Which Proof of Stake System is the Most Viable

[mhps]

There would be no penalty.  Lets look at the case of a majority and minority attacker separately.  

An attacker with a minority of the stake will optimally support ALL chains including the main chain.  
...  There is nothing at risk precisely because he can support all chains in parallel simultaneously.

I think this is over simplifying. To support all chains one *will* run out of resource (RAM or CPU cycles or fan speed or electricity bill... the whole *POW* cost) soon because the number of forks increases exponentially if you start to tend all of them. Althought the cost per fork looks low, it might just be enough to overwhelm the tiny probability adjusted benefit (e.g. you have to double spend several million PPCs to make it profitable after trying it so long). I posted something here but like to hear feedbacks from others before going further. I think a simulation is needed to find out how exactly profitable this business is.

An attacker only needs to support the main chain and his own attack chains. I believe that is the meaning here.

Sure. The point of mhps is that the number of "own attack chains" can get really big in order to create the best chain.

Right. It's still exponential because your own attack chains also have a non-zero probability to branch into alt-chains. It's just cancer.

You want other concurrent miners to cooperate to accept your alt-chains so you don't have to fight the main chain yourself. Or do you (grow their chains when you don't have an  direct interest in them)?  I suspect the net effect of more non-cooperative concurrent miners is just bringing more compettion against themselves.

[DeathAndTaxes]

I think you confuse linear with exponential.   y = 2^x is exponential.   y = 2x is linear.

[jonald_fyookball]

There would be no penalty.  Lets look at the case of a majority and minority attacker separately.  

An attacker with a minority of the stake will optimally support ALL chains including the main chain.  
...  There is nothing at risk precisely because he can support all chains in parallel simultaneously.

I think this is over simplifying. To support all chains one *will* run out of resource (RAM or CPU cycles or fan speed or electricity bill... the whole *POW* cost) soon because the number of forks increases exponentially if you start to tend all of them. Althought the cost per fork looks low, it might just be enough to overwhelm the tiny probability adjusted benefit (e.g. you have to double spend several million PPCs to make it profitable after trying it so long). I posted something here but like to hear feedbacks from others before going further. I think a simulation is needed to find out how exactly profitable this business is.

An attacker only needs to support the main chain and his own attack chains. I believe that is the meaning here.

Sure. The point of mhps is that the number of "own attack chains" can get really big in order to create the best chain.

Right. It's still exponential because your own attack chains also have a non-zero probability to branch into alt-chains. It's just cancer.

You want other concurrent miners to cooperate to accept your alt-chains so you don't have to fight the main chain yourself. Or do you (grow their chains when you don't have an  direct interest in them)?  I suspect the net effect of more non-cooperative concurrent miners is just bringing more compettion against themselves.

I think people are overcomplicating it.  An attacker only needs one longest chain to attack.  Sure you could run a multithreaded application and try simultaneous attempts to build the best longest chain but that's about it.

[mhps]

I think you confuse linear with exponential.   y = 2^x is exponential.   y = 2x is linear.

If you have several peers who are all eager to extend every chain they see, your altchains will soon have their own altchains. The global blockchain becomes a blocktree. Every branch of the tree is the end of an alt-chain, being able to have its own branches.

It's y = some_constant^blocknumber. The constant is greater than 1.

[jonald_fyookball]

I think you confuse linear with exponential.   y = 2^x is exponential.   y = 2x is linear.

If you have several peers who are all eager to extend every chain they see, your altchains will soon have their own altchains. The global blockchain becomes a blocktree. Every branch of the tree is the end of an alt-chain, being able to have its own branches.

It's y = some_constant^blocknumber. The constant is greater than 1.

But I don't think peers operate this way.  All chains except the best/longest are discarded.

If I'm an attacker, I wait until I have a long enough chain and then I broadcast it.
If peers think that is the best one, they will use it.  And if they don't, they won't.
Either way, nothing increases exponentially for me.

The blockchain never becomes a block tree because that is moving in the opposite direction from consensus.
Everything quickly converges onto one chain when you have a proper mechanism in place like best chain wins.

[mhps]

But I don't think peers operate this way.  All chains except the best/longest are discarded.

If I'm an attacker, I wait until I have a long enough chain and then I broadcast it.
If peers think that is the best one, they will use it.  And if they don't, they won't.
Either way, nothing increases exponentially for me.

The one  longest chain is the main chain, most of the times. Most people don't bother to concurrent mine an alt-chain if they have to program it.  If you have to program it you have to think if it's worth your effort. It is not absolutely nothing at stake. We are talking about "0 divided by 0" here (very small profit divided by very small cost). I don't know how profitable to grow only one chain. It should be studied in more details. But once you decide to grow an alt-chain, because it gives you a chance to double spend, why not add yet another one? Doesn't it give you even more chance? Yes or no? It has to be yes. Then how about another...? The logical end is the end of some kind of resource. You are saying the resource is your time and that limit the number of alt-chain to 1. That is fine. I hear your opinion.

The blockchain never becomes a block tree because that is moving in the opposite direction from consensus.
Everything quickly converges onto one chain when you have a proper mechanism in place like best chain wins.

Well then the attacker shouldn't even exist.

[jonald_fyookball]

once you decide to grow an alt-chain, because it gives you a chance to double spend, why not add yet another one? Doesn't it give you even more chance? Yes or no? It has to be yes.

Generally no, because you'd only be competing against yourself.  If you are an attacker, you want to put maximum resources on building one best chain.

If you're talking about separate attacks (doing a double spend and then later, doing another one) that's another story.

[mhps]

once you decide to grow an alt-chain, because it gives you a chance to double spend, why not add yet another one? Doesn't it give you even more chance? Yes or no? It has to be yes.

Generally no, because you'd only be competing against yourself.  If you are an attacker, you want to put maximum resources on building one best chain.

For Peercoin the POS mining (called minting) only happens once a second, lasting perhaps less than 100 microseconds (I guess). 99.99% of the time the computer is not minting.  Maintain a 10-block altchain (in addition to the main chain) takes less than 100KB RAM (my guess). It doesn't cost that much. But the cost is not absolute zero, either.

[sumantso]

IMO, the hard cap is very important which others doesn't seem to find a key feature. [...]

Point is, why?

Its like this, you can always get a single individual/group to set up up multiple pools in PoW/PoS, or multiple delegates in DPoS and grab more share than what it seems. But the hard cap means that it is more complex to get the same control.

Say, Ghash sets up another couple of pools anonymously (or maybe even does), or makes buddies with a couple of other big pools, then it already has control. In DPoS on the other hand, he/she/they have to go through a lot more trouble (some 50 delegates in case of BTSX) to get the same control.

Besides, say, a pool offers incentives, then everybody will naturally flock to it. Sure, at some they might start getting worried and not go, but as we have seen in the Ghash case, appealing to the better sense of the mining equipment owners doesn't work to well. They might not even be too worried about the long term health as they might be just looking at it as a business. In DPoS, the hard cap means such a scenario is not possible, and you have to also keep in mind that the users of the coin are the ones who are voting.

[sumantso]

Miner is the one who decides what transaction to include or exclude. In effect it is controlled by 10 or so miners. 55k or whatever running their machines is immaterial. I guess you can see the problem now.

Pooling won't happen with DPoS. Sure, somebody can set up multiple delegates and keep his identity hidden, but pooling as such directly is not possible.

Besides in DPoS, anybody transacting is playing is part in securing. So in effect the shareholders has a direct say. In PoW like Bitcoin, the users don't have any say.

You need just one miner to include the transaction in block.. You may wait more though...

Dont understand DPoS (I ll have a look) but the rest of PoS are flawed in the core idea and will be controlled by the rich of the coin always... Can the hard cap idea of DPoS fight the total control of the rich over the coin? What is the advantage?

You're missing the entire point. Effectively 10 people have the power to choose what types of transactions to include. For instance tomorrow Ghash and 2 others may decide to leave out all Counterparty transactions, which means they are screwed. Do you, as a Bitcoin user, have any say in it?

They aren't screwed.  The tx will still be included in blocks by other miners.   Also the excluding miners will lose the tx fees and that will make them less competitive relative to other pools and if the actual miners disagree with that loss they will leave and the pool (and pool operator's profits) will shrink.   Today fees are relatively small but as a % of total miner compensation they will only grow.

A system like XCP which is relying on the 10 minute blocktimes (even which is slow for a decentralised exchange), will be in a lot of trouble if the biggest miners decide to exclude their transactions. Point is the Bitcoin users, or even the ones running the mining equipment doesn't have any say in it. It just requires a couple of the miners to decide to leave them out and then XCP is in big trouble.

Just look in the XCP thread here where there was a big argument about this. I am not saying XCP is right or the couple of pool owners who engaged in the discussions were right. The point simply is there is no accountability, and the actual users and miners are dependent on the whims of a few.

[jonald_fyookball]

Miner is the one who decides what transaction to include or exclude. In effect it is controlled by 10 or so miners. 55k or whatever running their machines is immaterial. I guess you can see the problem now.

Pooling won't happen with DPoS. Sure, somebody can set up multiple delegates and keep his identity hidden, but pooling as such directly is not possible.

Besides in DPoS, anybody transacting is playing is part in securing. So in effect the shareholders has a direct say. In PoW like Bitcoin, the users don't have any say.

You need just one miner to include the transaction in block.. You may wait more though...

Dont understand DPoS (I ll have a look) but the rest of PoS are flawed in the core idea and will be controlled by the rich of the coin always... Can the hard cap idea of DPoS fight the total control of the rich over the coin? What is the advantage?

You're missing the entire point. Effectively 10 people have the power to choose what types of transactions to include. For instance tomorrow Ghash and 2 others may decide to leave out all Counterparty transactions, which means they are screwed. Do you, as a Bitcoin user, have any say in it?

They aren't screwed.  The tx will still be included in blocks by other miners.   Also the excluding miners will lose the tx fees and that will make them less competitive relative to other pools and if the actual miners disagree with that loss they will leave and the pool (and pool operator's profits) will shrink.   Today fees are relatively small but as a % of total miner compensation they will only grow.

A system like XCP which is relying on the 10 minute blocktimes (even which is slow for a decentralised exchange), will be in a lot of trouble if the biggest miners decide to exclude their transactions. Point is the Bitcoin users, or even the ones running the mining equipment doesn't have any say in it. It just requires a couple of the miners to decide to leave them out and then XCP is in big trouble.

Just look in the XCP thread here where there was a big argument about this. I am not saying XCP is right or the couple of pool owners who engaged in the discussions were right. The point simply is there is no accountability, and the actual users and miners are dependent on the whims of a few.

I agree that excluding transactions could be bad in a 51% attack against bitcoin.
I would like to see more proposals like using sidechains or something to increase
The work an attacker would have to do to maintain a malicious mining monopoly.

[jonald_fyookball]

once you decide to grow an alt-chain, because it gives you a chance to double spend, why not add yet another one? Doesn't it give you even more chance? Yes or no? It has to be yes.

Generally no, because you'd only be competing against yourself.  If you are an attacker, you want to put maximum resources on building one best chain.

For Peercoin the POS mining (called minting) only happens once a second, lasting perhaps less than 100 microseconds (I guess). 99.99% of the time the computer is not minting.  Maintain a 10-block altchain (in addition to the main chain) takes less than 100KB RAM (my guess). It doesn't cost that much. But the cost is not absolute zero, either.

Yes.  Maybe we should call it the "very little at stake problem" 

[clout]

once you decide to grow an alt-chain, because it gives you a chance to double spend, why not add yet another one? Doesn't it give you even more chance? Yes or no? It has to be yes.

Generally no, because you'd only be competing against yourself.  If you are an attacker, you want to put maximum resources on building one best chain.

For Peercoin the POS mining (called minting) only happens once a second, lasting perhaps less than 100 microseconds (I guess). 99.99% of the time the computer is not minting.  Maintain a 10-block altchain (in addition to the main chain) takes less than 100KB RAM (my guess). It doesn't cost that much. But the cost is not absolute zero, either.

Yes.  Maybe we should call it the "very little at stake problem" 

how could that be a problem. proof of work can be considered a proof of stake system in that you are proving your stake in the collective hashing power of the network. The value comes from the stake not from the cost of proving that you have stake. Thus,  the reduced cost of pos mining is not a problem but a solution.

[jonald_fyookball]

once you decide to grow an alt-chain, because it gives you a chance to double spend, why not add yet another one? Doesn't it give you even more chance? Yes or no? It has to be yes.

Generally no, because you'd only be competing against yourself.  If you are an attacker, you want to put maximum resources on building one best chain.

For Peercoin the POS mining (called minting) only happens once a second, lasting perhaps less than 100 microseconds (I guess). 99.99% of the time the computer is not minting.  Maintain a 10-block altchain (in addition to the main chain) takes less than 100KB RAM (my guess). It doesn't cost that much. But the cost is not absolute zero, either.

Yes.  Maybe we should call it the "very little at stake problem" 

how could that be a problem. proof of work can be considered a proof of stake system in that you are proving your stake in the collective hashing power of the network. The value comes from the stake not from the cost of proving that you have stake. Thus,  the reduced cost of pos mining is not a problem but a solution.

If you don't understand the "nothing at stake problem" aka "very little at stake problem" go back and read this:

https://bitcointalk.org/index.php?topic=584703.msg6982574#msg6982574

[ChuckOne]

Its like this, you can always get a single individual/group to set up up multiple pools in PoW/PoS, or multiple delegates in DPoS and grab more share than what it seems. But the hard cap means that it is more complex to get the same control.

Say, Ghash sets up another couple of pools anonymously (or maybe even does), or makes buddies with a couple of other big pools, then it already has control. In DPoS on the other hand, he/she/they have to go through a lot more trouble (some 50 delegates in case of BTSX) to get the same control.

Besides, say, a pool offers incentives, then everybody will naturally flock to it. Sure, at some they might start getting worried and not go, but as we have seen in the Ghash case, appealing to the better sense of the mining equipment owners doesn't work to well. They might not even be too worried about the long term health as they might be just looking at it as a business. In DPoS, the hard cap means such a scenario is not possible, and you have to also keep in mind that the users of the coin are the ones who are voting.

I think I see which direction you are coming from. But I do not clearly see how a hard-cap is going to solve the problem of a second pool under control of the very same real-world entity.

"A lot more trouble" Why? Are existing pools preferred before new ones?

[ChuckOne]

If I'm an attacker, I wait until I have a long enough chain and then I broadcast it.

There is no such thing as waiting for the best chain to show up and say hello.

You actually need to find it.

[jonald_fyookball]

If I'm an attacker, I wait until I have a long enough chain and then I broadcast it.

There is no such thing as waiting for the best chain to show up and say hello.

You actually need to find it.

Lol.  Yep, I agree.

[mhps]

once you decide to grow an alt-chain, because it gives you a chance to double spend, why not add yet another one? Doesn't it give you even more chance? Yes or no? It has to be yes.

Generally no, because you'd only be competing against yourself.  If you are an attacker, you want to put maximum resources on building one best chain.

For Peercoin the POS mining (called minting) only happens once a second, lasting perhaps less than 100 microseconds (I guess). 99.99% of the time the computer is not minting.  Maintain a 10-block altchain (in addition to the main chain) takes less than 100KB RAM (my guess). It doesn't cost that much. But the cost is not absolute zero, either.

Yes.  Maybe we should call it the "very little at stake problem" 

Probably a "very little at stake profitless non-problem"

[jonald_fyookball]

once you decide to grow an alt-chain, because it gives you a chance to double spend, why not add yet another one? Doesn't it give you even more chance? Yes or no? It has to be yes.

Generally no, because you'd only be competing against yourself.  If you are an attacker, you want to put maximum resources on building one best chain.

For Peercoin the POS mining (called minting) only happens once a second, lasting perhaps less than 100 microseconds (I guess). 99.99% of the time the computer is not minting.  Maintain a 10-block altchain (in addition to the main chain) takes less than 100KB RAM (my guess). It doesn't cost that much. But the cost is not absolute zero, either.

Yes.  Maybe we should call it the "very little at stake problem" 

Probably a "very little at stake profitless non-problem"

Not a problem for Bitcoin, certainly.

[mhps]

once you decide to grow an alt-chain, because it gives you a chance to double spend, why not add yet another one? Doesn't it give you even more chance? Yes or no? It has to be yes.

Generally no, because you'd only be competing against yourself.  If you are an attacker, you want to put maximum resources on building one best chain.

For Peercoin the POS mining (called minting) only happens once a second, lasting perhaps less than 100 microseconds (I guess). 99.99% of the time the computer is not minting.  Maintain a 10-block altchain (in addition to the main chain) takes less than 100KB RAM (my guess). It doesn't cost that much. But the cost is not absolute zero, either.

Yes.  Maybe we should call it the "very little at stake problem" 

Probably a "very little at stake profitless non-problem"

Not a problem for Bitcoin, certainly.

We will see about that https://bitcointalk.org/index.php?topic=638146.msg7120755