Blockchain = Powerful Tool for Keynesian Monetary Policy

[myrkul]

Either that, or you're trolling.

I find that to be entirely likely. The level of statism in his posts exceeds even the most brainwashed posters I've talked to, and approaches Colbert Report-style parody.

[Rudd-O]

Either that, or you're trolling.

I find that to be entirely likely. The level of statism in his posts exceeds even the most brainwashed posters I've talked to, and approaches Colbert Report-style parody.

I concur. That is why I added him to my shitlist and he gets no more replies from me. My time is far too precious to squander on the likes of that fool.

[Rotsor]

Rassah,
If you made some effort to understand cunicula's posts, you'd have realised that the mining business with PoW is very similar to saving in PoS: you invest money into it and are rewarded with newly-minted coins for that.

The differences are strongly in favour of PoS though:
* With PoW minting wastes power, with PoS it doesn't.
* With PoS mining returns are predictable and fair (proportional to the capital invested), with PoW it's more like a gamble (some people make a lot, others take a loss).

I don't know why you must resort to insults instead of making your point clear.

cunicula, I salute your patience!

Rudd-O, myrkul, bad, bad trolls.

[cbeast]

Also this: http://gavintech.blogspot.com.ar/2012/05/neutralizing-51-attack.html
Basically, it says that a crude proof-of-stake can quickly and easily be bolted upon the protocol if and when the attack comes.

If such a patch is coded, how would we know it is applied benevolently and affirm that it is genuine? If a 51% attack is overt, this might work, but it's more likely that such an attack will be covert and not immediately noticed. It would be better to simply guard against it by adding more hashrate. That is not a matter of how, but who will do it?

[Rassah]

Rassah,
If you made some effort to understand cunicula's posts, you'd have realised that the mining business with PoW is very similar to saving in PoS: you invest money into it and are rewarded with newly-minted coins for that.

The differences are strongly in favour of PoS though:
* With PoW minting wastes power, with PoS it doesn't.
* With PoS mining returns are predictable and fair (proportional to the capital invested), with PoW it's more like a gamble (some people make a lot, others take a loss).

I don't know why you must resort to insults instead of making your point clear.

cunicula, I salute your patience!

Rudd-O, myrkul, bad, bad trolls.

Cunicula is honestly the only person I blatantly insult like this, and I only do it because that's what he often does to others. I have no problems with stooping down to other people's levels if I feel they deserve it.
PoW separates the functions of saving/spending and mining, while PoS makes them one and the same. Mining returns are just as predictable in a PoW system as they are in a PoS system, but I'm not sure how you believe PoS is more fair. With PoW, you put in more of your own money, you earn more from mining. With PoS, you concentrate your wealth, and the wealth gets concentrated with you even more. PoW allows anyone to buy a small mining device and try their luck at mining, while PoS concentrates mining power among the most wealthy, and makes them even wealthier simply for being the most wealthy. It's about as fair as a tax system that makes everyone who is poor or middle class pay taxes, while giving money to the richest few just for being rich.

[Rotsor]

PoW separates the functions of saving/spending and mining, while PoS makes them one and the same.

Not sure why one needs to make them distinct. Is there a reason?

Mining returns are just as predictable in a PoW system as they are in a PoS system, but I'm not sure how you believe PoS is more fair.

Well, can you predict what will the buyers of the coming ASICs earn? Will they cover their costs? How large will be their margin? Neither can I.

And here, I invert this statement for you so you see it makes as much sense inverted as the original:

PoS allows anyone to buy a small number of coins and try their luck at mining, while PoW concentrates mining power among the hardware owners, and makes them able to afford even more hardware simply for being the most wealthy.

You see, however "fair" you try to make your wealth-distribution system, the rich will always be able to claim their proportion of distribution because they have the proportional amount of power. That problem is not to be solved by cryptocurrencies, and, in my opinion, is not a problem at all!

By the way, I'm not sure about this: do you realise that if everyone mines in a PoS system, the proportion of one's wealth does not change? For example, if I owned 1% of all the coins and you owned 30% and everyone was mining, after some time I would still be owning 1% and you would still own 30%, not making me any poorer, nor you any richer.

[Rudd-O]

Rassah,
If you made some effort to understand cunicula's posts, you'd have realised that the mining business with PoW is very similar to saving in PoS: you invest money into it and are rewarded with newly-minted coins for that.

The differences are strongly in favour of PoS though:
* With PoW minting wastes power, with PoS it doesn't.
* With PoS mining returns are predictable and fair (proportional to the capital invested), with PoW it's more like a gamble (some people make a lot, others take a loss).

I don't know why you must resort to insults instead of making your point clear.

cunicula, I salute your patience!

Rudd-O, myrkul, bad, bad trolls.

Cunicula is honestly the only person I blatantly insult like this, and I only do it because that's what he often does to others. I have no problems with stooping down to other people's levels if I feel they deserve it.

I don't even bother insulting him anymore.  An insult is far too precious to waste on that angry shithead.

[majamalu]

Cunicula is honestly the only person I blatantly insult like this, and I only do it because that's what he often does to others. I have no problems with stooping down to other people's levels if I feel they deserve it.

When the idiot of the forum insults you, remember: that's god's way to tell you that you're right.  

[Rassah]

PoW separates the functions of saving/spending and mining, while PoS makes them one and the same.

Not sure why one needs to make them distinct. Is there a reason?

Decentralizing and separating as many functions as possible is a good thing. Easier to upgrade and fix a piece if it's separate, for example.

Mining returns are just as predictable in a PoW system as they are in a PoS system, but I'm not sure how you believe PoS is more fair.

Well, can you predict what will the buyers of the coming ASICs earn? Will they cover their costs? How large will be their margin?

Yes, I can. We know close to how many ASICs were ordered and how much hashing power we are expecting to have within a month after they start shipping. Yes, they will cover their costs. A Mining Rig SC will earn about $6,000 a month at first, which will taper down to about $2,000 a month after about a year if sales continue to increase. We can't get exact predictions, but we can calculate that if the hashing power is such and such, and the difficulty is at a specific level, the payout will be a certain specific amount. You didn't think miners were just throwing dice in the dark, did you? I know on a certain other forum the general con census is that miners have no idea what they are doing, and are burning more electricity than they make, with the hose that maybe they'll get lucky and make a profit, but that's not how it works. Everything is very precisely calculated and accounted for. For example, I am currently earning exactly BTC5.43BTC a month, and am spending close to $45 for electricity (plus a few pennies).

On the other hand, in a PoS system, those with the nighest savings are the ones who generate blocks. I'm guessing who gets to process a block is chosen at random? How would people pool block mining? How can you tell whether you'll be the one to generate a block? How can you tell if you even have enough money to generate a block? Or is the hypothetical system totally ignoring the concept of blocks to secure transactions, and is just paying everyone 1% or whatever for just having money?

And here, I invert this statement for you so you see it makes as much sense inverted as the original:

PoS allows anyone to buy a small number of coins and try their luck at mining, while PoW concentrates mining power among the hardware owners, and makes them able to afford even more hardware simply for being the most wealthy.

The difference is that I have to go through the effort of taking my mining profits, and actually use it to buy new mining equipment. I also have to compete against others to set up the most efficient miner possible. Or I can let it mine at the same rate, and use the money on other things. And someone who isn't a miner can use their BTC to buy mining equipment and join the mining as well. With PoS, I get a new "miner" every time I get paid. It's automatic. You don't need to work for it, you don't need to compete, you just keep getting richer from simply being rich.

By the way, I'm not sure about this: do you realise that if everyone mines in a PoS system, the proportion of one's wealth does not change? For example, if I owned 1% of all the coins and you owned 30% and everyone was mining, after some time I would still be owning 1% and you would still own 30%, not making me any poorer, nor you any richer.

Again, this is assuming everyone mines. I'm not sure that can be the case. Who creates the blocks, whoever has the most at stake? Or is everyone just getting paid?

Oh, just thought of another major problem with PoS. Mining has two purposes: securing transactions, and distributing coins. Anyone who wants to make coins can buy mining equipment, and thus coin generation is available to anyone with money. PoS, on the other hand, only gives coins to those who already have them. That's not a very good method of distribution I don't think.

[cunicula]

PoS, on the other hand, only gives coins to those who already have them. That's not a very good method of distribution I don't think.

I actually agree with this point. The PoW distribution is an effective marketing device (although ASICs kind of break that; scrypt is better for this reason). There could be other free hand out mechanisms that work however. I don't have a problem with initially distributing all coins to PoW miners. I just would like to get this over with quickly, say in the space of 1 year. I also propose that PoW function solely as a mechanism for free handouts, not as a txn verification service.

If you want to bootstrap a network, you should initially give some handouts to consumers. You should also initially give handouts to businesses. PoW mining gives handouts to consumers, but fails to give any handouts to business. To solve this, I would propose that PoS miners select businesses for initial handouts through a majority voting procedure. As it stands now, we have lots of people threatening to 'money bomb' businesses to accept bitcoin. Unfortunately, these are empty threats. Voting would make the threats enforceable.

Here is a paper on a closely related issue. It discusses efficient provision of subsidies for technology adoption in commercial banking:

http://www.u.arizona.edu/~gowrisan/pdf_papers/netstruct.pdf

[iain]

Well! This thread has certainly got us all thinking about the robustness or lack thereof of various cryptocurrency designs! Cunicula's opening post paints (possibly provocatively or tongue-in-cheek?) a central bank's hypothetical successful 51% attack as a good thing. I think most of us on this forum would disagree. We want our cryptocurrency to stop any would-be central bank / central planner from saying "you can only spend your coins in a style approved by our macroeconomic policies". (In just the same way as we want it to stop a present or future PayPal from saying "you can only buy what we think you ought to buy, and donate to who we think you ought to donate to". - Or, more precisely, they can say it, but we can reply "we don't need you any more".)

That's what we want. How do we get it?

For attacks falling short of 51%, there's some mileage to be had in changing the "proof-of-..." choice from one thing to another. Proof-of-work, proof-of-stake, proof-of-activity... they all have interesting advantages and disadvantages and are all debated vigorously in various corners of this forum. Indeed, I'm planning to add to the list myself real soon now, with something I call "proof-of-burn". But they all crumple under a 51% attack. (That includes my proof-of-burn too! It's not immune!) So, when facing an adversary wealthy enough to acquire and use 51% of whichever "proof-of..." resource is being measured by the network - hashing work, stake, burn rate, signature activity, you name it - we need new techniques to stand up to such an attacker.

I think the good news here is that a 51% attacker's chain has to behave visibly strangely when excluding "technically fully sensible but politically unapproved" transactions, such as the "no, I'm not going to pay your coin-year-demurrage level of fees!" transactions Cunicula's example central bank would like to exclude. Such transactions sit in every node's memory pool. Then, every time any such transaction gets into a block (mined by an honest miner who's perfectly happy with its "ordinary" competitive-mining-market-clearing level of fee), the winning chain always ends up building on the previous block, orphaning the honest block and orphaning the transaction back into the memory pool. Whereas, every time no such transactions get into a block, the winning chain always ends up building on that block - it being a block produced by the 51% attacker (or by an honest miner who happens to have inadvertently followed the attacker's policy by happening not to have included those transactions for whatever mundane reason).

This behaviour is visibly strange in a statistical sense. It may not seem strange the first time, or the second time, or the tenth time, but as the politically-unapproved transactions hop in and out of everyone's memory pool more and more often, it becomes ever more absurd to ascribe their exclusion to bad luck.

(Contrast this with an attack whose motive is double-spending, rather than political control of the cryptocurrency. In the double-spending scenario, the network has no real opinion about which of the incompatible transactions ought to succeed and which ought to fail. An attacker can choose whichever one profits them and hurts the recipients[-until-later-reversed] of its double-spending sibling(s). Recipients just have to learn to wait long enough that even the attacker loses interest in further reversing their own chain - their own reversal-attack upon some earlier apparently winning chain - to that block-depth extent. But in the transaction-excluding scenario, the network's honest users do have an opinion about which treatment of the single [no double-spending siblings] transaction ought to succeed and which ought to fail. Namely: the transaction's presence is what ought to succeed, and its absence is what ought to fail!)

This visibly strange behaviour opens up the possibility of a "heuristic defence". I'm certainly not claiming I have such a defence in polished form ready to implement; but in broad outline, nodes would try to compute a "probability (or plausibility) rating" for each new block they encounter. How long has an in-again-out-again transaction been in (and out and in...) my memory pool? What fraction of my network neighbours agree it's been stuck like this for ages? (And recursively, can they report the statistics of their neighbours' opinions, in cheap aggregated form?) If it's ever more obvious that essentially the whole network knows about it, it becomes ever more ridiculous (exponentially so, I'd suspect) to believe that a whole sequence of miners can have not heard of it. Even more so, since it was sitting there inside an expensive object to produce - namely, a later-to-be-orphaned block produced by an honest miner - and a thousand websites could spring up, listing (unfakeably! the orphaned blocks are expensive things to produce!) all the transactions therein that are compatible with, but mysteriously excluded for ages by, the current winning chain.

The naive height-strength (difficulty or its proof-of-whatever equivalent) of a block would then be multiplied by that probability or plausibility rating, and it would be the sum of such plausibility-adjusted height-strengths, not the sum of the naive strengths, which would be used to judge a winning chain.

Yes, this does have the danger that different nodes would compute somewhat different plausibility ratings to multiply naive strengths by; and network consensus convergence could be placed in jeopardy if their opinions were too divergent. So, one would not want to be too eager to deprecate a block by a large factor. Still, in really extreme cases (say down into one-in-a-million territory for a transaction to have been excluded by bad luck - the power of exponential shrinkage means we get down there quite fast!), a sizeable deprecation becomes sensible (e.g. if we deprecate by the sixth root of plausibility, the attacker's blocks are deprecated by a factor of 10 in the one-in-a-million example - enough that 10% honest miners win out over a 90% attacker).

So... there's hope for us yet! Even with a billionaire central bank as adversary!

(A final note: who's running those "thousand websites" [or tor-sites... whatever] listing the suspiciously excluded transactions? Well, anyone can set one up; and serious, big full nodes, such as those run by serious professional miners, should be eager to subscribe to such sites, for a micropayment or subscription fee or the like if necessary. After all, if you're a miner, and you know that other nodes are going to deprecate your block if you don't make an effort to include that gaggle of suspiciously excluded transactions, that's a powerful incentive to keep yourself up to date with the general state of play! - And yes, we should of course aim for the network itself to achieve such functionality, without external sites' involvement. Perhaps nodes could report to their neighbours a standardised-mathematical-language set of reasons why they attached such-and-such a deprecation factor to such-and-such a block? The challenge would be to handle one's neighbours' reasons-descriptions in a way that, while stopping short of naive slavish agreement therewith, still encourages a helpful consensus to emerge.)

[cbeast]

If you want to bootstrap a network, you should initially give some handouts to consumers. You should also initially give handouts to businesses. PoW mining gives handouts to consumers, but fails to give any handouts to business.
http://www.u.arizona.edu/~gowrisan/pdf_papers/netstruct.pdf

This seems to be yet another example of a fundamental moral flaw in the understanding of game theory. It's called Proof of Work, not Proof of Entitlements. The block rewards are not a hand out, they are earnings for the work put into the network. No individual or business is guaranteed to make a profit and they shouldn't, but the rules still have to be fair for everyone.

I'm not sure how an ACH subsidy scheme for large and small banks relates to Bitcoin. The analogy is lost on me. Bitcoin is a fully automated ledger. Network management is a well established art. Mining businesses are able to work transparently. Network administration determines the profitability of mining. No subsidies required. Bootstrapping notwithstanding, few miners are currently in business to make big profits and instead are speculating on the growth of network capitalization and probably will do so for the next several decades.

[cunicula]

I'm kind of skeptical of these types of voting rules.

My concerns are:
a) If the voting rule is explicit and fixed, it can likely be exploited by the attacker. He will just need 51% of something or a combination of somethings.
b) If the rule is implicit and flexible, it will be hard to reliably generate consensus.
c) Complex rules are hard to model reliably.

If you are interested in these kinds of schemes you might check out the recently updated:
https://en.bitcoin.it/wiki/Proof_of_Stake
I added proposal which I believe to be more promising than anything else I have suggested so far. It is based on the PoA discussion with iddo.

[cunicula]

This seems to be yet another example of a fundamental moral flaw in the understanding of game theory. It's called Proof of Work, not Proof of Entitlements. The block rewards are not a hand out, they are earnings for the work put into the network. No individual or business is guaranteed to make a profit and they shouldn't, but the rules still have to be fair for everyone.

Game theory is amoral. I don't understand how it can have a moral flaw. If you prefer to call handouts a work subsidy, that is fine by me. If a business got a work subsidy, it would be because 51% of coin owners voted to give them one.

Example: Suppose 3% of all block reward was sent to newegg. In exchange newegg agrees to adopt bitcoin as a payment method. Your BTC balance would decrease by 3%. However, the worth of your BTC in USD would probably increase by much more than 3%. This would make you better off. The 'handouts' for business are just mechanisms to enable bribery. Does this seem morally wrong to you?

I know 'taxation = theft', etc., etc. 'I shouldn't be forced to pay newegg'. Seems like stuff & nonsense to me.

[cbeast]

This seems to be yet another example of a fundamental moral flaw in the understanding of game theory. It's called Proof of Work, not Proof of Entitlements. The block rewards are not a hand out, they are earnings for the work put into the network. No individual or business is guaranteed to make a profit and they shouldn't, but the rules still have to be fair for everyone.

Game theory is amoral. I don't understand how it can have a moral flaw. If you prefer to call handouts a work subsidy, that is fine by me. If a business got a work subsidy, it would be because 51% of coin owners voted to give them one.

Example: Suppose 3% of all block reward was sent to newegg. In exchange newegg agrees to adopt bitcoin as a payment method. Your BTC balance would decrease by 3%. However, the worth of your BTC in USD would probably increase by much more than 3%. This would make you better off. The 'handouts' for business are just mechanisms to enable bribery. Does this seem morally wrong to you?

I know 'taxation = theft', etc., etc. 'I shouldn't be forced to pay newegg'. Seems like stuff & nonsense to me.

What's so special about newegg? I would prefer (as most probably would as well) to do business with a company that chose Bitcoin based on its utility, not for a subsidy. Herein lies the morality of game theory you don't get.

[cunicula]

What's so special about newegg? I would prefer (as most probably would as well) to do business with a company that chose Bitcoin based on its utility, not for a subsidy. Herein lies the morality of game theory you don't get.

Nothing is special about newegg. It would just be a large merchant that accepts bitcoin. It is a common place to spend money among the bitcoin community. So there is a strong possibility that adoption would be self-sustaining after the subsidy is withdrawn. That is the goal of these subsidies. To enable something good to happen that might not occur otherwise.

Okay, it is true. I am trying to maximize success probability. I do not care whether the means through which success is achieved are moral or immoral. Even if I did I probably don't agree with you about morality.

[lonelyminer (Peter Šurda)]

Hello Iain,

great insights from you as usual. I just have one addition. I think that on a theoretical level, it is easier to distinguish attacker's blocks from normal ones than you portray, because the attacker has a particular goal in mind, which is by definition distinct from that of the "good" participants. He cannot reach the goal without exposing the method by which he is reaching it. So theoretically, it is always detectable, and can be mitigated against by the genuine nodes, irrespective of the exact mining algorithm (PoW/PoS/PoB/...).

The question is then more practical, the defence needs to be sufficiently quick, and sufficiently effective to allow the "good" blockchain to continue. It does not need to be immediate or 100% successful, or outcompete on mining. A fork is also an acceptable solution, indeed, it might be a better one than trying to outcompete the attacker on mining. The result would be two competing blockchains, mutually incompatible, which will economically lead to a floating exchange rate between them.

In order to avoid ideology in the block assembly mechanism, my personal recommendation is then to detect deviations from the market equilibrium. This results in greater predictability, as well as providing a reason for people to continue preferring Bitcoin. Even if Cunicula has other plans, all other things being equal, people do not choose a medium of exchange which they themselves would be prevented from using the way they want. If he wants to implement features that screw people over, as long as it is distinguishable from the legitimate Bitcoin (and doesn't have sufficient other advantages, such as liquidity or transaction costs), it would not be able to replace Bitcoin. Some masochists or luddites might use it but that's about it.

[cunicula]

Even if Cunicula has other plans, all other things being equal, people do not choose a medium of exchange which they themselves would be prevented from using the way they want. If he wants to implement features that screw people over, as long as it is distinguishable from the legitimate Bitcoin (and doesn't have sufficient other advantages, such as liquidity or transaction costs), it would not be able to replace Bitcoin. Some masochists or luddites might use it but that's about it.

My alt-chain scheme is detailed here:
https://en.bitcoin.it/wiki/Proof_of_Stake

If you read it, I think you'll find that it is not a Keynesian scheme at all. If you think otherwise, please let me know why.
 
My hope is simply to reduce effective transaction fees to near zero for users that maintain active nodes. No inflation tax. Negligible transaction fees. Blockchain secure against 99.999% PoW attack. Many active nodes. Limited losses in the event of private key theft. Those are my hopes. I don't think bitcoin can give us these things. If I did, I would not have bothered to make a new plan.

I don't work for a central bank. That is not my job. I'll let them worry about Keynesian stimulus. I could really care less. I'm just letting you know how I think central banks would regulate the bitcoin system.
Central bank intervention will only happen if cryptocurrency grows sufficiently to compete with national currency systems. If that is your goal, then you should have some sort of plan. Good luck.

I am more concerned about cryptocurrency growing to effectively compete with PayPal, Western Union, Visa, and Mastercard. I think the developers may not believe that bitcoin is capable of doing this.
http://www.reddit.com/r/Bitcoin/comments/13jj0d/in_favor_of_not_increasing_the_block_size/←This worries me. I think they are at least partly hamstrung by an absurd attachment to PoW.

[cbeast]

The fear about a Central Bank monopoly on Bitcoin is irrational. Central Banks power has waxed and waned, but it only happens when they appeal to people's fears about macro economics. We don't have powerful central banks when money is backed directly by gold. The problems with central banks enter when they have the power to print fiat money. They have done this in the past by appealing to stupid politicians that were elected by their public popularity. Somehow, there is a notion that central banks will find a way to aggregate computer engineers to develop a bulletproof bitcoin monopolization network. Here's the thing: nobody likes these guy and people smart enough to put this together would not do it for those assholes. CENTRAL BANKS WILL SOON BE HISTORY. Bitcoin is their extinction level event. It's time for money and politics to evolve beyond keeping the public ignorant about how things work and time to make information about money and commerce transparent. If there is ever a threat to bitcoin, it will not come from old money or central banks. It will be from civilization no longer needing money.

[Rassah]

Some more PoS concerns:

Fees on keys that do not maintain active nodes? How will "active" be determined without exposing the key to being traced to its IP address?

Right now, if I'm one of the wealthiest Bitcoin owners, all I need to do is keep my private key safe, and pay a fee to whoever wants to do the mining to be able to spend my money. I can mine myself, but mining for coins isn't the main reason for cryptocurrency, and I would much rather leave that to professionals. With a PoW system, I would be almost obligated to mine using my large wealth, with means also keeping a copy of the whole blockchain, and making sure my private key, which would otherwise be stored on a paper somewhere, is exposed to the web so it can keep mining.

The idea that to gain 51% of control in PoS is very expensive is quite wrong.
PoW has mining pools. A pool operator makes money by providing a central mining point, but if he proves to have bad intentions, or his pool gets over 51% hash rate, miners point their pools elsewhere.
In a PoS, the wealthy owners have a higher chance of signing a block and earning a reward. People will likewise pool their resources together into a single account in hopes of getting a more steady reward, and the pool operator will likewise have incentive to set up a pool and make money off of it. However, if the pool operator turns out to have bad intentions, or gains 51% of the hash rate, the owners are at the mercy of the pool operator, and only hope to get their coins back.
I think recent Bitcoin history has proven that people are quite willing to give their coins to someone if they can give them a good return, and when you pair that with the mining pool idea, I think it would pretty much be a guarantee.