Quote from: cryptohunter on July 31, 2015, 11:20:15 PM

So POS is a sham? it's as clear cut as that?

...

Quote from: smooth on July 31, 2015, 11:27:19 PM

... and do, make subtle changes to their systems when presented with flaws, or order to "fix" the flaws. In formal and security analysis, any change, however subtle, means the analysis needs to be completely redone. Obviously you can see how this might make it infeasible to keep up with every new variation and show how each and every one of them are broken in specific detail.

Nevertheless it is possible to analyze these systems in broad terms and reach conclusions in terms of general principles, such as needing to consume some external resource (i.e. proof of "work", broadly) in order to ~~reach a decentralized consensus~~maintain unbounded entropy...

Quote from: TPTB_need_war on June 06, 2015, 10:58:23 PM

Quote from: Zangelbert Bingledack on June 06, 2015, 10:35:51 PM

But anyway, what of Paul Stzorc's response to Vitalik? Riskless counter-contracts. In general with PoS it seems to me that Vitalik and the other PoS people are falling into the "make the security model confusing enough that even really smart people can't understand it = good security" error. Sure, PoS doesn't seem confusing, but with things like stake-grinding plus an endless parade of more unfamiliar-to-security-researchers workarounds it optimizes for a security model that's difficult to poke holes in during debate, but that a motivated attacker could eventually figure out how to attack precisely because it's too opaque to know that what the attack vectors are so that they can be defended against.

I maintained since 2013 that PoS can't pull from a large enough pool of entropy. The randomization of order can be gamed. Note a natural source of external entropy can't be employed (as this would require centralization).

The excessive use of resources in PoW can be easily solved by lowering the debasement rate (and transaction fees), but before you do this you have to remove the 50+% attack...

Quote from: TPTB_need_war on June 06, 2015, 03:44:54 PM

Proof-of-Work vs. Proof-of-Stake

Extending from my prior post, the bolded portion is an unnecessary assumption (i.e. a weaker assumption is also valid):

https://download.wpsoftware.net/bitcoin/pos.pdf#page=7

Quote from: Andrew Poelstra

We further claim that a majority of the network is working on producing a DMMS which extends
the true history. An elegant reason that this is true is given by Vitalik Buterin in [But15]: since the
reward transaction is only recognized if its block occurs in the true history, a Nash equilibrium for
each miner is to go along with the majority⁶.

The arguments made against Bitcoin succumbing to malfeasance is that the participants are self-interested in the value of the network and this interest in the public good is not undersupplied (because total or massive losses in value are possible). If that assumption is true, the participants would also align with the longest chain even if they weren't paid (note I make no claim about whether participants would mine for free, which can be considered orthogonally to my point), because the alternative is no consensus and loss of network value. Moreover, the latter assumption claim is more easily supported than the former, because it is always an immediate causal event whereas the former could be an obscured causality.

Thus in the prior post I quoted from where Vitalik has refuted Andrew's arguments, and yet Andrew (and apparently Gregory Maxwell as well) still didn't get it. So you still think Maxwell is the supreme expert? He makes mistakes too. He is not omniscient.

Quote from: Andrew Poelstra

⁶In that same blog post, Buterin says if you are tired of opponents of proof of stake pointing you to this article[Poe14b]
by Andrew Poelstra, feel free to link them here in response. It is not clear what he means by this; he did not, there or
anywhere, refute that papers claim that you cannot produce consensus except by consuming an external resource.

What part of "subjective condition" did Andrew (and Maxwell) not understand? Vitalik demonstrated an example whereby PoW suffers an analogous requirement for assumptions of mutual incentive for optimization of the public good as PoS does. Andrew is trying to argue that PoS is self-referential thus can never be absolute proof. But Vitalik shows by example that PoW is conditioned on subjectivity also.

The subjectivity claim against PoW may be weaker than against some variants of PoS (e.g. one-time spend addresses with check points), but the devil is in the details. PoW requires checkpoints to guard against 50+% attacks too. Checkpoints are a form of social trust (aka "assumptions of mutual incentive for optimization of the public good"), subjective (SPV-like) trust model which Maxwell alluded to.

Quote from: Vitalik Buterin

Objective: a new node coming onto the network with no knowledge except (i) the protocol definition and (ii) the set of all blocks and other important messages that have been published can independently come to the exact same conclusion as the rest of the network on the current state.

Weakly subjective: a new node coming onto the network with no knowledge except (i) the protocol definition, (ii) the set of all blocks and other important messages that have been published and (iii) a state from less than N blocks ago that is known to be valid can independently come to the exact same conclusion as the rest of the network on the current state, unless there is an attacker that permanently has more than X percent control over the consensus set.

The main argument I had against Proof-of-Stake since my 2013 debates with Etlase2 was the entropy of the randomization function. I still have to look at how that is done in variants and see if my former criticism still applies.

P.S. Andrew's paper and Vitalik's blog are both excellent for raising clarity on the issue and much appreciated.

Edit: Ah I see my long-standing reservation against PoS has remained true thus far:

https://blog.ethereum.org/2014/11/25/proof-stake-learned-love-weak-subjectivity/#comment-1730404390

Quote from: Stephan Tual

Random contract execution and random hash functions every x nonces both proved flawed after some research. The plan is to use a variant of Hashimoto for v1.