Adi Shamir's paper on bitcoin

[pyra-proxy]

Since when did "not spending all of one's income" change from the noble and encouraged act of "saving" into the ignoble and condemned act of "hoarding"?

It seems thrift is not only absent in modern society, but actively frowned upon. 

I've been having the same thought. I think usually "saving" implies the capital is being made available for investment, while "hoarding" doesn't?

Yeah, it's this.  Saving the money with banks that make loans to businesses/other people or investing directly with businesses keeps the money in circulation, with every time it exchanges hands generally being an instance of goods created or services rendered.

Personal opinion, I think others share is that:

Hoarding is the act of storing something merely for the purposes that it will be increasing in value by just sitting there idle, and typically in absurdly large quantities.
Saving is the act of storing something for the expected use when you need it, not due to the expectation it will be more valuable necessarily when the savings are used, and typically are in quantities reasonable for planned future activities/needs.

i.e. "I am going to hoard all of my bitcoins now because in 20 years they'll be worth $20 million each" vs. "I am going to save X bitcoins so that I can pay my rent for 6 months in case I loose my job"

It's all in attitude and purpose I believe.

[davout]

Dorit Ron and Adi Shamir have already answered.
See previous posts.

[molecular]

Dorit Ron and Adi Shamir have already answered.
See previous posts.

yes, I know, here your post for reference: https://bitcointalk.org/index.php?topic=118797.msg1280496#msg1280496

Menis email contains some questions/angles not contained in yours, though, and frankly, I didn't find their answers to yours quite satisfying.

I have to agree that "statistically", the assumption that all inputs of a transaction have the same owner, is probably mostly true in the wild, but Menis objection that it should be made clear (or quantified in some way) in the paper that this is not a fact but an assumption. Simply citing "an official policy statement" with no reference and then use it as a fact does not suit such a paper well.

[gmaxwell]

Simply citing "an official policy statement" with no reference and then use it as a fact does not suit such a paper well.

They don't cite anything in the paper for that, what they did is repeat the hover-over description text for the address column on blockexplorer word for word without providing any attribution, citations, or even indicating that it was a quotation— they repeated it as though it were their own words. By the bizarre academic standards this is plagiarism, though not especially severe. Whats worse is that it's wrong and that most people would instantly recognize that pop up help is not likely to be the most thoroughly complete information but since they've manage to obscure the source it's now going to be repeated as fact.  Their belief that the help text on block explorer was official policy is consistent with the general confusion they seemed to exhibit that webpages people have created about bitcoin _were_ bitcoin.

And sure, multi-controler transactions are probably not very common, but mistake on that fact alone makes the paper a poor citation for future reference— and it combined with the myriad more obvious though less harmful obvious-to-all-of-us embarrassing mistakes shows that they were generally clueless about the subject and that the peer review system is _not_ working.

In terms of the actual results the apparent misunderstandings about address generation, coin selection, and change (that when bitcoin is use correctly as described in the original paper _all_ bitcoin are going into 'savings accounts' at all times) and the confusion relative to control and ownership (That million BTC volume on MTGOX in the last month would mostly be 'unused'/'horded' coin) are probably bigger issues, but they're harder to reason about because the data for the real answers people want don't actually exist. Perhaps 3/4 of the coins are actually horded.  It's not the the paper's conclusions are wrong on that point as they are wrong on the operation of the system— its that no one, including the authors, knows— as the methods used don't actually show what they claim they do.

[Benatar]

Since when did "not spending all of one's income" change from the noble and encouraged act of "saving" into the ignoble and condemned act of "hoarding"?

It seems thrift is not only absent in modern society, but actively frowned upon. 

I've been having the same thought. I think usually "saving" implies the capital is being made available for investment, while "hoarding" doesn't?

Yeah, it's this.  Saving the money with banks that make loans to businesses/other people or investing directly with businesses keeps the money in circulation, with every time it exchanges hands generally being an instance of goods created or services rendered.

Personal opinion, I think others share is that:

Hoarding is the act of storing something merely for the purposes that it will be increasing in value by just sitting there idle, and typically in absurdly large quantities.
Saving is the act of storing something for the expected use when you need it, not due to the expectation it will be more valuable necessarily when the savings are used, and typically are in quantities reasonable for planned future activities/needs.

i.e. "I am going to hoard all of my bitcoins now because in 20 years they'll be worth $20 million each" vs. "I am going to save X bitcoins so that I can pay my rent for 6 months in case I loose my job"

It's all in attitude and purpose I believe.

Yeah, you're right too, especially when it comes to smaller things like personal savings and rainy days funds and stuff.  I was talking on like a larger scale where that money is a non-insignifcant chunk of the total created currency like in the case Shamir is talking about, where investing in a way that keeps the money circulating keeps the economy as a whole healthier than removing vast chunks from circulation.

[niko]

Each coin is divisible into 100 million units, for the total of 2.1x10^15 units. You can hoard 90% of coins, and I will still be able to use Bitcoin system without any problems. There's plenty of room for everyone. The non-hoarded, circulating  coins can represent value just fine.

[Meni Rosenfeld]

Here is Adi's response to my message:

Dear Meni,

First of all, I would like to thank you and several other members of the bitcoin community for your public comments and private emails, which provided us with a lot of authoritative information about someof the intricacies of the scheme. We will be happy to add more discussion and clarifications to a revised version of our paper, which will hopefully clarify our methodology and add more relevant materialabout the quantitative aspects of the transaction graph.

I would like to address two issues which created the most heated discussion over the last few days:

1. While the notions of a bitcoin and of an address are completely clear, the notion of an owner is quite fuzzy since it can not be derived in a precise way from the available data (this may be a feature ofthe scheme, rather than a bug!). There are several ways how to deal with this issue:

1.1 Ignore it completely, and derive from the graph only statistical information about the behavior of addresses. However, we believe that this will completely distort many types of statistical informationwe try to extract from the graph, e.g., what is the distribution of the number of bitcoins that users keep, how many bitcoins they receive and spend, how big are their typical transactions, etc. Since thescheme enables (and even encourages)  users to keep multiple addresses and to constantly shuffle bitcoins internally among their accounts, we believe that it is essential to find a way to distinguish between"internal" and "external" transactions, and thus to determine in some way what is the common ownership of different addresses.

1.2 Use our methodology, which is to assume that in most of the transactions, sending bitcoins from multiple addresses indicates that all these accounts are owned by a single entity. This classification istechnically easy to apply, but it creates two types of errors: We underestimate the common ownership of accounts just because we never saw it in the given transactions, and we overestimate it sinceoccasionally there may be multiple owners who send bitcoins in a single transaction. All the anecdotal evidence we saw so far indicates that overall we tend to underestimate the number of addresseswhich are associated with a single entity (as was demonstrated in the case of Instawallet, in which we found only about 1/3 ot the actual addresses associated with it), and that the errors in the otherdirection, while they exist, are not likely to distort our statistical conclusions in a major way.

1.3 Use a different methodology, which will be closer to the ground truth, and which can be derived either from the available data, or from reliable alternative sources. Here we need your help insuggesting such a methodology, which will be discussed by and accepted by most of the bitcoin community as better representing the issue of common ownership. It is always easier to complain about theshortcomings of one methodology than to suggest a better one!

2. The question of how many bitcoins are dormant. Even though this was only one of our many findings, it was the one statistic that caught the attention of most commentators and web journalists. Webelieve that measuring this aspect is extremely important, since it implies some fundamental truths about whether the bitcoin scheme is used mostly to trade in goods or to speculate, and how thescheme will behave if its current users will change their current pattern of behavior. Once again , we have several possible approaches, and I would like to recruit your help in initiating a frank discussionin your community about how to measure this fundamental statistics in the most accurate way. We have spent a lot of time and effort in collecting all the data, but once we have it, it will be easy for us toadapt our measuring methodology based on your suggestions as a service to your community and as a contribution to the scientific study of the bitcoin scheme. However, there is one thing I would like toclarify: I do not want to have a target-shopping experiment, in which once you will see the results you will decide whether you like it or would prefer to change the methodology again in order to geta politically more appealing result. We thus propose to wait until some consensus emerges, and only then run the selected methodology on the data and announce the results.

2.1 In order to start this discussion, I would like to make an initial suggestion: Fortunately, the issue of dormant bitcoins can be made independent of the issue of common ownership of addresses(even though several comments we received argues the politically convenient point  that since our decisions about the later point did not absolutely match the ground truth, our results about dormantbitcoins were completely invalid). Let us thus work entirely at the level of addresses, paying no attention to our attempt to find such common ownerships. We propose to compile the followingstatistics: For every amount of time x (e.g., in units of full months), we will measure how many bitcoins were deposited into addresses in transactions that took place more than x months before ourcutoff date (May 13-th 2012), and were not followed by any later transaction in which the address  was one of the sending addresses.

2.2 Notice that if someone keeps moving his bitcoins every few days from one address to the next (which seems to be a relatively common behavior), we will not count these bitcoins at all as dormant(and in this sense we will underestimate the number of dormant coins) unless that user stopped doing this sometime before the relevant point in time (x months before the cutoff date), and in this casewe will only count these bitcoins once, in the last transfer which he executed (since all the previous transactions had a later outgoing transaction).

2.3. To deal with the issue of coins which were minted at the earliest period, when they had little value and could have been abandoned by early experimenters, we can also consider only transactionthat took place after a certain date.

2.4. To be fair, we will have to take into account that if we consider a large value of x, there were fewer coins at that time, so when we compute percentages, we will have to use in the denominatorthe number of coins that had been minted up to x months before the cutoff date.

I would appreciate it if you can bring this proposal to the attention of the bitcoind community, in order to initiate some discussion (and hopefully some kind of consensus). Once you tell us how we shouldmeasure the number of dormant coins in a way that will be accepted to the community, and assuming that this proposal is scientifically sound and technically doable), we will be happy to run theexperiment and report our findings.

Finally, I would like to explain a point that seemed to raise the level of paranoia in your community, and this is the involvement of the Citi Foundation in the project. I can assure you that it was ourdecision to use some of the money that the Weizmann Institute got as a gift from this foundation in order to fund some research on alternative payment systems, that the Citi Foundation had zeroinfluence on the choice of topic, that they did not get any information about our findings while the research was going on, and that they did not see our scientific report before we published it. Our research wasthus motivated by scientific curiosity about the bitcoin scheme, and we had no hidden motives to support or discredit it when we embarked on this project.

Best personal wishes,

Adi.

The tl;dr version:

1. They would like the help of the Bitcoin community for devising an optimal scheme to determine common ownership of coins.
2. They would like the help of the Bitcoin community for devising an optimal scheme to determine dormant coins.
3. There is nothing nefarious about the usage of Citi Foundation funding.

Please see:
How to determine common ownership of addresses? (Inspired by Shamir's paper)
How to determine dormant coins? (Inspired by Shamir's paper)

[Benatar]

Each coin is divisible into 100 million units, for the total of 2.1x10^15 units. You can hoard 90% of coins, and I will still be able to use Bitcoin system without any problems. There's plenty of room for everyone. The non-hoarded, circulating  coins can represent value just fine.

Which would lead further into a deflationary spiral unless protocol is changed to get rid of the cap of units, except with the risk of someone trying to cash out those hoarded coins and crashing the economy as significant chunks enter the economy overnight.

[molecular]

Meni, thanks for posting. Shamir: thanks for in-depth reply.

2.1 In order to start this discussion, I would like to make an initial suggestion: Fortunately, the issue of dormant bitcoins can be made independent of the issue of common ownership of addresses
(even though several comments we received argues the politically convenient point  that since our decisions about the later point did not absolutely match the ground truth, our results about dormant
bitcoins were completely invalid). Let us thus work entirely at the level of addresses, paying no attention to our attempt to find such common ownerships. We propose to compile the following
statistics: For every amount of time x (e.g., in units of full months), we will measure how many bitcoins were deposited into addresses in transactions that took place more than x months before our
cutoff date (May 13-th 2012), and were not followed by any later transaction in which the address  was one of the sending addresses.

back in the days I made a bitcoin-abe query that does pretty much just that ("determine amount of coins not moved since")



I think this is the query I used:

select year(from_unixtime(block.block_nTime)) as year, week(from_unixtime(block.block_nTime)) as week,  count(distinct block.block_id), sum(txout_value)*1E-8 from block_tx inner join block on block.block_id = block_tx.block_id inner join tx on block_tx.tx_id = tx.tx_id inner join txout on txout.tx_id = tx.tx_id left join txin txin2 on txin2.txout_id = txout.txout_id where txin2.txout_id is null group by year, week;

there's also an interactive version (that lets you select the "cutoff-date" using the mouse) here: http://statistics.ecdsa.org/

[molecular]

Once you tell us how we shouldmeasure the number of dormant coins in a way that will be accepted to the community, and assuming that this proposal is scientifically sound and technically doable),

I think it will not be easy to reach a consensus here, because, quite frankly: it can't be done.

To even attempt this, we would first need a definition of "dormant coins".

sidenote: It would be great (to say the least) if Shamir popped up in the forums and joined the discussion without having to proxy messages through Meni/davout/...

[molecular]

Each coin is divisible into 100 million units, for the total of 2.1x10^15 units. You can hoard 90% of coins, and I will still be able to use Bitcoin system without any problems. There's plenty of room for everyone. The non-hoarded, circulating  coins can represent value just fine.

Which would lead further into a deflationary spiral unless protocol is changed to get rid of the cap of units, except with the risk of someone trying to cash out those hoarded coins and crashing the economy as significant chunks enter the economy overnight.

One could argue that "hoarded coins" are not part of the money supply. This would mean bitcoins supply was elastic after all. The hoarders would act as a sort of central banks, injecting/removing bitcoins from the supply (inflating/deflating Bitcoin money supply) based on some policies (probably mostly driven by self-interest, just like with the fed).

[molecular]

1. They would like the help of the Bitcoin community for devising an optimal scheme to determine common ownership of coins.

While I don't think it can be done well enough, this is the best I have come up with so far (this makes the same flawed assumption about all transaction inputs having to belong to one "owner"):

• cluster addresses into wallets, assuming all inputs of a transaction are owned by the same wallet
• compile a list of wallets that are well-known to have multiple owners (e.g. mtgox, silkroad,...)
• remove those known multi-owner wallets from the initial list of wallets
• for the remaining wallets assume the same owner for each

This is only marginally better than Shamirs approach and makes the same underestimation/overestimation errors. It removes the "huge rich owner"-problem introduced by "shared wallets" at the (very high) cost of having to compile a list of well-known wallets by hand.

I would like to ask you guys at this point how high you guess the current percentage (by volume?) of transactions in the wild that have inputs from different owners.

[Meni Rosenfeld]

@molecular - I've now linked to dedicated threads for discussing the two problems, specific discussion of them should continue in those threads.

[Syke]

One could argue that "hoarded coins" are not part of the money supply. This would mean bitcoins supply was elastic after all. The hoarders would act as a sort of central banks, injecting/removing bitcoins from the supply (inflating/deflating Bitcoin money supply) based on some policies (probably mostly driven by self-interest, just like with the fed).

This description sounds pretty good.

[n8rwJeTt8TrrLKPa55eU]

Regardless of any flaws in the methodologies and assumptions used to write the paper, I always view as positive any research which shows that a large percentage of Bitcoins are "hoarded" (or as Erik correctly points out, "saved").

"Hoarding" is a direct measure of a currency's strength, and people's faith in that currency's future.

No one hoards Zimbabwean dollars or Iranian rials.  Why?

Gold is hoarded to a 99.999% level; almost none of it circulates or is used in transactions.

It is fantastic to see Bitcoin in the same league as Gold, USD, and Swiss Francs, as one of the most hoarded currencies on the planet.

Also, to those who have misgivings about initial concentration of coins in the hands of relatively few people, I'd say two things:

1. Allocation over time will become maximally efficient anyway (http://en.wikipedia.org/wiki/Coase_theorem)
2. if we must have concentration, I'd rather it be in the hands of Satoshi and others who think like him in terms of monetary freedom and privacy, than the current system which concentrates money into the hands of central banks, governments, and their crony friends.

[Syke]

While I don't think it can be done well enough, this is the best I have come up with so far (this makes the same flawed assumption about all transaction inputs having to belong to one "owner"):

• cluster addresses into wallets, assuming all inputs of a transaction are owned by the same wallet
• compile a list of wallets that are well-known to have multiple owners (e.g. mtgox, silkroad,...)
• remove those known multi-owner wallets from the initial list of wallets
• for the remaining wallets assume the same owner for each

This is only marginally better than Shamirs approach and makes the same underestimation/overestimation errors. It removes the "huge rich owner"-problem introduced by "shared wallets" at the (very high) cost of having to compile a list of well-known wallets by hand.

Bitcoin, by design, makes it impossible to accurately determine which addresses belong to any given wallet. Therefore, this "analysis" of hoarded coins, etc. will always be significantly flawed.

[freequant]

hmm, either Shamir has gotten "old and ignorant" (like Stallman?) or someone else did this "study" and he just put the name.

Perhaps it isn't a good idea to show too much understanding of Bitcoin when there are legions trying to out Satoshi, and you are a reknown cryptographer in the list of top-10 suspects. Endorsing a poorly researched whitepaper pretty much disqualifies Dr Shamir as a potential Satoshi in the public eye. What better way to divert attention?
I can't think of any other rational reason why a high-flying cryptographer as A. Shamir would associate his name with such an unchallenging and unscientific study.

I am not telling that A. Shamir is Satoshi.
Only that this looks like an attempt, for understandable reasons, to dissociate himself from Satoshi.

That somehow reminds of Paco Ahlgren's strange (but again totally understandable) badly acted denial when he went under scrutiny after writing a (perhaps a bit too much) enthusiastic article about Bitcoin.

[niko]

hmm, either Shamir has gotten "old and ignorant" (like Stallman?) or someone else did this "study" and he just put the name.

Perhaps it isn't a good idea to show too much understanding of Bitcoin when there are legions trying to out Satoshi, and you are a reknown cryptographer in the list of top-10 suspects. Endorsing a poorly researched whitepaper pretty much disqualifies Dr Shamir as a potential Satoshi in the public eye. What better way to divert attention?
I can't think of any other rational reason why a high-flying cryptographer as A. Shamir would associate his name with such an unchallenging and unscientific study.

I am not telling that A. Shamir is Satoshi.
Only that this looks like an attempt, for understandable reasons, to dissociate himself from Satoshi.

That somehow reminds of Paco Ahlgren's strange (but again totally understandable) badly acted denial when he went under scrutiny after writing a (perhaps a bit too much) enthusiastic article about Bitcoin.

You think too highly of scientific publications...   What fraction of today's papers showcase reliable, in-depth, non-biased, honest results anyway? 

[freequant]

The biggest flaw on the paper is the webscraping of blockchain data.
Right there they destroyed any assurance they could have of working with validated data.
How do they know they were fed the correct data by blockchain.info or blockexplorer.com?
The only way to be sure you have the correct blockchain data is to let your bitcoin client download it from the network and verify it. You may also download a blockchain snapshot, but you still need to let the client verify it to be sure what you have is real data and not some decoy.

The paper shall be renamed "Quantitative Analysis of a Full Blockexplorer.com Screen Scraping"

[molecular]

hmm, either Shamir has gotten "old and ignorant" (like Stallman?) or someone else did this "study" and he just put the name.

Perhaps it isn't a good idea to show too much understanding of Bitcoin when there are legions trying to out Satoshi, and you are a reknown cryptographer in the list of top-10 suspects. Endorsing a poorly researched whitepaper pretty much disqualifies Dr Shamir as a potential Satoshi in the public eye. What better way to divert attention?
I can't think of any other rational reason why a high-flying cryptographer as A. Shamir would associate his name with such an unchallenging and unscientific study.

I am not telling that A. Shamir is Satoshi.
Only that this looks like an attempt, for understandable reasons, to dissociate himself from Satoshi.

That somehow reminds of Paco Ahlgren's strange (but again totally understandable) badly acted denial when he went under scrutiny after writing a (perhaps a bit too much) enthusiastic article about Bitcoin.

Interview with Adi Shamir:

Interviewer: "Mr. Shamir, please explain to our viewers, what is the bitcoin blockchain"

Adi Shamir: "The bitcoin blockchain is a list of html pages *twitch* that are connected by hyperlinks *flinch* -- *eyes widen* AAAAAH FUCK IT, I CAN'T DO THIS ANY LONGER!!! THERE, I'LL ADMIT IT TO END THIS CRUEL TORTURE:

I  A M  S A T O S H I !

And the blockchain is this BIEST that listens to us and will eat the creature from jekyll island for breakfast quite soon! Muahahahaaaaaahaaaaaaaaa!"