I know a CEO of a company which, among other things, owns a scheduled video meetings service. Basically, it is like a camwhore site, except that it is not for camwhores, but just for people who want to sell video chat time. E.g. it can be used by people who provide consultations, coaching; maybe just internet celebrities.

So they have implemented this thing, but they have problems marketing it.

I think it would be cool to accept Bitcoins on this site and to market it to Bitcoin community.

Why? I think there are both people who want to earn coins, and there are people who have coins to spend. And both are savvy enough to use payment system...

Use case example: a freelancing programmer besides his usual programming gigs can offer programming consultations via video chat. They might be useful to students who learn programming, or just people learning programming on their own. For a programmer it might be interesting because it takes a fixed amount of time and payment is upfront. For a student it's better than forum consultation because it's realtime and, perhaps, more comprehensible.

I've talked to company owner about adding Bitcoin payment options, he is generally sympathetic, but he does not believe that there will be a demand significant enough to justify development costs. I've offered my help to integrate some Bitcoin payment option, but without marketing it doesn't make any sense.

So I see an other option: if somebody in Bitcoin community is interested in this business he can enter partnership agreement with that company. Company will host the service, 'somebody' will do marketing, adapt landing page etc. Profit coming from Bitcoin revenue will be split among parties.

But this needs some financing. I doubt they will take us seriously if we can't pay for hosting and maintenance upfront. Also, landing page won't create itself...

(I'm myself a programmer, I can integrate some Bitcoin payment option, but I neither have any capital nor I have any marketing skills.)

Maybe financing can be done via Bitcoin capital markets (like GLBSE IPO), but I'm not good at business stuff.

Any Bitcoin investment bankers willing to help to finance this?

(I did not mentioned web site URL, please PM me if you are interested, I just do not want any embarrassment.)

I would liken PPCoin's security to that of a hot dog stand. You cannot simply steal money as dude who sells hot dog is guarding it, but if you overpower the dude (which is almost trivial) you can grab the money. BUT that dude brings money to bank from time to time (like each 4 hours), and once money is in bank it's much harder to steal it from there. (But if bank itself wants to steal the money, that's another story.)

So, well, hot dog stand dude provides high availability and convenience. But, well, he's not very secure...

HotDogCoin

I failed to understand about a half of MasterCoin paper, but it seems to be way too complex and it's unlikely to work. dacoinminster is neither a programmer nor a crypto guy, so there is a lot of unimplementable wishful thinking in there.

However, coloring bitcoins is the shit. I really see no downsides, but it's incredibly easy and in can work.
Even if it doesn't catch on, it's definitely worth to implement it as an experiment.

(Well, technically there is a couple of problems: Bitcoin blockchain is hostile towards microtransactions and probably cannot scale to support them on a large scale. But it isn't a fundamental problem, I think.)

Compared to other solutions, it is interesting because it allows one to create new assets with pretty much zero friction. There are no servers to worry about, no security woes, no DDoS attacks. Just color some bitcoins and it works: forever, worldwide, for free, in a form which is highly resistant to censorship and blockades.

Isn't it awesome?

Merged mining really cannot compete with it because it is incredibly hard to create a new asset with it.

OpenTransactions, perhaps, can, but colored bitcoins have numerous advantages. So it would be interesting to see them competing.

Is anybody working on an implementation now?

Actually a large stash of coins is not even necessary to perform double-spends: you can get extra coin-days-destroyed for your block by paying people to send you their send-to-self transactions privately. As proof-of-stake based mining earns 1% per year, you can pay like 2% per year to make it profitable for them.

Once you have access to transactions which consume a lot of coin-days (relatively to normal spending activity) you can add them to your block and cause a large reorg.

So, basically, what is required is enough hash-power to mine block once in a while, say, once in a hour. And double-spend is pretty much guaranteed.

It doesn't matter that it's rare. You can get access to a steady flow of double-spend transactions via a kickback mechanism:

You, a wealthy hacker, would implement a "ppcoin-double-spend-edition" client. It works exactly like a regular client, except there is an additional "double spend lottery" button. When user clicks that button client creates a double-spend transaction for a recent user's transaction and it submits this transaction to you.

This double spend txn will spend 90% of input to user and 10% as a kickback to you.

Now I assume that this client will get popular since users have a chance to buy products for 10% of their cost.

If this client is popular, you get a constant stream of double-spend transactions with kickbacks to you.

You include these double-spend transactions into your proof-of-stake blocks, aiming to trigger a reorg. If you successfully mine it and reorg is successful, you earn kickbacks. If reorg doesn't work, you lose nothing since your coin-days are not consumed and you can try again.

Alternatively, you can use proof-of-work and send-to-self to increase coin-days consumed in your transaction. Quote from the ppcoin paper:


Apparently, it doesn't matter whether coin-days are consumed in proof-of-stake blocks as a stake or in proof-of-work blocks in transactions.

So you can mine proof-of-work blocks which include double-spend transactions and aim to do a reorg. You can easily check whether it's currently possible and how much of an opportunity do you lose in terms of interest and power spent on hashing. Thus you mine only when there is a chance of profit, and on average this operation will be profitable.

Even if you own just 1% of hashing power you have a chance of double-spend once in 100 blocks, which is significant.

Well, I believe proof-of-stake can work if there is a way for someone to lose his stake if he is caught participating in malicious activity.

E.g. you use 1000 coins to sign a double-spend transaction and you're caught, your 1000 coins are banned. If chances to get caught are high, incentive from this double-spend must be much higher.

This means that for a transaction worth 100 coins you can trust 1000 coins worth of confirmations, as nobody in his sane mind will risk his 1000 coins for 100 coin double-spend.

Now there is a question: how do we detect and punish a double-spend? Well, detection is trivial, but we don't know which miner is guilty. (Or maybe miners are not guilty at all.)

I believe it's tricky, but not impossible.

One way is to implement is to make it manual: if there is a large reorg, simply half operation and let human operator to decide which blockchain we trust. Eventually consensus will be reached and guilty party would be punished.

So under these conditions double-spends will never be done for profit, but only as a form of DoS attack. But this DoS attack costs money, so we can expect that there won't be a lot of that.

Also, monopolization isn't such a problem: if monopolist pisses off people they can just ban his stake. (For this to work stakes must be identifiable, i.e. one needs to move his money from transactional account to stake account, and this move should take a lot of time to mature so it's not easy to switch.)

So back to your game theory analogy, it is a game where if you play by rules you get profit, but if you try to break the rules you lose. Makes sense, no?

They hope that they'll find an algorithm to do distributed checkpointing... But that's the whole point!

So what they say essentially is: "We haven't developed the main part yet, but we hope there is some solution. Meanwhile, here's this completely centralized system with proof-of-stake used as disguise of decentralization".

I'm not claiming that they are scammers, it is just incredibly sloppy crypto design. Somebody was just too eager to release the first proof-of-stake based cryptocurrency, without thinking about security much.

(It was already mentioned a couple of times in comments, but they are often buried, so I want a separate discussion.)

The most 'interesting' part of a cryptocurrency design is its defense against double-spend attacks (since ownership is trivially implemented via public key crypto). In Bitcoin it is done using proof-of-work approach.

In PPCoin it is done using proof-of-stake/proof-of-work hybrid.

The problem is that proof-of-stake used in PPCoin does not really defend against double spend attacks. At all.

If you have a large enough stash of coins you can do a history rewrite of arbitrary size. Particularly, you can rewrite last few blocks to do a practical double-spend.

If it fails, you lose nothing. So only irrational person would not do double spends.

If we assume that miners are rational, they will try to do these attacks, it is a legitimate business with PPCoin. It costs you nothing, but brings money (e.g. kickbacks), so why not?

So, well,. this scheme of proof-of-stake does not work. Actually, authors note it in PPCoin paper, so they use a centralized checkpointing approach.

So, let's summarize:

• proof-of-stake is useless
• currency is secured through centralized checkpointing

Thus it is definitely not a decentralized cryptocurrency.

(It's worth noting that there are better ways to implement proof-of-stake, it's just that method used in PPCoin is flawed. https://en.bitcoin.it/wiki/Proof_of_Stake )

(Elaborating on my previous comment a bit.)

Let's imagine lack of centralized checkpointing to consider proof-of-stake on its own.

Any rational person who has enough stake MUST try to do double-spends. Otherwise he just leaves money at the table.

There is no downside. If his reorg did not work, he doesn't lose anything (aside from little proof-of-work) and is free to try again.

So I envision future of such cryptocurrency like this: some individual or a group will accumulate a large stash of coins, wait till they are mature and will organize a double-spending service: they will accept transactions to be double-spend and then use their stash of coins to do history rewriting for a kick-back.

It's more like a game.

Checkpointing would make deep history rewrites impossible, but then security comes from centralized checkpointing alone. I.e. it is not a decentralized currency at all.

I wouldn't be so sure... It's based on original research and seems legit, of course.

But on the other hand, as author notes proof-of-stake of this form doesn't provide protection against double-spend attacks: stake is not lost in a double-spend, so essentially people are free to participate in double-spends.

Which makes proof-of-stake essentially useless, double-spend protection is supposed to come from centralized time-stamping.

So what we get is a currency which is protected with centralized time-stamping, and a proof-of-stake used essentially just for initial distribution of coins. Which encourage owning as much coins as possible...

I'm not claiming that authors have any malicious intents, they are probably too intelligent to be scammers...

But I'm saying that currency like that would make a lot of sense for pump & dump scheme. (More so than Bitcoin clone.)

And in a long term it makes no sense since authors hope that some future magic algo will solve all issues.

So I would only seriously consider this only after authors provide analysis of economics of double-spend attacks.

(Note that Satoshi did provide some analysis of forking costs in his paper, and he mentioned some economic aspects.)

Before that it is just a proof-of-concept, not a currency.

More-or-less, I actually considered taking over a dead block chain instead of starting a new one, but now taking over bbqcoin is pretty much pointless.

But with this discussion list of potential features got really long and it would take quite a lot of time to make it into a coherent vision and implement them.

However, I now got an offer to take over maintenance of a dead blockchain, one a bit more established than bbqcoin

So my current plan is to start developing relatively tame features in an established blockchain, and make a new one with radical features later, when/if I'll get a coherent vision.

But I need to evaluate feasibility of reviving of an old blockchain...

As for new block chain name, I haven't settled of something particular yet, but I kinda like "notacoin". I.e. "Not A Coin". Quite in GNU tradition, I think. It's supposed to mean "It's not a coin, it's better" or "This is not a currency you're looking for". Also can be interpreted as "Nota-Coin", as in "notary".

I believe that the right solution is 'divide and conquer', i.e. instead of having a huge-ass list of all transactions or list of all accounts we should split it into manageable parts and store on different servers. Like in a DHT, e.g. Kademlia. (Used in p2p file sharing, for example.)

Unfortunately DHTs do not provide features which are required for safe transactions, at least ones we know. But it doesn't mean that such technology won't be developed in future.

Why do you think that there are significantly fewer account values then there are unspent transactions?

What prevents person from starting a new account each time he receives money?

Why wouldn't he do that if that improves privacy?

You can introduce some account-creation fee, of course, thus encouraging people to reuse them, but it won't be like Bitcoin at all. It's a very radical, fundamental change.

If you're willing to do that, you can instead force txn defrag by making only outputs in last N blocks spendable. I.e. people will be forced to send money to themselves to save it. (It has numerous advantages: it fixes "grandfather's wallet problem", prevents deflation and subsidizes fees, thus encouraging miners.)

This requires only a tiny change to Bitcoin code. The only problem is that it will be hugely unpopular, but so will be switch to accounts, I think.

No, I don't see what value it brings from the start. And I don't see any solution which actually solves scalability problem. Pruning schemes only buy you some time.

With dynamic block frequency, however, there is an alternative approach: block weight is computed via a rather complex function which takes into account difficulty, quality of transactions and block size.

If we have two blocks with same difficulty, one with 'good transactions' would win, so miners have an incentive to include them.

This function can also automatically filter out spam by penalizing large blocks.

The only downside is that it is really hard to implement this without sacrificing security. I.e. a double spend attack might exploit some weakness in function to make attack cheaper.

However it is good against 51% attack which simply produces empty blocks: those blocsk would have low weight making attack much more expensive. To block normal economic activity attacker needs a large supply of old coins to fake 'good transactions'.

No. This would remove incentive for miners to even include transactions into their blocks.
Without this incentive they can as well mine hollow blocks, it might be cheaper. (E.g. you don't pay for traffic as much.)

Of course we could find some way to penalize hollow blocks, but transaction fee incentive is more straightforward.

Also, as noted by bitcoin.me, it prevents spam.

The way it works now, developers merely propose a lock and users have to accept it intentionally (by downloading updated software). And they can review and discuss lock before applying it. Thus control is entirely decentralized.

Doing locks more frequently would require doing it automatically, without user's explicit consent. This would make it more centralized.

Centralized/decentralized is more like a spectrum rather than a clear cut.

Maybe users can disable this automatic locking, then they have some control, but to a lower degree.

Hmm, like what?

That would be point 3.3 in my original message. I don't have a complete picture right now, but I guess it should be a trusted node which signs blocks it sees so certain version of blockchain becomes locked. This isn't very different from locks in source code, it just doesn't require binary updates.

But I think it should be advisory rather than mandatory. I.e. users are free to ignore it, or they can switch to different trusted node.

Also maybe it's worth detecting running 51% attack and advising to hold transactions for some time.

Frankly, I don't see 51% attack as a big issue. It's kinda unlikely that it will be used for double-spends on a young currency (aside from pranks), and denial of service isn't a big deal: they won't pull it off for months, right?

Network-level DDoS would be a different thing, though.

But if "influential people" would announce their hostility from start I will just cancel this idea, it's not worth it. But then, don't complain about lack of innovations

1. To get it merged-mined I need to convince some major pools that my chain is a great thing. To make it just mined I only need to convince a bunch of users to contribute their CPU resources. One is harder than another. And, frankly, I don't want to lie that some experimental chain is best thing since sliced bread, it might be a total failure. Users will be more forgiving than pools, won't they?

2. I think that CPU-mining is a great feature. Not for coin security, of course, but it's just fun for users. I believe that considerable part of initial bitcoin popularity could be explained by the fact that averages users were empowered thinking that they can download some program and start generating some currency. GPU-based mining is quite a bit more involved than that, but pools and GPU-mining came when Bitcoin already had some popularity. It also worked with a limited success for *brix and litecoin. But now, as far as I can tell, there is no real GPU-hostile currency at this point.

3. Obviously no existing block chain can serve as CPU-friendly merged mining host. Frankly, I don't see Litecoin merged-mining sufficiently different from Bitcoin merged-mining for it to matter, aside from the fact that it might be easier to convince Litecoin pools. (And maybe there will be some difference when ASICs will dominate Bitcoin mining.)

4. While CPU-only mining is mostly just for fun and economic reasons, it can also be seen as a way to improve democratic control over currency as there will be lower incentive for people to organize into pools. This might be of a higher importance for a experimental currency: pools are inherently more conservative, and "pooled democracy" is inferior to direct democracy. Basically, I won't have to convince DeepBit-analog to enable certain feature. You remember BIP-16, right?

5. I believe that worst thing can happen is DoS and double-spends, and I don't see it as a big deal for experimental currency. So I won't see 51% attacks and obscure forking conditions as a big deal.

6. Thanks for encouragement, but I also want to see some CPU power pledged. If bbqcoin could get it, can't I?