You can't strip context over a silly example. Let's not be so blind sighted. I like bitcoin too but if the industry ruins the life of some people we should accept the reality.
Here's reality: you either support bitcoin, and accept the idea that there will be noise anywhere close to mining rigs, or you reject bitcoin for this idiotic reason, and consequently show support for the alternative, debt-slavery, war-machine, poverty-generating fiat standard. |
|
|
|
You mean to say that adapting these much larger signatures will cause a collapse in security unless we increase the block size, right? No, I mean that we could not upgrade at all, and leave quantum computing be a threat. I don't see this happening, but it's also another option. At first glance it seemed to me that you are trying to say that changing the block size changes the mining economics, which I don't agree with. I hadn't thought of introducing a new field as stwenhao said, or changing the witness field we currently have. Maybe it's possible to increase the absolute block size without interfering with mining economics. What's the solution then? Can't find. Maybe quantum fud wasn't all fud at all. Time to panic? It might be a FUD that it will be a threat anytime soon. The problem is that, after many years, it might be too late until the whole network upgrades and endorses the protocol changes. It takes a hell of a lot of time to get consensus in bitcoin. We need to upgrade in the next years, but keep migration optional, if quantum computers do not prove to be threatening. |
|
|
|
This is one of the reasons why I said this won't be easy. Even if you strip away the controversial freezing and determine that FALCON-512 is in fact the best, it would require a block size increase which is yet another controversial topic. It further complicates the delicate situation.
The alternative to using FALCON-512 would be to waiting indefinitely until an entire new signature algorithm is penned, which might produce smaller signatures. Seems like a dead end, where we have to change mining economics by increasing the block size, or we fall short on security. |
|
|
|
That’s impressive! How did you determine the difficulty for this block?
Difficulty is determined by dividing the maximum target by the block hash. >>> max_target = int('00000000ffff0000000000000000000000000000000000000000000000000000', 16)
>>> min_hash = int('0000000000000000000000005d6f06154c8685146aa7bc3dc9843876c9cefd0f', 16)
>>> print(format(int(max_target/min_hash), ',d'))
50,541,668,626,379,227,136 |
|
|
|
It's block 756951: https://mempool.space/block/0000000000000000000000005d6f06154c8685146aa7bc3dc9843876c9cefd0f. It has a difficulty of more than 50 quintillion (50 million trillion). For comparison, right now difficulty is 127 trillion. That means it's around 393,000x more difficult to solve. Imagine that with 900 EH/s, the network has a little over 2% chance of mining a block at that difficulty in one year. With current hashrate, it's expected to find such difficulty only once per 50 years. |
|
|
|
Yeah, you definitely can't live next to this. If I were the people living next to Marathon, and there was absolutely nothing that I could do at the City Hall level, I'd put the house for sale. If it came to your neighborhood, would you still support bitcoin mining?
If I came next to your house, with loudspeakers, playing music loudly enough to be under the legal limit, would you still support the idea of loudspeakers?
People who think "crypto money" buys politicians are for a serious wake up call on what fiat money is capable of. Bitcoin mining does consume a lot of electricity, does produce a lot of noise, but it provides the world an alternative to a system that is responsible for most of genocide and poverty. There's nothing as morally imperative as ending central banks, and bitcoin is the only way to do that. People who wouldn't support bitcoin mining because of this, are completely blind and hypocrites, as they consequently show support for the alternative debt-slavery system that is responsible for a lot more evil. |
|
|
|
On the current quantum-resistant algorithms, Lopp doesn't believe any is good enough for Bitcoin. He even said "they suck" if I remember it correctly. They take up too much space. The signatures and keys are longer and they are slower to verify. He clarified that the idea of the BIP is not to choose a post-quantum algorithm, but how to get the community to migrate to a new system asap after one is chosen. These are the proposed solutions: The least worst, in my opinion, is FALCON-512. Easier to verify (0.6x), and "only" 10x in size, in comparison with Schnorr. It will be 24x slower to sign it, but that's completely fine, IMO. |
|
|
|
Taher Elgamal is also considered the "father of SSL", yet many later inventions that used SSL obviously weren't his. Adam Back invented hashcash, but that does not mean that no person could have used this knowledge to create something new. Also, Adam used a different version of hashcash than Satoshi, difficulty in hashcash was expressed in bits. You can also look on code written by Satoshi and Adam, and see they're not written by the same person. |
|
|
|
This could lead to Bitcoin losing public trust - creating a lose-lose situation for both society and the Bitcoin community as a whole. And how is freezing those coins anyhow different? In both cases, people lose access to their coins. This, also, undermines trustworthiness. Imagine going into your wallet after 5 years and realizing your transaction is invalid, because bitcoin "upgraded" to rules that consider your coins "too dangerous" for the network to have them vulnerable. This phase is designed to preserve trust in Bitcoin by ensuring that users don't permanently lose access to their funds. And what about paper wallets? Or bitcoin wallets that weren't generated using some HD standard? Or timelocked coins? Or any coin sitting on a public key?
Freezing coins provides no benefit to the network, as a whole. Only potentially to bitcoin holders, as the supply of money declines. If coins are not frozen, then there's a time period during which a quantum attacker might be able to recover many of them. This will result in victim holders losing access to their coins, and non-victim holders losing purchasing power. If they do get frozen, victim holders still lose access to their coins, and non-victim holders might not lose purchasing power. The only difference is that in the latter, pro-freezing scenario, we make sure that every single victim holder, with coins sitting in quantum-unsafe addresses, will certainly lose access to their coins long before a quantum attacker appears; we are precautionarily violating their property, which is something deeply against the philosophy of bitcoin, in my opinion. |
|
|
|
Am I missing something or did you not read the original post? That is the key point of the whole proposal. To be precise you can't force someone to migrate per say but by disallowing the spending of previous signature types you are in practice doing just that, forcing them to migrate or lose their coins. Yes, apologies. What I meant is that some of us are not in favor of a "mandatory migration", but rather an optional one. To not freeze any coin, but leave them on the fate of their security. |
|
|
|
It is dangerous to introduce a mandatory migration because it is a precedent and it significantly lessens the credibility of Bitcoin and the bit of our community that feels safe with Bitcoin. I don't see anyone proposing a "mandatory migration", nor can I see how this is possible in practice. You can't force people to migrate to quantum-safe addresses. You can only point them how to do it, after a soft fork is passed. The "dilemma" is whether to freeze coins that do not migrate after year 20XY, or leave them in their fate. I would find many reasons why the former would result in a much worse network that people would lose trust to. In either case, people who do not get informed about the emerged threat, years into the future, will lose access to their coins, in either case, frozen or not frozen. |
|
|
|
Actually the bolded is untrue, just as all derivative markets DO affect the overall market cap and remove the scarcity aspect of the underlying asset. But the bank that holds no bitcoin reserves does not interact with the bitcoin market, and thus, when it sells a "wrapped bitcoin", it doesn't suppress the price in any way. Whoever takes the promise just plays against the house. |
|
|
|
If you can't doublespend, you have no chance of creating any fractional reserve. You can lend your "fake bitcoins", but that is useless to everyone else not part of your system. I'd say we're not that far from such a situation. Many people already fall for "wrapped" Bitcoin, which it nothing more than a promise to real Bitcoin coming from a company hiding in the Cayman Islands. And yet, people fall for it. I wouldn't say they "buy" bitcoin. When you can't put your bitcoin to a bid or ask, nor can you spend it on-chain to some merchant, then you don't have it, nor can you affect the price howsoever. You're completely outside the system. A "promise" of bitcoin is more like a bet that you would put in a broker. Let's say that I open up a bitcoin bank, with zero bitcoin, only dollars in reserve, and I sell bitcoin promises. If these promises can only be redeemed for the bitcoin price at the time the redeemer decides in exchange for dollars, then he's just placing a bet that bitcoin will go up; does not affect bitcoin economy in any way. Now let's say that I open up a fractional bitcoin bank, with zero dollars and zero bitcoin in reserve. For every dollar I get in exchange for bitcoin promise, I only buy 10 cents worth of bitcoin without anyone knowing (practicing fractional reserve, with 10% in reserve in secret). If I grant my clients the right to withdraw bitcoin promises for real bitcoin, then it's a betting platform for 90% of the coins, and a custodian for 10% of the coins. (Of course I risk going bitcoin-bankrupt, but let's ignore it for the sake of simplicity.) So, essentially, one could claim that clients in those banks are "tricked" into believing they're buying bitcoin, while they're placing a bet on bitcoin, but I'd counter-claim that since they did not withdraw immediately, they weren't looking to buy bitcoin in the first place. What they would want, is to bet that it will go up. |
|
|
|
Sure you can! Just not on-chain. Just like a bank can lend out a million dollars without having a single physical dollar in the entire building. As long as the dollars (or Bitcoins) only exist on their own accounting system, they can pull it off.
If you try to withdraw a million dollars, the bank won't let you. The same will happen to Bitcoin if they get their way. Why would you want to get a loan in paper bitcoin, though? Why not take a loan in paper dollars, and use them to buy bitcoin? This way, you don't have counterparty risk (bank going bankrupt, or practicing fractional reserve with no reserves), while you do borrow the bitcoin. You're also increasing the supply of dollars, while decreasing the market supply of bitcoin, driving the price up. |
|
|
|
Thus, the whole BIP is based on a completely flawed concept of Bitcoin's economy.
Maybe what I think is an oversimplification of reality, but here's how I explain this reasoning: There's a perception, perhaps flawed, that what determines the consensus is dormant wallet holders. This is not entirely flawed, because large holders do move the market value of bitcoin by selling the forks for bitcoin, and thus, play key role by being in the position to determine which fork remains the most valuable. Certainly they are not the only entities that determine that, because their coins are valued that much, because people want it, and they want it, because it fits their definition of what's the "correct bitcoin" in the free market. For example, if a few large holders gathered, all holding more than 10 million coins, and decided to introduce censorship on the protocol rules, that wouldn't pass because the demand for coins in a pro-censorship network would likely go down. (And thus, would likely lose as "economic majority" by selling their bitcoin for their fork.) I think there's a similar case with Satoshi-era coins and this dilemma. People with dormant wallets might want to silently remove Satoshi-era coins from circulation, because they try to justify to themselves that those coins are lost, as they have a big conflict of interest. On the other hand, I'm not sure how good idea it is to them, if many bitcoiners consider it a violation to first principles. I think this issue requires a lot more discussion. |
|
|
|
My two sats on this: - Satoshi-era coins are not lost coins, and the fact that we, bitcoiners as majority, have passively accepted them as lost is something that is worth examination. We have seen some of those coins being spent after more than 10 years of inactivity, and yet we still treat them as "lost". If "price stability" is what we truly wanted, then why not freezing them at the present? In the end, it'd be within the realms of possibility that Patoshi woke up and spent his coins. I think you understand how this opens a can of worms.
- FALCON-512 seems the best solution, at the moment, but the block size has to increase, otherwise the throughput would dramatically decrease. My thought is that we should increase the block size by the same order as a regular transaction size is increased. FALCON's signature verification is also a lot faster than currently, so the idea that the block size increase would result in slower block sync and verification does not hold entirely.
- I don't like phase C's zero knowledge recovery as a concept. Based on which standard do we accept zk? BIP39, Electrum, something else? It can be very complicated. Also, Satoshi-era coins are sitting on public keys, and there is no more knowledge the true owner can provide than the quantum attacker.
- I think that finding consensus for this issue should be the highest priority right now.
|
|
|
|
Hardware has improved but not enough to make a significant difference in order to make this a possibility. That means your attempt at conveying a sense of urgency is wrong. I interpret his urgency as to "begin finding consensus". I too agree that it might take a long time until a quantum computer breaks ECDSA, but we must not wait until it's relatively, possibly feasible. We cannot upgrade to a quantum-safe algorithm the same way that a Windows update can. It will take many years. Just imagine that even if we have everything ready, developers done writing code and miners done signaling, we still need at least one year of nearly optimal consolidations in a hypothetical clogged up network to migrate most of the coins to quantum-safe addresses. (And that's just hypothetical, it'll take many years for most bitcoiners to move to quantum-safe.) And I'm not even discussing about the dilemma with the satoshi-era coins and whether to freeze them or not to freeze. |
|
|
|
|
Why don't you post the script in here for everyone to see?
|
|
|
|
Spiderpool and F2Pool also joined. From a pool's perspective, I think they have to choose between missing out on transactions because they reject the fee, or missing out on higher fees if users start switching to lower fees. They have more to lose if they reject transactions paying less than 1 sat/vb. My thought is that if pool X starts accepting those, then miners mining at that pool get more money when the mempool is empty. Miners mining at other pools will eventually realize that they make less than those mining at pool X when the network is not congested. Therefore, it creates an incentive to switching mining to the sub-1-sat pool. Right now, the first sub-1-sat mempool block, pays 0.008 BTC. That's 0.25% of the block subsidy. And remember than in 4 years, it will be 0.5%, then 1%, then 2%, etc... Miners need to be very cautious at some point, and cannot afford the luxury of ignoring possible income. Bitcoin game theory rocks. 
|
|
|
|
|
Show Posts
