Can you elaborate? this was my expectation as well.

And some will not. It only takes one that you can't measure to give you enormous error bounds.


It does not. Decenteralized mixing and joint payments can produce transactions which are indistinguishable at the transaction level from regular common ownership transactions.

You could try to wave your arms some more and say that some transaction is more likely to be one than the other because of the presence or absence of other linking transactions or the value involved,  but the accuracy of this guess depends on access to the ground truth on both sides.  You can't even say much about coin selection behavior without knowing in advance the full content of the wallet, and you can't say much about what unknown transaction look like.  Again, you're toying with systemic errors here.  You can basically pick whatever outcome you want based on what biases you assume they result in, and no one could disprove your results. That isn't science.

Which of your (1), (2), (3) in this case covers coins which are deposited in a bank like service but are actively changing ownership inside it with no blockchain activity?

I'm not aware of any method which will give reliable results and, worse, I'm not aware of any method which will give results where we can give a reliable distribution of the errors. The errors could enormously be in one direction or another based on the levels of hidden activity, proper non-reuse of addresses, and self mixing for consolidation/bookeeping and traffic analysis frustration. The levels of these cofounders are unmeasurable.

Right, because we all stopped doing all research when someone figured out that you couldn't predict the times of spontaneous particle emission from a radioactive sample by throwing chicken bones at a table…

They're asking to measure something (ownership) which is unmeasurable via the system. The techniques used can't give lower or upper bounds... and while it may have _some_ correlation to ownership there are a half dozen kinds distinct cofounders which are themselves unmeasurable. Result that have almost 100% error bounds are not that useful. The same data could arise from a single bitcoin owner or from a billion owners (even more owners than txouts! because bank like services completely conceal ownership and activity levels from the system).

The errors from making these assumptions are systemic, not random. It would be a methodological error to treat them as random errors.

You can't even give a distribution over the bias without knowing other difficult or impossible to measure cofounding factors (e.g. amount of decenteralized mixing and joint payment transactions, volume on various services, etc).

Litecoin doesn't help. It modified the normal scrypt behavior for inexplicable reasons to use only a very tiny amount of memory compared to the scrypt paper recommendations. It's quite easy to throw 128k of sram on a chip and scream out one cycle/hash.  You'd get an even bigger speedup over GPUs and CPUs than you get from Bitcoin.

As others have pointed out, in GPU land AMD was really the only game in town. The situation with bitcoin fpgas and asics appears to be more diverse. Moreover, without the public using asics an attacker could get a big speedup.

I've seen some POW ideas that I find intriguing for other reasons— like amiller's idea of using fast random access to the txout set as proof of ability to rapidly process Bitcoin transactions— but I've not seen anything that prevents people with custom hardware from getting a substantial advantage over the public— except by getting specialized hardware into the hands of the public.

If Bitcion itself is made illegal (which seems like far out scaremongering to me, but whatever) then no amount of technical mumbo-jumbo can help it. People like to compare the prospects of outlawing Bitcoin to the unsuccessful drug war or to preventing the illicit distribution of copyrighted goods... but the comparison is not fitting: An unlawful drug still gets you just as high— even if your upstanding friends won't touch it— an illicitly copied movie still makes you laugh. But a money like thing derives its value from other people's willingness to accept it and even underground arms dealers need to eat and pay the rent, so even outlaws have little use for an outlaw currency.  For Bitcoin there is a double whammy: Bitcoin isn't secure if used by only a small niche, resistance to overpowering requires widespread usage.

It's weak for reasons other than the ones listed. Coin selection tries to minimize change, so it doesn't tend to link much— especially if you use addresses once and in some clients like armory linking is explicitly avoided.  So you can have a bunch of coins in a common wallet and still not that much linkage— witness their enormous underestimation of instawallet.

What you're asking for— reliable identification of common ownership— is not possible in Bitcoin _by design_ because the pseudoanonymity of the participants is how we achieve any privacy at all, and thats diluted by combining addresses.

I also expect techniques like the ones used here to become increasingly unreliable as time goes on— as payment protocols reduce address reuse, as client software makes a greater effort to avoid linking, and as decenteralized mixing and joint payment transactions become more common.

Even if everything works nicely and you ignore the uncommon cases, what the available techniques are measuring is point of time control— which is only weakly informative about the past and future and doesn't indicate ownership at all.

If you want to know about how people use Bitcoin— You're just going to have to ask them.

As an aside, we might also care to remind researchers that most institutions have ethical standards required for experimentation on human subjects which normally precludes experimentation without informed consent— in the US the existence these standards are mandated by law for institutions which receive public funding— and deanonymizing and monitoring businesses and individuals using Bitcoin is something with ethical considerations.

54 GH at difficulty 19970091.25813 is 1.36 BTC/day after the halving. $16.32/day at $12.

I suspect your calculator is in need of repair.

Your power figure is 22% of the income— and thats a "soon" rate, e.g. the rate after the hardware which is already ordered and paid for is turned on. And what happens when the difficulty has cranked to 100x on second gen mining asics?

Wha?   The halfing will double energy costs, and there is 48TH in the BFL waitlist thread made public (actual orders are probably much greater)— I understand there will be 1000 bASIC units made, so thats another 54TH, and then another 20 from avalon. So thats 122TH. Plus whatever deepbit and the other efforts do.

Just from the numbers there and the halving you have a 12x increase in power usage per unit reward— 10x if all the existing hashpower turns off as a result of the increases, and I think its not unrealistic to call that a conservative lower bound. And this should all happen in the next couple months? Thats not skyrocketing enough for you?  It will rescale the difficulty charts so significantly that the introduction of gpus will be nearly invisible on them.

Huh? No. Power matters no matter what sane figures you plug in to either my deprecation free model or sturles alternative. Depending on the power costs you assume you might find that bASIC comes out ahead, or you might find BFL does (which is what I expect based on my prior power estimates at 130nm). But it certainly matters as differences in the figure change which product is more cost effective.

It's not surprising at all if they're on different process (or have made some improbable breakthrough against SHA256). And I can't believe BFL's numbers at all if they're not on a substantially more efficient process than 130nm.

They _tie_ at 149.77 under your deprecation schedule. I will be quite surprised if it comes in that low— a more reasonable number would probably be on the order of 300w.  And the deprecation schedule should properly be somewhat longer for the BFL device: Since alternatives on smaller process that use less power would be the major upgrade driver (assuming bitcoin doesn't go bust ). I'll have gotten almost two years out of my GPUs and I don't expect to see progress that rapid on the ASIC front, as we've vastly exceeded moore's law by moving to increasingly specialized hardware.

In any case, my major point was that power really does matter— and I think either of these ways of reasoning shows that it does matter. We can debate exactly how much it matters or if bASIC is tied or worse off¸ based on equipment deprecation which is anyone's guess... but at the end of the day delivery times and vibrant competition are more important factors.

Uhh. If you want to do conservative figures— which you ought to if you're trying to convince other people since non-conservative figures will be ignored— you should be using about 3-4x that power consumption. I'd potentially be willing to entertain bets that no 54GH/s device is ever going to exist on 130nm at that level of power consumption, but regardless, it's certainly not a conservative number.

Though the below analysis shows that even using 150w it's not super attractive.

Uh.  GPUs are power substantially power cost dominated now.

Lets go through the math:

The equilibrium for mining profits is exc = BTC/$ exchange rate, we'll use 11
mhj = MH/joule, lets use 2 (which is conservative as hell: it's the best gpu figure, and ignores cooling costs)
diff = difficulty, currently 3072321.73202076
kwh = $/KWH

So right now, that means that breakeven is at $.30/KWH. Anyone paying that much or more for power is losing money on GPU mining— thats most (all?) of germany, brazil, most of california (the initial rate is lower, but the marginal rate is higher) and some other places. The US average is $0.12/KWH.  At that price power consumption is _40%_ of your mining income.

Thats where GPUs are today and I believe that the deployment of hashrate is somewhat retarded by expectations around asics: People would buy _more_ GPUs and FPGAs and mining would be even less profitable but they're waiting on ASIC products and they're anticipating the halving.  I don't see any reason to assume the stable point for difficulty vs power to be more profitable in the future than it is now.

Regardless.... It's better if we compare these things without caring with the difficulty will do, since future difficulty just adds a lot more debate to the question.

But how do we compare an operating cost with one-time cost? Trying to figure in lifetime costs creates confusion because we don't know what the devices lifetime is: we don't know how long it will last, how long until 13nm ASICs, when really clever SHA256 optimizations make it obsolete, or what its resale value would be. So instead lets use the opportunity cost. Opportunity cost is especially useful when the good in question is durable and can be resold at any time at the same price, so every day you're effectively making the same decision to keep the device or not, which may not apply here but it frees us from having to pick a bunch of debatable parameters.

Lets say you have a stack of cash. You could buy a miner ASIC or you could put it in another investment, so one way to look at the price of a miner is the forgone income which you could have received by doing something else with it.  8%/yr is a commonly used figure for very long term average stock market returns, so lets use that.

8% per year is 0.6434% per month.

For the BFL:
 $1300 costs you $8.36/month in forgone investment income. At 60 watts it takes 43.83 KWH/month, or $5.26 at .12/KWH to power.

For the btcfpga:
 $1070 costs you $6.88/month in forgone investment income. It's also only advertised as having 9/10th the performance.

So for the btcfpga device to match the BFL operating cost (($8.36 + $5.26) * 9/10 =$12.258) under this model it must use less than 12.258-6.88 = $5.378 in power or 61.35 watts. This isn't going to happen. (And I'm a little shocked by how low BFL's claimed power is...).

This tradeoff depends on power costs, So the formula under this model is:
So at 300w your power must cost only $.00358/kwh for them to match, or $.009/kwh for 150 watts.

So I suppose it could be a good deal for people who wouldn't pay for a few hundred watts of additional power (e.g. flat rate rent), or for people who could otherwise make use of the waste heat and only have electrical heating available. Of course, for those people it really is only about the initial cost... at least up to the power consumption level that they can get for 'free'.

We could instead solve for the initial price needed to make it match:

At $0.12/kwh the btcfpga would need to draw no more than 139.87 watts (which isn't going to happen) or the price would have to be _negative_ to make it more attractive than a $1300/60w/60GH device. At $0.04/kwh (about as low as it goes in the US), it could use as much as 311 watts before you should ask to be paid to run one instead of a BFL. At $0.04/kwh and 150 watts the price would need to be $734 or less to make it more attractive.

Of course, all of this analysis can be largely mooted by a small difference in shipping times, failures of BFL to live up to their specs, or CP's device beating its specs.

I'm personally pre-ordered for the btcfpga devices (as well as avalon, which I expect to have similar economics)— but I expect to lose money on them, and I wanted to support secondary players. If they arrive early enough then even if the BFL's use a lot less power a faster arriving alternative still may have turned out to be a better buy. I expect major price wars in the future, and getting on a backlog list now sounds really unwise to me even ignoring BFL's long history of schedule slips (even on this product now).  (I don't begrudge them for this: doing this kind of small scale high tech stuff is hard... but it is what it is)

Plug in your own discounting rate for the costs of assets, but you'll reach the same conclusion for any reasonable value.

It was an analysis like this that convinced me to not produce a ASIC miner myself on 130nm over a year ago. It would have been a bit win IF I was one of only a few to do it. I estimated the odds of someone doing a miner on better process (which was a bit too costly and risky for me to undertake personally) as too great to justify because once they were available they'd be much more competitive than 130nm. I still have a hard time really believing that BFL's products are going to be real and meet their claims, but assuming that they are Inaba is right about his power arguments but at the moment it's all about shipping times.  Six months from now this market may be radically different.

Agreed.

The people who have the view that the power doesn't matter only have it because they have high profitability expectations.  The people saying that power is all that matters are expecting very long payoff horizons due to difficulty increases.  I think the latter view is safer and also more correct, especially if you're not counting on being very early in your deployment.

Which I think results is another interesting bit to take away from the discussion:   BFL is apparently not expecting their customers purchases to pay for themselves for quite a long time.   This is fine by me, as it's also what I expect— and I mine for fun and to support Bitcoin, and not because I'm expecting to make a a lot of funds doing it... but if you were thinking otherwise you might want to carefully review your expectations.

Of course, at the moment— there is still the potential of getting ASIC based miners before they are widely deployed and the difficulty catches up, so thats a competitive factor thats hard to reason about.  Though you can probably count on it not happening for you if you're last on a long preorder backlog…

69 to 876 to 12, clearly the people have spoken!

They don't cite anything in the paper for that, what they did is repeat the hover-over description text for the address column on blockexplorer word for word without providing any attribution, citations, or even indicating that it was a quotation— they repeated it as though it were their own words. By the bizarre academic standards this is plagiarism, though not especially severe. Whats worse is that it's wrong and that most people would instantly recognize that pop up help is not likely to be the most thoroughly complete information but since they've manage to obscure the source it's now going to be repeated as fact.  Their belief that the help text on block explorer was official policy is consistent with the general confusion they seemed to exhibit that webpages people have created about bitcoin _were_ bitcoin.

And sure, multi-controler transactions are probably not very common, but mistake on that fact alone makes the paper a poor citation for future reference— and it combined with the myriad more obvious though less harmful obvious-to-all-of-us embarrassing mistakes shows that they were generally clueless about the subject and that the peer review system is _not_ working.

In terms of the actual results the apparent misunderstandings about address generation, coin selection, and change (that when bitcoin is use correctly as described in the original paper _all_ bitcoin are going into 'savings accounts' at all times) and the confusion relative to control and ownership (That million BTC volume on MTGOX in the last month would mostly be 'unused'/'horded' coin) are probably bigger issues, but they're harder to reason about because the data for the real answers people want don't actually exist. Perhaps 3/4 of the coins are actually horded.  It's not the the paper's conclusions are wrong on that point as they are wrong on the operation of the system— its that no one, including the authors, knows— as the methods used don't actually show what they claim they do.

Another possibility is just having change.


Then the 3 BTC is considered still unmixed by the original owner.  This avoids DOS attacking the txout set, and requires fewer fees.

Another useful optimization is to trigger these activities when you want to make a payment so that it's not even creating an extra transaction and the ownership of the outputs is further clouded (e.g. in that example there could be 1-2 senders and 1-3 recipients who may or may not be the same as the senders).

Your observations are flawed though I can't tell how with how little information you provided.  In Bitcoin the block is always sent sequentially with one peer at a time. They do not increase your download speeds. And if you do reach 1000 connections you will crash.

This is asking for memory corruption and or FD exhaustion that will cause it to crash and potentially corrupt your wallet. Good luck with that.

Having large numbers of connections is counterprouctive because block relaying is serial, you're more likely to get stuck feeding to some slow edge host in Africa for 30 seconds the more peers you have.


It is quite rare that two solutions are found within seconds of each other.  The formula is p=1-e^(-1/600*delay_seconds)  so there will only be a contest within 10 seconds 1.6% of the time, and even if you're slow to propagate you still may win it. After all, your competition experiences delays too.

It's bad to be slow, but being fast isn't terribly important. Having a fast node— e.g. SSD or tmpfs storage for the blockchain, ultraprune, fast machine with lots of ram—  is more important than connectivity... but it's still not terribly important.

Don't worry, I'm sure the facts won't get in the way of whatever ponzi scheme you're planning on participating in next or people adopting the NextGreatThing designed by people who haven't a clue about what they're doing or the patience to learn.

The facts didn't stop people from trading Liquidcoin for BTC for a little while... until the facts caught up with them and made it vanish. 

I console myself with the fact that all the suckers and scammers are so slow to learn from their own mistakes that they just keep repeating them and its easier for the sane bystanders to avoid.