Quote from: spinoff on November 25, 2013, 02:05:30 PM

no one in all these years, despite the huge incentive, has found any flaw in it

Not so, there were quite a few serious flaws in it. We've fixed them over time and repaired the damage. OP_RETURN in a scriptSig originally let you spend anyone's coin "No need to check the rules, let me by!" value overflow let anyone summon a billion bitcoins out of thin air, the hash tree second preimage let anyone pick a block and doom it on the network, lshift (and related bugs): corrupt the memory of and crash all the nodes, duplicate transaction IDs with inconsistent rewrites left the chain vulnerable to irreconcilable forks between old and newly bootstrapped nodes. I'm sure I'm missing quite a few other deep protocol issues, plus a litany of more conventional bugs, memory leaks, and (serious) performance shortcomings.

As impressive as Bitcoin was on its first day it was far from perfect atypically reliable for such new and novel software, perhaps, but it had to be. Regardless of the original being the work of just one person or more than one it has taken many people to get it to what it is today.

Quote

A more detailed fact contributes to my skepticism: are we so sure that having *every* transaction recorded and public is really a good thing? [...] So bitcoin would actually be the exact opposite of anonymity.

No, it's not a good thing and I expect that Satoshi would have agreed that its not good. But it's the thing we can do. Bitcoin was already pushing the envelope of the kind of system that can be engineered (esp. when you start talking about making compatible alt. implementations) and at the time there was really no prospect of building a system that accomplished the goals without the public verification. It's not even completely clear yet if Bitcoin itself is fully viable, if transactions were a bit more expensive to store or validate, if the software was a bit more complex to author and maintain perhaps Bitcoin would be a big mess of failure, perhaps it still will.

Only very recently has the very cutting edge of computer science and cryptography e.g. things like Groth's 2010 paper and Gennaro, Gentry, Parno, and Raykova's 2012 improved system suggested that we could build succinct zero-knowledge argument systems with performance and space requirements not so far off from what Bitcoin uses today that we could even _consider_ the possibility of privacy stronger than Bitcoin's pseudo-anonymity in a zero-trust fully decentralized system. And this is real rocket science stuff, layer after layer of idea that was only conceived of in the last decade or two, while Bitcoin can be pretty completely grasped and trusted by someone with a conventional, industry level, understanding of information technology... and could have been implemented with 1970s computer science (though not with acceptable performance on 1970s hardware we're hardly keeping up as is).