This relies on features not yet present in protocol, but it is possible to make something similar with existing features.


Nobody is giving up on anything, there are many options.

Bitcoin isn't 100% anonymous either, so reputation system based on pseudonyms won't be significantly worse.

There is no "valid until" feature in transaction, but there is "not valid till" feature. It is called nLockTime: before nLockTime happens, transaction isn't considered final (locked) and thus cannot go into block. nLockTime can be specified either in wallclock time, or it can be specified as block number.

As you can see, this feature is frequently used to implement contracts: https://en.bitcoin.it/wiki/Contracts

You can simply use nLockTime somewhere in future and no party will haven an advantage in multisig/coin swap transaction: both can back out before nLockTime by spending their output.

It is less than perfect because it is prone to all sorts of race conditions, it is just that no party has a priority in that race.

Yes, this is more-or-less how we are going to do it. There is probably some discussion in "Atomic coin swapping" thread.

The fact that one of parties can cancel order isn't a huge problem.  It can be alleviated with a reputation system, for example. Or a spam-filtering moderator.

Double spend can be prevented by waiting until 'the payment' gets enough confirmations.

When Party B refuses to proceed and 'the payment' already got some confirmations Party A has to wait until Tx2 ('the contract') is locked so Party A will get its coins back.

So this is inherently slower than 'atomic coin swap' because in the best case one needs to wait several confirmations, in the worse case one needs to wait for Tx2 lock.

https://github.com/jgarzik/smartcoin: node.py: financial P2P network and DHT client

Description of how it's going to be used: https://bitcointalk.org/index.php?topic=92421.0

---

My plan is to use HTTP to post/retrieve orders and to exchange pieces of transactions. It can work in centralized way (one HTTP server) and in decentralized way (many HTTP servers).

I can publish a more detailed description if somebody's interested...

This isn't true. There are at least two exchange mechanism proposals.

You might not like that, but that doesn't mean that you can say that they don't exist.

Atomic swapping works only within one chain, not between two chains. To trade between chains one needs to use contracts.

Trade between blockchains is indeed vulnerable to double spends. Just like with accepting Bitcoin transactions, one needs to wait for a certain number of transactions before he ships goods -- in this case, finalizes the trade.

But it opens no vulnerabilities for blockchain itself: contracts are just transactions.

I'm not convinced that "bizarre legal hacks" cannot work. Shell corporations, offshore companies and trusts also can be seen as "bizarre legal hacks", but they are widely used and are quite legal.

For example, it is quite obvious when offshore trust is used to pay less taxes, but still it isn't illegal to do it even when intent is crystal clear. E.g. this: http://www.bloomberg.com/news/2012-09-27/romney-i-dig-it-trust-gives-heirs-triple-benefit.html

So, well, why not use same kind of hacks which financial industry uses now for decentralized markets too?

For example, something like this: http://en.wikipedia.org/wiki/Orphan_structure

Use of offshore trust can effectively decouple questions of crypto-ownership (which can be handled in jurisdiction which will recognize crypto-ownership as legitimate) from questions of company operations (it will still be subject of local laws).

Offshore financial centres will likely be much more friendly to new technology and new concepts than more financially conservative countries

So apparently it would be cool to find some solution for small issuers which would work for them until regulations are updated, since we have chicken-and-egg kind of a problem here, it seems.

One of possible solutions is to use intermediaries. P2P microcredit is already an established concept and there are numerous organizations which work with it, e.g. Kiva, Zopa, Prosper etc.

So perhaps it can work exactly like that (on issuer's side), except that creditors will be identified via blockchain rather than via some centralized database.

Use of decentralized market on investor's side is likely strictly superior in all aspects compared to centralized solution. In worst case it can function exactly like centralized solution.

But there are numerous advantages: it is more transparent, investor is able to sell bond at any time if there are buyers, and it largely sidesteps all regulations on investor's side to same extent as they are sidestepped by Bitcoin.

Of course, an argument can be made that it is not decentralized if middle man is used. But:

• Some solution is probably better than no solution at all; at least partially it will be decentralized.
• If there will be many intermediaries which will work with same decentralized market and there is competition among them, then we can say it is fully decentralized market.
  After all, some kind of underwriting is probably necessary even with a completely decentralized solution since you cannot really trust people on the internet.

Sure. But there is a lot of advantages of using the Bitcoin for payments: it is already established, it has a lot of ecosystem around it, exchange rate is not so volatile etc.

If you start a new currency exchange rate can easily change 10000x. It would be rather hard to convince people to use it when it's so volatile. So it will create additional problems for adoption.


I'm fairly sure people will tell you to make alt-chain with changed protocol and use cross-chain trade.


It is actually possible to have zero-valued inputs/outputs. And it's possible to attach arbitrary messages to it.

But it would be a shitty solution since all duty of validation will be passed onto clients. So you CAN have a situation where erroneous information is on blockchain, you can't have pruning and you can't have thin clients. And you have to pay fees with bitcoin.

So, again, how is that better than simply using colored satoshis?

It only makes sense in alt-chain with alternative rules, but I doubt we can collect all requirements now.

So it's better to start with colored satoshis and then maybe try something else.

The difference is that e-gold was actually providing a money-transfer service and was even profiting from it.

If you just issue some securities you won't be directly providing a service. So It would be much harder for authorities to claim that you're facilitating money laundering or something. After all, you can identify people who buy tokens from and who sell you tokens. These tokens can be traded somewhere, but in that sense they are not different from bearer certificates, cash, gold coins etc.

But if you want to do it on a large scale, it would be much better to do it through offshore shell company or something like that.

Also I've outlined a way which would allow to produce personalized final contract only at the last step, and last time I checked IOUs are not illegal.

Maybe authorities would claim that your intent was to create negotiable securities even though contracts do not look like that.

But then again, intent of using an offshore trust is paying less taxes, but it is not illegal. Even US presidential candidate does that, you know.

This is bullshit. The fact that many agreements are honored without legally binding contacts prove that legally binding contracts are not necessary.

Maybe you're saying that statistically people have better luck with legally binding contracts than they have without them, but then you need to show us this statistic, otherwise it is simply unfounded claim.

I don't know any such statistics either, but from personal experience, I never had problems with informal agreements. I work mainly as a contractor, and whenever clients agree to pay me for work they do. I never had any single client which didn't pay, and I never signed anything in advance. Likewise a lot of my friends work in a similar fashion and have no problems either.

I was scammed just once in my whole life, and ironically I even had an IOU from this person: that person was a criminal, as it turned out, and I didn't want to get beaten.


That's the problem with your reasoning: there will be consequences for issuer. At very least nobody will trust him again.

In the worst case... Have you ever heard about internet lynch mob? If somebody knows your real name and you've pissed them off it might be very, very bad for you.

Maybe it doesn't happen in your alternative reality, but it happens in the real world.

I'm not saying that it is a right way to resolve conflicts, but it surely is a possibility, and you have to acknowledge it.


But here we know that being careful and following the rules is statistically much safer than doing otherwise.

But it's far from certain in case with legally binding contracts since people lose their money despite these contracts ALL THE TIME.

It has been demonstrated that sometimes removing traffic lights is better for everybody, both in terms of security and in terms of convenience: http://www.youtube.com/watch?v=lwHfibl1AoI

It would be foolish to simply abolish all rules, everywhere. But sometimes experiments make sense and they produce positive results.


Somehow certification authorities have no problem doing extended validation (http://en.wikipedia.org/wiki/Extended_Validation_Certificate). It's pretty much same thing.


Well, hello? People use digital signatures to interact with banks and tax authorities, but for bond market it is a problem?


And it is a problem why?


Legal system can disagree with the conclusion of ownership represented by paper signed contracts, and? Does it make paper signed contracts meaningless in general?

Well, another advantage is that it is easier to implement atomic coin swaps in one blockchain than implement cross-blockchain trade.

Atomic coin swapping can be implemented with today-enabled features and it is inherently 100% secure.

Cross-blockchain trade requires support for 'contracts' and non-traditional scripts, and it has different security considerations:

1. You want 'the payment' to get several confirmations before you finalize the trade. Otherwise counterparty can pull off a double-spend. So it is inherently slower, i.e. you need at least 10 minutes for the trade.

2. If counter-party did not finalize the trade, your money will hang until time-out expires. So a sort of DoS attack is possible where attacker would make many trades without finalizing them, thus paralyzing counterparty funds for some time.

3. Since it depends on timeout, there are probably some sorts of race condition attacks. For example, attacker might finalize the trade around the timeout, so he will get counter-party's funds via the trade and his funds back via timeout.

But in a long term, I guess, we would want a separate chain just for colored coins, and perhaps it should follow ripplecoin semantics. But we don't know yet all requirements for "colored coin chain", so it's better to wait with it.

There is no reason why several implementation can't work in parallel: e.g. Colored Bitcoins for those who want to trade in Bitcoins, and Colored Ripplecoin for wider spectrum of things.

This is why I'm talking about divide-and-conquer optimizations...


It's not just proof-of-work, it is verifying inputs and ECDSA signatures, transferring data, storing blocks. With large amount of transactions this becomes a real problem.



I mean that if there are costs associated with mining then somebody needs to pay for them.

So it is about reducing costs. Which is not only proof-of-work, but all of the other stuff.

It is absolutely different thing in terms of security. Both for those small guys and for double-spends. (If you'll have large amounts of stake concentrated in hands of ewallet operators double-spending will be trivial.)

You know, I'd rather put my money into USD bank than into PPCoin ewallet. At least USD bank is regulated  and can pay some real interest. (Here where I live banks pay about 8% per year for deposits in USD...)


Oh, have you analyzed how it works? I did.

Consider a simplified scenarios where all stakes are of same size. Mining is essentially a lottery where chances to win are inversely proportional to number of stakes which are actively mined.

If number of actively mined stakes is large then chances to win in one round (after one block) are small.

E.g. suppose there are 52560 active stakes -- one for each block within one year time frame -- then it takes something like a year to win a stake if you check your stake each block.

If you do not check each block you have much lower chances. To the point where you'll die before you win in lottery. And at large time scales compounding starts to matter too.

And don't forget that to mine you need to download and verify blockchain... So you don't win that much from mining only from time to time.

Yes. This is what I was talking about from the start. Let's decouple it into many things and let each part to evolution independently.


Yes, this is what I was talking about. I don't think it's particularly hard, it is just a bit expensive, maybe more expensive than size of the market would support now... Essentially you need a bunch of lawyers (I assume ones which now do tax planning, offshore companies, investment banking perhaps) and a little bit of tech. The only problem is that high-end lawyer won't be interested in doing this if he gets lavish salaries on the Wall Street.

We have a lot of passionate tech guys here, but not enough passionate lawyers/investment banker

Anyway, it can work exactly like investment banking works in real world: to issue shares or debt you need to go to investment banking guys and they'll arrange it for you.

But of course different such companies will offer different level of service. Underwriting debt for a large company is different from personal loan or small startup crowdfunding.

Suppose colored coin represents ownership of property according to some contract. E.g. contract says "I owe money to bearer of that coin", basically.

Court might simply announce that it won't enforce that contract. I.e. for a particular coin contract is invalid.

Then you can still trade that coin, and issuer might pay you. But if you go to that court, it would not accept your claim. Maybe some other court will, who knows...

Anyway, people who trade coins are very interested to listen to these invalidation claims. And it naturally makes sense to publish them in same place where contract is published. Because it becomes pretty much a part of contract.

So it is decentralized: whoever is interested would store this information. It is compatible with uncertainty of court system decision: even if X says contract is invalid, you can go with it to Y.

And it is compatible with colored coin system as you can re-assign different color to invalidated coins, and so your client will not accept them being the same as original.

It is ugly, though, but legal system in general is ugly.

So there is a theoretic framework to do this, but I'm not saying that it should be done. It's more like "our system supports this feature too, if you really want that".

Actually it's more subtle that this for ppcoin. Let's assume that cost of mining doesn't depend on size of a stake.

Then whether it makes sense to mine depends on size of a stake! E.g. if person has X coins and cost of mining per year is C, then it depends on whether (0.01 * X - C) is positive.

So bigger miners get bigger nominal net income out of mining, while small miners will be losing money on mining.

Also note that it is nominal income, we haven't taken inflation into account. With inflation real net value of mining might be negative!

So we get this:

• people with small quantities of money are taxed
• people with bigger quantities of money might make nominal profit, but still lose value
• people with large quantities of money actually make profit on mining

If it's cheaper to mine tax can be reduced.

Think about it: tax = costs of mining.

Not really. It taxes both spenders and non-mining savers.

And even if I was wrong, that doesn't make you right.