Re: [bitcoin-dev] Opinion on proof of stake in future

I've created a thread on reddit where we can continue the conversation: https://www.reddit.com/r/BitcoinDiscussion/comments/o8dvlo/bitcoindev_opinion_on_proof_of_stake_in_future/ On Fri, Jun 25, 2021 at 9:59 AM greg m wrote: > Where do we go from here? reddit? > > Happy Friday everyone! > gm >

Re: [bitcoin-dev] Opinion on proof of stake in future

Hi all, Thanks for the lively discussion. On behalf of the bitcoin-dev moderators and with the readers of this mailing list in mind, we'd like to suggest finishing up this discussion. Of course there should be some room for exploring fringe ideas, but it should not dominate the mailing list

Re: [bitcoin-dev] Opinion on proof of stake in future

No, that's not how it works. PoS is constitutionally incapable of producing any further consensus from its starting point. If you start out by hardcoding the bitcoin ledger state at June 1, 2021, then your PoS system will be unable to reach a global consensus as to what the state was on June

Re: [bitcoin-dev] Opinion on proof of stake in future

> PoS is not suitable for use as a consensus system, because it is constitutionally incapable of producing a consensus. true - but only for a system that is starting from nothing. since bitcoin already exists, and we have a consensus, you can use bitcoin's existing consensus to maintain that

Re: [bitcoin-dev] Opinion on proof of stake in future

No, 51% of the *coin holders* can't do diddly squat. 51% of miners can, but in PoW, that's a different set to the coin holders. The basic problem with PoS, anyway, is that it's not actually a consensus system ("weak subjectivity"). Either you allow long reorgs, and then you open the door to

Re: [bitcoin-dev] Opinion on proof of stake in future

The key difference here is that in PoS the seller of the coin might still have a vested interest in the network, where in PoW the person you aquire energy from to mine and mint has absolutely nothing to do with the network. Anyone with power supply can sell it to you and has no further

Re: [bitcoin-dev] Opinion on proof of stake in future

> That is in fact true of Proof of Work as well. If a colluding coalition of miners with more than 50% of the hashrate want to censor transactions, they absolutely can do that by orphaning blocks that contain transactions they want to censor. This is not different in proof of stake. This power

Re: [bitcoin-dev] Opinion on proof of stake in future

> This is not true in a Proof of Work system and this difference absolutely should not be trivialized. That is in fact true of Proof of Work as well. If a colluding coalition of miners with more than 50% of the hashrate want to censor transactions, they absolutely can do that by orphaning blocks

Re: [bitcoin-dev] Opinion on proof of stake in future

> Premise: There is a healthy exchange market for PoS Coin X with tens of thousands of participants bidding to buy and sell the coin for other currencies on the market. The difference here though is that Proof of Stake allows the quorum of coin holders to block the exchange of said coins if they

Re: [bitcoin-dev] Opinion on proof of stake in future

> Barrier to entry in PoS is being given permission by the previous owner of a token The idea that proof of stake is not permissionless is completely invalid. It pains me to see such an argument here. Perhaps we can come to an agreement by being more specific. I'd like to propose the following:

Re: [bitcoin-dev] Opinion on proof of stake in future

Barrier to entry in PoW is matter for hardware and energy is permissionless and exist all over the universe, permissionless cost which exists for everyone no matter who because it's unforgeable. Barrier to entry in PoS is being given permission by the previous owner of a token for you to have it

Re: [bitcoin-dev] Opinion on proof of stake in future

@James wrote: On Tue, 15 Jun 2021 at 21:13, James MacWhyte wrote: > > @Lloyd wrote: > > Of course in reality no one wants to keep their coin holding keys online >> so in Alogorand you can authorize a set of "participation keys"[1] that >> will be used to create blocks on your coin holding key's

Re: [bitcoin-dev] Opinion on proof of stake in future

@Lloyd wrote: Of course in reality no one wants to keep their coin holding keys online so > in Alogorand you can authorize a set of "participation keys"[1] that will > be used to create blocks on your coin holding key's behalf. > Hopefully you've spotted the problem. > You can send your

Re: [bitcoin-dev] Opinion on proof of stake in future

@SatoshiSingh PoLW sounds like a hybrid of PoW and proof of burn. I agree with befreeandopen that proof of burn is basically a form of proof of stake. My conclusion from this exploration is that hybrid protocols are a dead end because hybrid

Re: [bitcoin-dev] Opinion on proof of stake in future

Great conversation everyone. I'm happy we're still engaged with this discussion. To add food for thought I'm bringing back something that was introduced in this mailing list sometime ago, which is Proof of Less Work. PoLW may or may not be it but we can certainly get more ideas from it to keep

Re: [bitcoin-dev] Opinion on proof of stake in future

> the classical debate with PoS supporters - I explain an attack and they > "patch it", creating problem elsewhere i agree. my original post was: "assume that we can accurately mimic the investment in ASIC's and the expenditure of electricity with "burns" of coin representing that

Re: [bitcoin-dev] Opinion on proof of stake in future

Comments inline. > > Could you explain what am I missing here, because this actually does not > > seem better, but rather worse than some PoS schemes? > > Given your example, if !BTC is needed to burn, that's a $50k > investment in an ASIC needed to mine a block. That's not anywhere > near

Re: [bitcoin-dev] Opinion on proof of stake in future

Erik, thanks for the link. So referring to https://en.bitcoin.it/wiki/Proof_of_burn, I do not really understand how this is supposed to be that much better over many proof of stake proposals. If there is more research on PoB, please note I'm not commenting on that as I only read this wiki

Re: [bitcoin-dev] Opinion on proof of stake in future

@befreeandopen "If you want to make some arbitrary very narrow definitions of what nothing at stake is so that you can claim your false statement that it is a solved problem" Wow, you are really unnecessarily hostile. This isn't r/bitcoin my friend. Please assume some good faith. I simply

Re: [bitcoin-dev] Opinion on proof of stake in future

best writeup i know of is here: https://en.bitcoin.it/wiki/Proof_of_burn no formal proposals or proofs that i know of. On Fri, May 28, 2021 at 10:40 AM befreeandopen wrote: > > Erik, I am sorry, I have little knowledge about proof-of-burn, I never found > it interesting up until now. Some of

Re: [bitcoin-dev] Opinion on proof of stake in future

Erik, I am sorry, I have little knowledge about proof-of-burn, I never found it interesting up until now. Some of your recent claims seem quite strong to me and I'd like to read more. Forgive me if this has been mentioned recently, but is there a full specification of the concept you are

Re: [bitcoin-dev] Opinion on proof of stake in future

Problems with proof-of-stake: - A single CVE can tear down the network and hacked nodes can result in transferring all mining power to one group - PoS is vulnerable to DOS attacks (increasing latency reduces the cost of mining attacks) - PoS is vulnerable to stakers colluding to punish/drive

Re: [bitcoin-dev] Opinion on proof of stake in future

> using nothing at stake I see from the way you're using this term now that you mean something completely different by it than I usually understand the phrase. You seem to mean it as that minters can check whether they can mint a block without any cost. By contrast, I generally understand the

Re: [bitcoin-dev] Opinion on proof of stake in future

note: the "nothing at stake" problem you propose is not broken for proof-of-burn, because the attacker a) has no idea which past transactions are burns b) has no way to use his mining power, even 5%, to maliciously improve his odds of being selected On Wed, May 26, 2021 at 9:12 AM befreeandopen

Re: [bitcoin-dev] Opinion on proof of stake in future

> @befreeandopen I guess I misunderstood your selfish minting attack. Let me > make sure I understand it. You're saying it would go as follows?: > > 1. The malicious actor comes across an opportunity to mint the next 3 blocks. > But they hold off and don't release their blocks just yet. > 2.

Re: [bitcoin-dev] Opinion on proof of stake in future

@befreeandopen I guess I misunderstood your selfish minting attack. Let me make sure I understand it. You're saying it would go as follows?: 1. The malicious actor comes across an opportunity to mint the next 3 blocks. But they hold off and don't release their blocks just yet. 2. They receive a

Re: [bitcoin-dev] Opinion on proof of stake in future

> @befreeandopen " An attacker can calculate whether or not she can prolong > this chain or not and if so with what timestamp." > > The scenario you describe would only be likely to happen at all if the > malicious actor has a very large fraction of the stake - probably quite close > to 50%. At

Re: [bitcoin-dev] Opinion on proof of stake in future

@befreeandopen " An attacker can calculate whether or not she can prolong this chain or not and if so with what timestamp." The scenario you describe would only be likely to happen at all if the malicious actor has a very large fraction of the stake - probably quite close to 50%. At that point,

Re: [bitcoin-dev] Opinion on proof of stake in future

> > you burn them to be used at a future particular block height > This sounds exploitable. It seems like an attacker could simply focus all > their burns on a particular set of 6 blocks to double spend, minimizing their > cost of attack. could be right. the original idea was to have burns

Re: [bitcoin-dev] Opinion on proof of stake in future

> FYI, proof of stake can be done without the "nothing at stake" problem. You > can simply punish people who mint on shorter chains (by rewarding people who > publish proofs of this happening on the main chain). In quorum-based PoS, you > can punish people in the quorum that propose or sign

Re: [bitcoin-dev] Opinion on proof of stake in future

Is this the kind of proof of burn you're talking about? > if i have a choice between two chains, one longer and one shorter, i can only choose one... deterministically What prevents you from attempting to mine block 553 on both chains? > miners have

Re: [bitcoin-dev] Opinion on proof of stake in future

> > your burn investment is always "at stake", any redaction can result in a > > loss-of-burn, because burns can be tied, precisely, to block-heights > I'm fuzzy on how proof of burn works. when you burn coins, you burn them to be used at a future particular block height: so if i'm burning for

Re: [bitcoin-dev] Opinion on proof of stake in future

> proof of burn clearly solves this, since nothing is held online Well.. the coins to be burned need to be online when they're burned. But yes, only a small fraction of the total coins need to be online. > your burn investment is always "at stake", any redaction can result in a loss-of-burn,

Re: [bitcoin-dev] Opinion on proof of stake in future

> I don't see a way to get around the conflicting requirement that the keys for > large amounts of coins should be kept offline but those are exactly the coins > we need online to make the scheme secure. proof of burn clearly solves this, since nothing is held online > how does proof of burn

Re: [bitcoin-dev] Opinion on proof of stake in future

I made a couple typos and mistakes in my couple previous emails: * "People repeat this often, but the facts support this" -> "the facts *don't *support this" * "Together, both of these things reduce PoW's security by a factor of about 83% (1 - 50%*33%)." -> "factor of about 83% (1 - 50%**(50% -

Re: [bitcoin-dev] Opinion on proof of stake in future

@Lloyd > Proof-of-SquareSpace I agree with your points about delegated proof of stake. I wrote my own critique about that as well. And your point, that other forms of PoS devolve

Re: [bitcoin-dev] Opinion on proof of stake in future

Hi Billy, I was going to write a post which started by dismissing many of the weak arguments that are made against PoS made in this thread and elsewhere. Although I don't agree with all your points you have done a decent job here so I'll focus on the second part: why I think Proof-of-Stake is

Re: [bitcoin-dev] Opinion on proof of stake in future

@Erik > it also solves the "nothing at stake" problem A. the "nothing at stake" problem can be and has been solved by PoS consensus mechanisms (unless you mean it more broadly than I'm taking it), and B. Proof of Burn should have just as much "nothing at stake" issues as PoS. Both consensus

Re: [bitcoin-dev] Opinion on proof of stake in future

proof of burn has all the benefits of proof of stake (if there are any) but it also solves the "nothing at stake" problem the incentive in POB is that you're making a long-term investment in mining, and you want a stable protocol, quality network, etc to pay off your investment. On Thu, May

Re: [bitcoin-dev] Opinion on proof of stake in future

It is difficult to understand how energy usage is a bad thing. At one end we talk about energy usage as a bad thing and we also talk about global warming. If Earth is receiving extra energy which is causing global warming shouldn't we use extra energy to do something useful. On Fri, May 21, 2021

Re: [bitcoin-dev] Opinion on proof of stake in future

I think there is a lot of misinformation and bias against Proof of Stake. Yes there have been lots of shady coins that use insecure PoS mechanisms. Yes there have been massive issues with distribution of PoS coins (of course there have also been massive issues with PoW coins as well). However, I

Re: [bitcoin-dev] Opinion on proof of stake in future

Ah sorry, I didn't realize this was, in fact, a different thread! :) On Wed, May 19, 2021 at 10:07 AM Michael Dubrovsky wrote: > Folks, I suggest we keep the discussion to PoW, oPoW, and the BIP itself. > PoS, VDFs, and so on are interesting but I guess there are other threads > going on these

Re: [bitcoin-dev] Opinion on proof of stake in future

Folks, I suggest we keep the discussion to PoW, oPoW, and the BIP itself. PoS, VDFs, and so on are interesting but I guess there are other threads going on these topics already where they would be relevant. Also, it's important to distinguish between oPoW and these other "alternatives" to

Re: [bitcoin-dev] Opinion on proof of stake in future

1. i never suggested vdf's to replace pow. 2. my suggestion was specifically *in the context of* a working proof-of-burn protocol - vdfs used only for timing (not block height) - blind-burned coins of a specific age used to replace proof of work - the required "work" per block would simply be a

Re: [bitcoin-dev] Opinion on proof of stake in future

Hi ZmnSCPxj, Please note that I am not suggesting VDFs as a means to save energy, but solely as a means to make the time between blocks more constant. Zac On Tue, 18 May 2021 at 12:42, ZmnSCPxj wrote: > Good morning Zac, > > > VDFs might enable more constant block times, for instance by

Re: [bitcoin-dev] Opinion on proof of stake in future

Good morning Zac, > VDFs might enable more constant block times, for instance by having a > two-step PoW: > > 1. Use a VDF that takes say 9 minutes to resolve (VDF being subject to > difficulty adjustments similar to the as-is). As per the property of VDFs, > miners are able show proof of

Re: [bitcoin-dev] Opinion on proof of stake in future

VDFs might enable more constant block times, for instance by having a two-step PoW: 1. Use a VDF that takes say 9 minutes to resolve (VDF being subject to difficulty adjustments similar to the as-is). As per the property of VDFs, miners are able show proof of work. 2. Use current PoW mechanism

Re: [bitcoin-dev] Opinion on proof of stake in future

Good morning Erik, > Verifiable Delay Functions involve active participation of a single > verifier. Without this a VDF decays into a proof-of-work (multiple > verifiers === parallelism). > > The verifier, in this case is "the bitcoin network" taken as a whole. > I think it is reasonable to

Re: [bitcoin-dev] Opinion on proof of stake in future

Verifiable Delay Functions involve active participation of a single verifier. Without this a VDF decays into a proof-of-work (multiple verifiers === parallelism). The verifier, in this case is "the bitcoin network" taken as a whole. I think it is reasonable to consider that some

Re: [bitcoin-dev] Opinion on proof of stake in future

Good Afternoon, Proof-of-stake sounds like an altcoin fork. There is no consideration that proof-of-work is insufficient or that it can be improved upon, only that it should be regulated. Imagine, you are a gold miner with larger hands so you start a mining race and mine plenty more than

Re: [bitcoin-dev] Opinion on proof of stake in future

re: 2, there's been some promising developments with Verifiable Delay Functions that make me think that the block regulation problems are solvable without requiring brute-force search proof of work. Are those inapplicable for some reason? ___ bitcoin-dev

Re: [bitcoin-dev] Opinion on proof of stake in future

To reiterate some of the points here. My problem with proof of stake is twofold. 1. It requires permission of coin holders to enter into the system. This is not true of proof of work. You may even attempt (though not successfully) a proof of work with pencil and paper and submit the block from a

Re: [bitcoin-dev] Opinion on proof of stake in future

personally, not speaking for anyone else, i think that proof-of-burn has a much higher likelihood of being a) good enough security and b) solving the nothing-at-stake problem the only issue i see with a quality PoB implementation is a robust solution to the block-timing problem.

Re: [bitcoin-dev] Opinion on proof of stake in future

Proof of stake is permissioned by coins, an internal, permissioned, and already owned resource. You cannot gain tokens without someone choosing to give up those coins - a form of permission. Permission can also be thought of as an infinite barrier to entry. PoW forces giving up control through

Re: [bitcoin-dev] Opinion on proof of stake in future

According to this paper: https://www.cs.umd.edu/projects/coinscope/coinscope.pdf PoW is also only resilient to 1/3rd of the network. On Sat, 8 May 2021 at 14:46, Eric Martindale via bitcoin-dev < bitcoin-dev@lists.linuxfoundation.org> wrote: > > Mr. Singh, > > Proof of Stake is only resilient to

Re: [bitcoin-dev] Opinion on proof of stake in future

On Sun, May 9, 2021, 6:21 AM R E Broadley < rebroad+linuxfoundation@gmail.com> wrote: > On Sat, 8 May 2021 at 15:36, Karl via bitcoin-dev > wrote: > > Bitcoin would get better mainstream public reputation if the block > reward were reduced to reduce mining. This would quickly and easily

Re: [bitcoin-dev] Opinion on proof of stake in future

On Sat, 8 May 2021 at 15:36, Karl via bitcoin-dev wrote: > Bitcoin would get better mainstream public reputation if the block reward > were reduced to reduce mining. This would quickly and easily reduce energy > expenditure. You're in luck then, as the block reward is being reduced by 50%,

Re: [bitcoin-dev] Opinion on proof of stake in future

Bitcoin would get better mainstream public reputation if the block reward were reduced to reduce mining. This would quickly and easily reduce energy expenditure. A system would be needed to do that with consensus, to make it political. For example, making a norm of extending the block reward

Re: [bitcoin-dev] Opinion on proof of stake in future

My opinion: 1.I don't consider PoS to be a better consensus mechanism compared to PoW used in Bitcoin. So any proposal related to PoS in Bitcoin is not an improvement for me.   2.Bitcoin is a protocol for decentralized network that creates consensus without needing a central authority to

Re: [bitcoin-dev] Opinion on proof of stake in future

And to address your energy usage concern: Energy usage, in-and-of-itself, is nothing to be ashamed of!! It's the composition of that energy usage that could be shameful. There is much debate currently about what that composition is for Bitcoin, but those estimates range from between 20-80%

Re: [bitcoin-dev] Opinion on proof of stake in future

Proof-of-stake tends towards oligopolistic control, which is antithetical to bitcoin. Proof-of-stake also has some other security issues that make it a bad substitute for Proof-of-work with respect to equivocation (reorgs). Overall you'll find me *personally* in the camp that it's OK to explore

Re: [bitcoin-dev] Opinion on proof of stake in future

https://github.com/libbitcoin/libbitcoin-system/wiki/Proof-of-Stake-Fallacy > On May 7, 2021, at 15:50, SatoshiSingh via bitcoin-dev > wrote: > > Hello list, > > I am a lurker here and like many of you I worry about the energy usage of > bitcoin mining. I understand a lot mining happens