of these new addresses are owned by the same person. 

Later on, they'll confirm it if, say, one of those 20 outputs gets spent, and you get a millibitcoin of change, and then later that millibitcoin of change gets spent in the same transaction as another of those 20 outputs, or as change from another of those 20 outputs - they go, Aha, look!  This new evidence means that what we thought about the addresses being owned by the same person, is now confirmed!  These two txOuts were owned by the same person, and now we can link all the purchases that were made with both of them! 

Now consider what happens with a coinjoin.  Alice is buying an Anvil, Bob is buying a Book. Carol is buying a Coat, Dave is buying a duck, and so on....  Maybe Zebulon is buying a Zebra, who knows.  They do a coinjoin transaction, and there's an output to the blacksmith shop and an output to the bookstore, and an output to the clothier, and also outputs to Alice, Bob, Dave, Carol, and everybody else - and the outputs are all kinds of different sizes instead of just being clearly "payment" and "change." 

Superficially, it looks like the same transaction.  Some number of inputs, some number of outputs.  But the snoops looking at it say, "Oh, all these inputs must have come from the same person, and it doesn't look like a regular purchase, so we'll assume all the outputs are going to the same person too...."  except this time they're wrong.  They'll pretty quickly figure out (because the way merchants combine the money that they get paid is very obvious) which outputs went to merchants and how much each merchant got.  They may be able to backtrace a lot of the unconnected txIns to figure out who owned them before the transaction.  But they will never figure out who it was that bought the duck, who it was that bought the book, and who it was that bought the zebra.  The best they'll be able to say is, "one of these people whose coins went into the transaction." 

And by the same token, even after they figure out which outputs were paid to merchants, they won't know which of those people now have the other outputs, until or unless those other people spend them along with txOuts they can link to that person.  Again, best they'll be able to say is "one of these people whose coins went into the transaction." 

But this requires that Alice, and Bob, and Carol, and Dave, etc have a way to set up the coinjoin that Eve can't figure out.  Even if Eve is one of the people putting coins into the coinjoin and getting coins out, she shouldn't be getting information about what other people are putting in and getting out.

Heh.  Okay.

The way things are now, snoops looking at the block chain can mostly tell which transactions were made by the same people as other transactions.  If they identify a single thing as belonging to a particular person (which is usually easy, because among other things they listen on the network to get the IP addresses where tx originate) then they can generally walk it back and identify every other transaction that person has ever made from that wallet. 

People generally don't think this is okay.  Even if they're not crooks they don't necessarily want everybody else to know when and where they bought a dirty magazine and some hand lotion - or, you know, bondage gear or any number of other things that are just plain private. 

So they look for a way to mix up transactions; store txOuts in the block chain somehow where snoops can't tell which belongs to whom.  When a hundred people do a coinjoin, you take a bunch of different transactions, and make them into one giant transaction, with maybe hundreds of different txIns and txOuts - and now the snoops can't tell any more which of the txOuts belongs to whom.  If you then open a new wallet and put the txOuts from the coinjoin into it and no txOuts from your old wallet, they'll never be able to link the purchases you made (or payments you received)  before the coinjoin with the ones after it.  At most they'll be able to tell such-and-such a purchase group of purchases after the coinjoin was made by one of the hundred people who participated in this coinjoin transaction. 

But it's dastardly hard to do this in such a way that when you're exchanging messages to set up the coinjoin, you don't give the eavesdropping snoops enough information to suss out which txOuts from the coinjoin belong to whom.  Especially since everybody has to be able to verify that the transactions are correct. 

So what you try to do is things like Diffie-Hellman key exchange, where you can have two people (or in this case way more than two) find a secret value together (in diffie-hellman a key; in coinjoin a whole transaction) without giving snoops any clues. 

This is made harder by the difference between the two use cases.  In Diffie-Hellman the parties don't care much what the value winds up being; only that they agree on what it is and nobody who's been listening to them can suss it out.  But with coinjoin you care a whole lot about exactly what the value is, because the value you're trying to agree on has to be a valid transaction that does what you want it to do. 

So we need things more complicated than just hashes and bit commitments and signatures; we need things like cryptographic accumulators and commutative encryption, which are sort of esoteric and usually really compute expensive.

Somebody figured out a way to do it with a compound-exponential accumulator under a modulus (called the ZeroCoin protocol) but it's ridiculously compute-intensive; it would mean everybody has to spend five minutes or so just checking correctness after each block, and people with 'weak' machines couldn't check those tx at all.  I've been wondering about a way to do it using single-exponential accumulators and bit commitments. 

Note:  An 'accumulator' is a keyed transformation such that

A ==> Encrypt with key1, key2, key3, etc, in any order ==> Decrypt with key1, key2, key3, etc in any order ==> A.

You could use something like that to show that you have one of the keys that went into creating it, without revealing which.  That is, assuming you  manage to not reveal the key that went into creating it when you encrypt it the first time.  Which, if you don't, makes the transaction hard to check....

Bitcoin will flatly refuse to become what banks need, which correctly represents the desire of its community. 

Therefore banks will use a different block chain, with additional transaction types, that does the things they need.  It's that simple.

You pretty much can't create money by loaning at fractional reserve in Bitcoin.  (Mark Karpeles managed it, but he lied about the risk, and there's three different countries lined up to put him in jail for fraud.)  And that is what banks do.  Further, that is what people RELY on banks to do.  Harold and Harriet go down to the bank to borrow money when they need a new car or when they're buying a house, and they WANT to be loaned money, and they want a low interest rate, and they can get the best interest rates at a place that makes loans on fractional reserves, because having that leverage means banks can meet operating expenses. 

Furthermore, governments rely on banks to loan at fractional reserve because adjusting the reserve rate is their goto method for regulating money supply. 

Now, most Bitcoiners regard no loaning at fractional reserve and no government regulating the money supply  as good things, and therefore Bitcoin will never do it. 

But if banks can't do it with bitcoin, they'll just do something else besides Bitcoin, and they'll survive just fine because they'll provide services Bitcoin won't.

Likewise, banks want to be dealing in money that police can trace and courts can recover.  If they get ripped off, they want to be able to sue the bastard who did it, have their assets frozen until the case is settled, and get their money back.  It lowers their operating expenses and there's an existing legal framework that does it.  Harold and Harriet want the ability to stop payment if a vendor sells them a network cord that doesn't work.  Banks want to be able to sell mortgaged assets if it turns out that Harold and Harriet default on their mortgage.

And once again, if they can't do that with Bitcoin, they'll do it with something that isn't Bitcoin. And they'll prefer that other thing over bitcoin. 

Because bitcoin will never do these things, and both Government and Bankers see great value in an open central ledger (because quite correctly none of them trust the others), they will create an open ledger, using block chain technology, that has little or nothing to do with Bitcoin.

That open ledger will support transactions like courts freezing assets,  police recovering assets, loans at fractional reserve, txOuts destroyed as bad debt, transactions spending the money of people who don't divulge their keys as a result of court judgments, etc.  Block chain technology can do all of these things; you just record a transaction and the nodes check that it falls within whatever rules they check.

If Bitcoin doesn't add these transaction types to its block chain, and it most emphatically won't, then banks will just make their own block chain and ignore Bitcoin. 

I would not expect difficulty to increase very fast; The system simply doesn't provide reward proportional to proof-of-work in the long run.  A miner would not be getting hugely more coins for doing PoW than he'd be getting just for regular tx with minimal PoW, and no matter how much PoW he did it could get orphaned by a chain with less PoW and more coin age if he doesn't process transactions and promptly publish his blocks, so trying to force a reorg with PoW would be futile.  At the same value per block as another coin with a more traditional structure, a miner would always be better off mining the other coin where ALL of the money reward is proportional to Proof-of-work.

Including the hash of a recent block is exactly what Gmaxwell was referring to when he mentioned "staking a block."  It makes the txOuts that existed before the block into a finite resource that can only support one chain or the other, and (sort of) fixes the nothing-at-stake issue. 

It's still pretty sensitive to exactly *when* large, old txOuts get spent though;  Having a checkpoint server sign blocks which thereafter couldn't be rejected in a reorg would be a good idea, settling the canonical-chain issue within seconds if it signs only the first valid block it sees.  But I'd want the system to continue to be robust when the checkpoint server goes offline, so I should think hard about making it really difficult to force a reorg once a block has been accepted, while still allowing it to happen when some nodes do get firmly stuck on the wrong chain, or even after a significant network partition. 

A special nondivisible token on the net that counts for a billion coins in terms of coin age is interesting, but there'd have to be a way to make sure nobody could just keep transferring it back to herself and capture the block chain.  If someone can form every block just by transferring the token from her left pocket to her right every round, she could unilaterally determine who has permission to get tx into the block chain, forever, and that's no good.  You'd also need a way to replace if if it got lost, dislodge it if it got into a txOut that someone just plain doesn't spend ever, and insure that it doesn't get duplicated in a fork. Having one of them bouncing around in each branch of a fork would be a whole lot of no help.

Well, consider the RSA/ extended Diffie-Hellman construction:

When you have X^AB mod G, (where X and G are public) you can find B if you know A, or you can find A if you know B, but you can't find AB, or A, or even B, unless you know the factors of G. 

So you can multiply the exponent by a couple of factors and produce a new accumulator - and nobody can tell what the factors were.  But later you can undo it, because you know what the factors were.  And you can do this even if a dozen other people have since added or removed values to the accumulator, in any order. 

In a lot of ways, what the people forming a coinjoin are doing is passing around an accumulator.  None of them knows what the others are putting in, but each is able to check the final accumulator and make sure their own input is part of it (ie, their values are still factors of the exponent).  And then if they break it down in a different order, at no time does it acquire the same value as it had at any previous state or one easily related to such - but it returns to the same initial state when everybody's value has been taken out of it.

That's sort of a truncated version of what Zerocoin does - but if you work out the details, you might be able to do it without that horrible zero-knowledge signature of knowledge proof.  People would only have to verify steps and final result of a single join per block.

I'm just sort of brainstorming here... 

This is kind of a raw and undeveloped idea, but I'll throw it at the wall anyway and see if anybody can find a good reason why it wouldn't work.

The basic goal would be to keep the network distributed instead of concentrating mining into huge hives of servers who are then the only ones making any new coins.

Suppose there were an alt in which you had to present a proof-of-work -- a small one, but yes, you'd actually have to mine a little bit -- just to make a transaction.  Every transaction would have a 'micro-coinbase' output recording the hash low enough to authorize your spend. 

The priority of transactions would be determined based on two criteria; how good was the proof-of-work, and how much coin age was used up.  It might be something like the sum of the percentile ranking in each category; so if you turn in a zero hash (infinite proof of work), or have more coin age in your tx than anyone else, you get a score of 100 points on a scale of 200.  But if your coin age and proof of work are *both* in the top third with respect to other transactions, then your transaction would have priority of 133 or better.

Blocks would be formed whenever sufficient tx are assembled that total proof-of-work exceeds the minimum difficulty and spent txOuts exceed the minimum coin age.  Whenever there were enough transactions out there to add up to that diff and coin age, somebody - anybody, really - would form a block.

They'd get the tx fees for the block, add the block to the block chain, and publish it.  At this point the value of all the micro-coinbases would be determined according to tx priority.  The bottom quarter in priority would get nothing, the second quartile would split up two shares of the block subsidy, the third would split up three shares, and the highest-priority quartile would split up four shares.

Block chain forks would be resolved in favor of whichever fork had the greatest amount of coin age (proof-of-stake), excluding spends of txOuts created after the fork.  Transactions would have to include the hash of a recent block so they couldn't be replayed into a different fork if the reorg goes back before that block.  This makes txOuts existing before the fork into a finite resource that can't be infinitely duplicated (nothing-at-stake) but also has the effect of invalidating tx if there's a reorg that goes deeper than their base block.

Now, I think this would  work, would reward actual users for reasonable mining efforts accruing to ordinary use, and would pretty strongly resist devolution into a contest to see who has the biggest ASIC farm.

I see people on here being asses to the female half of humankind every so often, and I'd like to remind them that we don't even know which half of humankind Satoshi was a member of. 

FWIW, the first dev version of Bitcoin from Satoshi that I saw didn't even have a block size limit at all.  So, I'd pretty emphatically say this crisis wasn't her idea.

Putting a limit on the block size was Hal Finney's idea, because he was running down that standard list of threats and got to "Denial of Service."

It was considered a temporary measure, just to prevent stupid stuff from happening. At the time bitcoin was still sort of imaginary nerd money and some 4chan troll would likely have tried to spike it with an impossible-to-store block chain just for the lulz.  None of us ever imagined it would become this point of contention.

Effective coinjoin that doesn't create metadata patterns of its own is hard. 

If you want the capital-S Solution, the Zerocoin protocol is down the hall - but it wasn't, and won't be, implemented in Bitcoin because the cryptographic accumulator comes with ridiculous compute-time overhead for verifying spends. 

If you want a lowercase-s Solution, Dash has its mixing masternodes; some node operator posts a big bond to the block chain to get to be trusted for pooling, and then people run their transactions through a dozen different masternodes that cant see what each other are doing to get them thoroughly mixed before they go on to the block chain.  This doesn't suck, but it's also not ideal; those masternodes are "trusted" in the sense that if they cooperate they can de-anonymize transactions. 

But coinjoin, in the absence of mixing services (aka masternodes) to join transactions between arbitrary people who've never heard of each other, creates exactly the kind of metadata it seeks to avoid.  People analyze the block chain and coinjoined transactions attract attention because they are anomalous in terms of how their inputs and outputs are connected to other tx.  When the chain is analyzed further, the snoops can identify which actors know each other and cooperated together to create the coinjoin. 

FTFY. 

I don't remember a single thing about him/her that indicated giving a tinker's damn about prestige or publicity.  And Satoshi certainly doesn't need the money of a motion picture or book deal.  I just don't buy it.


Okay, big nope.  Satoshi absolutely never lost a key.  S/He kept correspondence keys I'd deleted a whole year previously and was amazed that anyone would EVER lose keys.  I remember him/her being puzzled about the idea that people might not get further payments to old txouts because they'd delete or lose keys after spending txOuts.  Exact words:  "why would anyone *ever* delete a key?"  

As for being altruistic, I dunno.  I think s/he just doesn't give a crap about having a lot of money.  I know for certain that s/he didn't do this for the purpose of getting wealth for him/herself.


No, not any more.  The second halving is coming up, and at this point 15 million coins are mined already.  Satoshi's coins are less than 10% of the coins out there.  It would affect the market, sure, but it wouldn't kill it.  And anyway, why would the same person go to great effort to create bitcoin, and then destroy it?  That makes a lot of nonsense.  If s/he does start spending coins, it won't be a massive dump.

On the contrary, Bitcoin has been demonstrated not to be run by a pack of scammers.  Whereas, with alts, if you assume that anyone with a new coin is a scammer, you'll be right more often than wrong. 

Satoshi may be the only anonymous coin dev ever, who DIDN'T Abuse anonymity to the detriment of the coin's users.

The 51% attack works only if nobody notices you're doing it.  That's why people keep looking at the pool percentages to make sure no single pool goes over 51%. 

But it's easy to arrange things so none of those numbers go over 51%.  All you need do is put some fraction of the 51% attack under the name of a different pool.

If 70% of the hashing is being done at the same immense data center, in a business owned by the same set of people, I really don't give a crap if they pretend to be two or three different pools.  The 51% is a reality. They allow other people to get blocks only as often as they have to in order to avoid arousing suspicion.

It's the flying spaghetti monster.  A classic case of a thing which is believed to exist although completely impossible to prove or identify.  Quite appropriate.

If Satoshi wanted to announce that he's still around, without painting a target on his back, he could just get on Tor and send 1 satoshi from one of his early mining outputs to the address of another. Everybody would notice.  Everybody could tell, hey, someone still has the keys to those addresses. 

But why would he want to announce anything?  This is the point I keep trying to make.  Satoshi does not stand to benefit, at all, by ever using that identity again.  He knows it.  And THAT is why you should not believe anyone claiming to be Satoshi. 

Satoshi has absolutely no reason to announce himself.  Anyone who has a reason  to do so, isn't him.

I thought I saw a transaction go by with an utterly ridiculous fee.  But now it has disappeared from the pool, and it did not wind up in a block. Or maybe I just read it wrong.  

As the number of bitcoins awarded per block goes down, the hash rate and rate at which electricity is spent will also go down.

At some point miners become dependent on tx fees alone, and I expect that a fee market will develop that makes bitcoin quite expensive to use relative to other forms of payment, for all transactions except the very large ones.  Someone making a 100BTC spend may not mind spending 1BTC on fees.  Someone making a 4BTC spend, not so much.