Quote from: iruu on May 21, 2014, 03:09:51 AM

Proof of work is significantly inferior than proof of stake, for several reasons.
1. Centralization. Just look at the distribution of hash power. The problem is that mining has almost infinite economies of scale, logically leading to complete centralization eventually, ie. one mining actor. Had a powerful state wanted to destroy bitcoin, raiding a few mining farms is already trivial and cheap. The security of bitcoin depends on lack of political will.

There are no economies of scale in PoS. There can be in some PoS implementations, but it's not characteristic of all PoS.

2. Low and very expensive security. The miner doesn't have any economic interest in the currency per se, only in daily miners' revenue (new coins + fees). If at some point expected return on capital from acting against currency is higher than expected future miners' revenue, rational miner will become hostile.
This is a much more serious problem if it's possible to rent vast amount of hash power, because then the costs for the attacker are drastically smaller.

Thus, on a perfect market with renting, the price for control of pow coin for time t is just a tiny bit more expensive than half of miners' revenue in time t. Hard to say what's the time required to significantly profit from damage, probably by using derivatives on coin's price. A day?

In comparison, attacking Proof of Stake currency requires losing the value of >50% of coin's market cap, which is a much bigger number than half of daily mining reveneus. PoS currency is much, much safer.

Quote from: DeathAndTaxes on May 15, 2014, 08:42:49 PM

You misunderstand. The risk isn't that someone could attack the network, it is that they could attack the network with no cost.

Imagine bitcoin worked using a PoS. An early adopter had acquired 1M BTC at one time in the past but over time he lost/sold/spent/transferred them. Today he has no bitcoins but the blockchain contains a history of a time when he did have 1M BTC. If the amount of the stake being used is <1M BTC he could rewrite history not by using coins he has today (a real cost), not by buying millions of mining rigs (a real cost) but by using the history of the coins he once had (no cost). He has absolutely nothing at risk and nothing to lose. If he and potentially others decided to attack the network they would rewrite the blockchain starting from when they had a larger stake, creating a parallel history where they didn't lose/sell/spend/transfer the coins.

They can attack the network based on what they had (but no longer do) in the past. There is nothing at risk and no cost to the attack. THAT is the PoS problem.

That only works for the attackers which collectively owned 100% of coins at one point in time (one block), because otherwise, if at any point foreign coins are present, the stake of their blockchain is lower and their attack fails.

It's very important that PoS doesn't allow one to replay transactions from different blockchain into another one, otherwise it's indeed theoretically possible to buy different coins, sell them, then buy another different coins, and then replay all those transactions in a false block.
Note that attackers, by the act of selling their coins, confirm the true blockchain. Situation:

A sells all 99% of all coins on block x in chain A, effectively affirming this blockchain's validity as of block x-1.
Now A wants to rewrite the history, he creates block x without his transaction.
If he's the only forger and there are no transactions, the blockchains, up to and including x, are equal in validity, with 99% of stake behind them. After x, he can create new blocks in fake blockchain, the buyer can create blocks in true blockchain.
However, if in true blockchain in block x or at any point later there's another stake involved, even a minuscule amount, his fake blockchain loses. A block x with 99% of stake followed with block x+y with 0.5% of stake means that block x is confirmed by 99.5% of stake.
A can't do anything.

This invalidates the "nothing at stake" argument. Attacks are not free. You need to own the majority of stake, because creating a transaction confirms the blockchain.

I'm sort of afraid that one of badly designed PoS currencies will be attacked by the way you described sooner or later, which will cause everyone to think that it's the fault of PoS in general.

Quote from: AnonyMint on May 02, 2014, 01:58:20 AM

Proof-of-stake will never remain decentralized:

https://bitcointalk.org/index.php?topic=558316.msg6501774#msg6501774

Send all proof-of-stake currencies to the trashcan.

Quote

any system that attempts to replace proof-of-work will rely on some form of reputation, and reputation is centralization

The amount of stake isn't reputation.

Quote

The most significant flaw of any proof-of-stake system and any system that diminishes coin rewards, is it can't distribute currency from the hoarders to the users of the currency, thus it will end up with the hoarders (the banksters) accumulating all the coin and the currency usage dying.

Proof of stake is a system for achieving consensus as to the state of balances. A proof of stake currency can have PoW method of distribution which plays no other role. Or any other method.

I think you're going to have to do better than this before you can claim to have solved the nothing at stake problem.

You're saying that Alice who sold 99% stake to Bob would have her chain outcompeted by someone transacting with .5% share on top of Bob's chain, presumably because Bob would wait for confirmations before accepting the transaction, while others are building on top of it.

But what about when Alice owns 30% stake, sells it, and secretly has another 30% stake waiting in the wings.
The fact is you don't know how much stake an attacker has, (how much of their stake is going into the attack).