But I trust my grandmother more than I trust CNN, or Coinbase, or the government.
This discussion really distills down to this point. If 50+% of the stake has someone they trust with a live version of events and all of them have the same version of events, then they can all choose the correct fork and the remaining minority of the stake can see the majority has decided on a fork. Then the attacker loses. But you would still have an additional problem in that to detect double-spending with 100% objectivity requires 100% finality of epochs. IOW, all of you in the 50+% stake will not be able to agree with 100% certainty on a double-spend without 100% finality. Yet 100% finality of epochs (as opposed to probabilistic finality of transaction confirmation) requires permissioned set of validators of which only 1/3 of them can stall the entire chain and the only way to unstuck the (transaction confirmation of the) chain is to hardfork. The attacker then only needs control of 1/3 of the validators in order to short the token and profit. The chain's protocol can't confiscate the security deposits of the non-responding validators because they may be legitimately under DDoS attack or suffering from some general failure such as Amazon or Azure outage. Also permissioned validators is a political clusterfsck as described in the EOS section of @anonymint's most recent blog: https://steemit.com/cryptocurrency/@anonymint/scaling-decentralization-security-of-distributed-ledgersA consensus system with nothing-at-stake permissionless validators can fake a network outage by Sybil attacking the validator set. Your Decrits design apparently forces new validators to queue up and be approved by many epochs before joining or leaving, but this is in essence a permissioned system, because then 1/3 of the validators can stop the forward movement of the chain and those queued validators never become approved. If you use an elapsed time instead of epochs, then that opens a different sort of security hole. Regardless of whether or not objectivity exists, there will be a loss to those attacking the network (and to those actively defending if the attacking network persists). Unless 100% of all economic value goes to their fork, they suffer a loss. Even if they convince 90% of the economic value to move, they lose the 10% which remains on the other fork where their stake is destroyed. Only the non-staking users of the network do not lose any value.
Everything you wrote as quoted above is the opposite of the possible outcome that @anonymint wrote about: https://medium.com/@shelby_78386/the-caveat-though-is-that-when-the-attacker-can-fork-the-vested-interests-of-some-of-the-users-9340dd037a61But perhaps the reason you didn't think so, is because you may not have realized the point above about 100% finality is required for 100% objectivity of live observers? The attacker can profit even in the presence of security deposits. That was one of the main points of the Medium post. Apparently there is a great cognitive dissonance in interpretations of the game theory and economics between your thought process and that which is written at the linked Medium blog. Did the above point about permissioned validators and 100% finality bring your understandings closer together? If that is the case, the objectively better fork is obvious.
Analogous to network synchrony, censorship can't be objectively proven. And especially when the censorship is against a few billionaires or such that nobody believes or gives a fsck about. People have a crab bucket mentality. They love to see some billionaires lose everything. You seem to not have a very realistic appraisal of human nature and the madness of crowds, or perhaps you just haven't looked it this way before?? But to do so they have to invest in the network itself, unlike with PoW.
Disagree. They gain back what ever they "invested" by shorting one and pumping the other. Besides they probably bought the hell out of the token when it crashed to 50 satoshis in the crypto winter, then they pump it up, short, and crash the fscker with an attack. Or they issued the ICO and bought the ICO from themselves taking 80% of the money at no cost. Many different sorts of manipulations and schemes. It's depressing. I want to caution you before you go thinking you have some magic cure. Many people have thought deeply about these issues for the past 5 years. You're not the only one. Although you were probably thinking about non-proof-of-work consensus systems before most of us. @anonymint was on proof-of-diskspace and then memory-hard proof-of-work ideas for most of 2013 whilst you were already designing Decrits. Btw @Ix, if you're an excellent programmer and you are interested to collaborate, there's BTC funding and vestment available. But maybe you want to do your own. |
|
|
|
There is no incentive structure here to control the behaviour of the chain, so what's left is the incentive to double spend instead. Coin days destroyed can be double spent just as easily as any other transaction.
Please don't make me repeat what @anonymint told me which I already posted for you, because I want to minimize my posts. He had pointed out very clearly that TaPoS is not effective as a short-range objectivity and thus by implication it will not prevent short-range double-spends. It is only effective against a long-range attack. And the behavior of the chain can be made to respect the TaPoS, but @anonymint is not going to reveal his design today. |
|
|
|
How is this any different from what anyone can do without attacking the network? Create a copy of the software with some divergent property to create two chains. If the diverging property is seen as valid by some percentage of users, the divergent chain has some value. Do you have some solution to this as well?
@anonymint thinks the distinction is that in the case of ambiguous nothing-at-stake forks from the perspective of those who were offline, they're more or less ambivalent to the outcome which doesn't affect them. And without a strong compass, they can then be swayed by the powers-that-be to believe in the mainstream opinion. Mainstream opinion is owned by those who own the corporate behemoths. So the point is that relying on community opinion is centralization. If instead there was objectivity, then the users who were offline at the time of the forking wouldn't need to trust CNBC, CNN, FOXNEWS, BLOCKINFO.COM, COINBASE, ZEROHEDGE, ALEXJONES, and all those other gatekeepers. We want to destroy their power if we can come up with a design that can do it. Tangentially (and somewhat offtopic), see how Thatcher was the moma to those men, who reverted to children without a compass after she was gone: https://steemit.com/politics/@anonymint/re-anonymint-unfairness-of-tax-cuts-for-the-rich-explained-in-beer-20180602t081228178z@anonymint's idea for ending the "new feature" forks is to solve most of the problems that drive a hype market for forks such as scaling and latency of confirmations. The speculation in the market is significantly driven by idea that the market for cryptocurrency is still nascent and largely untapped. There will always be such speculative snake oil in the future, but who cares when their market caps top out at $1 billion on the pump and dump, when the main cryptocurrencies will have market caps in the $100s of trillions. His idea for solving the nothing-at-stake problem revolves around formation of objectivity with statistical evidence. We must remember that finality is always probabilistic any way. There is little to no risk to creating a fork out of thin air such as in the case of Bitcoin Cash and whatnot, but there is a huge risk to creating an on-network fork - namely nobody cares about your fork and the value of your money from the main chain is destroyed.
Offline users do not know which one is the main chain. Ostensibly you presume that COINBASE et al are going to agree with what the users who were live thought they observed. It can’t be proven that one live group’s network synchrony was superior to another group's. The point is you are presuming objectivity where objectivity doesn't exist. From there you must devolve your argument into what amounts to mind control. Do you really believe some nameless, faceless identity has a chance to sway users over the people they interact with daily on which chain is honest? And all this over trying to get their side of a double spend to complete?
He thinks you have this transposed from the actual reality that is likely to be the case. Not only do you presume that the powers-that-be who want to do this attack are nameless, but you presume that the live users who speak out against the powers-that-be will not be nameless. Why wouldn't the powers-that-be own COINBASE et al? They own everything. These gatekeepers are always for sale to the highest bidder who can steal the most from society. That is what corporations do. They maximize profit by any means possible. They have a fiduciary duty to maximize profit. They do not have morals. I know you do not believe in fairytales so why would you believe the world is some fantasy fairytale where corporations and gatekeepers do the moral thing so they can lower their profits? And their motive may not be double-spending but rather censoring transactions (although they can do this with a majority of the stake in most designs any way) and even long-range attacks where they steal coinbase funds and downstream lineage UTXO and burn UTXO they can't steal in order to accomplish attacks on competitors and what not (including shorting the token and then going long again after their attacks or what not especially if they're trying to destroy that token): https://bitcointalk.org/index.php?topic=4266048.msg39124755#msg39124755https://medium.com/@shelby_78386/btw-i-noticed-in-your-responses-to-others-at-the-end-of-your-blog-youre-emphasizing-393f4ca0deffAlso for a competing token to their Bitcoin, maybe they just want to destroy your token and short it into the ground. The powers-that-be get their power largely through manipulation. P.S. Ty for the debate on the merits. You still have a slight tone of presumptious arrogance as if you assume the other person doesn't have a valid rebuttal for you, but it's possible to interpret your tone here as just skepticism. Apologies that @anonymint didn't understand in 2013 when you used to post from username @Etlase2, that groupwise cryptographically secure entropy is possible in a proof-of-stake system. Ourobos and Algorand exemplified it is plausible within some security thresholds. |
|
|
|
When I think about time-travel in general I am not thinking about how CERN machinery works and what physical theory is on stake ...
I think about protocols like NTP ( for historical reasons I will mention RFC 958 )
The concept of time presumes a universal total order, yet for time to exist requires friction which implies the lack of a total order (and unbounded partial orderings) because not all witnesses can observe all events in "exactly now" real-time. A humorous example about losing car keys points out that the only entity that knows the reality of "now" is the entity observing it. Each of our realities can't be communicated precisely, only related. No other entity will ever be able to know all the thoughts that passed in your mind as they occurred. Therefore triangulation of observations doesn't exist and is always an approximation of reality and thus never 100% final.
Exactly how are you defining 'inertia' in terms of TaPoS combined with burning?
As stated there at the linked post. The owners of the UTXO that is intertwined with the history by TaPoS don't want their UTXO to be reverted thus they will agree with the fork (the perspective of reality) which contains those TaPoS. So the inertia is tying all the stake holders to the history. Thus the nothing-at-stake is removed without consuming an external resource. @anonymint helped Dan Larimer invent TaPoS in 2013. It is probably the one significant invention he created that might help us convert nothing-at-stake to something at stake. The inertia is that they have something at stake. These are decentralized checkpoints which are implicitly a consensus and don't rely on any central party to state what the consensus is. Vitalik argued that TaPoS can be subverted by bribing old UTXO owners to sell their private keys, but this is not only unrealistic but the current UTXO owners will not agree. The unrealism is because the old UTXO owners and the new ones have a significant overlap. The stakeholders en masse don't want to destroy their own money. And this line of thinking will lead you towards the consensus system @anonymint has devised. But you have to be cautious of the fact the majority are apathetic and can be divided-and-conquered by their own selfishness.. |
|
|
|
@anonymint says: In the case of 4, well, its just a disaster. Blocks can be replaced all the way back to the last checkpoint potentially and all transactions from that point could be destroyed.
Checkpoint is useless against a majority of the world's hashrate. The attacker can even divide-and-conquer the vested interests of the majority of the users: https://medium.com/@shelby_78386/the-caveat-though-is-that-when-the-attacker-can-fork-the-vested-interests-of-some-of-the-users-9340dd037a61https://bitcointalk.org/index.php?topic=4266048.40#msg39124755In the case of 3, which is by far the most difficult to resolve, the partition tolerance reduces proportional to the duration of the partitioned state, and becomes more difficult to resolve without consequence in any system, as there may be conflicting actions which diverge the resulting state of all partitions further away from each other. These partition events will always become unsolvable at some point, no matter what the data structure, consensus mechanisms or other exotic methods employed, as it is an eventuality that one or more conflicts will occur.
The fact is that DAGs/Tangles and our channels have a better partition resolution performance in the case of event 3 as the data structures are more granular. An inconsistency in P doesn't affect the entire data set, only a portion of it, thus it is resolvable without issue more frequently as the chances of a conflict preventing resolution is reduced.
Now, you haven't provided any detail on exactly how you imagine a data structure that uses blocks that could merge non-conflicting partitions, let alone conflicting ones. In fact I see no workable method to do this with blocks that may contain transactions across the entire domain. Furthermore, who creates these "merge" blocks and what would be the consensus mechanism to agree on them? In the event of a conflict, how do you imagine that would be resolved?
One possible solution which @anonymint first wrote about in 2014 (and @patmast3r mentioned in 2016 which I dismissed at that ime only the context of the Iota-style DAG) is that double-spending burns all the UTXO involved. All lineage balances are reduced by the destroyed value. And if the payer associates a KYC identity, then all (or the amount designated by the payer) UTXO of that identity are destroyed or used to pay all of the double-spends instead of burning them if the designated amount is sufficient to pay all. Or stated in another way independent of KYC, the payer may designate some other UTXO which is time locked guaranteeing he will not issue a double-spend. Note even if the attacker had forked the chain before commitment to the time lock and orphans the commitment, then the attacker doesn't succeed in double-spending because the network remembers the signed commitment regardless of it being on an orphaned fork and inserts into any subsequent block unless the attacker can sustain censorship of the winning fork indefinitely. Yet this penalty system has to have some expiration into finality, otherwise an attacker can maliciously burn lineage far in the past causing current descendent UTXO to be burned. The payee (and all payees down the lineage chain) then judge the risk of the transaction based on the amount of UTXO still guaranteeing against double-spend combined with the depth of the confirmations. It's important to understand that all consensus is probabilitistic because of the physics of our universe. However this proposed solution may not work in general cases of smart contracts although it can adapted to smart contracts in smart contracts where each user action is provably either a descendent or replacement of a prior action, so that issuing replacements can be penalized. And each such linearlized action chain has to be independent of the other ones, so that removing actions in one chain doesn't impact other action changes. An example of an independent linearized action chain, is a blog author making sequential edits of his blog. That would be independent of the edits of the other blogs of that author and other authors. Note that these attributes are actually necessary in any smart contract system which employs blocks, because otherwise the block producer could influence the outcome of the interactions by controlling the ordering of contract transactions within each block. The smart contract thus can't assume these interactions are randomized nor deterministic from the perspective of the signers of the transactions. This is probably yet another security hole in many extant smart contracts. Note this idea is employed in SPECTRE and @anonymint pointed out that it would be incompatible with Replace-by-fee in Bitcoin. Yet his most significant criticism was specific to the fact that SPECTRE doesn't form consensus around a single total order, so that criticism wouldn't apply to the idea above because the total order will designate that the double-spends are burned and can't be further transacted as UTXO. @anonymint's understanding of SPECTRE is that the status of UTXO being double-spent is interpreted by the payer and payees, not by any total order of the ledger and ledger validators. Note this sort of design is also being discussed in the ECDSA signatures: why not force the reuse for r for spends from the same address thread. The best case scenario any system can hope for is that the actor with 51% majority can influence future events only, not the past! Because at least then, in the event of a complete system failure, you still have a true historical record of fact which can be trusted up to the point of failure.
100% finality of confirmations requires a permissioned set of validators which has significant downsides to liveness. See also the explanation below in response to @Ix. Without a block reward, you are correct that the only incentive to be on a longest chain is so your transaction is confirmed unambiguously.
There are still transaction fees to consider (although obviously not in Iota), otherwise you might argue that bitcoin itself would suffer the same fate of diverging consensus, when the block reward expires. Indeed that ends up being exactly the case. See also the further discussion of Byzcoin in the OmniLedger discussion in @anonymint's latest blog. So both of you were prescient. That's what I'm trying to establish. As far as I can tell, there isn't any real cost (neither coins or electricity) to obtaining a majority of nodes, but I'll wait for fusilier's[fusillade's] reply.
Fixed that misspelling for you. Sorry I couldn't resist a little humor given the context of the discussion that was quoted from. In honor of the favorite word of the MSM in the Trump era. |
|
|
|
For another slant... and I don't understand how any slant which doesn't attack other members of this forum can be considering trolling... a free exchange of ideas is not trolling. That paper makes projections about the timing and quantity of qubits that will be available in the world based on what is currently known by the pawns in public academia. We must look instead to the queens and kings on the chessboard. The Manhatten Project exemplified that when national security is at stake, governments can mount intensive capital resources to accelerate and focus development of a key technology. When Bitcoin is the international reserve currency with a $500 trillion marketcap 20 years from now, there will be a huge payoff for the Zionists if they can complete their destiny as preordained in Revelation where all wealth/control will become concentrated on the hill in Jerusalem. Presumably they will make the necessary investments. They will already control all ASIC mining because they control the very high capex fabs. The Chinese recently made an advance in quantum communication encryption insuring that a man-in-the-middle must destroy the information when attempting to read it: https://www.insidescience.org/news/china-leader-quantum-communicationsI'm not implying that the sober assessment isn't worthy. I'm just noting that it shouldn't be taken as 100% certain gospel. I do not think we should be complacent about trying to eliminate the threat from quantum computing. Such effort must be open source and it must be widely supported, otherwise those who are successfully working towards such might conveniently die in "accidents". However, in the past @anonymint thought quantum computer would never likely be any faster on Grover’s algorithm than classical computers with parallel memory tables where he cited a paper by Daniel Berstein, but perhaps that is only until you meet the state. |
|
|
|
I am hesitant to be listed on centralized exchanges, but will consider it if the opportunity presents itself on one that I believe will not be a scam in the future.
Polo I don't like how they acted previously, however now that they're under new management I may consider asking them to re-list. Though I'm not 100% on that.
Then you probably wont get enough liquidity. Polo acted that way because allegedly client was broken. I'm not sure which conf you used, but seeing how many users complained as well, it's not unlikely that polo didn't actually have same problems. And it probably wasn't worth it for them to try to set it up properly because it was low liquidity coin in the first place. Do you know how much Qora is still on polo? |
|
|
|
Yeah well... ~20 people who voted 100+ times are apparently not allowed to win because it's considered cheating. Outrageous. |
|
|
|
If you want to solve the double spend problem, you have to start with something that isn't double spendable.
Agreed. Costless witnesses have nothing-at-stake. In bitcoin this is CPU cycles, which is a proxy for time.
Albeit an imperfect proxy which can theoretically be broken thus breaking the assumption that probabilistic finality is asymptotic. You can't double spend time.
We can in the multiverse. Quantum computing will (if it is achieved) open a portal into the multiverse. If you start out your design by choosing to use something which is double spendable (a transaction, stake*, a vote) then you're going to be chasing your own tail.
Not necessarily. For example, transactions can be converted into inertia which becomes probabilistically unlikely to be double-spendable. Hope these out-of-the-box thoughts help your conceptualization. |
|
|
|
Proof-of-Approval does require majority to be online but not supermajority.
Then the transactions are only probabilistically final, not 100% final. 100% finality requires 2/3 of the validators to approve of the epoch. Your blog is in error to claim you have an advantage over Ouroboros in this respect. You can find links to the "math of safety and liveness" in @anonymint's latest blog. See also this post |
|
|
|
what could be the best option to stop such attacks which will have the power end up an era started to promote anonymity?
Anonymity isn't really the killer app of permissionless, trustless ledgers. They generally disrupt top-down control, gate-keepers, and rent-seeking parasites in many ways. The page of the Iota whitepaper which @anonymint cited explains that Iota mitigated the vulnerability in their ( flawed) DAG design by making the proof-of-work difficulty very low. But such a low difficulty in a blockchain consensus system would make the block period so fast relative to the network synchrony that the orphan rate would skyrocket and the chain would no longer converge on a longest chain and/or attacking it would become much easier. Yet the principle Iota employed could perhaps be applied to a different design that employed some sort of DAG that is not flawed. For example, @anonymint has been researching such designs. Possibly some non-proof-of-work consensus system could be found that doesn't suffer from the nothing-at-stake vulnerability but that seems unlikely. If I am not mistaken, perhaps the EquiHash in Zcash had some quantum computing resistance, but it seemed to have some other flaws, but the details are not fresh in mind at the moment. I presume that mathematically it must be possible to design a proof-of-work system which is quantum computing resistant. But haven't delved into it. Mircea Popescu is working on a proof-of-work which is ASIC-resistant but don't know if it would be quantum computing resistant. My concern is it may introduce a DoS vulnerability because the validator doesn't have a deterministic bound on computation. |
|
|
|
In that case, why approve blocks at all?
Who are you replying to? What specific issue are you attempting to take issue with? Let me presume that you're trying to say that if public opinion can be ambiguous then why approve blocks at all? If that is your point, then the answer is that proof-of-work is not ambiguous because there is an objective longest chain proven by the cumulative difficulty by adding the difficulty of all the blocks in the chain. IOW, to avoid making posts which are noise, it is helpful to learn Bitcoin 101 before commenting here. Anyway, educating is okay but the problem is if someone does not respond correctly, then incorrect ideas promulgate.
@d5000, I think you may remember the discussion you had last year with @anonymint (under one of his former pseudonyms) in Theymos' thread about altcoins. So it seems the points you are making here are reiterating some of that discussion about nothing-at-stake. @anonymint wrote down his analysis of the nothing-at-stake issue which will seem to apply to all of these non-proof-of-work consensus systems: https://gist.github.com/shelby3/e0c36e24344efba2d1f0d650cd94f1c7#oligarchy-if-pos-is-functioningHe does not think there will be any non-proof-of-work design that escapes from the nothing-at-stake problem except under the conditions he already mentioned when a super majority of the users are always online and network remains within a bounded asynchrony. He is confident a nothing-at-stake vulnerability can be identified in Proof-of-Approval. But who has the time to find the nothing-at-stake flaw in all of these non-proof-of-work designs? It is like everyone wants to try to reinvent the wheel of nothing-at-stake finding some way to blind themselves to the fact their design is also vulnerable. Well, what I like about your protocol is that you have created something like a DPoS/BFT model without a static "delegate" set (e.g. Bitshares, Tendermint or Casper).
The inviolable rule is that 100% finality of transaction confirmations can only be obtained with a permissioned validator set. And then of course there’s the liveness issue that the chain can get stuck and require a hardfork to unstuck. And of course what you wrote about the political corruption that results from that and/or delegating stake. That was covered again in detail in the discussion of EOS/DPoS in @anonymint's latest blog: https://steemit.com/cryptocurrency/@anonymint/scaling-decentralization-security-of-distributed-ledgers |
|
|
|
I asked @anonymint in private Crypto.cat to respond one more time, and he was reticent because he said clearly @Ix has some vendetta and the discussion is turning nasty. He agreed to reply one more time for me for this thread, because of the technical errors that need to be corrected. Here follows verbatim the response he wrote to me in Crypto.cat... Even a quantum computer takes over 2^45 operations to rewrite the chain which has accumulated work of 2^89 hashes. Even at a generous single cycle double SHA computation and 1 Ghz quantum cycle time this will take 2^15 seconds. That's about 10 hours rather than a nanosecond.
Also, wouldn't it take longer since every 2016 blocks, the difficulty of the clandestine network would go up 4x until it took them approximately 10 minutes to mine a block? No. The longest chain is measured by adding up the difficulty of all blocks. So even though the blocks will be produced more slowly by the attacker, the difficulty of the chain being replaced is constant and the difficulty per unit time of the attacker is not decreasing. Or is this something that just can't be spoofed?
With all due respect, your ideas for fixes Will not work. If you'd like to discuss this with me, you may post comments on Steemit or Medium for me to answer.
But this line of arguing is pretty pedantic if they can just steal all unprotected funds and funds as they are spent from scripts.
Hashed addresses aren't vulnerable until they're spent. After a few unfortunate users are hacked as they attempt to spend, the 99.999% of the UTXO that remains hashed will remain hashed until a fix is in place as word spreads of the attacks. Your response belies an understanding of what was already written in this thread. As was explained to @tromp when comparing the vulnerability to the signature scheme, the proof-of-work vulnerability doesn't have the protection of the preimage security of a hash which protects the public addresses. Thus the proof-of-work vulnerability is much more severe than the possibility of breaking the security of the private keys. That is the point I made to @tromp at the start. But really, all they need to do is rewrite recent history to perform double spends at will, and the developer checkpoints will prevent very deep history rewriting.
Your suggested attack is the proof-of-work vulnerability that I raised. Whether the attacker deploys it long-range or short-range, my point to @tromp remains valid, that the proof-of-work is more vulnerable than the private keys. Also, developer checkpoints are centralization and are futile if the miners refuse to adhere to them. The community would have to fork to a different proof-of-work algorithm because all of their coins would be stolen by rewriting the entire chain. Such an event would likely crater the price. The attacker could for example short the token and/or have other ulterior (externalities) profit/control motives that are achieved with the attack. Moreover, the attacker could rewrite the chain and steal/burn only the tokens he wants, leaving the vast majority of users unaffected. Since democracy is one vote per human torso, the attacker can steal tokens from for example the Bitcoin $billionaires (that have minimal interleaving with other users´ UTXO from the time they were mined at coinbase or burn those portions of the targeted victims that intervealed) and leave the masses intact so the attacker(s) have political support for their takeover. Bitcoin transactions don’t reference the block hash where they were confirmed, so that makes this variant of a proof-of-work attack plausible. (anonymint is very good at sending discussions off course.)
Look in the mirror to see who has been trying to drag the discussion into the gutter. First by your gross misapplication of Occam’s Razor wherein you argued that the more complex assumptions are the simpler ones, and now by making an incorrect technical argument. And then you have the audacity of injecting offtopic ad hominem inspite of your numerous errors and myopia about about how attacks can interact with externalities (and so for the 3rd time this is linked for you): https://medium.com/@shelby_78386/the-caveat-though-is-that-when-the-attacker-can-fork-the-vested-interests-of-some-of-the-users-9340dd037a61As for objectivity, I can only presume based on your statement quoted below that apparently you're still angry at me for discussions with you about your Decrits in 2013. (something you went on for days about being a vulnerability - but it's not).
Is that vindictive behavior indicative of a civil and mature way to conduct a discussion? Since I started responding to posts in this thread via private chat with @Traxo, you've been trying to find a flaw in my technical argument with which you can nail me to an adhominem cross. Just stick to the points in the arguments without personalizing the argument. It is not taking the thread offtopic to make points about Satoshi’s possible motives. Because motives are possibly relevant to how, why, and when such a quantum computing attack might be deployed. Come on man. Please elevate your game to a civil discourse. If you want to prove something, then after 5 years finally launch your Decrits. Trying to ego battle me is the affliction of the incapable and isn't going to prove anything nor gain you anything.
2. NSA announced in 2015 that it is going to develop a anti Quantum Cryptographic System. ==> A vague hint to my Third point that we can be still secure
3.But it is said that when the Quantum computer is available for everyone it will cost you millions of dollars. For example : D-Wave 2000Q cost around 15 Million USD ==> Directly strengthening my second point.
@anonymint remarked to me that powers-that-be will be able to afford that, and it ties directly into his point about who "Satoshi" probably really was. Seems this argument offends people who want to believe Satoshi is some inept Japanese hacker who created Bitcoin from his garage located next to his/her/it/their extended family kabota. |
|
|
|
ironic that Proof of Anti-stake may work
the idea is, that user destroys it's coins and by doing so confirms a block
Doesn't work because to burn stake you must send a transaction, and you cannot come to a consensus on the current set of valid transactions by sending more transactions, it's a chicken and egg problem. @anonymint says that your conclusion is not quite right or let's say it's incomplete. After sufficient time the TaPoS combined with burning has inertia because users don't want to have the tokens reverted by a fork. So essentially it's a more decentralized variant of checkpointing. Will not help objectify consensus in the short-range case though. I had relayed what @anonymint wrote about proof-of-stake: https://gist.github.com/shelby3/e0c36e24344efba2d1f0d650cd94f1c7#oligarchy-if-pos-is-functioning |
|
|
|
my concession is that this will be big news in any kind of remotely popular network, so picking the correct network will be an easy, one time event.
This response is applicable to all nothing-at-stake systems, so I will reply in this thread. Your reply belies the fact that @anonymint refuted it before you wrote it. Did you not see the linked Medium post I cited for you in the prior post: https://medium.com/@shelby_78386/the-caveat-though-is-that-when-the-attacker-can-fork-the-vested-interests-of-some-of-the-users-9340dd037a61Public opinion can be manipulated. Just look at every fork war that has taken place already for evidence. There's no objectivity in public opinion. Just a lot of chest thumping and arguments about whose furk is longer and fatter. Because after that, all the money of the attacker's fork is destroyed
Which one is the attacker's fork? Again, please read the Medium post that was cited. No supermajority is required to be online because the order of records is determined in advance
Which section of your white paper explains this? |
|
|
|
Yet the speed-up of the proof-of-work is 17 billion times faster which is sufficient to replace the entire chain in a nanosecond!
Even a quantum computer takes over 2^45 operations to rewrite the chain which has accumulated work of 2^89 hashes. Even at a generous single cycle double SHA computation and 1 Ghz quantum cycle time this will take 2^15 seconds. That's about 10 hours rather than a nanosecond. I presume @anonymint was speaking figuratively for the dramatic effect. Thanks for the more plausible estimate. Probably the quantum computer would be even slower than 1 Ghz, but I think his point about the potential threat remains valid.
When we're real close to perfection in quantum computing, and it starts looking like a big threat to bitcoin, we (the bitcoin community developers) can:
What if we don’t know we're real close? What if quantum computers become a state secret? Also what if the extant miners at the juncture refuse to change the protocol because they're complicit?
-hardfork bitcoin and create a tangle (like that of IOTA or a better form of DAG) based coin.
Are they better? See this: https://steemit.com/cryptocurrency/@anonymint/scaling-decentralization-security-of-distributed-ledgers-part-2 |
|
|
|
$3  Is this the moon? Didn't know moon was a black hole! comrades, who knows - this is the bottom you can already buy or go even lower ... sad everything.  Who could have guessed that BTX would tank when the biggest news in last few months is getting BTX/BTC pair listed on yet another (among many others) exchange that nobody cares about. And when the person who single-handedly wrote BTX whitepaper leaves few hours after releasing it to the public and demonizes the project to the max, and team (which btw Pete called "lazy", lol) responds like this: https://twitter.com/Bitcore_BTX/status/1000066406711472128And on the top of that the only "hope" to see at least small green candle is getting some random funds from getadcoin, which apparently can easily be gamed by bots. |
|
|
|
If you're interested, you can check out my signature for a link to my whitepaper on the Decrits consensus algorithm which is relatively similar to yours (with an identical long range attack defense), and is 5+ years old.  Another message from @anonymint which I received in private chat. He says that section 4.2.5 Scenario: Voices Colluding to Fork the Network is correct that with non-proof-of-work systems only the users which were online during the attack can detect malvolence and this requires bounded/partial asynchrony (i.e. not fully asynchronous as are Byteball and Hashgraph). So if those assumptions for super majority of users being online and bounded network asynchrony are not fulfilled, then security deposits are insufficient for security, although they might or might not help rate limit. So without any effective penalty on malevolence there's no cost to attacking it regardless if the validator set is permissionless or permissioned. He presumes the same vulnerability can be found in every non-proof-of-work design including Proof-of-Approval. |
|
|
|
Scripts could contain bare addresses then if your argument was valid. They can and do. @anonymint recapitulated his point is that only idiots would leave their public keys bare. And certainly the person who invented Bitcoin is not an idiot and would certainly realize no worthy person would opt to leave addresses bare. So to presume that he only added hashing because scripts need to be cryptographically compressed when referenced is not really an application of Occam’s Razor. Occam’s Razor would not presume that Satoshi was so sophisticated as to become ignorant just so that he could fulfill your theory. Occam’s Razor assumes the simplest and most natural reason.
For all his purported insight, Satoshi left all of his bitcoin in exposed coinbase to public key transactions. Over a million bitcoins just waiting to be stolen by a quantum computer.
Nice deception isn’t it. So the elite can steal the BTC from themselves and make it look like they stole from this inept Japanese dude who created Bitcoin in his garage next to a kabota.
Double hashing was due to the known SHA2 length extension attacks.
As @anonymint stated, he was very meticulous about cryptographic security. So why would you assume he became non-meticulous in other cases of Bitcoin’s design? Why is it that you think the anonymous person (or group) who created the technology that is disrupting the entire world was only capable of very limited thoughts compartmentalized to the convenient areas where you would like them to be? Is it because you really want to believe Satoshi was inept? You presume Satoshi is compartmentalized in just the areas you need him/her/it/them to be, but that is a very complex proposition. The simplest assumption is that Satoshi was not perfectly compartmentalized in just the precise areas we need him/her/it/them to be. For example, to presume he/she/it/them would be too dumb to not put hashing on addresses unintentionally is a very complex assumption in light of someone of Satoshi’s meticulous attention to detail w.r.t. cryptographic security. |
|
|
|
Hi anonymint
I live in Europe, and @anonymint lives in the Philippines. Please note that I'm not @anonymint. And mods can verify this because I'm not using a VPN.
So thus Satoshi designed Bitcoin addresses to be secure against quantum computing by wrapping them in a hash.
Occam's razor, Satoshi designed bitcoin addresses to use hashing because payments are not made to public keys, but to scripts which are of an undefined and unbound length and would make horrible addresses. It had nothing to do with quantum computers which I don't believe he considered at all. @anonymint says he was wondering where the original creator of Decrits had disappeared. He remembers the intensive discussions with you in these forums back in 2013. He said he will look at your whitepaper. He does not think Satoshi would be so haphazard, footloose, and unpremeditated as you presume him to be. Scripts could contain bare addresses then if your argument was valid. But instead he always made addresses hashed. And he put a lot of thought into making sure that the cryptography couldn’t be cracked by for example his paranoid use of double-hashing. |
|
|
|
|
Show Posts
