Fundamental bitcoin flaw - revisited

[beeblebrox]

Hello,

Yesterday I posted a message about how bitcoin has a flaw.  I was told to research it because it has been discussed many times before and that it has been dealt with.  However, I've have tried to research but can't find anything on it.  Could someone please direct me to discussions about this.  Here is a copy of what I posted in the newbie section:

-------------------------------------------------------------
Hello,
I'm a new member here, although I've been following bitcoin and this forum for a while.  Something has been bothering me for quite some time and I've finally joined to ask you guys about it.   Specifically: it fascinates me that people don't seem to discuss what appears to me to be a most obvious fatal flaw in bitcoin.

ie: The transaction fee model will not support the cost of block creation.  Bitcoin will lose hashing power in the future when block reward coin generation drops off faster than the increase in bitcoin price.

The transaction fee model will not work because you can potentially exchange bitcoins outside the system which doesn't generate any fees for the miners.  For example, you can do this at the moment by physically  printing out the public and private keys to a wallet and physically passing these around in a tamper proof way instead of transferring the coins by way of a transaction within the system-- this is how Casascius coin works.   At the moment these off-chain transfers cannot be done electronically and require that you trust the person that creates the item that is exchanged.  However, soon transferring coins outside the system will be very easy to do since we are currently entering a new era of secure computing where everyday desktop computers and phones will allow you to exchange these key pairs in a secure, non-exploitable way.  This technology is the same that the media companies are demanding that all computers must have to prevent illegal copying of content.  Once someone creates the software to exchange coins this way it will become the most popular way to exchange coins since it is  totally free and instant-- at this point, hardly any coins will be exchanged on the network and hence no transactions fees will be collected by the miners and hence no-one will mine anymore and ultimately bitcoin FAILS.
 
There are various solutions to this problem, but most require hard forks:  listed below are just some
1) Infinite coin supply-- don't 1/2 the block reward every 4 years- instead at some point (say 12 years in the future stop the block halvings).   Note: If you have a constant reward eventually the coin supply will more or less balance out the rate of coin loss so you won't actually end up with an inifinite number of coins.
2) Satoshi Dice and similar services which use the block chain, requiring people to make transactions in the chain (eg: introduce namecoin domain name service, voting services, registration services, proof-that-something-has-happened services)
3) Demurrage where the miners get a fixed amount of the total supply every year, like freicoin.
4) Other schemes similar to demurrage where the miners get rewarded directly from people's wallets without them having to make transactions--eg: long term non-active wallets trigger an expiry date that allows miners to collect its contents. 

Please explain to be why this is not considered the major problem with bitcoin and why it is not discussed on this forum.

(PS:   I personally like the idea of expiry-dates for non-active wallets since it froces people to make a transaction before the expiry or they lose the money (or maybe just a percentage of it)- so the miners can make money by transaction fees and reclaiming dead coin. Am thinking of creating a new coin system based on it-- does one like this already exist though?)
-----------------------------------------------------------------

[jimbobway]

https://gist.github.com/gavinandresen/2961409

[Ichthyo]

it fascinates me that people don't seem to discuss what appears to me to be a most obvious fatal flaw in bitcoin.

The transaction fee model will not support the cost of block creation.  Bitcoin will lose hashing power in the future when block reward coin generation drops off faster than the increase in bitcoin price.

The transaction fee model will not work because you can potentially exchange bitcoins outside the system which doesn't generate any fees for the miners.

You are asking why people aren't discussing what you claim to be a "flaw" in the Bitcoin system.
The answer is simple that what you point out is not a flaw in the system. Rather it is a risk.


Your argument boils down to: people might not be using the Bitcoin network at some point in the future.
And indeed, you're right. There is the possibility that people will not use Bitcoin to a larger extent or switch over to some other system. There is the danger that ordinary people (just everyone beyond us geeks) will not "get" the innovative stance of bitcoin and just prefer to use fiat money, credit cards and gift vouchers or some similar payment instrument. And in this case -- indeed -- the Bitcoin system would fail to succeed and might even collapse entirely. Everyone should be aware of that possibility.

But you are not presenting an argument here. You state that "transaction fee model will not work because..." but you fail to proof why it will not work. You just point out "it might". Everyone will agree with that "it might fail", but there is no need to discuss that.


Having said that -- every discussion about how the Bitcoin system works and might be improved or might not work as intended -- every such discussion makes the basic assumption that the Bitcoin system as such will continue to be used. If we indeed make that assumption, then there are still some possibilities within the system so that there might not be enough incentive for the transaction fees to rise. If you just look through the threads started in the last weeks right here in the main discussion board, you'll find a shitload of threads discussing the issue with the block sizes. These discussions revolve around exactly that topic: are the parameters of the system set correct, so that it continues to generate enough revenue to keep the miners happy, once the finite block reward has dropped significantly. And, just from reading this threads, you'll learn a lot of interesting possibilities, you'll learn, that the answer is not conclusive right now, and that we're basically all just guessing. In that respect, Bitcoin is a huge economical experiment.

[beeblebrox]

https://gist.github.com/gavinandresen/2961409

Just had a skim read of the link.  This is does not really cover the point I'm asking about.  What I'm talking about is the fact the when bitcoin is exchanged off-the-block-chain (eg: casascius coin) there are NO transaction fees at all.  Once off-chain transactions become avaialbe electronically by using the DRM (digital rights management) hardware found in modern computers then it will become the most popular way to exchange coins since it is totally free and instant thus there will be hardly any transaction fee availalbe for miners

I should give a link to the acutal discussion I've had already that details the problem:

https://bitcointalk.org/index.php?topic=147933.0

[MoonShadow]

https://gist.github.com/gavinandresen/2961409

Just had a skim read of the link.  This is does not really cover the point I'm asking about.  What I'm talking about is the fact the when bitcoin is exchanged off-the-block-chain (eg: casascius coin) there are NO transaction fees at all.  Once off-chain transactions become avaialbe electronically by using the DRM (digital rights management) hardware found in modern computers then it will become the most popular way to exchange coins since it is totally free and instant thus there will be hardly any transaction fee availalbe for miners

Addressing only the part I highlighted...

While it's true that off-network or out-of-band transactions could be executed without fees, that does not mean that they are without cost.  Bitcoin transactions are, currently, free under certain conditions; and it's going to remain difficult to compete with that for some time.  That said, even if Bitcoin is so successful that on-network transactions are no longer free in practice; off-network transactions cannot ever be costless, you just might not understand the cost.

For starters, it cost's real resources just to manufacture casascious coins.  Thus they will only be used in cases that their costs are perceived to be lower than their advantages.  Cacasicus coins are as anonymous as paper cash (advantage cash) but still require either an in person transaction or a physical shipping method (advantage bitcoin).  Other off-network methods will have different advantages and disadvantages, but will all have to deal with problems that bitcoin has already solved.  Certainly, there will be cases wherein off-network transactions do make sense.  That's a far cry from the assumption that off-network transactions will always make sense.  For example, your (theoretical) DRM model might have a real use, but it already sufferes from it's own flaw.  Namely that users would have to 1) have a computer capable of 'trusted computing' and 2) an owner that actuallly believes that it is true.  

Furthermore, you'd have to be transacting with a vendor who has similar faith in your computer's trusted computing model.  It's still a central authority model, except you're then putting your faith in Microsoft's ability to deliver on their promises compared to the security model of the blockchain.  While, certainly, there will be a market for this kind of thing; it would likely be limited to small transaction values that a vendor would likely be willing to accept with zero confirmations anyway.  And the first time a computer virus breaks that trusted computing model, whether or not it's bitcoin related, and your theory falls apart.

There is also the issue of vaporware, since the 'trusted computing' thing has been floating around the net as the next big thing for a decade now, and there is no example of it in the wild.  At least not an example anyone would be willing to trust with actual currency.

[beeblebrox]

https://gist.github.com/gavinandresen/2961409

Just had a skim read of the link.  This is does not really cover the point I'm asking about.  What I'm talking about is the fact the when bitcoin is exchanged off-the-block-chain (eg: casascius coin) there are NO transaction fees at all.  Once off-chain transactions become avaialbe electronically by using the DRM (digital rights management) hardware found in modern computers then it will become the most popular way to exchange coins since it is totally free and instant thus there will be hardly any transaction fee availalbe for miners

Addressing only the part I highlighted...

While it's true that off-network or out-of-band transactions could be executed without fees, that does not mean that they are without cost.  Bitcoin transactions are, currently, free under certain conditions; and it's going to remain difficult to compete with that for some time.  That said, even if Bitcoin is so successful that on-network transactions are no longer free in practice; off-network transactions cannot ever be costless, you just might not understand the cost.

For starters, it cost's real resources just to manufacture casascious coins.  Thus they will only be used in cases that their costs are perceived to be lower than their advantages.  Cacasicus coins are as anonymous as paper cash (advantage cash) but still require either an in person transaction or a physical shipping method (advantage bitcoin).  Other off-network methods will have different advantages and disadvantages, but will all have to deal with problems that bitcoin has already solved.  Certainly, there will be cases wherein off-network transactions do make sense.  That's a far cry from the assumption that off-network transactions will always make sense.  For example, your (theoretical) DRM model might have a real use, but it already sufferes from it's own flaw.  Namely that users would have to 1) have a computer capable of 'trusted computing' and 2) an owner that actuallly believes that it is true.  

Furthermore, you'd have to be transacting with a vendor who has similar faith in your computer's trusted computing model.  It's still a central authority model, except you're then putting your faith in Microsoft's ability to deliver on their promises compared to the security model of the blockchain.  While, certainly, there will be a market for this kind of thing; it would likely be limited to small transaction values that a vendor would likely be willing to accept with zero confirmations anyway.  And the first time a computer virus breaks that trusted computing model, whether or not it's bitcoin related, and your theory falls apart.

There is also the issue of vaporware, since the 'trusted computing' thing has been floating around the net as the next big thing for a decade now, and there is no example of it in the wild.  At least not an example anyone would be willing to trust with actual currency.

hey, it's the guy from last night who blocked me...

Well, I'm still waiting for *any* links to threads from *anyone* who read my thread which discusses this issue.  (Just as a reminder, you blocked me because you said that there is a massive amount of discussion on this topic already and that I should do some research before posting.  Well,  I've have been looking for an hour now and so far my post is the only one which directly deals with the problem of off-chain transactions costing miners--  perhaps you can give me just a mere 5 or so threads which I could read.  If you give me them then I'll go off and be quiet and good in my own little corner and not bother you anymore --- I promise   )

[MoonShadow]

https://gist.github.com/gavinandresen/2961409

Just had a skim read of the link.  This is does not really cover the point I'm asking about.  What I'm talking about is the fact the when bitcoin is exchanged off-the-block-chain (eg: casascius coin) there are NO transaction fees at all.  Once off-chain transactions become avaialbe electronically by using the DRM (digital rights management) hardware found in modern computers then it will become the most popular way to exchange coins since it is totally free and instant thus there will be hardly any transaction fee availalbe for miners

Addressing only the part I highlighted...

While it's true that off-network or out-of-band transactions could be executed without fees, that does not mean that they are without cost.  Bitcoin transactions are, currently, free under certain conditions; and it's going to remain difficult to compete with that for some time.  That said, even if Bitcoin is so successful that on-network transactions are no longer free in practice; off-network transactions cannot ever be costless, you just might not understand the cost.

For starters, it cost's real resources just to manufacture casascious coins.  Thus they will only be used in cases that their costs are perceived to be lower than their advantages.  Cacasicus coins are as anonymous as paper cash (advantage cash) but still require either an in person transaction or a physical shipping method (advantage bitcoin).  Other off-network methods will have different advantages and disadvantages, but will all have to deal with problems that bitcoin has already solved.  Certainly, there will be cases wherein off-network transactions do make sense.  That's a far cry from the assumption that off-network transactions will always make sense.  For example, your (theoretical) DRM model might have a real use, but it already sufferes from it's own flaw.  Namely that users would have to 1) have a computer capable of 'trusted computing' and 2) an owner that actuallly believes that it is true.  

Furthermore, you'd have to be transacting with a vendor who has similar faith in your computer's trusted computing model.  It's still a central authority model, except you're then putting your faith in Microsoft's ability to deliver on their promises compared to the security model of the blockchain.  While, certainly, there will be a market for this kind of thing; it would likely be limited to small transaction values that a vendor would likely be willing to accept with zero confirmations anyway.  And the first time a computer virus breaks that trusted computing model, whether or not it's bitcoin related, and your theory falls apart.

There is also the issue of vaporware, since the 'trusted computing' thing has been floating around the net as the next big thing for a decade now, and there is no example of it in the wild.  At least not an example anyone would be willing to trust with actual currency.

hey, it's the guy from last night who blocked me...

Well, I'm still waiting for *any* links to threads from *anyone* who read my thread which discusses this issue.  (Just as a reminder, you blocked me because you said that there is a massive amount of discussion on this topic already and that I should do some research before posting.  Well,  I've have been looking for an hour now and so far my post is the only one which directly deals with the problem of off-chain transactions costing miners--  perhaps you can give me just a mere 5 or so threads which I could read.  If you give me them then I'll go off and be quite and good in my own little corner and not bother you anymore --- I promise   )

<sigh>

No.  That would be me doing your research for you.  I'm normally not inclined towards hand holding.  The search function really does work.  Start by trying to think about it from an economics perspective.  What are the economic drivers for people to seek out off-network transactions, for example?  The short answer is that, in order for people to worry about avoiding the high costs of on-network transactions, the on-network transactions must be more expensive than the costs associated with the development of an off-network transaction method.  As already noted, cash isn't costless.  So what is the real costs of those off-network transactions?  You assume them to be free or near free, but that is provablely not the case. 

And yet, free transactions exist, and we can reasonablely asume they will always exist so long as the blocksize is not near the maximum.  So if the blocksize is near the maximum, then the fee required to get included into a block would be forced (by the free market) to rise.  If the transactions are maxed out, and the fees are rising, under what conditions would an off-netowrk method of avoiding those fees actually lead to the collapse of that market price in on-netowrk transactions?

You Sir, are he who are challenging the status quo; and thus are the one with the burden of evidence, not I.  So please explain how a rising market price in transaction costs, followed by the developmetn of a cheaper off-network method, fails to reach a price equilibrium in the average costs of transaction fees before crashing to zero?  If the price for on-network transactions is non-zero, how does the resources supplied by miners (who desire those transaction fees) also not reach an equilibrium?

[beeblebrox]

....

You Sir, are he who are challenging the status quo; and thus are the one with the burden of evidence, not I.  So please explain how a rising market price in transaction costs, followed by the developmetn of a cheaper off-network method, fails to reach a price equilibrium in the average costs of transaction fees before crashing to zero?  If the price for on-network transactions is non-zero, how does the resources supplied by miners (who desire those transaction fees) also not reach an equilibrium?

Ok, challenge accepted: Let's do the math (I'll even make it personal and use your own levels of acceptible security....)

Firstly I need to know at what level do you consider the system secure enough for transactions: so please reply with your minimium average cost to an attacker for a successful attack for the values of $1000, $100,000 and $10,000,000US.
 (eg: for me personally I would feel comfortable knowing that it would cost for a small transaction <$1000US atleast 2x that to mount a successful double spend attack (ie: if the attacker spent twice as much as they stole they it's good enough for me), if for a moderate individual sum say <$100,000 I'd like feel comfortable that it cost atleast 5x and for a large sum <$10,000,000 say 20x

(please note: just edited 1x to 2x for under 1000US)

[ralree]

Every time you make a physical bitcoin, you must load the associated address.  Every time you cash in physical bitcoins, you must transfer from the coin to your wallet.  Both of these actions incur transaction fees.  It's not conceivable that physical bitcoins will ever represent the bulk of bitcoin commerce for a very simple reason: making change is nearly impossible, and for change to not matter, one would have to carry ridiculous amounts of physical bitcoins with them at all times.  Physical bitcoins are good for simple medium-value face-to-face transactions (eg. "I owe you a coffee, here's a bit-dime") and for advertising.  All large transactions and all online transactions (see bitmit) will still incur transaction fees.

[beeblebrox]

....

You Sir, are he who are challenging the status quo; and thus are the one with the burden of evidence, not I.  So please explain how a rising market price in transaction costs, followed by the developmetn of a cheaper off-network method, fails to reach a price equilibrium in the average costs of transaction fees before crashing to zero?  If the price for on-network transactions is non-zero, how does the resources supplied by miners (who desire those transaction fees) also not reach an equilibrium?

Ok, challenge accepted: Let's do the math (I'll even make it personal and use your own levels of acceptible security....)

Firstly I need to know at what level do you consider the system secure enough for transactions: so please reply with your minimium average cost to an attacker for a successful attack for the values of $1000, $100,000 and $10,000,000US.
 (eg: for me personally I would feel comfortable knowing that it would cost for a small transaction <$1000US atleast 2x that to mount a successful double spend attack (ie: if the attacker spent twice as much as they stole they it's good enough for me), if for a moderate individual sum say <$100,000 I'd like feel comfortable that it cost atleast 5x and for a large sum <$10,000,000 say 20x

(please note: just edited 1x to 2x for under 1000US)

Ok, I've waited for a response for 30 mins and nothing yet from you so I assume your not here any more at the moment.  I have something else to do right now, will check again in 3~5 hours if you have responded and will continue from there...

[beeblebrox]

Every time you make a physical bitcoin, you must load the associated address.  Every time you cash in physical bitcoins, you must transfer from the coin to your wallet.  Both of these actions incur transaction fees.  It's not conceivable that physical bitcoins will ever represent the bulk of bitcoin commerce for a very simple reason: making change is nearly impossible, and for change to not matter, one would have to carry ridiculous amounts of physical bitcoins with them at all times.  Physical bitcoins are good for simple medium-value face-to-face transactions (eg. "I owe you a coffee, here's a bit-dime") and for advertising.  All large transactions and all online transactions (see bitmit) will still incur transaction fees.

Yes, physical coins have problems but that not what I really talking about.  I'm referrring to an electronic version of casascius coin that uses DRM.  

See this thread below (read through it and you'll understand what I'm talking about.  I had to start this new thread to continue talking about it because I one of the moderators closed the old one)

https://bitcointalk.org/index.php?topic=147933.0

[solex]

As long as the main block chain has capacity for extra trade volume it will attract fees.

Check out how fees are increasing exponentially:

https://blockchain.info/charts/transaction-fees-usd?showDataPoints=false&timespan=&show_header=true&daysAverageString=7&scale=0&address=

Transactions done off-blockchain will fund the 3rd party services which will complement bitcoin (such as instant confirms), but this will still leave mining profitable.

[notme]

As long as the main block chain has capacity for extra trade volume it will attract fees.

Check out how fees are increasing exponentially:

https://blockchain.info/charts/transaction-fees-usd?showDataPoints=false&timespan=&show_header=true&daysAverageString=7&scale=0&address=

Transactions done off-blockchain will fund the 3rd party services which will complement bitcoin (such as instant confirms), but this will still leave mining profitable.

It is even growing in btc terms: http://blockchain.info/charts/transaction-fees

[Zangelbert Bingledack]

So begins the wave of newbs who don't understand economics? There'll be a lot more coming, may as well practice before the flood.

[MoonShadow]

Firstly I need to know at what level do you consider the system secure enough for transactions: so please reply with your minimium average cost to an attacker for a successful attack for the values of $1000, $100,000 and $10,000,000US.
 (eg: for me personally I would feel comfortable knowing that it would cost for a small transaction <$1000US atleast 2x that to mount a successful double spend attack (ie: if the attacker spent twice as much as they stole they it's good enough for me), if for a moderate individual sum say <$100,000 I'd like feel comfortable that it cost atleast 5x and for a large sum <$10,000,000 say 20x

(please note: just edited 1x to 2x for under 1000US)

All that is required, IMHO, is that the cost of a double spend attack to likely be higher than the potential ill-gotten gains.  So if you go and buy a car for $50K in BTC, it should be more expensive an attack than that.  However, you are already overlooking a feature of Bitcoin, the more 'confirmation' blocks that one waits for after the first one that accepts your transaction before you walk away, the more "expensive" (in several ways) that such a double spend attack becomes.  Also, it becomes more expensive at an exponential rate.  Thus, anyone who is selling you that car, considering the sums involved, is going to want to wait for 6 confirmations or so before letting you drive away.  At the current hashrate of about 400 PetaFLOPS equivalent, it would take at least 20 of these to overcome just one block confirmation...

http://en.wikipedia.org/wiki/Titan_(supercomputer)

Therefore, the current level of security is several orders of magnitude beyond what is necessary to disincentivize a frausdster from even attempting a double spend attack.  We crossed that point around 2010.

The security that is being paid for is to protect teh entire system from an institutional attack on the blockchain itself, and there is (likely) not a single nation-state with the spare resources to attempt it for even a few hours.  So I'm going to assume that the current profitablility for miners is more than sufficient to secure the blockchain.

Thus the question then becomes, how do we make sure that the curernt level of profitablity continues after the block subsidy is reduced?  First off, that may not realy matter for decades, as teh growth in value has thus far outweighed the reduction in block subsidy.  What was the exchange value when the subisdy dropped from 50 BTC to 25?  I know that it was under $15, and I'm fairly sure that it was under $10.  So at the current price of $34, we are already well over double the profitablity for miners overall.  As long as the real spending value of a BTC continues to double within a four year period, the concern is moot.

But, of course, eventually it wont.  Such growth is not sustainable, so at some point the value must stablize.  How, then, can we be certain that transaction fees will be enough for miners to continue to secure the network?

In short, we can't really know this, but the economics of the system imply that we can expect that an equilibrium of fees will be reached in one fashion or another.  So long as the overall Bitcoin economy is large & mature enough by that time, a tiny fraction of the GDP would be required to incentivize miners into the foreseeable future.  Far less, in fact, than what is taken from you via inflaiton of fiat currencies; which are at least 2% of their entire monetary base every year.  The big key is that Bitcoin is much more economicly efficient than fiat currencies are.

[ancore]

I'm willing to humor you and consider a working, available, universal DRM trusted computing model with remote attestation.
now please consider it doesn't make much sense to use bitcoin any longer

I assume you would want to use bitcoin in that case because you like the fact that it was issued in a decentralized way (and maybe you also like the limited supply?)
now you would use fixed denominations I'll quote you here (from the other thread)
"Also, you only need of regular totals of off-chain wallets to make any amount you wish to exchanged: eg- you can have .... 0.001, 0.002,  0.005 0.1, 0.2 0.5, 1, 2, 5, 10, 20, 50, 100BTC,.... totals in the wallets and you exchange the  key-pairs of the required numbers of wallets to make up the any amount you wish (ie: similar to how regular denomination coins/notes work in real like currency)"
and everybody uses
Why would you keep the burden of maintaining the blockchain at all,  at this point? you could just distribute the one file stating how much every address represents and trade them at face value
at this point bitcoin ceases to exist

in this scenario however bitcoin didn't fail because of a fundamental flaw it simply got out competed by another system, that used bitcoin to solve the problem of how to initially distribute your currency

so please explain what the fundamental bitcoin flaw is?
I just don't get it

[FreeMoney]

In case some people aren't realizing the simple practice of handing off keys is not a safe way to preform bitcoin transactions. The 'sender' can reuse that money any time, a primary way would be to send it to themselves at a new address by making an actual bitcoin transaction.

[flipperfish]

In case some people aren't realizing the simple practice of handing off keys is not a safe way to preform bitcoin transactions. The 'sender' can reuse that money any time, a primary way would be to send it to themselves at a new address by making an actual bitcoin transaction.

Exactly what I wanted to point out, too: How can you be sure, that the previous owner of the coin didn't have a look at the private key?

[ancore]

no, the OP is talking about a trusted computer model (where you can both prove that data wasn't tampered with, there is only one copy and nobody looked at a certain part(the private key in this case) oh and also be somehow pseudonymous )
I'm not saying this model is feasible or not, or how much it would cost or even if it even would be reliable. That's not the point to discuss. The OP thinks that it's a flaw of bitcoins that they can be traded in such a manner

[Mike Hearn]

This has been discussed before. I remember talking about use of TC hardware for improving confidence in unconfirmed transactions years ago, and indeed, this is one of the reasons we want to change the default mining algorithm to allow parents to pay for no-fee children.

If people are building long chains of transactions off the chain by relying on secure chips that's absolutely fine and is not a "flaw" in anything, indeed, it's something I'd encourage. When the chains are eventually resolved by broadcasting them online whoever is doing so can attach a fee to the end and that will encourage confirmation of all dependent transactions recursively.

I guess I don't understand how this is meant to cause problems for Bitcoin. The fees that are being placed onto the network are supposed to be high enough to incentivize sufficient mining to keep the double spend rate acceptably low. If people use secure hardware then the double spend rate is made lower via other means and less mining is needed.