Quote from: theymos on October 19, 2016, 01:14:14 AM

I've casually proposed this for Bitcoin in the past, but there's no way that something as experimental as this would ever be done in Bitcoin without at least a successful altcoin example, so it'd be cool to see it implemented in an altcoin, if any altcoin devs are interested. I have not rigorously examined this scheme for any flaw, so maybe it won't work well at all, but maybe it will.

One problem in Bitcoin is mining centralization. To solve this, I propose that the PoW be changed to the following:

- If the block height mod 4 is 0, the PoW for that block is SHA-3 (or similar), an ASIC-friendly algorithm.
- If the block height mod 4 is 1, the "PoW" for that block is "follow the satoshi", a form of proof-of-stake described in the Proof of Activity paper.
- If the block height mod 4 is 2, the PoW for that block is cuckoo, a very ASIC-unfriendly algorithm.
- If the block height mod 4 is 3, the "PoW" for that block is again "follow the satoshi".

Most likely:

- The SHA-3 group will be controlled mainly by a handful of centralized ASIC miners as is the case with mining in Bitcoin today.
- The cuckoo group will be controlled mainly by a handful of botnet operators, though ordinary users might also participate to some extent.
- The PoS group will be controlled mainly by a handful of early adopters, though ordinary users might also participate to some extent.

However, importantly, all three groups need to cooperate in order to do anything majorly evil such as rewriting many past blocks. And since the three groups seem very likely to be independent, this significantly increases the decentralization and security of the system's mining.

I didn't see this when it was originally posted, thus I am late to respond.

Assuming much greater than 51% mining cartel control then if the PoW blocks provide the randomness to select the PoS address to construct the next block, then the PoW is still in control and does not need to coordinate with the PoS in order to do PoW attacks. Except in any case, the PoS can also jam the latest PoW block, thus causing ambiguity as PoW miners must decide how to long to wait before they instead produce a replacement PoW block which selects a different PoS address. This destroys the unambiguous Nash equilibrium to mine asap, thus I believe that will cause a divergence of PoW away from consensus to multiple competing partial orders because different miners will take different strategies so you have a split of the network hashrate such that no chain can definitely advance ahead of the other one (or at least you'll have massive orphan rate and selfish mining strategies with much smaller minorities of the hashrate).

If instead the PoS is using its self-referential entropy (i.e. nothing-at-stake), there can be ambiguity for PoW miners over which PoS block to build on, which can cause a divergence of PoW away from consensus to multiple competing partial orders.

As for removing the catastrophic PoS, it is an incorrect presumption that there can ever be any PoW algorithm (even hybrid) that can't be optimized by economies-of-scale. I covered this in more detail in my white paper, but here was an early version of a pertinent portion.

Quote from: iamnotback on November 10, 2016, 07:10:04 PM

...

Proof-of-Work as Space Heaters Belies Economics of Specialization

Specialization enables economies-of-scale.

An example of an erroneous posited caveat[4] that proof-of-work mining resources would not become power-law distribution centralized due to the posited high electrical cost of dissipating heat in centralized mining farms coupled with the posited free electricity cost of using the waste heat of ASIC mining equipment as space heaters, is (in hindsight) incorrect because:

Two-phase immersion cooling is 4000 times more efficient at removing heat from high-power density data centers[5], reducing the 30 - 50% electricity overhead to 1%[6].
Electricity proximate to hydroelectric generation or subsidized electriciy costs approximately 50 - 75% less than the average electricity cost.
Heating is rarely needed year-round, 24 hours daily, at full output. Not running mining hardware at full output continuously renders its purchase cost depreciation much less economic because the systemic hashrate is always increasing and (because) ASIC efficiency is always increasing[7]. The posited purchase of obsolete mining equipment[8] is incorrect because `MR = MC` so a combination of increased demand for obsolete mining raising its price and weighted profit at the margins increasing thus increasing the mining difficulty so that savings due to waste heat is offset. Closer to home, to make it profitable enough to be worthwhile (to justify the pita of jerryrigging a space heater for equipment not designed for the purpose) requires running so many 10s or 100s of kWH of relatively much less efficient (i.e. obsolete) hardware generating more heat than can be typically utilized (unless infernos are in sufficient decentralized demand).

Proof-of-Work on CPUs Belies Economics of Specialization

The posited caveat[4] that mining on general use computers (as a refutation of the power-law distribution of resources) would be economically viable if ASICs are not more efficient than (H + E) / E (even factoring that E might be pyschologically 0 because it is obscured in monthly variability of the electric bill) falls away at least because of the transition to power efficient (battery powered or fanless) devices which don't consume enough electricity to provide enough security for a longest-chain-rule blockchain even if millions of said devices were mining[9]. Or more generally because the portion of the general use computers' cost which represents circuits applicable to proof-of-work computation is equivalently too small.

[4] https://blog.ethereum.org/2014/06/19/mining/
[5] http://www.allied-control.com/immersion-cooling
[6] http://www.allied-control.com/publications/Analysis_of_Large-Scale_Bitcoin_Mining_Operations.pdf#page=9
[7] https://www.reddit.com/r/Bitcoin/comments/335107/i_am_thinking_of_using_a_bitcoin_miner_to_heat_my/
[8] https://bitcointalk.org/index.php?topic=918758.msg10109255#msg10109255
https://bitcointalk.org/index.php?topic=1527954.msg16816538#msg16816538
[9] https://bitcointalk.org/index.php?topic=1361602.msg15553037#msg15553037

I don't want to waste time analyzing Theymos's proposal very mathematically and exhaustively, because my intuitive understanding is it is very insecure.

Unfortunately he has probably incentivized someone to go hype an altcoin on this insecure concept, proclaiming that it was endorsed by Theymos.