Proof of work is significantly inferior than proof of stake, for several reasons.
1. Centralization. Just look at the distribution of hash power. The problem is that mining has almost infinite economies of scale, logically leading to complete centralization eventually, ie. one mining actor. Had a powerful state wanted to destroy bitcoin, raiding a few mining farms is already trivial and cheap. The security of bitcoin depends on lack of political will.
There are no economies of scale in PoS. There can be in some PoS implementations, but it's not characteristic of all PoS.
Thanks for your reply iruu! The very real problem you outline of centralization of miners is exactly the same or worse in a proof of stake system. If miners can work together to become a nefarious majority, so can forgers. In fact logistically it would be much easier for the forgers but that is a moot point: proof of stake offers nothing new here. 2. Low and very expensive security. The miner doesn't have any economic interest in the currency per se, only in daily miners' revenue (new coins + fees). If at some point expected return on capital from acting against currency is higher than expected future miners' revenue, rational miner will become hostile.
This is a much more serious problem if it's possible to rent vast amount of hash power, because then the costs for the attacker are drastically smaller.
Thus, on a perfect market with renting, the price for control of pow coin for time t is just a tiny bit more expensive than half of miners' revenue in time t. Hard to say what's the time required to significantly profit from damage, probably by using derivatives on coin's price. A day?
In comparison, attacking Proof of Stake currency requires losing the value of >50% of coin's market cap, which is a much bigger number than half of daily mining reveneus. PoS currency is much, much safer.
Of course it is possible to rent hashpower or stake at cost. We all know that cost and so bury our TXs under an appropriate number of blocks. These are valuable resources so a market exists for them. I fail to see the difference between hashpower and stake in that regard. Remember also that the >50% attack is not >50% of all the hashing power (or stake) in the world, but only >50% of the current network rate. For a PoS coin this is much lower than half of market cap. Perhaps you have some kind of proof of burn system in mind with this requiring losing stake? If you wish to claim PoS is much much safer against 51% attack you need to outline an algorithm that closes the new holes introduced by PoS (deep chain re-orgs with old keys, resusing stake, good solution to choosing which stake gets which block) but also come up with some reason it is better (none is offered).
Proof of stake is a system for achieving consensus as to the state of balances. A proof of stake currency can have PoW method of distribution which plays no other role. Or any other method.
Good point! However, how do you intend to incentivise forgers if not with coinbase rewards and fees? If you remove this "interest payment", do you think folks will still be interested? I don't. |
|
|
|
Very interesting paper! Thank you for discussion here.
"In contrast, incumbent credit/debit card payment systems are faster [3] and more certain for consumers. Incumbent bank wire transfer, e.g. Swiftnet [4], is faster and more certain for business-to-business users. Incumbent payment transfer systems have data security policies that Bitcoin lacks [5] with regard to protecting host computers and customer data, e.g. private keys."
I disagree with these statements. Incumbent systems do have advantages but they are not necessarily faster or more certain (can be reversed up to months later). As for security policies the incumbent systems are all way behind (pull system, no triple accounting, etc).
When I say faster, I mean the typical customer check-out experience at point-of-sale. You verify the payment account at a terminal, swipe a card, and collect the receipt. When I say more certain, I mean to cover the odd case where a bitcoin transaction makes into a block after a certain delay, or the less likely, but worse case when the transaction never gets into a block. The bitcoin network forwards transactions on a best effort basis. There are no guarantees that the transaction will be recorded into the blockchain. Thanks for your reply! Funny you should mention that. I waited in line behind a credit card payer at the sandwich shop yesterday. Long wait, card didn't go through. Next in line was me. I asked for the total in bitcoin, pressed send. Accepted (at zero confirmations) instantly. There are no guarantees in life, but bitcoin is pretty damn good.
Why? There is no reason to use proof of stake. Saying that miners use too much energy is simply saying miners are not smart, not that there is a problem with proof of work. Miners are free to use as much energy as they like. Proof of stake looks to me like a solution in search of a problem.
Proof-of-stake was immediately recognized as a very attractive idea when first proposed back in 2011. It is the main reason why PeerCoin has the 4th highest market cap. Satoshi admitted that his design would eventually force miners to congregate in locations with the least expensive power, as math shows that competing miners will use all the block reward to support their efforts. So we need it because other people think we need it? Peercoin also has a novel reward schedule, both in it's proof of work component with reward linked to difficulty, and of course in the proof of stake portion that appeals to the greedy. Yes, people will use resources more where they are cheap. Is that a problem? |
|
|
|
|
Very interesting paper! Thank you for discussion here.
Two comments:
"In contrast, incumbent credit/debit card payment systems are faster [3] and more certain for consumers. Incumbent bank wire transfer, e.g. Swiftnet [4], is faster and more certain for business-to-business users. Incumbent payment transfer systems have data security policies that Bitcoin lacks [5] with regard to protecting host computers and customer data, e.g. private keys."
I disagree with these statements. Incumbent systems do have advantages but they are not necessarily faster or more certain (can be reversed up to months later). As for security policies the incumbent systems are all way behind (pull system, no triple accounting, etc).
Second comment:
Why? There is no reason to use proof of stake. Saying that miners use too much energy is simply saying miners are not smart, not that there is a problem with proof of work. Miners are free to use as much energy as they like. Proof of stake looks to me like a solution in search of a problem.
|
|
|
|
|
Thanks ChuckOne for keeping the discussion going and those posters who have helped educate me on this issue. I have to side with those who argue the genesis block is a checkpoint of sorts. But that is a semantic argument isn't it? To derail more meaningful discussion?
Indeed it looks like the goalposts have changed in this discussion. In my opinion the proof of stake proponents still need to pursue the goal of showing us one way in which proof of stake is necessary or helpful. So far it looks to me like the only way it is helpful is to make an economic distribution which is more unfair. Of course, more unfair is good if you are on the right side of the fence.
Instead of trying to explain what problem PoS tries to solve, the discussion has been around just how bad the various other security holes introduced by PoS are.
The argument that PoS is somehow more energy efficient is false. Either you allow your miners (forgers) to expend as much energy to mine as they like (as e.g. BTC and PPC do and perhaps NXT as well if this talk of SHA256 guesses in forging is true).. or you don't. If you are allowing miners / forgers to expend as much energy as they like, they might spend a lot if they so choose. Hardly a problem in need of a solution is it.
As to proof of stake somehow being more immune to 51% attack the discussion has basically been around how much more vulnerable it is than proof of work. A lot more vulnerable? Or just a little bit. In any case there isn't really a problem here either because all participants know of the possibility of a double spend attack and associated costs and can wait for an amount of confirmations that they choose accordingly.
|
|
|
|
I hate to discourage this perhaps noble goal but it is unfortunately a bad idea. On one side we will reverse engineer your verification procedures (it won't be hard because you have to open source them anyway). How hard can it be to generate a million unique realistic enough fingerprints? On the other side we will have large databases of sounds and data from real unique humans and even call centers filled with unique humans waiting to solve captchas. Meet my friend Sybil here from Iceland.  |
|
|
|
|
Keep up the great work devs!
Right now I would put highest priority on getting Obelisk servers out there. All traffic currently going through wss://gateway.unsystem.net <--- (glad I'm not the one running this box)
|
|
|
|
Yes I missed that.  Obvious now, Ty. It gets worse the more you think about it. An attacker could acquire coins (if he didn't already have them) by buying private keys which have no coins today but which had significant balances at one point in the past. Imagine you at one time had 100,000 peercoins but no longer have any. The private keys are worthless to you but to an attacker which intends to rewrite the chain back from that point they may have some value. So he gives you 100 PPC equivalent for the private keys which "had" 100,000 PPC. In this case the attacker isn't attacking for free but he is doing so at very low cost. He doesn't even need to have already owned or buy up a significant stake and then try to sell them off before the attack he can just attack for millibits on the coin.  ! Wow, thanks DaT.. for getting me all paranoid. I guess this is avoided in PoW by difficulty weighting. In other words, if I say here take a look at my big chain 400,000 blocks also starting from the same satoshi genesis that I produced in 1 hour falsifying timestamps, this is longer than the current chain use me! a node would say: yeah great, but the difficulty was 0.001 the whole time that is not really a longer chain than our current BTC chain. At least, I sure hope that's in the code. Unfortunately stake difficulty doesn't represent real work so it can always be faked in a reorg going back to some substantial early stake as you point out to us. |
|
|
|
|
Did you know most of the easily accessible hydrocarbon energy on earth was burned away immediately in flaring?
On the contrary to your thesis, PoW valuation will help us use energy more efficiently. Once we realize that energy = value = money, we might just stop leaving all our lights on and burning gas to move steel round in circles on parking lots.
|
|
|
|
|
Tested with 0.1 BTC. Withdraw not working. *face palm*
Edit: For completeness: my small test withdrawl did come through 2 days later. However I can't sign in with https anymore.
|
|
|
|
|
Wow maybe third world countries like the USA will get working trains one day.
|
|
|
|
Nice paper It is indeed a complex ecosystem of competing currencies we find ourselves in. couple comments: "Sudden jumps and rapid phase transitions are programmed at xed dates in time and are likely to ruin the life of these currencies" Participants know in advance about the sudden jumps and value hashpower and currencies accordingly far in advance. See 1st bitcoin halving. Will people prefer this to the nondisclosed jumps/transitions in supply and mining rates we have seen in fiat or even gold? "We discovered that neither Satoshi nor bitcoin developers have EVER mandated any sort of transaction timestamp in bitcoin software." I disagree. Block height is one of the best timestamp mechanisms ever developed. Second, more conventional dates ARE in the software as they are required to set difficulty properly. In some commmodities there is not even a public record let alone a great timestamping system. "In this paper we show that most crypto curren-cies simply do NOT have ANY protection against double spending." Participants all know and understand the possibility of a longer-chain or 51% attack and its cost. We wait for the appropriate number of blocks (confirmations) until we know a double spend effort on a payment we are accepting would be a total loss for the payer. Pretty good protection against double spend IMHO, especially compared to fiat  |
|
|
|
|
These bank decisions have only changed the character in which RMB holders are aquiring coin.
|
|
|
|
|
The only way to store substantial gold securely is to use undisclosed locations. That doesn't lend itself well to a centralized, audited, "backed by gold" currency issuing institution which as we know doesn't work anyway. The idea is full of gaping security holes and also experimentally tested to be a failure.
|
|
|
|
The pseudo vegetarians probably far outnumber the real ones. All the vegetarians I know eat some form of meat, or cheat sometimes. Can't really blame them though...
Hello, vegetarian refers to preference at the moment. All animals consume some animal protein, it is impossible to avoid in this geologic era. |
|
|
|
SHOCK VIDEO➙ Obamacare Contractor Pays Workers to DO NOTHING – Sit at Computer & Press Refresh
Imagine my shock. Federal government employees paid to do nothing? Stop the press! |
|
|
|
Oh you absolutely cannot just send 300MB, your peers could just lie to you and it would be greatly in their short term financial interest to do so (because they could make you accept inflation or spends of non-existing coins). But you can produce this trusted state for yourself and you don't need to store anything else. ECDSA is cheap, with libsecp256k1 my i7 desktop here validates at almost 6000x the maximum realtime rate for the Bitcoin network.
Thanks for your very helpful replies. There are two issues we are discussing: 1) Cost of downloading & validating full chain 2) Cost of "keeping up" a full node I guess your machine is 6000x more than adequate enough for task number two  My original concern is with number 1. For #1 you don't "need" anything more than the UXTO plus set of pruned merkle trees. The same optimizations which improve the efficiency of #2 can be used to improve the efficiency of #1 as well. Great, so how do we ensure that I am getting a legit UXTO/tree set? Where are we now with this stuff? I.e., can I start up a full honest node to help support the network in an hour or less? I imagine there are some problems that could develop should the number of full nodes continue to drop. |
|
|
|
Ether permutes space. Then we found out ether is alcohol that people snuff to get high and aether is the mystical substance that permutes space.
...
Aether is a mystical element that permutes all of space and I think its appropriate.
I believe the word you are looking for is "permeate" and not "permute". So the idea of the mythological "Aether" reflects the vision with what we are trying to accomplish.
Hardly mythological! The concept underlies much if not all of modern physics though the word itself has grown out of favor in academia. Good luck; watching your project! |
|
|
|
How many of you people go out and buy Bitcoins and then use those Bitcoins to make a purchase? I'd be willing to bet none of you do because it's too difficult to make it worthwhile and if you do you just increased the cost of your purchase.
That's a bet you will lose quickly: yesterday 50,000 bitcoins were spent. For me it is much easier to make a purchase and I have decreased the total cost. |
|
|
|
...
the Fed is still adding $45 billion in bonds each month, ...
Just curious, is Yellen providing the functionality here of getmininginfo() ? Is there a way for the public to verify the number in any way? |
|
|
|
|
There are a few other things one must learn about bitcoin before using it effectively. One of them is that they are divisible. Some of us learned that a dollar was divisible into 100 cents, remember? It's not rocket science.
|
|
|
|
|
Show Posts
