Quote from: monsterer2 on January 26, 2018, 11:34:22 AM

Quote

But that's all that is needed; order. Not "real world time". Of course, IF you tag real world time to transactions, you automatically get an ordering. And IF you tag real world time to consensus pictures, they are of course also automatically ordered. But it is not a necessary condition.

Trustless ordering cannot occur without a unforgeable proxy for elapsed time.

The order doesn't need to be the one of real time. Any order is good enough from the moment that it is an order. Any set can be ordered. One simply needs a consensus on the order, that's all.

And then there is of course obvious "real time ordering" on the long term. The problem with all these false attacks is that one wants a system that can prove to a newcomer that it was ordered in real time before. That's not needed. A newcomer just accepts the next consensus, without asking questions about the past. It is to a newcomer, as if the starting point, the "genesis block" if you want bitcoin speak, was published at the next consensus he will be aware of, and needs to accept that. There's no need to dig into the past.

And yes, of course, once you're in the system, you have to remain attentive to the new consensus decisions. If you're absent (if you are a long time off line), you cannot say anything. You accept the new truth when you're online again, as if you were a newcomer. Of course you have to stay on line, or trust your peers the time you're absent. It is a silly idea to want to be able to prove to you that during your absence, everything happened according to the rules.

So the long-term real-time order is evident, because you were there, or you accept the truth from those that were there. There's no way we will come back to the consensus decisions of yesterday. Wanting to prove that, is what makes all these things difficult for no reason. The consensus of yesterday is fixed once and for all, simply because you were there. You're not going to wind back. The consensus of today can still be discussed, but by tomorrow, that one will be fixed forever. Simply by those that were online. The only thing that is needed for this to come to global consensus, is that there's sufficient communication between all participants during a lapse of one day. Well, that is obviously the case. There won't be a "split of the internet in large chunks for more than a few hours", so there won't, for all practical purposes, be entirely different histories when they are connected back ; and if there are, there's a simple rule to decide which one is to be accepted, on the basis of a pseudo-random number.

As I said, one is making this thing much more complicated on the grounds of unrealistic requirements, such as the need to prove that the system behaved well in the long past. For all practical purposes, nobody cares. Everyone accepts the state of yesterday, no matter how it got there, like everyone accepts what was printed in the newspaper yesterday, as being the thing that was printed in the newspaper yesterday. We're not going to accept to re-write history "if we were there", and the others shouldn't care. If you weren't there, you shouldn't have anything to say. So it is normal that only those on-line decide about how this is advancing, and there, real-time order is evident if it is slow enough to account for every form of network delay. You can think that one day is good enough. Which is why there isn't any difficulty to consider that day by day, there are historical points of no return. The block chain starts yesterday. Every day. How it got there, is of no importance any more.

Quote

Quote

In order to avoid this, one needs to make sure that nobody is accumulating hardware capacity without using it. Bitcoin is only protected if one can make sure nobody has a significant amount of unused hardware. If one has a huge pile of unused hardware, one can switch it on and outperform the existing system with not much more proof of work than was put into it.

So bitcoin's ultimate protection is not by proof of work, but by proof-of-non-existence-of-unused-hardware. See, the attack of piling up unused hardware is obvious in PoW.

No one piles up unused hardware because there exists a competition to mine; mining is, on average, more profitable than attacking the network, that is the key of why PoW is superior to PoS.

That is an assumption about the attacker that you shouldn't make. Of course, *within the system*, mining correctly is mostly profitable. Not because of technical reasons, but because otherwise, you crash the market. However, for an external attacker, you cannot know what are the motives. As I said, piling up hardware without using it, and hence, without pushing up the difficulty, can be profitable if the market wouldn't crash. When you orphan a big chunk of chain, you do not increase the difficulty, and you do reap in the block rewards of the chain you redo. It may be profitable to buy hardware and pile it up (or just rent it) to do such an attack, rather than to pump up the difficulty by competing. I think that the past total cost of bitcoin's yearly mining was about $2 billion. Let us assume that $1 billion is in hardware costs, and $1 billion in mining costs. Suppose now that an attacker piles up for $3 billion worth of mining equipment. He has hence 3 times the total hash power of bitcoin. However, he will use that hardware to redo last year's chain. Yes, the whole last year's chain. That will take him grossly 3-4 months to do so, while nobody knows about it. He will use about the same amount of energy to do so, which is grossly in our case, $1 billion (the total mining cost last year was $2 billion, we put $1 billion in hardware, and $1 billion in energy). So his total cost is $4 billion. But now he publishes his chain, orphans the 1 year + 4 months of previous block chain, and hence reaps in the 60 000 block's rewards plus fees, and all reversals of all payments he did last year. At the current price of bitcoin, $10 000, that would bring him already $9 billion of profits from the rewards only. Add to that reversed transactions and all other things he can do with rewriting history and he's a winner.

Of course, in reality, bitcoin would be done. So, for a total cost of $4 billion, someone external to the system can bring the whole thing down by redoing a whole year worth of history. But even better now. Suppose the guy shorts bitcoin for $20 billion in cash. I think his $ 4 billion are well-spent.

Quote

Quote

That really depends on the PoS algorithm. It would be a stupid algorithm that doesn't allow staking.

No it doesn't depend on the PoS algorithm; block producers are elected by stake, and to prevent that election happening repeatedly as stake moves around (creating attack vectors), stake must be bonded in some way by preventing new blocks from being produced right away. So if you send your stake to yourself, you're subject to that bonding period. If everyone does that, no one can produce a block and the network stalls, forever.

You cannot elect a block producer by stake, because you don't know if he's willing to stake. You simply give an ordering those that do stake, to decide which one of the proposed competing consensus solutions is to be accepted. If there's only one node online, of course that node will do all consensus decisions by himself repeatedly. Any other design would be crazy. If you are the genesis block creator, of course you stake all by yourself all the time until you have sent coins to someone else. How could a PoS system even bootstrap if what you say is unavoidable ? If you did recently stake, of course, that diminishes your priority to stake. But if you are the only one, of course, even low priority, you can stake. It is just that if there is a higher staker on the list that stakes, this one is to be preferred to stake on top. So the NEXT staker is going to stake on top of the highest priority staker that did stake. In case there is, because of network delays, a split that goes further than one last staker, another algorithm determines the FORK priority, which is cumulative over the different blocks, and indicates what prong the next staker should prefer. A priori, the only way in which there can be a split is when two different stakers decide to stake within the time lapse of network propagation time between them ; the "ping" say. When the chain splits because of this, most nodes will be aware of it within a few times the network propagation time. The idea is that if such a split occurs, then all participants wait for a few times the network propagation delay to make sure everyone has the two prongs before continuing. An algorithm them makes clear which of the prongs is to be continued. If ever one finds out that two prongs continue to exist, the waiting time is doubled before staking. When it is seen that the right prong grows, the waiting time is diminished again.

Again, there shouldn't be staker rewards, it should be a voluntary and altruistic act "of confirmation of mempool" and of "random choice of double spends received up to a point". This avoids continuous staking on the losing prong with the hopes that it will take over. If your transaction is within a single consensus which is old enough, and you haven't seen a competing prong, and you get from your on-line peers sufficient confirmation that they haven't seen any, then you can start to assume that your transaction has gotten into the irreversible consensus.