I did not find this post convincing especially as many proof of stake systems have been running consistently for years now and with significant transaction and economic volume.

As an example Tezos has decentralized apps such as liquidity pools, collateral based stablecoin systems, nft ecosystems, coin bridges to other networks such as Ethereum (two way) I use these smart contracts on a weekly basis and have done for a long time now.

Tezos manages several orders of magnitude more transaction throughput based on opcode count count vs Bitcoin, transactions, even complex ones cost pennies the network has not been attacked, is worth billions and Tezos energy usage is easily a million times less than Bitcoin.

The main reason proof of work works so effectively is that it deals in physics with the actual expenditure of electricity as the punishment system for failing to produce the correct desired outcome.

Abstracting this away again, we have reality itself to content with. Evolutionarily we have evolved in respect to the dominance hierarchy (https://youtu.be/rUiG5_GcMyY) Where effort itself is a necessary precursor to ascending the ranks and being fit to lead.

Not to get too metaphysical, but essentially it boils down to:

- Social Status is based on real world implications and not self derived from the perceived ranking itself, that is if it is to be most stable across time. Being labeled the boss is essentially useless long term unless you truthfully represent the ideal or most capable individual. (Michael Scott from the television series The Office is a funny example of this)

- PoS offers reliability for the system based on its election of stake amount in the system that favors inventors, early adopters, and pre ordained position holders where distribution was not derived from effort in the real world with non-reversible consequences (burning electricity)

- Instead the selection mechanism its own value structure which may or may not accurately assess competence for reliable trust in a domain where zero-trust is key to consensus.

- Outsourcing consensus to something mediated by the laws of physics is more stable across time, and is yet another abstraction upon competence taking it outside the realm of US Dollars for social proof, but also adding in the component of physical consequences towards the chain of proof.

I'm also thinking as I write this that it would be important to consider changes in the environment as useful to the selection pressures. Why purely basing it upon success (stake) at one point in time is non-useful as the rules of the game may change, or reputation lost or abused in a PoS system would not accurately reflect changes in the need for rotation of positions of voting authority.

eg. Anything like "proof of latency"?

Distributed consensus is the problem of getting a bunch of computers to agree on some state when some of the computers can behave maliciously. In the case of cryptocurrency, the state is a log of transactions, which when replayed tells you who owns what. There are well-known algorithms for distributed consensus, such as Paxos and Raft, that are used in real-world applications, e.g., the Chubby lockservice.

Distributed consensus algorithms can be proven to reach consensus as long as at most a fixed percentage (e.g., 1/3) of the computers are behaving maliciously. This assumption is fine for applications like Chubby, where Google is running all 5 of the computers participating in the consensus, and no one can add additional computers. However, this assumption breaks down in the case of cryptocurrency, where anyone can spin up computers to participate. In fact, an adversary can effectively spin up an infinite number of computers. This form of attack is known as a sybil attack.

Proof-of-work and proof-of-stake add sybil-resistance to distributed consensus algorithms by requiring the adversary to commit a scarce resource in order to participate in the consensus process. In the case of proof-of-work, the scarce resource is computing power. For proof-of-stake, the resource is the currency secured by the system itself. This may seem a bit circular, but it's fine. In order to attack the system, the adversary would have to purchase or borrow a bunch of the currency on the open market, which has an economic cost. Proof-of-work permits the same attack, where the adversary buys or rents computing power instead.

From this perspective, the bitcoin consensus algorithm is in fact the odd one. Most distributed consensus algorithms (like Paxos and Raft) rely on some kind of voting system.

For what it’s worth, this is how plenty of buildings are designed. Ignoring silly things like the inside not fitting in the outside, an architect may design the building and hand it off to a technical architect who works out how to make it stand up and has some back and forth with the architect modifying the design. At a later stage it goes to a structural engineer who will make sure that it really is likely to stand.

That, and the author has a wrong understanding of the Nothing at Stake problem. At the time, the argument was there was nothing stopping someone from staking on multiple forks to hedge their bet on the dominate chain, giving them nothing at stake on the forked branches since the get equal ownership on each chain.

Mind you, Nakamoto consensus is pretty awful and completely ignored these days. Why do you believe that nodes flagged for support of protocols and miners with dominate hashrate LOST the big block debate? Because of the nodes, and community consensus.

proof of work proves that not just one miner had sufficient hash power, but that the entire network had a certain aggregate hash power that was required to mine the block.

can't this be emulated by requiring all major stakers to sign the block? (so rather than one miner staking being enough, all the aggregate staked was required to mine the block)

The article is also misleading in inferring that there is a very narrow range of ways to implement PoS; in reality, there are many ways and all of the 'drawbacks' mentioned only apply to certain (poorly designed) implementations which no modern PoS blockchain would ever use.

> What happens if you’re presented with two identical blocks, and have to decide which one to pick?

Easy, you can just have a vote on one of the block and choose the one with the majority votes; it can be chosen on the basis of any attribute of the block (E.g. commonly you can look at block IDs). This is what PoS blockchains like COSMOS do with the Tendermint protocol. Other blockchains like Lisk have a delayed voting so that consensus is reached after a certain number of blocks.

> The entire point of the consensus mechanism was to allow us to tell which transaction was first, without personally having seen it take place.

Anyone who understands distributed systems knows that the exact order of transactions (down to a few hundreds of millisecond) cannot be physically determined due to latency between the nodes and the unpredictable geography of participants. This is as true for PoW as it is for PoS. The most important thing (for certain use cases such as DeFi) is that transactions cannot be predictably front-run; using block ID ordering with voting as the basis for selecting between two valid blocks guarantees this. If the forger tried to cheat the system by producing multiple blocks, the network may not be able to reach consensus on the block vote and the forger would not receive any block rewards.

This is not true. You will have scratched far fewer tickets on average than one million.

If you have one million tickets, one of them guaranteed to be a winner, you will on average scratch exactly half of them (500 000) before finding the winning ticket. If you have an infinite supply of tickets, each with a 0.000,001 chance of winning, the number becomes higher, but the number of tickets scratched on average is still lower than one million.

Finding an error regarding something I know makes me skeptical about the rest of the article.

I have other issues with the article but this bit seems ok.

The actual truth is that PoS is infinitely safer than PoW in the short to medium term, while theoretically weaker in the long term. A long-term attack would require first buying obsolete signing keys, which would stop nodes that sync starting from the pre-fork point from syncing - ie. a denial of service attack. Which is in a very weak threat, as online nodes wouldn't even notice it. A short to medium term attack would stop finalization for a while at an enormous cost of slashing. It's a denial of service attack because nodes would be able to see contradictory signing from the same keys - so while without out of band data they won't be able to decide which one is the commonly accepted chain, it's enough information to recognize than an attack is happening.

PoW is very weak in the short term to medium term because runtime cost of attack is equal to mining rewards + epsilon, which is negligible, meaning it's just a question of hardware. Contrary to PoS, mining hardware is an external resource - it's always possible to get enough of it, given enough money (single digit billions for bitcoin). Getting 2/3 stake of a long-running PoS system is impossible - it's a scarce internal resource and there isn't enough for sale.

Reverting years of blocks is indeed infeasible - but interestingly in practice it would also amount to a DoS attack, as everyone would notice it and pause all payments. Contrary to PoS, where it would only work on newly syncing nodes, it would stop everyone. However, while theoretically more expensive, it's still only a matter of money - while a long-run DoS attack against newly syncing nodes in PoS would require buying obsolete keys, which is very likely to be impossible in practice.

Is this even an advantage? I don't think so, but it's arguable. However, for this singular arguable point PoW pays with a 4 orders of magnitude higher cost and a much, much weaker short and medium term security.

Empirically, lower security of PoW is confirmed: multiple 51% attacks happened (most famously ETC), while even a much weaker DPoS coins never had a successful double spend attempt.

In terms of public trust, not many people are able or even interested in technical arguments - they just observe if something works. In reality, consensus-level attacks are very rare as it's currently very hard to profit from them regardless of the consensus method, and the biggest danger is from software bugs in nodes, most likely unrelated to consensus.

If any PoW blockchain became a foundation of global commerce, attacking it would become very profitable, or even a military target - but that's never going to happen. So I don't expect bitcoin to get 51% attacked in any near future - at best years in the future when value of block rewards is so low one person with lots of old mining hardware can attack it just for fun.

Seems miners have been driving the price down for years and a new proposal just was written to give them only 10%, and 80 to stakeholders.

https://proposals.decred.org/record/427e1d4

IMO PoW for the bigger chains produce far too much waste & none of the supposed PoS attacks have materialized even though hundreds of millions are up for grabs

Prof of stake is analogous to Wall Street institutions and probably modelled after them.

To be fair, I'd love to hear him chime in on this discussion, and tell his side of the story, relate his exploits and prosecution as a viagra spammer, and finally answer all those unanswered questions people have asked him, to which he replied "Dodge Dodge".

Not that he's unique or special: POS shills like him are a dime a dozen. But he hangs out here and shills on HN, and has won awards for his deceptive scams (and also lost court cases too), and claims to "help people" on his web site, so I hope to hear from him again.

https://richardheart.com/

His real name is actually Richard J Schueler, under which he is famously known as the "Spam King", for being one of the first people in the world to be successfully sued for online spam, specifically the Viagra spam scheme that he ran from Panama (which he lost).

Richard Hart (aka "Spam King" Richard J Schueler) wins the "Golden Pump Award" for "Best New Scam" for his POS shitcoin Ponzi scheme "HEX":

https://twitter.com/JuanSGalt/status/1233242355995750400

https://www.youtube.com/watch?time_continue=857&v=tf-lJu5iDh...

Peacefire.org beats spammers in court.

https://www.zdnet.com/article/peacefire-org-beats-spammers-i...

>Free-speech group Peacefire.org wins a legal round in its fight against unsolicited e-mail, invoking Washington state's anti-spam law.

>The King County District Court in Bellevue, Wash., on Monday granted Peacefire $1,000 in damages in each of three complaints filed by Peacefire Webmaster Bennett Haselton. The small-claims suit alleged that Red Moss Media, Paulann Allison and Richard Schueler [who now operates under the pseudonum "Richard Hart"] sent unsolicited commercial messages to Haselton that bore deceptive information such as a forged return e-mail address or misleading subject line.

Confronting Richard Heart of HEX - SPAM KING and Crypto Scammer

https://www.cointelligence.com/content/confronting-richard-h...

>During ANON Summit 2020, I participated in a “fireside chat” with Richard Heart, founder of HEX. HEX is one of the most sophisticated, if not THE most sophisticated scams I have ever seen.

>Why was I so aggressive with Richard? I have a lot of experience fighting with scammers, at events, and in online discussions. I’m familiar with their bullshit techniques. Richard is the sort of “master debater” who will answer a question without actually answering the content of the question. I watched more than 6 hours of his previous talks and learned how to tell when he was trying to avoid a real answer.

>If you don't want to sit through hours of interviews yourself, this 4 minute video not only sheds light on Heart's motivation for establishing HEX, but also shows just how abrasive and crude he can be. This video was not created or edited by Cointelligence.

https://www.youtube.com/watch?v=_MIdlXHedlU

>I want to draw your attention to the quote in the video above: "What am I going to make more money doing? Promoting my token, that I own a whole ton of? Or promoting bitcoin, where I own one-one zillionth of the available supply?" He's clearly in this to make money for himself in any way possible. [...]

>When asked why HEX was not categorized as a security, at around the 21 minute mark, Richard offered an explanation that has no legal grounding. On the website, HEX claims that it is "The first high interest blockchain certificate of deposit." However, HEX has no legal authority to issue CDs. Richard is illegally claiming to provide CDs when in fact the instruments are nothing but glorified savings accounts.

More quotes: "What's up now, fggot? What are you going to do now, you little btch? Get the fuck out of here! That's the dumbest piece of shit I've ever seen in my fucking life. [...] Let me give you some more bullshit, ok?" -Richard Heart aka Richard J Schueler

Richard Heart - Spam, ICOs, and Death Threats

https://imnotdead.co.uk/blog/richard-heart

Richard James Schueler - Friggin Spam King

https://web.archive.org/web/20190416235350/http://www.panama...

Why HEX is a Ponzi and not a solid investment (Part 2): Richard Heart

https://www.reddit.com/r/CryptoCurrency/comments/kwhjxa/why_...

>During the interview at ANON, Richard confirmed that he was one of the first people in the world to be sued for online spam, back in 2002. This shows us Richard has experience abusing unregulated markets, as he is doing with crypto these days.

Richard: this an accurate quote of your own words?

>When I pressed the matter and asked for a simple “yes” or “no” as to whether he, as the FOUNDER of HEX, knows who benefits from the funds sent to the “Origin Address” he flat-out said “I’m dodging your question.” Dodging the question! He proceeds to repeat “Dodge, dodge.”

Richard, your tag-line "Do you want to develop my new cryptocurrency?" is the new "Do you want to develop an app?"

https://www.youtube.com/watch?v=jVy0JWX5XEY&ab_channel=Adult...

"Dodge, dodge." -Richard Heart aka Richard J Schueler

PoW miners tend to spend more and more resources on finding blocks, until the cost approaches the rewards. But the rewards go up as the cryptocurrency becomes more popular, because the price and transaction fees go up. Therefore, a PoW cryptocurrency tends to "eat the world" as it becomes bigger.

That's why Bitcoin is already approaching 1% of global electricity consumption, if it hasn't passed that point already. If the price were to go up tenfold, then so would electricity usage (roughly). That's not sustainable, both technically for grids and economically because electricity prices go up.

Because of that, I foresee two possible futures for PoW cryptocurrencies:

1. The resource usage overshoots and PoW collapses because it gets banned everywhere. (This seems to be playing out now with China having banned crypto mining, Kazakhstan running into grid issues because of the miner influx, and Sweden arguing for a ban in the EU.)

2. The popularity of these currencies stops growing and only some niche applications remain. Speculators leave because there's no more money to be made. Prices go down.

The strongest point here is the strawman presentation of the altered security model that PoS can be proven to form consensus under. Reading the source he cites is far more informative: https://blog.ethereum.org/2014/11/25/proof-stake-learned-lov...

The majority of the article frames distributed consensus mechanisms in an extremely sophomoric understanding of asset value and the PoW security model. All of these topics (including valid ETH criticisms) are discussed in much better ways in many other places.

To be honest, I don't understand why it hasn't been banned already.

Sweden has recently called for a EU wide ban because it identified PoW mining as a threat to transition their economy to renewable energy.

https://www.fi.se/en/published/presentations/2021/crypto-ass...

1. For all consensus systems, at least a vast majority will rely on PFC for base consensus since they will not personally audit the client software they download, and thus will rely on PFC to determine which software distribution channel to trust to download the client software from. In other words, there is in practice no pure PFC-free consensus protocol, to be taking such a hard stance on Proof of Stake for its reliance on it.

2. The Schelling Point PFC in Proof of Stake will always be the real order of transactions, and therefore PFC will be highly reliable. Cases like Bitcoin's block size hard limit dispute, and Ethereum's DAO hack rollback dispute, dealt with something other than order of transactions, and in both cases, the dispute was severe enough to lead to a hard fork - which jettisonning PFC can't protect against - regardless.

The raw figure it uses for gross power consumption (62 Twh) is also unsourced.

Meanwhile, the Cambridge Center for Alternative Finance puts the figure at around twice that - 110 Twh.

Not that we had any reason to grant credence to what a bitcoin "investment" company says about the matter, anyway.

Where is the use case?

Bitcoin already proved its use case years ago, it already won. The only question now is how far can it go.

It may be the case that coal is cheaper if you ignore the capital cost of the plant (e.g. running an old plant beyond its design life) but including capital costs amortised over the lifetime of the plant coal is not even cheaper than natural gas.

My understanding is that a major source of electricity used for bitcoin mining in China was hydro power during the wet season (when there is a natural power surplus because the level in the dam must be reduced)

The reason it's the cheapest is that you're negotiating with somebody who is desperate and has no options left. They have to sell the energy to you for bitcoin production because there's literally nowhere else they can turn.

The more green energy proliferates and climate change action expands, the more of these plants will be reduced to this desperation. The worst energy production is the cheapest, so long as it's been outlawed and the plant has no other options.

Don't get me wrong, I love the politics of decentralization. But it's worth remembering that decentralization tends to be a cost-center, not a profit-center, from the standpoint of efficiency and performance; and decentralized tech is no guarantee of decentralized results (see Amazon/Facebook/Google, who have quasi-monopolies in their niches, despite being delivered over open and federated web protocols).

Which then results in situations like miners buying up the majority of new GPU releases, leading to shortages for any other users, and still not having enough to keep up with the difficulty increases.

I have conquered [and seen others close to me] FOMO by stubbornly writing things off, and I suspect others have done the same thing: it's calorically inexpensive and cognitively frictionless. No one can reasonably assess everything that comes their way.

I am not saying that that's the reason with the writer, but it's surely the reason in some people, precisely because it's easy. And easier still to click upvote on a take that reinforces that stubbornness. It's this latter group whose motives are being questioned, as per the GP who asked why these takes get upvoted. I wasn't actually questioning the motive of the writer of the article, hence why I didn't engage in the arguments in the first place.

And of course you have the corollary of true believers who will support anything positive of X-thing-they-have-adopted.

It's seems to be only these two dichotomies we see, rarely balanced takes. And that's the real problem.

(alternatively, tax the electricity use beyond a certain per-person allocation).

I agree that there can be harms from PoW, but this is because of the electricity use, and so the thing to tax is the electricity use. Rather than the state deciding what things it considers valid for an individual to value and seek, it should put the restrictions on the thing that more directly causes negative externalities to others.

If there is a concern that this would harm things that we are sufficiently convinced is objectively valuable (e.g. making it more costly than is appropriate for people to heat their homes), so that we want to not significantly impact the finances of people who are like, using "reasonable" amounts of electricity, then we can, as I said, put some threshold amount of electricity use per person below which there's no tax on it, and increase the tax rate above that amount to account for this (and use the revenue to pay for CO2 removal and/or green energy development).

Or, like, I suppose in the most extreme case you could (on e.g. an annual basis) give everyone an initial amount of CO2 credits and no one is allowed to emit CO2 beyond the credits they have (but unused credits can be bought and sold).

... Oh.

Also the difficulty scaling is important even if you don't take security into account: if you don't raise it, then the block mining frequency rise progressively, and then you end up with more and more orphaned blocks, until you end up with parallel chains that don't really converge to a single coherent one.

2. do you agree that nuclear is a sustainable and necessary solution?

3. do you agree that mining provides massive incentives, on huge scale, to nuclear power developers?

And yes majority of people behave according to game theory because if they do not then they lose or in extreme cases die.

>If it were for me I'd force oil well operators to [....]

Maybe it's too costly for a reason? Building power lines or pipelines to the middle of nowhere has economic and environmental costs as well, so top down legislation forcing every single well to do it might result in worse overall outcomes. For instance, the resources it takes to construct a pipeline/power line to the nearest town might be more than the electricity/methane that can be generated from the well.

> but unfortunately "regulation" of any kind is seen as a bad thing in wide parts of the US.

So you would have them be regulated out of business? Most of us in the U.S. do indeed see that as a bad thing.

If you want you can build a generator near those wells. It's just cheaper to get the energy from somewhere else, because energy is fungible. A watt is not good or evil, it's the same as any other watt. Which means crypto energy consumption can be offset just like anything else, and is exactly as evil as any other convenience - driers, for instance, or flood lights, or inefficient heating, or anything else.

Focusing on crypto in particular says more about the author than anything else.

If we're going to start legislating how we're all allowed to use energy that civilization has made available, who gets to decide what's allowed?

Numbers I've seen suggest that global PC gaming alone (excluding consoles) currently uses about as much electricity as bitcoin. Should we ban that too since playing cards are readily available and use almost no energy? Maybe we can make a concession and only allow low powered handheld consoles?

If bitcoin mining actually becomes problematic, then by all means we can definitely ban it or add some sin taxes to it, and we probably will in a lot of jurisdictions. I'm actually kind of eager for that to happen, because it will force miners to actually become novel/stranded energy ventures. They'll be the capital drive that builds out energy sources that not enough humans live around to justify tapping and/or we can't economically justifying building without expensive transmission infrastructure. And once it's built out and paid off, it may be a lot easier to justify investing in building out long distance transmission infrastructure so the rest of civilization can also tap into these sources.

x = x

As if that's insightful. But in the spirit of HN, can you say more? My understanding is that renewables are the cheapest and will likely continue to trend in that direction, causation or not. So are you suggesting maybe there's a chance of a super inexpensive non-renewable overtaking this trend?

Unless we believe that Bitcoin has some use, its power consumption would be problematic even if it weren't so monstrously large. And vanishingly few people believe Bitcoin has any value beyond a get rich quick scheme.

There is no market in the world where you are going to decrease consumption by increasing the demand. That's just not how economics works.

It's also a new finance world completely under the control of an even smaller elite of devs and mining pool owners (see the hard fork of Ethereum that happened a long time ago, and the upcoming fork of Ethereum that will move it to PoS; sure, Ethereum isn't Bitcoin, but there is nothing fundamentally different to prevent Bitcoin taking a similar step whenever the devs and miners decide).

What Bitcoin definitely is not is a new currency where the people have any kind of control. It is actively opposed to that goal, and takes away even the slight chance of a benevolent leader that exists with central bank controlled currencies.

- electricity is the only part where Bitcoin produces emissions (emissions of mining hardware)

- wasting climate neutral energy does not matter (it does: it's harder, takes more time and resources to switch to climate neutral sources; iirc studies estimate Germany needs to cut 50% of energy consumption to achieve 1.5° conformity)

- Bitcoin miners don't bypass widely adopted regulations somehow

Even if BTC and every other POW cryptocurrency converted this afternoon to 100% renewable energy use (and we ignore the carbon cost of manufacturing the hardware), it is STILL a huge climate problem.

Why?

1) Because that ~1% of total energy consumption is being squandered on maintaining the cryptocurrency instead of any other use. Thus, it prevents those clean energy sources from displacing CO2-generating sources which would otherwise be taken offline.

2) Even if the BTC energy is entirely derived from some power source that could not be used by others, perhaps all geothermal generation on a remote volcanic island, it will still add net heat to the atmospheric system. and, of course, we still have the energy use and CO2 spewage of fabricating and moving the mining equipment into location.

So, no, this problem is NOT taking care of itself.

Btw Satoshi introduced blockchain checkpoint so no attacker can fork the existing Bitcoin chain and make a competing one.

It really sounds like you're rationalizing banning Bitcoin because you don't see any value in it. That's a dangerous way to decide who gets to use electricity.

LED was a technological innovation. Nothing says Bitcoin can't have those. If you want more light, you need more lamps and you need to spend more energy. I don't really see the difference here.

About every 4 years the reward for mining a block will be halved. I don't see LED lights getting two times more efficient every 4 years.

What you do is buy up the dirtiest plants, run them until they break, bribe or evade any authorities (if they even exist) who would stop you, and if the plant is being shut down because it's failing to comply with pollution regulation (again, if such even exists) that just puts it in a weaker negotiating position. As such they HAVE to deal with you at whatever price you're willing to pay because they can't go anywhere else because they have to run illegally. But they're powering bitcoin, so it stops mattering if they're running illegally, because bitcoin is the currency in which it doesn't matter if you're being paid for crimes, only that the coin exists.

I consider that powerful motivation to arbitrage the energy system and exploit cases where energy suppliers are running out of options because they are too dirty. And this can be happening anywhere. Climate's global. If all the dirtiest coal burners are huddled together on a secret island for warmth and to eke out the last pennies (of real money) they can earn, they'll do that for bitcoin if they can't operate any other way.

And it'll still matter. It'll just be happening in secret, because bitcoin don't care.

Why push around everyone to consume differently while distributing vast amount of tax money that immediately go into more wasteful crypto ? It will not stay at 1% and I agree with the OP that it's going to be difficulty to reduce electricity wastage on one end while ignore the elephant baby in the crib taking over the room.

I'm a random internet person in Hong Kong. I have a friend mining half his rent in a hotel room who decided that he doesn't need to pay rent the "normal way" anymore, he can just sleep next to a cluster of mining machines in a hotel room. Is he the stupid one, or am I, paying 3000 USD of my own money monthly ? I have another friend who lost half his saving in shitcoin speculation, I have colleagues who made a 10x profit this year, I mean it's all fucking around me and it's very hard to say it's just a 1% part of an important problem.

I feel sometimes it's going to become the main problem. I can't wait for a mega crash to calm down all this excess. I can't accept I'm the idiot working the traditional way to make traditional money paying for traditional things while the futuristic gamblers mine their hotel room fees on a bet I'm going to eventually be forced into using their tokens at whatever cost when it becomes legal tender, locking the future price into making them billionaires.

I think crypto has a lot of socially useful potential, beyond mere speculative gambling and Austrian-school value storage, but that's in addition to the centuries of momentum in our real-world political economy; crypto-currencies are unlikely to replace that entirely, anymore than the internet replaced the New York Times.

[0] https://xkcd.com/538/

Bitcoin has merits. So proof of work, being a part that is currently necessary for it to work has merits.

But the argument that proof-of-work has the merit of incentivizing cheaper energy sources does not stand up.

1. All uses of energy already incentivize the search for cheaper energy. This isn't a novel incentive that proof-of-work provides.

2. But proof-of-work does have a relatively novel disadvantage. It won't just incentivize greater energy uses as prices come down, as in normal supply-demand curves, but must keep up the original and even grow the amount spent on energy.

This would not be a problem in a market without negative externalities, but energy is famously a huge industry that will be struggling with negative externalities for quite some time and at great cost.

congrats, you've reinvented central banking and plutocracy.

It fairly describes every political system and economic system that has ever existed or will ever exist. What's being described is how humans always organize systems in regards to political and economic power.

See: Socialism, Communism, Fascism. It applies just the same to those. Except in those systems they'll murder you and your entire family, then burn your village/town to the ground, if you attempt to compete with the rulers or party (Chavez, Castro, Stalin, Lenin, Mao, Hitler, Mussolini, Pol Pot, Kim, Putin, Erdogan, Lukashenko, etc.).

Whereas I can freely compete with Coca Cola, Tesla, Salesforce, Splunk, DigitalOcean, Cloudflare, Starbucks, 3M and most other companies if I'm able to. Nobody is stopping me from inventing a new coffee drink and going after Starbucks with it, or setting up a better coffee chain on the corner. Nobody is stopping me from inventing a better soda-competing drink (see: Monster or Red Bull or 5hour Energy; those people weren't assassinated by the soda cartel). Nobody is preventing me from starting the next great convenience store (ask 7-11 how they feel about upcoming Sheetz; or ask KFC how they feel about Chic-fil-A).

https://web.archive.org/web/20170720143148/https://www.reddi...

For transacting indeed you need to trust the various clients, but that's easy and can be done once. With the consensus isn't being tampered with, and, more importantly that others are using other types of rules.

Except the people you bought something real-world from, once they figure out that their "tipcoin" is worthless. So now it's a question of convincing some people that your technobabble is valid enough. How hard is that?

This irrational fear of short selling is such a modern midwit view. There is way more value to fraud on the upside then there is on the downside, and we see that everyday.

All transactions are not gathered in one place, ever. All nodes receive all transactions independently. All nodes are capable of providing a copy of the ledger for verification.

Transactions don't go through a server. Historical record gets finalized by any one participating node. These two things are not the same thing. The transactions that will be mined are publicly known by all nodes before they are mined. Mining only ensures that nobody can change them after the fact.

There is no concurrency, this is true. The systems we have currently are single threaded systems, and from a classical standpoint, hugely inefficient single threaded systems. But this is not the same thing as centralization.

That doesn't make the network centralized, since the server that acts as the centralized state transitioner will be randomly selected from a very large pool of servers with equal authority.

Innovations that Rollups and Sharding further extend the scalability that is achievable with Ethereum's Proof of Stake consensus protocol, mostly by debundling tasks to create modular components, so that the consensus layer has to handle far less load per transaction.

The exact formula is given in the Bitcoin whitepaper <https://bitcoin.org/bitcoin.pdf>, see page 6 and on.

Soft forks don't force you to download and run new clients just to be able to use the network, which is an important difference. You can use your existing client, you just don't have the new features and don't run validations on them.

The greatest risk on soft forks is that chain split you mention. That's why any reasonable soft fork deployment requires a long time window with a large majority of hashrate signaling support (like 95%).

Why would Doctor Evil attack a block chain network when he could attack global/national/regional credit card/wire transfer/ACH networks, many of which are built upon ancient pre-Internet technology, are full of discoverable vulnerabilities and critical points-of-failure, and are operated by cash-rish financial institutions with liquid, easy-to-short stocks?

https://fc18.ifca.ai/preproceedings/6.pdf

Despite that, PoS has the benefit of offering decentralized staking pools like RocketPool, and the fact that they are growing may indicate that the chain will over time become more decentralized and less able to be centrally attacked[1]. The PoS mechanism itself is also perhaps more resilient to these kind of attacks, see [2].

None of this mechanism is as simple as PoW (which has worked quite well for BTC and ETH so far), but the environmental cost makes it worth exploring an alternative mechanism.

[1] - https://uk.style.yahoo.com/valid-points-ethereum-2-0-1130005...

[2] - https://vitalik.ca/general/2020/11/06/pos2020.html

With PoS exactly the same works. Most of the holders should be honest, and a successful attack would require spending at least 50% of the market cap of the coin to successfully execute - and then losing that stake as the reputation of the coin is soiled.

I challenge you to present a "simple python script" that implements the exact bitcoin consensus rules (as codified in bitcoin core). Bitcoin is not all that simple and there's a nontrivial amount of complexity in bitcoin script alone [1].

> The chain is validated in its entirety upon first sync. 100% from genesis to tip.

The default behavior is to skip signature verification for all signatures before some relatively recent block [2].

[1] https://github.com/bitcoin/bitcoin/blob/master/src/script/in...

[2] https://github.com/bitcoin/bitcoin/pull/9484

You can't even fork a stablecoin. in case of a split in a PoS chain, the correct fork will be decided for you by USDC and Coinbase.

Warren Buffet buys up 70% of the network, induces a network partition, and then double spends it all, signing both transaction histories.

By the time he’s caught, he’s converted 2x the value of the POS network to POW bitcoins.

Replace “warren buffet” with “crypto exchanges selling bundled securities”, and the above is not just plausible, it’s inevitable.

The same scam has been run over and over again with conventional banks (who are inevitably bailed out on top of getting to take the money and run), POS just changes the nature of the obscure underlying financial instruments.

so, proof of work?

This is just evidence that this particular slope isn't as slippery as some thought.

https://twitter.com/vitalikbuterin/status/760232885483806720

Indeed, but the same is true for attacks on "weak subjectivity" proof-of-stake. They're only a threat for nodes that have been disconnected for a long time (months) before they try to reconnect.

For other people: https://news.ycombinator.com/item?id=29367857

VDFs are far too new, at best bleeding edge research, nobody is going to gamble serious money on the robustness of such new constructions.

You would need unanimous agreement from the entire cryptology field.

However, yes, there are some workshops on quantum and implications for mining, and some other fanciful stuff that are also just research at this point.

The current setup of PoW relies on rather well understood, battle hardened primitives, that have been in actual usage under adversarial conditions for decades.

Do you think any major central bank will hold any asset that's secured by a paper written last year?

I can still propose blocks invalidly, you see. And then someone who doesn't already have the consensus (e.g. trying to sync) will have no way to tell which is legitimate.

This is the problem - you can't look at what the system does when everything's working as it should, you have to look at what happens when it's outside of the comfort zone.

Miners do not set the rules, they are merely a service that provides immutability to a ledger, with a nuclear option that will bankrupt all the billions they have invested, should they misbehave.

Large stakers can rent-seek and extract your wealth, PoS is the same system we have now, plus some code.

You are quite literally being exploited right this minute, by the same methods outlined in the article.

To demystify what a VDF is, consider the delay function (i.e., the majority of the work done to compute a VDF) used by the most prominent proposals:

Let N = p*q be a product of two large primes (so an RSA modulus) and assume that the primes p and q have been immediately thrown away/forgotten after initialization. Then, computing

f(x) = x^(2^T) mod N

is believed (dating back to a paper by Rivest, Shamir and Wagner in 1996) to take T sequential steps provided that T is large enough. For a large T, the only feasible approach seems to be repeated squaring modulo N. That is, compute y = x^2 mod N, y' = y^2 mod N, ... for T times.

If you want to use coinbase to buy crypto and tokens, that's on you.

And if by some chance your subreddit manages to become popular, the admins and power mods will conspire to take it from you. Reddit sucks.

What you are arguing for requires either an amendment to the constitution or nationalization of those private enterprises.

"More" of it isn't going to make any of those things go away.

"Freedom of speech" isn't a guarantee that your prefered brand of rational discourse is going to have an audience of millions. If anything, it's a guarantee that it won't, because someone with a self-serving profit motive is far more incentivized to shout over you.

Freedom of speech does not entitle you to broadcast to anyone else's audience.

These weaknesses weren’t due to consensus failures or protocol failures, but bugs in applications running on Ethereum. If Ethereum’s protocol allowed arbitrary funds to be stolen, that could certainly cause a loss of trust.

Spend $X billion, then just bleed everyone without power. Sort of like what we do now.

We have a bunch of examples of this happening in practice. The humans are usually a mix of the developers, parties important to consensus (miners, stakers) and big ecosystem players.

> It sounds hard to manage this type of maintenance breaks in a trustless way.

When solving a problem that violates your core security assumption you are only longer in the world of security definitions. It doesn't really make sense to talk about "trustlessness". If the protocol is busted, you need to find a solution and get enough people on board with that solution that you can upgrade the protocol.

> Once you have established the trust required for checkpointing the entire blockchain regularly, wouldn't it be much easier to checkpoint every block instead and in an instant do away with all the hard problems of blockchain networks?

The checkpoints aren't trusted for safety but instead for availability. Instead you should think of them like alarms that "something has gone horribly horribly wrong, stop everything, don't transact, don't move, don't touch anything, pull the ebrake."

tl;dr Much like the fuse box in your house, my view is that checkpoints should turn safety failures (electrical fires) into availability failures (electricity is shut off).

Person A buys a movie and agrees to not distribute it, but goes ahead and does it anyway to Person B. Person B hosts it for everyone, and Persons C through Z get it and also host it. You're suggesting Person A is liable, but the cat's out of the bag and Persons B through Z can continue redistributing it forever because they never agreed to anything.

If this is the desired goal, you don't need copyright at all, you can already get Person A on violating Terms of Service or whatever.

However, I’m not sure I understand how this is supposed to help. Proving that a few seconds passed just slows down block generation a little, but this cannot be a significant barrier to block generation or else you just have a full PoW system again. And if it’s not a significant barrier then it’s not clear to me what this is supposed to do, beyond preventing me from generating and signing a new block within milliseconds of some event happening.

But since the “nano scale” PoW doesn’t define the rate of block generation, it just establishes a lower bound, it feels like it’s just a speed bump for anyone trying to attack the system. If it only takes 10 seconds to rebuild the last 100 minutes worth of blocks, then it doesn’t establish a universal clock and therefore cannot prove which block came first.

I’m not the parent, but – no, I don’t. But that’s exactly the point. The need to bootstrap from centralized authorities is what’s supposedly so bad about weak subjectivity in proof-of-stake. Yet in practice, it’s needed with proof-of-work as well.

In IPv4 a client might have a chance at auto-discovering peers.

It's also not necessary to rely on a single centralized authority. There are many things (DNS, Encyclopedias, Linux kernel mirrors, etc.) where the majority of existing centralized authorities agree with each other.

This 'long range attack' is different from a 50% attack because it doesn't affect nodes that were running before the attack happened. But a situation where new entrants into the network are uncertain of the 'true' fork is not tenable in the long term.

This seems more viable for a value destruction attack than for a double spend. But value destruction can be lucrative for blackmail. It means a coalition of stakers could withdraw their stakes and state "increases the blocksize or suffer a long-range attack".

In PoW miners risk going bankrupt overnight for egregious behaviour like that.

I'd like to see how one defines "slashing" programmatically that is impartial, works algorithmically, and does not have edge cases that can lead to catastrophic failures without handwavy assumptions that every single PoS network has today.

However, if you are only forking the vm and allowing for people de deploy other protocols (or forks of other protocols), this is not the case (they just start off at lower total supply relative to the native collateral available on that network from a lower demand base).

About VDFs, there is a tolerance, you need to be in the same ballpark as the fastest, not _the_ absolute fastest. The more tolerance you need, the less snappy the PoS blockchain will be. They plan to make a low-power asic for that task, to be as close as the theoretical max speed for that, and have the lowest tolerance margin as a result.

Also, there is a way to reduce all VDFs results so that only one of the whole set of VFS-ers need to be honest.

So it's not one volunteer, but a pool of volunteers, using low powered asics so close to the theoretical max (ie speed of transistor switching) that you couldn't outrun them enough to profit from that speed up. I am not sure if they are incentivized, because it's not costing a lot, but maybe.

> Edit: I suppose the VDF's input might not be "the block being computed" but instead "the previous block", and the output then used to elect participants who are then trusted to build the new block. This would allow the new block to indicate whether the VDF actually took longer than expected.

Indeed, that's what I thought I was saying, but maybe I was not clear enough.

I don't quite get that. As far as I understand it the "nothing at stake" problem works by a malicious party inducing a fork, one of which they double-spend in. Since it's in the best interest for everyone else to mine both forks, you can force your double-spend fork to become the longest chain by only validating the double-spend fork.

This means you have to trust that nobody part of your current chain has double-spent in this way. But isn't this the same as in PoW where you have to trust that nobody has launched a 51% attack to disrupt the network in the past?

Also, can't you just prevent people from mining all forks? I.e. for becoming a validator you have to deposit X as a security beforehand and you can only earn at most X via staking (so it is in the history before you can attack with nothing at stake). If it is recognised that you mine on more than one fork at a time, you lose the security deposit you gave before the fork. X goes to the person who found the fork, incentivising that the mallicious fork is identified on all forks (miners on competing forks are incentivised to look at all forks and quickly add the mallicious fork detection for their own benefit). If you want to retrieve your security and money earned, you have to announce this on all forks (you immediatly seize to be a validator). You are only allowed to retrieve the funds, if it is confirmed on all forks, or the forks are sufficiently behind the longest chain. This allows everybody ample time to look for dual-fork work and also incentivizes rapid solution of forks.

Right now, it seems to be one of the best protected PoS chains. It's still fairly new, with novel mitigations, so it still doesn't stand the test of time against all possible attack vectors.

In that sense, it still can't be considered as secure as a PoW chain with high hashrate, which is protected by thermodynamics (you can't produce more hashes than the physical energy you have access to allows).

Which parts of this are checked by the client software, and which parts are just checked by interested humans in the block explorer?

There's a trade-off here. If you require 8000 guys to all vote in favor of your block, what does the client do if it only sees 7999?

> which wouldn’t be supported by any ETH1 deposits ... signed by 260k freshly generated public keys

You misunderstand. What happens if some of those private keys get compromised? In Bitcoin, if I sell my miners to someone else, it's not like they're radioactive waste that has to be buried. In PoS, someone can cause quite a bit of damage with keys that ostensibly don't contain any money. And because I've already withdrawn, I have no reason to care.

Note that in Bitcoin you can have a fork in which both chains have equal length. The idea is that eventually the longest chain will be established, but if say 90% of the mining is malicious that malicious miner could ensure that most of the time both chains are of equal length.

With a PoS fork you can ask, which fork has the most amount of stake voting for it. An attacker that controls enough stake might be able to balance the total stake vote in the same way as a malicious miner could on Bitcoin.

In both cases if the core security assumption of the blockchain is violated, that blockchain should halt until that assumption is made sound again. If someone orphans the last two years of Bitcoin's blockchain something has gone horribly wrong. The fact that Bitcoin now switches to the longest chain doesn't actually address the problem that two years of transactions may have been rendered invalid.

The hard fork reversed those transactions.

No matter what fancy spin you put on it, that was absolutely a violation of the blockchain's integrity, as it violated the principle that accepted transactions can't be reversed after the fact, even if you call it an "irregular state-change" that just keeps things secure.

You can absolutely defend the position that this was best for the ETH ecosystem. But it was absolutely a reneging on the blockchain rules.

I think this is where you get the problem - if you just have two sets of signatures, how do you tell which is legitimate and which one isn't? How do you conclude in which set the cabal was lying?

An eclipse attack is so named because it requires you to keep all the light out so they're kept in the dark. But here, since there's no internal mechanism to tell the two chains apart, you don't only need the accurate information, but also outside information about which one is accurate.

1. X is a problem?

2. But Y is also a problem, in my opinion.

3. X and Y are both the same, I think.

4. Therefore X is not a problem.

We can - theoretically - verify the correctness of PoW software by downloading the source code, reading it over, etc. We can also refuse to update, reducing ourselves to SPV security. We can internally verify the checkpoints using 100% objective standards. There are other things as well. This is not the case for PoS, where our "signature A existed at time B" has to be taken as faith, or evidence of things unseen. There is no internal way to verify the veracity of such a statement.

The fact that users aren't personally doing this, is not the same as saying it makes no difference whether they are able to or not. I'm not personally going to withdraw all the money in my bank account - that would be ridiculous - but if the bank informed me I was no longer able to withdraw the money in my account, that would not be suitable at all. The assurance that I can do it makes it so that I don't have to.

Which means that large stakeholders suddenly stop verifying blocks. Long-term active wallets stop transacting.

The same might be true for both chains after the fork, but I would imagine the fake one would have a larger change in participation (weighting older wallets and larger stakes) than the real one.

For each chain you'd be able to look at the age, stake & historical participation level of the post-fork participants and get a pretty good idea which (if either) of the chains is real. The absence of honest participants should look a lot different than the absence of dishonest ones.

Granted, this method is not nearly as simple as checking the number of 0s on a hash, but I would imagine it to be quite difficult to circumvent.

If sufficiently powerful quantum computers become readily available to anyone, sure, everybody will upgrade. Given the exotic hardware they typically require, it seems likely that for a while only a few large organizations will have them.

Proof of Work does not get you any votes at all.

PoW is a service to the network, to create an immutable ledger. It comes with a very real nuclear option that will bankrupt miners if you misbehave and get fired by hashing algo change.

It's just a boring industrial business, like smelting aluminum or iron.

With PoS, the coin creators can assign themselves an arbitrary fraction of the coins, concentrating the wealth. Even if there is a public record of all the funds raised in a public sale and all expenditures made (which is rarely the case), it's possible for the creators to participate in the public sale and recover large parts of funds used to buy their own token by generous expenditures on software development and such.

Just as an aside, when you move a newspaper or a magazine from print to only existing as a web page, you certainly have 'dematerialized' it to a degree. However you still need hardware to keep and display the data and energy to move it around and light up the screens. In so far it does not stop being physical. The 'intangible' is somewhat of a red herring. Yes, it is less haptic, but it's still physics, physical all the way down. Other than that, currencies, freedom, equality, education, entertainment—we've been having intangibles all the time, at least from the dawn of human culture onward. Cryptomining does not bring anything genuinely new to the table in this respect. It's not even new in being a fraudulent, volatile scheme that betrays traits of a cult, one that benefits a few and hurts the many.

You're right that Bitcoin will never accept a change of PoW. At least not until SHA256 shows signs of being broken.

It's probably not renewable (well, neither is the Sun on large enough timescale), but do you believe nuclear, either fission or fusion, will play a large role in the future?

[0] https://en.wikipedia.org/wiki/Pigovian_tax

Is it though? It seems minor protocol tweaks aren't uncommon and hard forks managing to eclipse the original protocol in popularity are also conceivable.

https://en.wikipedia.org/wiki/List_of_bitcoin_forks

If we do not bound the growth of PoW energy usage, I think it could easily destroy itself in a roundabout way: by destroying the fragile global order that keeps humanity going.

Hardly unprecedented, considering that until very recently nations did not have a monetary policy.

No, there is no voting and there is no leader election. Miners construct blocks with transactions and if they manage to find a signature - that block is appended to the chain. If somebody does it faster - they append their block.

Please at least get the basics before you start arguing with people.

The vast majority of mining today uses sustainable energy (70%+), because it is actually cheaper.

Dishwashers and heated swimming pools use WAY more energy globally, but because pleasant luxuries are quite enjoyable, nobody seems to attack them.

This has a clear answer in PoW, but not in your scheme

It's also hard to see how push button Armageddon has possibly made us more safe than nobody having nukes. We are only more safe than if only our enemies had them. The same could even be said of armies.

This has happened multiple times with attempted hard forks of Bitcoin which have failed because once you change the monetary policy once, the promise of hard money effect disappears. So the original monetary policy remains in place and the original network continues as the reigning champion.