Re: Proof of stake instead of proof of work

[hashman]

https://blockchain.info/stats
Total Miners Revenue $2,052,572.14

So in a perfect market, you can take control of bitcoin's network, for a day, at a bargain price of $2,052,572.14  + $0.01. That's 0.0326%. You can wait a bit for the next halvening and it's going to be even cheaper!  

Thanks for your reply.  I am interested in proof of stake but still missing something.  I don't understand some details of the NXT algo including the universal random number (just reading http://www.docdroid.net/cckd/forging0-4-3.pdf.html)

Yes:  total BTC miners revenue in a day is 3600 coin.  Before accepting 3600BTC and making a physical delivery from a source with zero trust I would wait about that long.  Lets look at NXT for comparison:

Total Forgers Revenue: 5500 NXT
 
So in a perfect liquid market of stake, I would want to wait about a day before accepting 350 mBTC worth of NXT. 

I understand that liquid markets in hash power and accretion of hashpower by individuals can be bad very bad.  But replacing hashpower by something that is even more liquid already seems like hardly a solution to that particular problem. 

Yes, I understand that the big stakeholders now holding the 100% premine might not want to accept my offer of a little extra doublespend revenue to borrow their stake because they are afraid the word could get out and this would affect the value of their personal holdings.  But isn't concentration of power in the hands of a few and requiring the network to trust them part of the problem we were trying to avoid?  If we want to trust a central entity, this whole blockchain system is a waste.   

Then there's also lack of wasted energy, capital, and smaller market supply, because miners needs to sell the majority of coins to fund their operations. Mining is effectively a tax on all bitcoin users, almost a billion a year. You could run a small country on that.    

Indeed.  Bitcoin hardly seems perfect.  But imagine if the 21million BTC  (that's 10 billion or so dollars) were all premined in the hands of a small team.  They could run a country on that, especially with their total control of the transaction record for all time.  Institutionalized double spending, here we come.

[dogisland]

DaT,

The NXT genesis account's pass phrase is well known.  (The first line of 1984.)  I wonder if a person could use that account that held 100% of coins and create an alternate chain?  

No because the genesis block is hard wired into the NXT server and all the coins from the genesis block were sent to the original investors.

I am also a little curious about this 51% attack thing.  It has been explained that because not everyone is supporting the network, a person might only really need 10% of coins to take over a chain.  

I'm not an NXT developer but I have looked at the code.

Let's say I have 25% of NXT coins. And I want to mount an attack. I need to do the following.

1. Wait until I am selected as a forger.
2. Create 2 blocks, one for the network and one I hold back.
3. Continually add more blocks to the block I hold back. This is my chain I will introduce later as my attack.

The problem is step 3. To add another block to my held back block I need to be selected as the forger for that block too. However forger selection is based on the hash of the previous block and my account address.

Neither of these I can change quickly enough to be sure I generate the next block. So my probability of being selected to build the next block is 25% for each block.

I read carefully what DaT contributed, but I can't apply his attack to the code as I see it.

[telepatheic]

Yes:  total BTC miners revenue in a day is 3600 coin.  Before accepting 3600BTC and making a physical delivery from a source with zero trust I would wait about that long. 

The problem is you have assumed a double spender would simply do the obvious thing and try to buy a single very expensive thing. The reality is that a double spender will involve a number of people who are in on the scam and will make many moderate sized purchases. As a bitcoin merchant I have no idea if the 1BTC transaction I have received is part of a set of many transactions which will all be double spent.

[jonald_fyookball]

DaT,

The NXT genesis account's pass phrase is well known.  (The first line of 1984.)  I wonder if a person could use that account that held 100% of coins and create an alternate chain?  

No because the genesis block is hard wired into the NXT server and all the coins from the genesis block were sent to the original investors.

I am also a little curious about this 51% attack thing.  It has been explained that because not everyone is supporting the network, a person might only really need 10% of coins to take over a chain.  

I'm not an NXT developer but I have looked at the code.

Let's say I have 25% of NXT coins. And I want to mount an attack. I need to do the following.

1. Wait until I am selected as a forger.
2. Create 2 blocks, one for the network and one I hold back.
3. Continually add more blocks to the block I hold back. This is my chain I will introduce later as my attack.

The problem is step 3. To add another block to my held back block I need to be selected as the forger for that block too. However forger selection is based on the hash of the previous block and my account address.

Neither of these I can change quickly enough to be sure I generate the next block. So my probability of being selected to build the next block is 25% for each block.

I read carefully what DaT contributed, but I can't apply his attack to the code as I see it.

What DaT basically says is this:

1. whoever has 51% of the resources (poW , PoS, or another Po"X")...can attack whatever network it is.
2. PoS has the disadvantage of the nothing-at-stake problem.

I think he is generally correct.  We were told there is a secret sauce to NXT,
but until it is revealed we don't know the validity of their claims or the security trade-offs.

So I guess we should just wait to see what will unfold.

[platorin]

It depends. Hard to say which one is better at this moment. Both have their advantages and disadvantages.

[iruu]

Is that because of transparent forging?  Could you explain how NXT might be more immune?

25% of active stake is not enough, you need majority.  

Thanks for your reply.  I am interested in proof of stake but still missing something.  I don't understand some details of the NXT algo including the universal random number (just reading http://www.docdroid.net/cckd/forging0-4-3.pdf.html)

Yes:  total BTC miners revenue in a day is 3600 coin.  Before accepting 3600BTC and making a physical delivery from a source with zero trust I would wait about that long.  Lets look at NXT for comparison:

Total Forgers Revenue: 5500 NXT
 
So in a perfect liquid market of stake, I would want to wait about a day before accepting 350 mBTC worth of NXT.  

A miner just a tiny bit worse per W than best miner is literally worthless, on a perfect market. Which means there's no risk to factor into because there's no capital to risk. While lending nxt, lender would have to calculate possible risk of lending his coin, which would include the risk of currency collapse, especially as any serious lender would ask for your other liabilities.  

In practice, sooner or later there's going to be a ton of miners worse by few percents than top, sold for next to nothing, so achieving non-profitable hashing power will be very easy. However, borrowing more than half of nxt or other PoS currency would be next to impossible.  

Yes, I understand that the big stakeholders now holding the 100% premine might not want to accept my offer of a little extra doublespend revenue to borrow their stake because they are afraid the word could get out and this would affect the value of their personal holdings.  But isn't concentration of power in the hands of a few and requiring the network to trust them part of the problem we were trying to avoid?  If we want to trust a central entity, this whole blockchain system is a waste.  

Why is currency operated by all holders less decentralized than bitcoin's two-three pools (mainly few big farms), which control everything? Proof of stake is the epitome of decentralization.  
Mining monopoly is unavoidable. It can be as well already true, just hidden between few pools.  

You can become a currency owner even for $0.01, you can't mine for that amount, you can only rent, and you're not going to make any money even with expensive miner due to lack of scale.  

Indeed.  Bitcoin hardly seems perfect.  But imagine if the 21million BTC  (that's 10 billion or so dollars) were all premined in the hands of a small team.  They could run a country on that, especially with their total control of the transaction record for all time.  Institutionalized double spending, here we come.

That's not argument against PoS, but NXT. PoS doesn't require big IPOs, in fact you can use sell just a few percent and allow people to mine the rest. Or other method of distribution. 

[Brangdon]

Where do you get these 99% stake stuff?
PoS coins use 10% of stake and dropping as economic activity goes up. Let alone that their profits are tiny to justify such big stake in minting (Just early adopters minting to support their system). If a real economy exists many will put their coins in more productive uses than minting and will not even care.

Again, this doesn't apply to Nxt because in Nxt minting with coins does not preclude them being available for other uses.

Why do you assume all these nodes will be online at the time of the attack?

People who don't want to be online 24/7 can lease to those that do. So a high proportion of coins should be online at any given time. (It's not like that now, partly because leased forging is new, and partly because I think some whales are keeping out of it to let other people gain forging revenue.)

Why do you assume that lending will be something everybody will do?

If you have sufficient coins that leasing pays for itself, it's the rational thing to do, with no downsides, so most people will do it. (Except the ones that have enough to justify running their own node.)

Why do you assume that it will not backfire giving one person extreme stake history who might not care about the coin at the present?

It's something we need to be vigilant about, in the same way the Bitcoin community needs to be vigilant about mining pools becoming too powerful. However, because Nxt forging doesn't have the same economies of scale as Bitcoin mining, there is less pressure towards centralisation.

Why do you say lend your coins to a person you can trust if you want to build a trustless system?

Because trusting a forging pool is no worse than trusting a mining pool (except you have a choice about which pool you trust, in Nxt.)

Why do you assume that the rest honest stakers (those not having their coins reversed) will not mint both chains?

They can only mint blocks when the algorithm picks them as the current forger. Minting blocks when you aren't current is pointless.

All PoS coins are very centralized in their stake distribution and dont forget that when you say they are decentralized.

Initial distribution is orthogonal to PoS. It's a problem for Nxt, partly because it's so new. It improves over time.

Total Forgers Revenue: 5500 NXT
 
So in a perfect liquid market of stake, I would want to wait about a day before accepting 350 mBTC worth of NXT.

I don't understand why you think there is a connection between mining revenue per block and the number of blocks to wait before considering they are confirmed.

[ThePurplePlanet]

Brangdon,

Why do you assume that lending will be something everybody will do?If you have sufficient coins that leasing pays for itself, it's the rational thing to do, with no downsides, so most people will do it. (Except the ones that have enough to justify running their own node.)

Why only about 20% are forging then? The downside is centralization of power. If at any point of stake history anyone had 50+% of current stake rate (i.e. current is 20% means that lending to a pool more than 10% at any point) it will haunt the coin forever.

Why do you assume that it will not backfire giving one person extreme stake history who might not care about the coin at the present?It's something we need to be vigilant about, in the same way the Bitcoin community needs to be vigilant about mining pools becoming too powerful. However, because Nxt forging doesn't have the same economies of scale as Bitcoin mining, there is less pressure towards centralisation.

There is nothing you can do other than checkpoints. For PoW is one time event that doesnt haunt bitcoin in the future. Not that Ilike litecoin but Litecoin had 51% on 1 pool lately but that will not affect its future if the hash distribution changes. For PoS it does.

Why do you say lend your coins to a person you can trust if you want to build a trustless system?Because trusting a forging pool is no worse than trusting a mining pool (except you have a choice about which pool you trust, in Nxt.)

See the difference in first point.

All PoS coins are very centralized in their stake distribution and dont forget that when you say they are decentralizedInitial distribution is orthogonal to PoS. It's a problem for Nxt, partly because it's so new. It improves over time..

Dogecoin, darkcoin are newer but better distributed.. Not an excuse. A serious PoS algorithm that wants decentralization should be as distributed as possible from the get-go because of security decentralization and history attack.

Is that because of transparent forging?  Could you explain how NXT might be more immune?
25% of active stake is not enough, you need majority.  

May not be enough for reversing the chain but No 25% is enough for double spending. In fact it enough for even bitcoin. The difference is that for bitcoin it will cost money but for PoS it wont... You can double spend a casino as many times as you want given enough time.

[foodies123]

I know I'm butting in and I apologize. I can see there are alot of well informed people in this thread with solid arguments one way or the other and I would like you gentleman if you'd be so kind to relay onto me your opinion about multi-pow (separate algorithms mining independently on the same chain), pros ? cons ?
I'd really like to hear what you gentlemen have to say about it.

Is it more viable as a means to secure the chain further ?
Is it more viable for a fairer and wider distribution of the coins ?


Disclaimer: I'm part of the team for such a coin (Myriad) but am not the creator of the concept. I joined the team because I liked the concept and it seems pretty solid.

[ThePurplePlanet]

I know I'm butting in and I apologize. I can see there are alot of well informed people in this thread with solid arguments one way or the other and I would like you gentleman if you'd be so kind to relay onto me your opinion about multi-pow (separate algorithms mining independently on the same chain), pros ? cons ?
I'd really like to hear what you gentlemen have to say about it.

Is it more viable as a means to secure the chain further ?
Is it more viable for a fairer and wider distribution of the coins ?


Disclaimer: I'm part of the team for such a coin (Myriad) but am not the creator of the concept. I joined the team because I liked the concept and it seems pretty solid.

Not that I am expert but here is my opinion

1. I personally didnt study the mechanics of the coin but it maybe more secure if the ASIC hardware manufacturers dont decentralize and we stick to 1 or 2 like now
2. I dont know...but probably due to different hardware to mine..  Distribution is not only about mining hardware but also how many people know about it in the early cycle of the distribution unless you have a  slow distribution cycle..

Too many new technologies coming out with little time to study the problems with each until academics start writing papers about these technologies. Bitcoin has been out for 5 years and people still find and will find more attack vectors. Very tough to judge all these coins without proper white-papers. There are no proper write-ups of the technologies just some talk here and there is available on forums...

[telepatheic]

I know I'm butting in and I apologize. I can see there are alot of well informed people in this thread with solid arguments one way or the other and I would like you gentleman if you'd be so kind to relay onto me your opinion about multi-pow (separate algorithms mining independently on the same chain), pros ? cons ?
I'd really like to hear what you gentlemen have to say about it.

Is it more viable as a means to secure the chain further ?
Is it more viable for a fairer and wider distribution of the coins ?


Disclaimer: I'm part of the team for such a coin (Myriad) but am not the creator of the concept. I joined the team because I liked the concept and it seems pretty solid.

The main problem with multi-POW coins is that it is difficult to work out how to fairly and securely weight the security factor attributed to each algorithm.

Myriad uses a weighted model (code here). This means that a SHA256 block needs to have a difficulty 4096 times that of a Scrypt block for them to have equal security weighting. I haven't thought too much about the economic and security implications of this but I know that the weights shouldn't be fixed because the actual difficulty of mining a certain block depends on the type of hardware used.

Also miners rarely care about the security factor (it only comes into effect when there is a fork/orphaned block), so it is easy for the developer to change the weights without requiring the miner's explicit consensus (the change does not lead to long lasting forks).

On the other hand multi-POW coins have more decentralised coin generation (not necessarily security because of the weighting) which is theoretically good for the coin economy.

[ThePurplePlanet]

I know I'm butting in and I apologize. I can see there are alot of well informed people in this thread with solid arguments one way or the other and I would like you gentleman if you'd be so kind to relay onto me your opinion about multi-pow (separate algorithms mining independently on the same chain), pros ? cons ?
I'd really like to hear what you gentlemen have to say about it.

Is it more viable as a means to secure the chain further ?
Is it more viable for a fairer and wider distribution of the coins ?


Disclaimer: I'm part of the team for such a coin (Myriad) but am not the creator of the concept. I joined the team because I liked the concept and it seems pretty solid.

The main problem with multi-POW coins is that it is difficult to work out how to fairly and securely weight the security factor attributed to each algorithm.

Myriad uses a weighted model (code here). This means that a SHA256 block needs to have a difficulty 4096 times that of a Scrypt block for them to have equal security weighting. I haven't thought too much about the economic and security implications of this but I know that the weights shouldn't be fixed because the actual difficulty of mining a certain block depends on the type of hardware used.

Also miners rarely care about the security factor (it only comes into effect when there is a fork/orphaned block), so it is easy for the developer to change the weights without requiring the miner's explicit consensus (the change does not lead to long lasting forks).

On the other hand multi-POW coins have more decentralised coin generation (not necessarily security because of the weighting) which is theoretically good for the coin economy.

Thats a good point.

What if one technology hashing power increases over time faster that the rest due to hardware/algorithmic improvements? Does the re- weighting of each PoW needs to change? If yes who decides that? Does the algorithm have rules to change that automatically? Will miners approve that if they get penalized?

[telepatheic]

If yes who decides that? Does the algorithm have rules to change that automatically? Will miners approve that if they get penalized?

The miners essentially decide (with bitcoin the rules are sort of obvious so everyone agrees to them) but with multi-pow coins miners have to rely on working out what will make them the most money/coins.  In general this means sticking with what everyone else is doing, the only practical way of knowing what everyone else is doing is assuming everyone is following the software. In theory thus, optimum strategy is to follow the software and hence the developer gets to choose.

In reality, some miners might refuse to download new updates. Now you have different miners enforcing different rules, working out the optimum in this situation is far from trivial and could lead to instability. The full economic analysis of this is very complex.

[foodies123]

If yes who decides that? Does the algorithm have rules to change that automatically? Will miners approve that if they get penalized?

The miners essentially decide (with bitcoin the rules are sort of obvious so everyone agrees to them) but with multi-pow coins miners have to rely on working out what will make them the most money/coins.  In general this means sticking with what everyone else is doing, the only practical way of knowing what everyone else is doing is assuming everyone is following the software. In theory thus, optimum strategy is to follow the software and hence the developer gets to choose.

In reality, some miners might refuse to download new updates. Now you have different miners enforcing different rules, working out the optimum in this situation is far from trivial and could lead to instability. The full economic analysis of this is very complex.

Fair point, we are working on a dynamic method of weighing although the fix worked thus far (8x hasing power increase within minutes on SHA algo did no damage at all to the chain and a few weeks earlier a scrypt pool with 51%+ forked resulting in just that their miners lost some mining time again with no consequences to the chain) we are aware that fixed factors are somewhat unreliable in long term.

[telepatheic]

Fair point, we are working on a dynamic method of weighing although the fix worked thus far (8x hasing power increase within minutes on SHA algo did no damage at all to the chain and a few weeks earlier a scrypt pool with 51%+ forked resulting in just that their miners lost some mining time again with no consequences to the chain) we are aware that fixed factors are somewhat unreliable in long term.

Were these attackers actually being dishonest (not mining on top of the chain with greatest difficulty) ? Or were they just flooding the hashing power?

[foodies123]

Fair point, we are working on a dynamic method of weighing although the fix worked thus far (8x hasing power increase within minutes on SHA algo did no damage at all to the chain and a few weeks earlier a scrypt pool with 51%+ forked resulting in just that their miners lost some mining time again with no consequences to the chain) we are aware that fixed factors are somewhat unreliable in long term.

Were these attackers actually being dishonest (not mining on top of the chain with greatest difficulty) ? Or were they just flooding the hashing power?

Well I have no actual evidence they were malitious but an 8x spike in minutes that lasted for about an hour was not an attempt on mining sha. I can only presume they had ill intentions. The scrypt thing was an accident.

[Eadeqa]

"Economic Clustering"

https://nxtforum.org/news-and-announcements/economic-clustering/

[micryon]

Because the network follows a longest chain is valid rule?  If it doesn't then you are relying on a node knowing that an alternate chain came "later" and not all nodes will no that.  As I already pointed out up thread imagine you are a new node, you connect to the network and receive two competing chains A & B.  A is longer.  Which chain do you use?  If you use A and other nodes use B that is a problem (isolation attack and network fork due to non deterministic chain selection).  If they are choosing B over A because they "saw it first" there is no way for you to confirm that or even know that.  
Still it doesn't need to be 10,000 blocks.  A 51% attack can be accomplished with a reorg of any length.

What's the downside of just hard coding a max limit of history blocks that can be reorged in AcceptBlocks?  And must make that max limit < confirmation needed?

Wouldn't this protect nodes with the an existing "real" chain, without fearing for it to be overwritten (at least past the limit)?


nvm.. i guess that would cause the "hard fork attack problem".. where offline/new nodes could still pick up an entirely different fork all the time.  no consensus..

great thread though.. i learned a lot:)  Someone needs to make a diagram'd youtube video though.. hehe

[Brangdon]

Why only about 20% are forging then?

I don't know. I suspect because leased forging is a new feature and not everyone has caught on yet. Also, I suspect some whales are not forging because they want to give everyone else a chance. Either way, it should improve over time. Nxt is 6 months old; it's achieved a lot in that time, but some things mature slowly. When it's as old as Bitcoin is now, we'll have a better idea if this is working.

The downside is centralization of power. If at any point of stake history anyone had 50+% of current stake rate (i.e. current is 20% means that lending to a pool more than 10% at any point) it will haunt the coin forever.[/b]

I gather the Nxt devs have a solution for that.

[svojoe]

Where does this concept of PoS being less 'fair' come from?   Or the whole rich get richer thing?!    I would really like someone to break this down for me.

Bitcoin vs Blackcoin

You can buy them both directly on exchanges
You can still mine bitcoin directly, However it requires massive investment in specialized hardware to hope of ROI, (massive investment)
You can obviously indirectly mine Blackcoin from exchanges with numerous mining platforms not just specialized mining hardware, creating a immensely lower point of entry as a function of mining cost vs Blackcoin reward against market cap.    While this is a add-on to blackcoin itself, not part of its codebase (its no longer PoW mineable) It is the current state of reality in crypto today and likely for as long as Blackcoin commands attention.   If all other altcoins vanished miners would still mine BTC directly to sell for blackcoin with greatly dimished returns.  But possibly still greater gain in BC against market cap, than with BTC vs marketcap.

So, allowing the blackcoin multipools into the equation is leaps and bounds cheaper and easier to get blackcoin with your mining hardware than it is BTC.

Whew, hope you followed!

Now...
Bitcoin mints at 3600 BTC perday,  At current market cap that is about 2.3 MILLION dollars of supply creating constant sell pressure in a agnostic market.   Blackcoin mints at 1% interest per year.    If Blackcoin had
the same 8.5B usd market cap BTC does, that would be around 230,000 THOUSAND dollars of new supply created daily.  Roughly ten times less depreciation if there the market is stagnant in-regards to demand.

This means that you are in a race to the bottom with PoW, unless you are standing at the very top of the mining/minting game.

AND those new coins ONLY go to the miners that can keep up with current tech and price of mining.   Whereas if you hold any amount of BlackCoin that 1% is paid to you.  Not a big mining farm, but you.



Why is PoW more fair?!?!   PoW is the epitome of rich get richer,   Previous poster was correct,  PoW  TAXES the holders that can't mine if you factor in that many mined coins will be insta-dumped soon as mature. Gotta pay for those million dollar mining farms after all.