Proposal: An Alternative Currency that doesn't "waste" energy

[RaggedMonk]

When you do folding@home, you waste a MASSIVE amount of energy and computational power on useless calculations. Most of the results are wrong and can't be used. Once in a while, someone's computer calculates the problem correctly, and that result is the only one that is useful (possible drug or whatever). With bitcoin, there is massive waste, resulting in one calculation that is useful (transactions between a bunch of people get recorded in the ledger and money can change hands). You could argue about which single correct calculation is more important/beneficial, but other @home distributed computing setups are just as wasteful.

I think "wasteful" is the wrong term, because it cannot be avoided.  I think "inefficient" is more accurate.  These are problems which must be brute forced, trying every combination.  Verifying that a solution does not work is not a waste, it eliminates one possibility from a great many, but it is also not really a "success" either.

Coordination, like in mining pools, reduce waste by avoiding repeating computation.  Hopefully most @home programs coordinate their volunteers.

Others have mentioned the idea of the hashing process doing something "useful" IE: perhaps curing cancer or some sort of SETI signal processing, but there is a very convincing (although I can't point to where it is at the moment) argument as to why the hashing process can't be anything 'useful' in an outside sense if the integrity of the system were to be maintained.

I'd love to hear more on this. I'm still leaning towards believing the use of intrinsically valueless computational intensity as a obstacle/control is a design flaw, maybe even an awkward and artificial hack    I'm also unconvinced that the desired characteristics of a medium of exchange like bitcoin should require it.

There are inherent challenges with using BTC network computation for something useful:

-You don't know when someone succeeds because no one knows the answer.
The way hashing works, it is very hard to find the solution, but the solution can be quickly and easily verified.  I don't know much about the @home projects, but this means a btc-style network will only work for certain types of problems.

-but for the projects that can be quickly verified-
-For a cryptocurrency to remain stable over time, it needs a constant string of problems with new ones every 10 minutes.
Because these problems are unsolved, we don't know how long it will take to solve them.  You can't trust a currency where the blocks could be 10 minutes or 10 months, it would be worthless.

-The entire network needs to be able to start working on the next one whenever a block is found.  If the problems are coming from some centralized research institution (ala Stanford), miners closer to the research would get an advantage, because some would have to wait for the problem to travel through many nodes to reach them.

However, if someone can figure out a good solution to these challenges, it would be wonderful.

[1714975483]

1714975483

[1714975483]

1714975483

[1714975483]

1714975483

[crazy_rabbit]

I think it's a non issue. By the time Bitcoin has a substantial user base, there will be technological solutions to energy efficiency.

+1

This is already happening. Buttefly Labs is bringing out specialized hardware that can mine 1 Gh/s @ 20 W.

Expect energy consumption to decrease as difficulty increases.

5 years from now, most mining will probably take place in specialized complexes in Iceland comprising data centers and geothermal power plants.

Yes, a huge industry around doing nothing that actually needs to be done in the most resource intensive way possible makes perfect sense 

a) It's not going to be a huge industry, in relation to the bitcoin economy as a whole, just like gold mining isn't a huge industry. 

b) If you want an example for "a huge industry doing nothing that needs to be done" then look at the marketing industry!  Both Coca-Cola and Pepsi "waste" huge amounts of energy and labor on marketing and all it achieves is to keep their market share approx. constant.    If both of them mutually decided to stop with all the aggressive marketing, they could probably keep their market share and all those resources could be used for something "useful".

Capitalism is suboptimal.  Deal with it.

Yeah, that's actually not true. If they were to stop advertising tomorrow they would immediately lose market share to such obvious alternatives like, water. The industry has studied this topic to death. If they didn't HAVE to spend it on advertising they would gladly give themselves bonuses.

Marketing is critical to capitalism. It's critical to a lot of things actually.

not water, water doesn't have caffeine
what they're really competing against is tea and coffee

in fact, they're trying to supplant tea as the drink of choice in other countries by aggressive marketing

Well, I said, "Like water" implying there are others. You're right though, tea and coffee are the go-to drinks of choice in most places.

[714]

When you do folding@home, you waste a MASSIVE amount of energy and computational power on useless calculations. Most of the results are wrong and can't be used. Once in a while, someone's computer calculates the problem correctly, and that result is the only one that is useful (possible drug or whatever). With bitcoin, there is massive waste, resulting in one calculation that is useful (transactions between a bunch of people get recorded in the ledger and money can change hands). You could argue about which single correct calculation is more important/beneficial, but other @home distributed computing setups are just as wasteful.

I think "wasteful" is the wrong term, because it cannot be avoided.  I think "inefficient" is more accurate.  These are problems which must be brute forced, trying every combination.  Verifying that a solution does not work is not a waste, it eliminates one possibility from a great many, but it is also not really a "success" either.

Coordination, like in mining pools, reduce waste by avoiding repeating computation.  Hopefully most @home programs coordinate their volunteers.

Others have mentioned the idea of the hashing process doing something "useful" IE: perhaps curing cancer or some sort of SETI signal processing, but there is a very convincing (although I can't point to where it is at the moment) argument as to why the hashing process can't be anything 'useful' in an outside sense if the integrity of the system were to be maintained.

I'd love to hear more on this. I'm still leaning towards believing the use of intrinsically valueless computational intensity as a obstacle/control is a design flaw, maybe even an awkward and artificial hack    I'm also unconvinced that the desired characteristics of a medium of exchange like bitcoin should require it.

There are inherent challenges with using BTC network computation for something useful:

-You don't know when someone succeeds because no one knows the answer.
The way hashing works, it is very hard to find the solution, but the solution can be quickly and easily verified.  I don't know much about the @home projects, but this means a btc-style network will only work for certain types of problems.

-but for the projects that can be quickly verified-
-For a cryptocurrency to remain stable over time, it needs a constant string of problems with new ones every 10 minutes.
Because these problems are unsolved, we don't know how long it will take to solve them.  You can't trust a currency where the blocks could be 10 minutes or 10 months, it would be worthless.
 
-The entire network needs to be able to start working on the next one whenever a block is found.  If the problems are coming from some centralized research institution (ala Stanford), miners closer to the research would get an advantage, because some would have to wait for the problem to travel through many nodes to reach them.

However, if someone can figure out a good solution to these challenges, it would be wonderful.

Good. It's very interesting that there's a game in the mathematical sense that can be constructed called a cryptocurrency, there's all kinds of clever applications of cryptography. However, from there you went directly to how bitcoin et al. is implemented. Are you saying that spinning virtual wheels into heat on a cost basis that is open-ended ( the difficulty level ) and completely arbitrary is a functional requirement? If this was any other kind of system or machine, this would clearly be an area for improvement. What value is added by this property that is actually able to vary so much in cost?

Game wise, I do like what seems to be the increasingly self-defeating endeavor of mining as an enterprise as more and more of it takes place. It brings to mind a donkey led with a carrot on a stick, the optimal solution is to see to it that the donkey only ever gets enough carrot to continue chasing the end of the stick.

[gmaxwell]

Are you saying that spinning virtual wheels into heat on a cost basis that is open-ended ( the difficulty level ) and completely arbitrary is a functional requirement?

Fundamental to bitcoin's solution to the decentralized attack resistant distributed decision problem? Yes.

The POW proves that a majority of the interested holders of an forgery resistant asset (computing power/energy) have selected a particular transition history, in a way which can be independently verified by anyone without any trust at all.

This was the fundamental problem which prevented decentralized digital money prior to the invention of bitcoin.  Anyone arguing that it's not essential needs to also answer why why didn't have digital cash in the early 1990s— certainly many people were working hard on making it true then.

[cunicula]

Are you saying that spinning virtual wheels into heat on a cost basis that is open-ended ( the difficulty level ) and completely arbitrary is a functional requirement?

Fundamental to bitcoin's solution to the decentralized attack resistant distributed decision problem? Yes.

The POW proves that a majority of the interested holders of an forgery resistant asset (computing power/energy) have selected a particular transition history, in a way which can be independently verified by anyone without any trust at all.

This was the fundamental problem which prevented decentralized digital money prior to the invention of bitcoin.  Anyone arguing that it's not essential needs to also answer why why didn't have digital cash in the early 1990s— certainly many people were working hard on making it true then.

I'm here to quickly counter FUD from an authority. I won't get into a debate with everyone else.

The innovative concept is validity based on blockchain length. Proof-of-work is a burdensome way of achieving competition for blockchain length . The longest blockchain can win with proof-of-stake just like proof-of work.

Here's a mechanism:

For proof of stake, clients sign blocks with a frequency determined by their coin holdings. Clients can sign a block every t(x) days, where t() is a decreasing function and x is the number of coin-confirmations controlled by the client's private key. Coin-confirmations are the product of the number of coins associated with a private key and the number of confirmations on these coins. Clients demonstrate control over coins by including them in an escrow address within block (k-1). In block (k), escrowed coins are returned along with a 'txn' fee; simultaneously, the signer of block (k) deposits a new set of coins with sufficient coin-confirmations in the escrow address.  

Individuals can't make a long chain without broad participation because acquiring a sufficient number of coin confirmations would be prohibitively expensive.

Ways of improving the mechanism:

Chain reorganizations and information transmission may be troublesome. One solution is to combine proof-of-work with proof-of-stake. (i.e. so that your proof-of-stake provides a subsidy for your proof-of-work)
With lots of coin-confirmations you can accompany your escrowed coins with a proof-of-work of difficulty 123 in block (k-1). With very few coin-confirmations. you can accompany your escrowed coins with a proof-of-work of difficulty of 123456789 (k-1). The scale of the subsidy can be periodically adjusted to keep blocks arriving once every 10 minutes on average. I think this may be the best model.

Benefits in terms of long-run txn fees and security:

Expenditure of scarce resources with alternative uses (electricity) leads to high txn fees and/or weak security (there's a tradeoff). Expenditure of resources without alternative uses (confirmed coins) leads to cheap txn fees and/or better security. High txn fees are far in the future, so no one cares. However, that does not mean that my logic is flawed.

[Rassah]

Who or what holds the escrow? And what prevents the largest coin owners from colluding together to create more coins? H they hold the reserves large enough that everyone depends on their confirmation authority, what's to stop them from abusing that power? Don't forget that inflation is VERY beneficial to those dependent on loans/borrowing, so high value stakeholders could still prefer inflation (see governments and central banks)

[Rassah]

Actually, yeah, let me summarize my last post with: what if the largest stakeholders prefer inflation and the power to arbitrarily print more money?

[cunicula]

Who or what holds the escrow? And what prevents the largest coin owners from colluding together to create more coins? H they hold the reserves large enough that everyone depends on their confirmation authority, what's to stop them from abusing that power? Don't forget that inflation is VERY beneficial to those dependent on loans/borrowing, so high value stakeholders could still prefer inflation (see governments and central banks)

The blockchain holds the coins in escrow. They are not held by an individual. If the chain is extended then they are returned with a reward to the original owner. If the chain is not extended, then the record of them having been escrowed is superceded. In this case, the client would judge that the coins had never been escrowed and they would be returned to the original owner without a reward. These are the only two possibilities. As in the current system, clients will only recognize valid chains and miners will only extend valid chains because of self-interest.

Collusion. People can collude to extend invalid chains. The same arguments applies 100% to the proof of work system. Any group can collude to manipulate the blockchain. They don't do this because it's too expensive to be worthwhile. That's the point of proof-of-work. It forces attackers to spend resources to get their way. Proof-of-stake does the same thing. Control of the blockchain would require accumulation of a majority or near majority of all extant coins. This can be done, but it would be expensive.

Would you really want to spend $10 million to acquire a bunch of bitcoin, fuck bitcoin up, and then try to sell your $10 million of bitcoin back to people? No. For the same reason you wouldn't want to convert a warehouse full of graphics cards and a power plant worth of electricity into bitcoin and fuck up bitcoin. You don't throw a large sum of money into bitcoin in order to make bitcoin worthless. It is a money losing proposition. If you are willing to lose large amounts of money to screw bitcoin, then neither of the two systems can stop you. 

Please, think carefully before asking questions. You are inventing distinctions between proof-of-stake and proof-of-work. If you have a criticism of proof-of-stake, ask yourself whether it applies in the equal measure to proof-of-work. If it does, then there is a problem with your reasoning.

I'm sorry, but this is going to become tiresome very quickly. From now on, I will only respond to critics who employ structured, logical arguments.

[Rassah]

OK, I'll try to construct this logically:

Proof of Work

Needed for successful attack: mining hardware.
Uses for attack assets: Useless for anything other than mining. No reason to acquire unless intending to mine or attack.
Benefit from successful attack: double spending. Possible inflation, though other miners can reject new coins.
Cost of successive attacks: lots and lots of electricity.

Proof of Stake

Needed for successful attack: lots of money. Will be acquired from normal business operations anyway.
Uses for attack assets: it's money. Everyone will have incentive to acquire it anyway.
Benefits of successful attack: double spending. Possible inflation, and continued inflation, since having highest stake means you continue to control the block chain.
Cost of successive attacks: nothing as long as you still have the highest amount of coins

Reasons for Inflation

Money is not wealth, it's just a measure of it. Someone with power of inflation can borrow money to acquire wealth, such as real estate, and then use their power to inflate away the debt or print money to pay off the loan directly, and keep growing their physical wealth at the expense of every other money holder suffering from inflation.
Worse, inflating your own money guarantees you can continue to hold the Proof of Stake power that lets you buy stuff with inflated currency.

I hope this was straightforward and logical enough.

[cunicula]

No sorry. someone else will have to debunk this. Or you can remain confused.

[Rassah]

No sorry. someone else will have to debunk this. Or you can remain confused.

I shall remain so, though primarily because the initial proposition was not logical enough either.

[Explodicle]

No sorry. someone else will have to debunk this. Or you can remain confused.

Which part needs debunking? Now I'm confused because Rassah's description seems to make sense. Could you write a similarly concise pro and con list?

[iopq]

Rassah: there's a problem with your reasoning
if you have 1,000,000 bitlesscoins by taking over the chain and doublespending and stuff, the price of bitlesscoins will plummet and your bitlesscoins will be worthless unless you are able to exchange them for another currency before people notice the hacking

that is, if you are able to doublespend and get more than 1,000,000 bitlesscoins and exchange all of them for BTC (at a good rate too, better than what you bought them for) to pull off an attack then it will be successful

if the volume on the exchange is not great enough, then it will be too cost-prohibitive to buy 1,000,000 BLC just to exchange 500,000 and kill the network and have 500,000 useless coins

[cunicula]

Rassah: there's a problem with your reasoning
if you have 1,000,000 bitlesscoins by taking over the chain and doublespending and stuff, the price of bitlesscoins will plummet and your bitlesscoins will be worthless unless you are able to exchange them for another currency before people notice the hacking

that is, if you are able to doublespend and get more than 1,000,000 bitlesscoins and exchange all of them for BTC (at a good rate too, better than what you bought them for) to pull off an attack then it will be successful

if the volume on the exchange is not great enough, then it will be too cost-prohibitive to buy 1,000,000 BLC just to exchange 500,000 and kill the network and have 500,000 useless coins

Bingo. And if you think that the attacker has any chance of extricating himself quickly without losing money (I don't), then you could just require escrow of coins in the blockchain for 10k blocks (two months) instead of just 1 block (ten minutes). It would then be 2 months before the attacker could recover his coin horde and try to sell it off.


If the attack hasn't been discovered and reduced coin prices after two months, then can you really call it an attack?

[DeathAndTaxes]

Yeah escrowing tens of thousands of coins for months at a time into perpetuity is going to be popular. 

[cunicula]

Yeah escrowing tens of thousands of coins for months at a time into perpetuity is going to be popular. 

Got logic?

[mckoss]

I've not seen any way to resolve the problems with my original proposal; it seems too easy to use a large amount of cash to reach back arbitrarily far in the block chain to re-write history (and hence, invalidate transactions where you spent money).

I also don't like the proposals where participants have to wage a continuous battle to reinforce a disputed block with additional escrow balances.

Unless someone can come up with a brilliant way to salvage this, it seems currently to be unworkable (to me).

But I've enjoyed the discussion and the help poking holes in my proposal.

[Gavin Andresen]

I've not seen any way to resolve the problems with my original proposal; it seems too easy to use a large amount of cash to reach back arbitrarily far in the block chain to re-write history (and hence, invalidate transactions where you spent money).

... or, even worse, invalidate competing proof-of-stakes.

I might like proof-of-stake schemes better if somebody has a good plan for how to get them started-- you've got a genesis block, so the creator starts with 100% stake.

Now what, exactly, happens to create block number 2 for proof-of-stake systems?

[g2x3k]

http://xkcd.com/927/ ....................

[DeathAndTaxes]

http://xkcd.com/927/ ....................

Awesome although it is good enough to inline (the author approves and even supports inlining).