Eve said Bob isn't available right now.  You can just give any private information to her and she'll be sure Alice gets it!

1. Bitcoin will always have "fees" too unless it changes its very inefficient coin security model.  It currently costs $150,000 a day just in electricity (not including other costs) to secure Bitcoin.  These costs are being paid by the users and miners of the coin.  Unless the profits of the miners cover their cost of mining, Bitcoin cannot exist.  So Bitcoin will continue to have either mining profits (a form of fee similar to dollar inflation) or transaction fees in the future, which may even exceed those of credit cards.
2. Ripple has less fees becauses it uses a consensus model with a small number of computers to process transactions, so it doesn't consume all the electricity of Bitcoin and can afford to be profitable with very low fees.
3. Ripple is not a scam.  However, it is similar to other coins that have been considered scams, because it is 100% pre-mined.  In the past, coins that were even partly pre-mined were considered scams because the miners thought it was unfair that they are paying for high costs of equipment and electricity to compete against others who already took the best benefits of pre-mining for themselves.  However, Ripple simply uses a different security model that doesn't involve mining, so their reflexively labeling it a scam is not insightful.  They are biased and prejudiced, and too quick to judge based on their other experiences.  Ripple is not a fly-by-night scamcoin, but a serious effort backed by big names and good money.  It is no more a scam than a stock market offering, where the company keeps a lot of stock for themselves while selling off a portion to the general public.  All companies do this.  Ripple is a for-profit enterprise, not a pure community-based coin, but it is not a scam.

Truely this is the greatest coin evar.  After LoliCoin, there can be no moar!  

Thinking about proof-of-work-history (POWH) some more.  I think it could make the coin more efficient as well as more secure.

If a branch is characterized by higher scores, it is a more valid branch and not an attacker.  Likewise, if a block within the branch is characterized by a high score (because those mining the block have been mining the coin longer), then you can reduce the difficulty required to accept that block, because those producing the block are more trustworthy.  This reduces the energy needed to secure the coin over time.

Furthermore, stronger protection against 51% attack means that if mining happens to be reduced for whatever reason in the long run, the coin will still be reasonable secure.  That allows long-term energy efficiency with adequate security even for small coins.

That's true, he is making a black-and-white argument, where I am making a more probabalistic or practical argument.  The agreement system of checkpointing is a working agreement system, it just has different practical characteristics than Bitcoin so I don't consider it as a possible stand-alone protocol.  It lacks the strength of the original.

Also I see what you're saying about the developers.  They could either displease the majority of users, resulting in a permanent fork, or a schism could arise among the developers themselves, also resulting in a permanent fork, although they would have to be convincing to drag a significant number of users with them.  So far this has not happened.  In all of the forks in the open source world, I don't personally recall any that actually destroyed their project.

This reminds me of some new features introduced into Gnome/Ubuntu, that a loud minority of users rejected, or else the split of OpenOffice into LibreOffice.  While somewhat damaging, the community did survive.

I think there is a possible flaw in the Ben Laurie paper on Bitcoin, called "Decentralized Currencies are Probably Impossible, But Let's At Least Make Them Efficient" (http://www.links.org/files/decentralised-currencies.pdf).

If I may summarize his argument:
1. Bitcoin is inefficient, because it may require as much as 51% of the world's computer power to protect against a 51% attack.
2. Bitcoin solves this problem by doing periodic checkpoints, which are snapshots of the currency at a point in time beyond which its history cannot be rolled back.
3. These checkpoints use some other form of consensus which is more efficient than Bitcoin, but still secure and presumably decentralized, otherwise Bitcoin is not secure and decentralized.
4. He calls this hypothetical checkpointing mechanism "efficient unbounded agreement", and then claims that a more efficient coin than Bitcoin can be built on the basis of that mechanism alone.

The flaw in his argument, it seems to me, lies in assuming that the efficient unbounded agreement mechanism can somehow be separated from Bitcoin as a separate standalone protocol.  Checkpointing is merely freezing Bitcoin at a moment in time and refusing to roll back any transactions before that time.  Checkpointing relies on the assumption that the original Bitcoin proof-of-work is robust and secure, so that it is quite unlikely that a sustained attack can be made longer than a given period of time on the original Bitcoin protocol, thus it is presumed safe to checkpoint after that time.

However, checkpointing is only a secondary protocol that is not capable of standing on its own as the basis for a coin.  Checkpointing is merely a secondary validation of a primary security model.  Thus his conclusion, which essentially seems to say that we should throw out the Bitcoin and keep the checkpointing, is false and unworkable.

An analogy might be made with credit card security.  Imagine that credit cards have all their existing security mechanisms, plus you can't do chargebacks after 30 days.  An analogy to Ben Laurie's argument would be claiming that you can do away with all other card security and simply refuse to accept chargebacks after 30 days, and that would be just as secure as before.  That of course would be false, since a limit on chargebacks would just be a secondary security mechanism that can't stand on its own.

I bring this up because the PPCoin paper references this paper and seems to rely on it (http://www.ppcoin.org/static/ppcoin-paper.pdf).  Elsewhere I have attempted to criticize PPCoin as well, along slightly different lines (an effort that I am still working on -- see https://bitcointalk.org/index.php?topic=202573.0).

I am not implying that it is impossible to make a more efficient coin than Bitcoin.  Also, I am not implying that PPCoin is insecure simply because it references that paper.  However, I did want to point out the apparent flaws in that paper's arguments, which if genuine, imply that it should not be relied on.

Duplicate post... I'm pretty sure I'm already mining this one.

How about calling it "NNAA is Not An Altcoin", or just "NNAA" for short?  Surely that will silence the critics! 

1. Probably someone will be mining.
2. $25,000 ASICs have about the same cost of MHash/s/$ as the cheaper ASICs.  See https://en.bitcoin.it/wiki/Mining_hardware_comparison.  So it's not true that you have to buy $25,000 of mining equipment just to get in.  $1,000 or even $250 will buy you a stake at the table with the same proportional ROI as the bigger miners.
3. Maybe a little.  ASICs are a challenge mostly to non-ASICs.  On the other hand, as specialized equipment they make Bitcoin mining more energy efficient, which is good in a way, even though it reduces the profit per MHash since the MHash of the network increases greatly with no corresponding increase in mining rewards.

Also, you can mine with your own GPU.  The pools just make payouts more steady, as I understand it.  Otherwise you might wait months between payouts.  If you want to mine GPU, you should probably be mining Litecoin or one of its derivatives, not Bitcoin.

Think of my suggestion #3 as "proof of history of work."  It is better than proof-of-work because it accumulates history over time of who has done all the work and thus is not subject to sudden takeover.  The longer the network runs, the more resistant it becomes to takeover, since the older miners become trusted, not based on how many coins they own, but how much mining they have done.

In Meni's implementation, weights are given for those who sign special signature blocks.  The weight varies from 0 to their number of coins based on his formulas.  However, his formula seems unnecessary to me.  Why not just base it on the number of coins?  There is almost no difference.  Having a hybrid system means a person would have to accumulate 51% of the coins and 51% of the hashrate.  It's only slightly stronger than the original.  Plus you can't tell when someone is about to combine their coin pile and start an attack.

However, my suggestion assigns a weight based on the number of blocks that miner has successfully helped mine in the past.  That is a different, stronger approach.

There have currently been 235,804 blocks mined in Bitcoin.  If I had been present from the beginning and had helped mine 10% of those blocks, I would have a weight of 23,580.  This is a strong proof of stake (actually, proof of history of work) that always increases over time.  It is a record of all the computer work that I have thrown at bitcoin.

When comparing two different branches, you add up the scores of everyone signing the branch, not just the branch length.  If I sign branch A, and it has 5 blocks, each block has my weight added to it, for a total weight of 23,580 * 5 = 117,900.

An attacker who wants to create branch B would have to create a branch with more weight.  If he is new on the network, he has a weight of 1.  He would have to create a branch that is 117,900 blocks long to overpower the valid branch!

This type of network offers far stronger protection than the 51% hashrate attack of Bitcoin or the 51% hashrate/51% stake combined approach.  The attacker would have to be someone who can override not just the present hashrate of the coin, but the sum of the the entire history of hashrate of the coin.  This is virtually impossible.

That's an interesting variation.  However, the formula could use a little tweaking.  After only 10 days, your coins have already attained 99.99546% of their stake.  This system then is not very different than my suggestion #1, just using the amount of coins as the measurement of stake.  However, I think my suggested system #3 is stronger.  It is something like Meni's Implementation of a Proof of Stake system (https://en.bitcoin.it/wiki/Proof_of_Stake#Meni.27s_implementation).

2. Couldn't you design the coin so they are identified by their public key in the blockchain?

Also, your example doesn't make sense to me.  The days are an unnecessary addition.  Throw the day measurement out entirely and you get the same results.  100 coins > 10 coins.  Age doesn't matter.

I've been thinking about PPCoin.  While I like the idea of combining Proof-of-Work with Proof-of-Stake to save energy, I think maybe PPCoin is doing it wrong.

The measurement of stake that PPCoin uses is "coin-days", the age of your coin since it was last spent.  That is not actually measuring stake.  If I have 100 coins and let them mellow for 10 days, I don't have 10 times as much stake as I did on the first day.  I still just have 100 coins, exactly the same stake as on the first day.  Letting coins age requires no effort or energy to be expended.  Thus, rewarding someone for the age of their coin is nonsense.

Imagine if we treated currency that way.  "I have two $100 bills in my wallet.  I've kept the first one for 100 days, but I've received the second one only yesterday.  Obviously, the fact that the first $100 has been sitting there makes it more trustworthy."  The age of the bills in my wallet does not measure their validity.

As an experiment, imagine that the average age of a PPCoin is 10 days (this experiment assumes coin age is unlimited, although I think it may be limited in practice).  Assume that there are a total of 1,000 PPCoins coins in the whole world as a simplified example.  As an attacker, I acquire 1/10 of the available coins (in this example, 100 coins) and let them age 100 days.  My coin age = 100 days * 100 coins = 10,000 coin-days.  The rest of the network has 900 coins * 10 days = 9,000 coin days.  It looks like my ageing the coins just gives me free leverage to take over the network.  Since it doesn't reflect any actual additional stake being invested in the coin, it actually weakens it rather than strengthening it.

Furthermore, spending the coins arbitrarily destroys their coin age, which doesn't make sense either.  Both the buyer and seller of a pile of coins value them equally -- why does one have a lot more stake than the other?  This also reduces the incentive to spend the coins.

A proof-of-stake coin should actually measure stake!  Age of a coin is not an investment because it costs them nothing, and it is not a stake.  Just because you can measure something, like coin age, does not make it important.

How to fix, if this is indeed a problem?  Don't know, cause I'm not a coin designer.  My guesses:
1. Use amount of coins as a measurement of stake rather than coin-days.  That way, a person would have to acquire 51% of the coins to execute an attack, without the free leverage added by coin age.
2. Use amount of coins times the age of the person in the network not the age of the coin.  That is, measure the number of blocks they have helped mine and weight their amount of coins by that as a measure of their trustworthiness.  Not sure if or how to accomplish this.  However, it has the benefit that they can buy and sell coins freely without diminishing their stake in the network.
3. Ignore amount of coins and use the number of blocks the person has helped mine as a measure of their trustworthiness.  This would reward durability of mining, which unlike coin age is actually a measurement of stake.  Call it mining-days rather than coin-days.

Imagine that 1,000 people have equal computer power and mine the coin every day for one year.  That is 1,000 mining-years.  A new person who wanted to overtake the network would not just have to muster 51% of the network, but would have to do so until his total contribution was more than the rest of them put together.  To exceed the rest of them in the second year, the attacker would have to provide 2,000 mining years in one year all by himself just to exceed their combined, growing stake.  Since he only has 1 year to do it in, he has to muster 2,000 times the capacity of the rest of the network combined.  At least that is how I imagine it.

Well, comments?

XRP has a consensus model, not a proof-of-work mining model like Bitcoin that uses mining to distribute the coins.  It would be an interesting problem to somehow combine the two.  If a consensus model distributed coins to miners, that would seem to imply that only those who are part of the consensus would received the mined coins, which would also seem to not be fair.  As a future exercise, it might be interesting to create a coin that allows a consensus to build among any interested parties that still uses the virtue of distributing the coin through mining.

It's not that hard to open source something.  If they say they are going to open-source it, they probably will.  Bitcoin took a couple of years to develop before its release as well.  Just give it some time.

LOL... that's fine with me. 

I thought OP raised some good points.  In addition, as a non-mined system, OpenCoin costs much less to run.  Bitcoin costs $150,000 in electricity per day just to keep it secure.  Less cost for OpenCoin means more profits.

Also, I read that Satoshi could profit enormously from Bitcoin as well.  His share of Bitcoins has been estimated at 1 million coins.  That's not chicken feed.

Finally, by putting a business-like appearance and accountability on their currency, OpenCoin can easily score a better reputation than Bitcoin with the general public, which is not interested in experimental currencies or in buying drugs on Silk Road etc.

What an excellent idea.  Tell me, what is your TrollCoin wallet, I would like to send you 100 TrollCoins to honor your subtle advancement of the artistry of TROLL!!!  Or are you just pudding me on... 

I understand how you might not be interested, but it wasn't proposed "just for the hell of it", but rather to decide relevant group standards and allow them to submit disputes to binding arbitration.  This would be used for things that matter, such as contract enforcement, not trivialities.  This concept is no more arbitrary than Bitcoin is arbitrary.  You as a sovereign individual can pretend that your notion of value is what matters, and that's fine, but look what happens when a group of people voluntarily decide on a shared notion of value -- that is Bitcoin, and it is not a waste of time!

Based on this discussion, I hereby propose a new country of the Internet, to be called "Bitland".
* What is it?  Open source, libertarian, democratic goverment of the Internet, similar to the way that Bitcoin (and the altcoins) are.
* Why is it needed?  To have an explicit, codified set of principles for governance of the Bitcoin community and its interactions, particularly business transactions.
* How can a government exist without land?  Yes, but how can a currency exist without an army?  It does so based on its attractiveness, by the willing participation of its members without the use of force.
* How does Bitland collect taxes?  It doesn't, it runs on donations for any necessary expenses.
* What does the government consist of?  A constitution, bill of rights, and set of laws that can be forked, modified, and improved, just like the Bitcoin software can be forked.
* How to start it?  Use a wiki to write the constitution and bill of rights.  Everyone votes.  90% acceptance means the constitution is valid.  90% vote needed to amend it.
* How to create laws?  Anyone can write a proposed law.  Summon a representative assembly and vote, with 2/3 majority needed for acceptance.
* How to become a citizen?  Either you are one of the 90% who voted for the constitution, or you swear to obey the constitution and laws and are admitted by a jury of citizens.
* How to quit from Bitland?  The same way you joined, only you repudiate your citizenship and your repudiation is acknowledged by a jury of citizens.
* How does Bitland regulate the activity of non-Bitlanders?  It doesn't, it only has jurisdiction over those who voluntarily agree to follow its laws.

Imagine that we create a new Internet government called the Free, Independent People of Bitland (FIPB).  What's the point?  Well, for starters, when you're doing international transactions, who has jurisdiction?  We need a lightweight, instant, Internet government that can play a binding role in judging Bitcoin disputes.  That way, someone doing business in Bitcoin can say, "I am a citizen of FIPB" or "I am a Bitlander" and you automatically know what common rules are expected.  If someone steals your coins, or doesn't deliver your product, or misbehaves generally contrary to the laws of Bitland, you can bring charges and summon up a jury of their peers, who can decide between them in a legally binding arbitration, thus avoiding the slowness, messiness, and jurisdictional disputes of existing governments.  If anyone refuses to accept the results of arbitration, they can be fined or expelled.

Later on, if the Bitland concept becomes popular, you can worry about obtaining real estate.