Long-term mining incentives
37 messages, 11 to 28 May 2015. Started by Thomas Voegtlin.
Aaron Voisine (5), Thomas Voegtlin (4), Gavin Andresen (4), Tier Nolan (3), Alex Mizrahi (3), Mike Hearn (3), Pedro Worcel (2), Jorge Timón (2), +10 more
The discussion on block size increase has brought some attention to the other elephant in the room: Long-term mining incentives.
Bitcoin derives its current market value from the assumption that a stable, steady-state regime will be reached in the future, where miners have an incentive to keep mining to protect the network. Such a steady state regime does not exist today, because miners get most of their reward from the block subsidy, which will progressively be removed.
Thus, today's 3 billion USD question is the following: Will a steady state regime be reached in the future? Can such a regime exist? What are the necessary conditions for its existence?
Satoshi's paper suggests that this may be achieved through miner fees. Quite a few people seem to take this for granted, and are working to make it happen (developing cpfp and replace-by-fee). This explains part of the opposition to raising the block size limit; some people would like to see some fee pressure building up first, in order to get closer to a regime where miners are incentivised by transaction fees instead of block subsidy. Indeed, the emergence of a working fee market would be extremely reassuring for the long-term viability of bitcoin. So, the thinking goes, by raising the block size limit, we would be postponing a crucial reality check. We would be buying time, at the expenses of Bitcoin's decentralization.
OTOH, proponents of a block size increase have a very good point: if the block size is not raised soon, Bitcoin is going to enter a new, unknown and potentially harmful regime. In the current regime, almost all transaction get confirmed quickly, and fee pressure does not exist. Mike Hearn suggested that, when blocks reach full capacity and users start to experience confirmation delays and confirmation uncertainty, users will simply go away and stop using Bitcoin. To me, that outcome sounds very plausible indeed. Thus, proponents of the block size increase are conservative; they are trying to preserve the current regime, which is known to work, instead of letting the network enter uncharted territory.
My problem is that this seems to lacks a vision. If the maximal block size is increased only to buy time, or because some people think that 7 tps is not enough to compete with VISA, then I guess it would be healthier to try and develop off-chain infrastructure first, such as the Lightning network.
OTOH, I also fail to see evidence that a limited block capacity will lead to a functional fee market, able to sustain a steady state. A functional market requires well-informed participants who make rational choices and accept the outcomes of their choices. That is not the case today, and to believe that it will magically happen because blocks start to reach full capacity sounds a lot like like wishful thinking.
So here is my question, to both proponents and opponents of a block size increase: What steady-state regime do you envision for Bitcoin, and what is is your plan to get there? More specifically, how will the steady-state regime look like? Will users experience fee pressure and delays, or will it look more like a scaled up version of what we enjoy today? Should fee pressure be increased jointly with subsidy decrease, or as soon as possible, or never? What incentives will exist for miners once the subsidy is gone? Will miners have an incentive to permanently fork off the last block and capture its fees? Do you expect Bitcoin to work because miners are altruistic/selfish/honest/caring?
A clear vision would be welcome.
On 2015-05-11 16:28, Thomas Voegtlin wrote:
Quoted text (6 lines)
> My problem is that this seems to lacks a vision. If the maximal block > size is increased only to buy time, or because some people think that 7 > tps is not enough to compete with VISA, then I guess it would be > healthier to try and develop off-chain infrastructure first, such as > the > Lightning network.
If your end goal is "compete with VISA" you might as well just give up and go home right now. There's lots of terrible proposals where people try to demonstrate that so many hundred thousand transactions a second are possible if we just make the block size 500GB. In the real world with physical limits, you literally can not verify more than a few thousand ECDSA signatures a second on a CPU core. The tradeoff taken in Bitcoin is that the signatures are pretty small, but they are also slow to verify on any sort of scale. There's no way competing with a centralised entity using on-chain transactions is even a sane goal.
I think long-term the chain will not be secured purely by proof-of-work. I think when the Bitcoin network was tiny running solely on people's home computers proof-of-work was the right way to secure the chain, and the only fair way to both secure the chain and distribute the coins.
See https://gist.github.com/gavinandresen/630d4a6c24ac6144482a for some half-baked thoughts along those lines. I don't think proof-of-work is the last word in distributed consensus (I also don't think any alternatives are anywhere near ready to deploy, but they might be in ten years).
I also think it is premature to worry about what will happen in twenty or thirty years when the block subsidy is insignificant. A lot will happen in the next twenty years. I could spin a vision of what will secure the chain in twenty years, but I'd put a low probability on that vision actually turning out to be correct.
That is why I keep saying Bitcoin is an experiment. But I also believe that the incentives are correct, and there are a lot of very motivated, smart, hard-working people who will make it work. When you're talking about trying to predict what will happen decades from now, I think that is the best you can (honestly) do.
Thank you for your answer.
I agree that a lot of things will change, and I am not asking for a prediction of technological developments; prediction is certainly impossible. What I would like to have is some sort of reference scenario for the future of Bitcoin. Something a bit like the Standard Model in Physics. The reference scenario should not be a prediction of the future, that's not the point. In fact, it will have to be updated everytime technological evolutions or code changes render it obsolete.
However, the reference scenario should be a workable path through the future, using today's technologies and today's knowlegde, and including all planned code changes. It should be, as much as possible, amenable to quantitative analysis. It could be used to justify controversial decisions such as a hard fork.
Your proposal of a block size increase would be much stronger if it came with such a scenario. It would show that you know where you are going.
Le 11/05/2015 19:29, Gavin Andresen a écrit :
Quoted text (22 lines)
> I think long-term the chain will not be secured purely by proof-of-work. I > think when the Bitcoin network was tiny running solely on people's home > computers proof-of-work was the right way to secure the chain, and the only > fair way to both secure the chain and distribute the coins. > > See https://gist.github.com/gavinandresen/630d4a6c24ac6144482a for some > half-baked thoughts along those lines. I don't think proof-of-work is the > last word in distributed consensus (I also don't think any alternatives are > anywhere near ready to deploy, but they might be in ten years). > > I also think it is premature to worry about what will happen in twenty or > thirty years when the block subsidy is insignificant. A lot will happen in > the next twenty years. I could spin a vision of what will secure the chain > in twenty years, but I'd put a low probability on that vision actually > turning out to be correct. > > That is why I keep saying Bitcoin is an experiment. But I also believe that > the incentives are correct, and there are a lot of very motivated, smart, > hard-working people who will make it work. When you're talking about trying > to predict what will happen decades from now, I think that is the best you > can (honestly) do. >
Added back the list, I didn't mean to reply privately:
Fair enough, I'll try to find time in the next month or three to write up four plausible future scenarios for how mining incentives might work:
1) Fee-supported with very large blocks containing lots of tiny-fee transactions 2) Proof-of-idle supported (I wish Tadge Dryja would publish his proof-of-idle idea....) 3) Fees purely as transaction-spam-prevention measure, chain security via alternative consensus algorithm (in this scenario there is very little mining). 4) Fee supported with small blocks containing high-fee transactions moving coins to/from sidechains.
Would that be helpful, or do you have some reason for thinking that we should pick just one and focus all of our efforts on making that one scenario happen?
I always think it is better, when possible, not to "bet on one horse."
On Tue, May 12, 2015 at 10:39 AM, Thomas Voegtlin <thomasv@electrum•org> wrote:
Quoted text (16 lines)
> Le 12/05/2015 15:44, Gavin Andresen a écrit : > > Ok, here's my scenario: > > > > https://blog.bitcoinfoundation.org/a-scalability-roadmap/ > > > > It might be wrong. I welcome other people to present their road maps. > > > > [answering to you only because you answered to me and not to the list; > feel free to repost this to the list though] > > Yes, that's exactly the kind of roadmap I am asking for. But your blog > post does not say anything about long term mining incentives, it only > talks about scalability. My point is that we need the same kind of thing > for miners incentives. >
I think proof-of-idle had a potentially serious problem when I last looked at it. The risk is that a largish miner can use everyone else's idle time to construct a very long chain; it's also easy enough for them to make it appear to be the work of a large number of distinct miners. Given that this would allow them to arbitrarily re-mine any block rewards and potentially censor any transactions then that just seems like a huge security hole?
Cheers, Dave
Quoted text (47 lines)
> On 12 May 2015, at 17:10, Gavin Andresen <gavinandresen@gmail•com> wrote: > > Added back the list, I didn't mean to reply privately: > > Fair enough, I'll try to find time in the next month or three to write up four plausible future scenarios for how mining incentives might work: > > 1) Fee-supported with very large blocks containing lots of tiny-fee transactions > 2) Proof-of-idle supported (I wish Tadge Dryja would publish his proof-of-idle idea....) > 3) Fees purely as transaction-spam-prevention measure, chain security via alternative consensus algorithm (in this scenario there is very little mining). > 4) Fee supported with small blocks containing high-fee transactions moving coins to/from sidechains. > > Would that be helpful, or do you have some reason for thinking that we should pick just one and focus all of our efforts on making that one scenario happen? > > I always think it is better, when possible, not to "bet on one horse." > > > On Tue, May 12, 2015 at 10:39 AM, Thomas Voegtlin <thomasv@electrum•org <mailto:thomasv@electrum.org>> wrote: > Le 12/05/2015 15:44, Gavin Andresen a écrit : > > Ok, here's my scenario: > > > > https://blog.bitcoinfoundation.org/a-scalability-roadmap/ <https://blog.bitcoinfoundation.org/a-scalability-roadmap/> > > > > It might be wrong. I welcome other people to present their road maps. > > > > [answering to you only because you answered to me and not to the list; > feel free to repost this to the list though] > > Yes, that's exactly the kind of roadmap I am asking for. But your blog > post does not say anything about long term mining incentives, it only > talks about scalability. My point is that we need the same kind of thing > for miners incentives. > > > > -- > -- > Gavin Andresen > ------------------------------------------------------------------------------ > One dashboard for servers and applications across Physical-Virtual-Cloud > Widest out-of-the-box monitoring support with 50+ applications > Performance metrics, stats and reports that give you Actionable Insights > Deep dive visibility with transaction tracing using APM Insight. > http://ad.doubleclick.net/ddm/clk/290420510;117567292;y_______________________________________________ > Bitcoin-development mailing list > Bitcoin-development@lists•sourceforge•net > https://lists.sourceforge.net/lists/listinfo/bitcoin-development
Disclaimer: I don't know anything about Bitcoin.
Quoted text (1 line)
> 2) Proof-of-idle supported (I wish Tadge Dryja would publish his
proof-of-idle idea....)
Quoted text (1 line)
> 3) Fees purely as transaction-spam-prevention measure, chain security via
alternative consensus algorithm (in this scenario there is very little mining).
I don't understand why you would casually mention moving away from Proof of Work, I thought that was the big breakthrough that made Bitcoin possible at all?
Thanks, Pedro
2015-05-13 4:10 GMT+12:00 Gavin Andresen <gavinandresen@gmail•com>:
Quoted text (62 lines)
> Added back the list, I didn't mean to reply privately: > > Fair enough, I'll try to find time in the next month or three to write up > four plausible future scenarios for how mining incentives might work: > > 1) Fee-supported with very large blocks containing lots of tiny-fee > transactions > > 2) Proof-of-idle supported (I wish Tadge Dryja would publish his > proof-of-idle idea....) > 3) Fees purely as transaction-spam-prevention measure, chain security via > alternative consensus algorithm (in this scenario there is very little > mining). > 4) Fee supported with small blocks containing high-fee transactions moving > coins to/from sidechains. > > Would that be helpful, or do you have some reason for thinking that we > should pick just one and focus all of our efforts on making that one > scenario happen? > > I always think it is better, when possible, not to "bet on one horse." > > > On Tue, May 12, 2015 at 10:39 AM, Thomas Voegtlin <thomasv@electrum•org> > wrote: > >> Le 12/05/2015 15:44, Gavin Andresen a écrit : >> > Ok, here's my scenario: >> > >> > https://blog.bitcoinfoundation.org/a-scalability-roadmap/ >> > >> > It might be wrong. I welcome other people to present their road maps. >> > >> >> [answering to you only because you answered to me and not to the list; >> feel free to repost this to the list though] >> >> Yes, that's exactly the kind of roadmap I am asking for. But your blog >> post does not say anything about long term mining incentives, it only >> talks about scalability. My point is that we need the same kind of thing >> for miners incentives. >> > > > > -- > -- > Gavin Andresen > > > ------------------------------------------------------------------------------ > One dashboard for servers and applications across Physical-Virtual-Cloud > Widest out-of-the-box monitoring support with 50+ applications > Performance metrics, stats and reports that give you Actionable Insights > Deep dive visibility with transaction tracing using APM Insight. > http://ad.doubleclick.net/ddm/clk/290420510;117567292;y > _______________________________________________ > Bitcoin-development mailing list > Bitcoin-development@lists•sourceforge•net > https://lists.sourceforge.net/lists/listinfo/bitcoin-development > >
I think its fair to say no one knows how to make a consensus that works in a decentralised fashion that doesnt weaken the bitcoin security model without proof-of-work for now.
I am presuming Gavin is just saying in the context of not pre-judging the future that maybe in the far future another innovation might be found (or alternatively maybe its not mathematically possible).
Towards that it would be useful to try further to prove this one way or another (prove that proof of stake cant work if that is generically mathematically provable).
Adam
On 12 May 2015 at 14:24, Pedro Worcel <pedro@worcel•com> wrote:
Quoted text (90 lines)
> Disclaimer: I don't know anything about Bitcoin. > >> 2) Proof-of-idle supported (I wish Tadge Dryja would publish his >> proof-of-idle idea....) >> 3) Fees purely as transaction-spam-prevention measure, chain security via >> alternative consensus algorithm (in this scenario there is very little >> mining). > > I don't understand why you would casually mention moving away from Proof of > Work, I thought that was the big breakthrough that made Bitcoin possible at > all? > > Thanks, > Pedro > > 2015-05-13 4:10 GMT+12:00 Gavin Andresen <gavinandresen@gmail•com>: >> >> Added back the list, I didn't mean to reply privately: >> >> Fair enough, I'll try to find time in the next month or three to write up >> four plausible future scenarios for how mining incentives might work: >> >> 1) Fee-supported with very large blocks containing lots of tiny-fee >> transactions >> 2) Proof-of-idle supported (I wish Tadge Dryja would publish his >> proof-of-idle idea....) >> 3) Fees purely as transaction-spam-prevention measure, chain security via >> alternative consensus algorithm (in this scenario there is very little >> mining). >> 4) Fee supported with small blocks containing high-fee transactions moving >> coins to/from sidechains. >> >> Would that be helpful, or do you have some reason for thinking that we >> should pick just one and focus all of our efforts on making that one >> scenario happen? >> >> I always think it is better, when possible, not to "bet on one horse." >> >> >> On Tue, May 12, 2015 at 10:39 AM, Thomas Voegtlin <thomasv@electrum•org> >> wrote: >>> >>> Le 12/05/2015 15:44, Gavin Andresen a écrit : >>> > Ok, here's my scenario: >>> > >>> > https://blog.bitcoinfoundation.org/a-scalability-roadmap/ >>> > >>> > It might be wrong. I welcome other people to present their road maps. >>> > >>> >>> [answering to you only because you answered to me and not to the list; >>> feel free to repost this to the list though] >>> >>> Yes, that's exactly the kind of roadmap I am asking for. But your blog >>> post does not say anything about long term mining incentives, it only >>> talks about scalability. My point is that we need the same kind of thing >>> for miners incentives. >> >> >> >> >> -- >> -- >> Gavin Andresen >> >> >> ------------------------------------------------------------------------------ >> One dashboard for servers and applications across Physical-Virtual-Cloud >> Widest out-of-the-box monitoring support with 50+ applications >> Performance metrics, stats and reports that give you Actionable Insights >> Deep dive visibility with transaction tracing using APM Insight. >> http://ad.doubleclick.net/ddm/clk/290420510;117567292;y >> _______________________________________________ >> Bitcoin-development mailing list >> Bitcoin-development@lists•sourceforge•net >> https://lists.sourceforge.net/lists/listinfo/bitcoin-development >> > > > ------------------------------------------------------------------------------ > One dashboard for servers and applications across Physical-Virtual-Cloud > Widest out-of-the-box monitoring support with 50+ applications > Performance metrics, stats and reports that give you Actionable Insights > Deep dive visibility with transaction tracing using APM Insight. > http://ad.doubleclick.net/ddm/clk/290420510;117567292;y > _______________________________________________ > Bitcoin-development mailing list > Bitcoin-development@lists•sourceforge•net > https://lists.sourceforge.net/lists/listinfo/bitcoin-development >
Le 12/05/2015 18:10, Gavin Andresen a écrit :
Quoted text (21 lines)
> Added back the list, I didn't mean to reply privately: > > Fair enough, I'll try to find time in the next month or three to write up > four plausible future scenarios for how mining incentives might work: > > 1) Fee-supported with very large blocks containing lots of tiny-fee > transactions > 2) Proof-of-idle supported (I wish Tadge Dryja would publish his > proof-of-idle idea....) > 3) Fees purely as transaction-spam-prevention measure, chain security via > alternative consensus algorithm (in this scenario there is very little > mining). > 4) Fee supported with small blocks containing high-fee transactions moving > coins to/from sidechains. > > Would that be helpful, or do you have some reason for thinking that we > should pick just one and focus all of our efforts on making that one > scenario happen? > > I always think it is better, when possible, not to "bet on one horse." >
Sorry if I did not make myself clear. It is not about betting on one single horse, or about making one particular scenario happen. It is not about predicting whether something else will replace PoW in the future, and I am in no way asking you to focus your efforts in one particular direction at the expenses of others. Various directions will be explored by various people, and that's great.
I am talking about what we know today. I would like an answer to the following question: Do we have a reason to believe that Bitcoin can work in the long run, without involving technologies that have not been invented yet? Is there a single scenario that we know could work?
Exotic and unproven technologies are not an answer to that question. The reference scenario should be as boring as possible, and as verifiable as possible. I am not asking what you think is the most likely to happen, but what is the most likely to work, given the knowledge we have today.
If I was asking: "Can we send humans to the moon by 2100?", I guess your answer would be: "Yes we can, because it has been done in the past with chemical rockets, and we know how to build them". You would probably not use a space elevator in your answer.
The reason I am asking that is, there seems to be no consensus among core developers on how Bitcoin can work without miner subsidy. How it *will* work is another question.
On Wed, May 13, 2015 at 10:49 AM, Thomas Voegtlin <thomasv@electrum•org> wrote:
Quoted text (5 lines)
> > The reason I am asking that is, there seems to be no consensus among > core developers on how Bitcoin can work without miner subsidy. How it > *will* work is another question. >
The position seems to be that it will continue to work for the time being, so there is still time for more research.
Proof of stake has problems with handling long term reversals. The main proposal is to slightly weaken the security requirements.
With POW, a new node only needs to know the genesis block (and network rules) to fully determine which of two chains is the strongest.
Penalties for abusing POS inherently create a time horizon. A suggested POS security model would assume that a full node is a node that resyncs with the network regularly (every N blocks). N would be depend on the network rules of the coin.
The alternative is that 51% of the holders of coins at the genesis block can rewrite the entire chain. The genesis block might not be the first block, a POS coin might still use POW for minting.
https://blog.ethereum.org/2014/11/25/proof-stake-learned-love-weak-subjectivity/
Quoted text (3 lines)
> With POW, a new node only needs to know the genesis block (and network > rules) to fully determine which of two chains is the strongest. >
But this matters if a new node has access to the globally strongest chain. If attacker is able to block connections to legitimate nodes, a new node will happily accept attacker's chain.
So PoW, by itself, doesn't give strong security guarantees. This problem is so fundamental people avoid talking about it.
In practice, Bitcoin already embraces "weak subjectivity" e.g. in form of checkpoints embedded into the source code. So it's hard to take PoW purists seriously.
On Wed, May 13, 2015 at 11:31 AM, Alex Mizrahi <alex.mizrahi@gmail•com> wrote:
Quoted text (3 lines)
> > But this matters if a new node has access to the globally strongest chain. >
A node only needs a path of honest nodes to the network.
If a node is connected to 99 dishonest nodes and 1 honest node, it can still sync with the main network.
Quoted text (6 lines)
> > In practice, Bitcoin already embraces "weak subjectivity" e.g. in form of > checkpoints embedded into the source code. So it's hard to take PoW purists > seriously. > >
That isn't why checkpoints exist. They are to prevent a disk consumption DOS attack.
They also allow verification to go faster. Signature operations are assumed to be correct without checking if they are in blocks before the last checkpoint.
They do protect against multi-month forks though, even if not the reason that they exist.
If releases happen every 6 months, and the checkpoint is 3 months deep at release, then for the average node, the checkpoint is 3 to 9 months old.
A 3 month reversal would be devastating, so the checkpoint isn't adding much extra security.
With headers first downloading, the checkpoints could be removed. They could still be used for speeding up verification of historical blocks. Blocks behind the last checkpoint wouldn't need their signatures checked.
Removing them could cause a hard-fork though, so maybe they could be defined as legacy artifacts of the blockchain. Future checkpoints could be advisory.
Let's consider a concrete example:
1. User wants to accept Bitcoin payments, as his customers want this. 2. He downloads a recent version of Bitcoin Core, checks hashes and so on. (Maybe even builds from source.) 3. Let's it to sync for several hours or days. 4. After wallet is synced, he gives his address to customer. 5. Customer pays. 6. User waits 10 confirmations and ships the goods. (Suppose it's something very expensive.) 7. Some time later, user wants to convert some of his bitcoins to dollars. He sends his bitcoins to an exchange but they never arrive.
He tries to investigate, and after some time discovers that his router (or his ISP's router) was hijacked. His Bitcoin node couldn't connect to any of the legitimate nodes, and thus got a complete fake chain from the attacker. Bitcoins he received were totally fake.
Bitcoin Core did a shitty job and confirmed some fake transactions. User doesn't care that *if *his network was not impaired, Bitcoin Core *would have *worked properly. The main duty of Bitcoin Core is to check whether transactions are confirmed, and if it can be fooled by a simple router hack, then it does its job poorly.
If you don't see it being a problem, you should't be allowed to develop anything security-related.
If a node is connected to 99 dishonest nodes and 1 honest node, it can
Quoted text (2 lines)
> still sync with the main network. >
Yes, it is good against Sybil attack, but not good against a network-level attack. Attack on user's routers is a very realistic, plausible attack. Imagine if SSL could be hacked by hacking a router, would people still use it?
Fucking no.
Quoted text (3 lines)
> A 3 month reversal would be devastating, so the checkpoint isn't adding > much extra security. >
WIthout checkpoints an attacker could prepare a fork for $10. With checkpoints, it would cost him at least $1000, but more likely upwards of $100000. That's quite a difference, no?
I do not care what do you think about the reasons why checkpoints were added, but it is a fact that they make the attack scenario I describe above hard to impossible.
Without checkpoints, you could perform this attack using a laptop. With checkpoints, you need access to significant amounts of mining ASICs.
Checkpoints will be replaced by compiled-in 'at THIS timestamp the main chain had THIS much proof of work.'
That is enough information to prevent attacks and still allow optimizations like skipping signature checking for ancient transactions.
I don't think anybody is proposing replacing checkpoints with nothing.
On Wed, May 13, 2015 at 1:26 PM, Alex Mizrahi <alex.mizrahi@gmail•com> wrote:
Quoted text (7 lines)
> He tries to investigate, and after some time discovers that his router (or > his ISP's router) was hijacked. His Bitcoin node couldn't connect to any of > the legitimate nodes, and thus got a complete fake chain from the attacker. > Bitcoins he received were totally fake. > > Bitcoin Core did a shitty job and confirmed some fake transactions. >
I don't really see how you can protect against total isolation of a node (POS or POW). You would need to find an alternative route for the information.
Even encrypted connections are pointless without authentication of who you are communicating with.
Again, it is part of the security model that you can connect to at least one honest node.
Someone tweated all the bitcoin headers at one point. The problem is that if everyone uses the same check, then that source can be compromised.
Quoted text (2 lines)
> WIthout checkpoints an attacker could prepare a fork for $10. > With checkpoints, it would cost him at least $1000, but more likely
upwards of $100000.
Quoted text (1 line)
> That's quite a difference, no?
Headers first mean that you can't knock a synced node off the main chain without winning the POW race.
Checkpoints can be replaced with a minimum amount of POW for initial sync. This prevents spam of low POW blocks. Once a node is on a chain with at least that much POW, it considers it the main chain.,
Quoted text (4 lines)
> I don't really see how you can protect against total isolation of a node > (POS or POW). You would need to find an alternative route for the > information. >
"Alternative route for the information" is the whole point of weak subjectivity, no?
PoS depends on weak subjectivity to prevent "long term reversals", but using it also prevents "total isolation" attacks.
The argument that PoW is better than PoS because PoS has to depend on weak subjectivity, but PoW doesn't is wrong. Any practical implementation of PoW will also have to rely on weak subjectivity to be secure against isolation attack. And if we have to rely on weak subjectivity anyway, then why not PoS?
Quoted text (3 lines)
> Again, it is part of the security model that you can connect to at least > one honest node. >
This is the security model of PoW-based consensus. If you study PoW-consensus, then yes, this is the model you have to use.
But people use Bitcoin Core as a piece of software. They do not care what security model you use, they expect it to work. If there are realistic scenarios in which it fails, then this must be documented. Users should be made aware of the problem, should be able to take preventative measures (e.g. manually check the latest block against sources they trust), etc.
Quoted text (3 lines)
> The problem is that if everyone uses the same check, then that source can > be compromised. >
Yes, this problem cannot be solved in a 100% decentralized and automatic way. Which doesn't mean it's not worth solving, does it?
1. There are non-decentralized, trust-based solutions: refuse to work if none of well-known nodes are accessible. Well-known nodes are already used for bootstrapping, and this is another point which can be attacked. So if it's impossible to make it 100% decentralized and secure, why not make it 99% decentralized and secure?
2. It is a common practice to check sha256sum after downloading the package, and this is usually done manually. Why can't checking block hashes against some source become a common practice as well?
Also it's worth noting that these security measures are additive. Isolating a node AND hijacking one of well-known nodes AND hijacking a block explorer site user checks hashes against is exponentially harder than defeating a single measure.
On Tue, May 12, 2015 at 7:48 PM, Adam Back <adam@cypherspace•org> wrote:
Quoted text (4 lines)
> I think its fair to say no one knows how to make a consensus that > works in a decentralised fashion that doesnt weaken the bitcoin > security model without proof-of-work for now. >
Yes.
Quoted text (4 lines)
> I am presuming Gavin is just saying in the context of not pre-judging > the future that maybe in the far future another innovation might be > found (or alternatively maybe its not mathematically possible). >
Yes... or an alternative might be found that weakens the Bitcoin security model by a small enough amount that it either doesn't matter or the weakening is vastly overwhelmed by some other benefit.
I'm influenced by the way the Internet works; packets addressed to 74.125.226.67 reliably get to Google through a very decentralized system that I'll freely admit I don't understand. Yes, a determined attacker can re-route packets, but layers of security on top means re-routing packets isn't enough to pull off profitable attacks.
I think Bitcoin's proof-of-work might evolve in a similar way. Yes, you might be able to 51% attack the POW, but layers of security on top of POW will mean that won't be enough to pull off profitable attacks.
I hope to keep continuing this conversations. Pardon my absence, but I don't alway feel like I have much to contribute especially if it's not techincal.
On my part I have been a proponent, of an alterrnativ consensus, that begins shifting away from teh current cooinbase reward system in order to reduce mining on the whole and thus limit those who do mine to do so on a level of integrity.
I took a look at the ethereum blog on weak subjectivity, it does seem to be a good transtition to use a gravity schema to be implemented in a Log Structured Merge tree in order to find doscrepancy in forks.
Using this sama data structure could still be used in a consensus model. In
terms of how nodes communicate on teh network their speed and latency
communication are at least halfway solved based off their intereactions
(kernel software changes) with how nodes write and read memory { smp_wrb()
|| smp_rmb() } This would allow for a connection on the
Let me provide a use case: Say that we wanted to begin a new model for integrity, then the current value for integrity would utilize a OTS from the previous hash in order to establish the previous owner address of the block it was previously part of. THE MAIN ISSUE here is being able to verify, which value of integrity is useful for being able to establish a genesis block. A paper by Lee & Ewe (2001) called *The Byzantine General's Problem* gives insight as to how a O(n^c) model is suitable to send a message w/ value through out the system, each node is then sent a read-invalidate request in order to change their cache logs for old system memory in a new fixed address. Upon consensus of this value the rest of the "brainer" {1st recipeients} nodes would be able to send a forward propagation of the learnt value and, after acceptance the value would then be backpropagated to the genesis block upoon every round in orderr to set a deterministic standard for the dynamic increase of integrity of the system.
In POW systems the nonce generated would be the accumulation of the integrity within a system and what their computatiuonal exertion in terms of the overall rate of integrity increase in the system as the new coinbase -> this value then is assigned and signed to the hash and teh Merkel Root as two layers encoded to its base and then reencrypted using EDCSA from the 256 to 512 bit transformation so that the new address given has a validity that cannot be easily fingerprinted and the malleability of teh transaction becomes much more difficult due to the overall 2 ^ 28 verification stamp provided to the new hash. The parameters T T r P
(Trust value) -> foud in the new coinbase or the scriptSig ( Hidden) -> found in the Hash, and the merkel root hash (TRust overall) R = within the target range for new nonces and address locations Paradigm (integrity) = held within the genesis block as a backpropogated solution
Using this signature then the nodes would then be able to communicate and transition the memory resevres for previous transaction on the block based on the byzantine consensus. What noone has yet mentioned which I have forgotten too, is how these datacenters of pool woul be supported w/out fees. I will thrw that one out to all of you. The current consensus system leaves room for orp[haned transactions if there were miltiple signature requests the queue would be lined up based off integrity values in order to have the most effective changes occcur first.
I have some more thoughts and will continue working on the techinical vernacular and how a noob developer and decent computer science student could make such an mplementation a reality. Thanks in advance for listengin to this.
<Thank you to Greg Maxwell for allowing us to liosten to his talk online, was hearing while writing this.> And to Krzysztof Okupsi and Paul McKenny(Memory Barriers Hardware View for Software hackers) for their help in nudging my brain and the relentles people behind the scenes who make all our minds possible.
On Wed, May 13, 2015 at 4:26 AM, < bitcoin-development-request@lists•sourceforge•net> wrote:
Quoted text (337 lines)
> Send Bitcoin-development mailing list submissions to > bitcoin-development@lists•sourceforge•net > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.sourceforge.net/lists/listinfo/bitcoin-development > or, via email, send a message with subject or body 'help' to > bitcoin-development-request@lists•sourceforge•net > > You can reach the person managing the list at > bitcoin-development-owner@lists•sourceforge•net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Bitcoin-development digest..." > > Today's Topics: > > 1. Re: Long-term mining incentives (Thomas Voegtlin) > 2. Re: Long-term mining incentives (Tier Nolan) > 3. Re: Long-term mining incentives (Alex Mizrahi) > 4. Re: Proposed alternatives to the 20MB step function (Tier > Nolan) > 5. Re: Block Size Increase (Oliver Egginger) > 6. Re: Block Size Increase (Angel Leon) > > > ---------- Forwarded message ---------- > From: Thomas Voegtlin <thomasv@electrum•org> > To: Gavin Andresen <gavinandresen@gmail•com>, Bitcoin Dev < > bitcoin-development@lists•sourceforge•net> > Cc: > Date: Wed, 13 May 2015 11:49:13 +0200 > Subject: Re: [Bitcoin-development] Long-term mining incentives > > Le 12/05/2015 18:10, Gavin Andresen a écrit : > > Added back the list, I didn't mean to reply privately: > > > > Fair enough, I'll try to find time in the next month or three to write up > > four plausible future scenarios for how mining incentives might work: > > > > 1) Fee-supported with very large blocks containing lots of tiny-fee > > transactions > > 2) Proof-of-idle supported (I wish Tadge Dryja would publish his > > proof-of-idle idea....) > > 3) Fees purely as transaction-spam-prevention measure, chain security via > > alternative consensus algorithm (in this scenario there is very little > > mining). > > 4) Fee supported with small blocks containing high-fee transactions > moving > > coins to/from sidechains. > > > > Would that be helpful, or do you have some reason for thinking that we > > should pick just one and focus all of our efforts on making that one > > scenario happen? > > > > I always think it is better, when possible, not to "bet on one horse." > > > > Sorry if I did not make myself clear. It is not about betting on one > single horse, or about making one particular scenario happen. It is not > about predicting whether something else will replace PoW in the future, > and I am in no way asking you to focus your efforts in one particular > direction at the expenses of others. Various directions will be explored > by various people, and that's great. > > I am talking about what we know today. I would like an answer to the > following question: Do we have a reason to believe that Bitcoin can work > in the long run, without involving technologies that have not been > invented yet? Is there a single scenario that we know could work? > > Exotic and unproven technologies are not an answer to that question. The > reference scenario should be as boring as possible, and as verifiable as > possible. I am not asking what you think is the most likely to happen, > but what is the most likely to work, given the knowledge we have today. > > If I was asking: "Can we send humans to the moon by 2100?", I guess your > answer would be: "Yes we can, because it has been done in the past with > chemical rockets, and we know how to build them". You would probably not > use a space elevator in your answer. > > The reason I am asking that is, there seems to be no consensus among > core developers on how Bitcoin can work without miner subsidy. How it > *will* work is another question. > > > > > ---------- Forwarded message ---------- > From: Tier Nolan <tier.nolan@gmail•com> > To: > Cc: Bitcoin Dev <bitcoin-development@lists•sourceforge•net> > Date: Wed, 13 May 2015 11:14:06 +0100 > Subject: Re: [Bitcoin-development] Long-term mining incentives > On Wed, May 13, 2015 at 10:49 AM, Thomas Voegtlin <thomasv@electrum•org> > wrote: > >> >> The reason I am asking that is, there seems to be no consensus among >> core developers on how Bitcoin can work without miner subsidy. How it >> *will* work is another question. >> > > The position seems to be that it will continue to work for the time being, > so there is still time for more research. > > Proof of stake has problems with handling long term reversals. The main > proposal is to slightly weaken the security requirements. > > With POW, a new node only needs to know the genesis block (and network > rules) to fully determine which of two chains is the strongest. > > Penalties for abusing POS inherently create a time horizon. A suggested > POS security model would assume that a full node is a node that resyncs > with the network regularly (every N blocks). N would be depend on the > network rules of the coin. > > The alternative is that 51% of the holders of coins at the genesis block > can rewrite the entire chain. The genesis block might not be the first > block, a POS coin might still use POW for minting. > > > https://blog.ethereum.org/2014/11/25/proof-stake-learned-love-weak-subjectivity/ > > > ---------- Forwarded message ---------- > From: Alex Mizrahi <alex.mizrahi@gmail•com> > To: Bitcoin Dev <bitcoin-development@lists•sourceforge•net> > Cc: > Date: Wed, 13 May 2015 13:31:47 +0300 > Subject: Re: [Bitcoin-development] Long-term mining incentives > > >> With POW, a new node only needs to know the genesis block (and network >> rules) to fully determine which of two chains is the strongest. >> > > But this matters if a new node has access to the globally strongest chain. > If attacker is able to block connections to legitimate nodes, a new node > will happily accept attacker's chain. > > So PoW, by itself, doesn't give strong security guarantees. This problem > is so fundamental people avoid talking about it. > > In practice, Bitcoin already embraces "weak subjectivity" e.g. in form of > checkpoints embedded into the source code. So it's hard to take PoW purists > seriously. > > > ---------- Forwarded message ---------- > From: Tier Nolan <tier.nolan@gmail•com> > To: > Cc: Bitcoin Development <bitcoin-development@lists•sourceforge•net> > Date: Wed, 13 May 2015 11:43:08 +0100 > Subject: Re: [Bitcoin-development] Proposed alternatives to the 20MB step > function > On Sat, May 9, 2015 at 4:36 AM, Gregory Maxwell <gmaxwell@gmail•com> > wrote: > >> An example would >> be tx_size = MAX( real_size >> 1, real_size + 4*utxo_created_size - >> 3*utxo_consumed_size). > > > This could be implemented as a soft fork too. > > * 1MB hard size limit > * 900kB soft limit > > S = block size > U = UTXO_adjusted_size = S + 4 * outputs - 3 * inputs > > A block is valid if S < 1MB and U < 1MB > > A 250 byte transaction with 2 inputs and 2 outputs would have an adjusted > size of 252 bytes. > > The memory pool could be sorted by fee per adjusted_size. > > Coin selection could be adjusted so it tries to have at least 2 inputs > when creating transactions, unless the input is worth more than a threshold > (say 0.001 BTC). > > This is a pretty weak incentive, especially if the block size is > increased. Maybe it will cause a "nudge" > > > ---------- Forwarded message ---------- > From: Oliver Egginger <bitcoin@olivere•de> > To: bitcoin-development@lists•sourceforge•net > Cc: > Date: Wed, 13 May 2015 12:37:17 +0200 > Subject: Re: [Bitcoin-development] Block Size Increase > 08.05.2015 at 5:49 Jeff Garzik wrote: > > To repeat, the very first point in my email reply was: "Agree that 7 tps > > is too low" > > For interbank trading that would maybe enough but I don't know. > > I'm not a developer but as a (former) user and computer scientist I'm > also asking myself what is the core of the problem? Personally, for > privacy reasons I do not want to leave a footprint in the blockchain for > each pizza. And why should this expense be good for trivial things of > everyday life? > > If one encounters the block boundary, he or she will do more effort or > give up. I'm thinking most people will give up because their > transactions are not really economical. It is much better for them to > use third-partys (or another payment system). > > And that's where we are at the heart of the problem. The Bitcoin > third-party economy. With few exceptions this is pure horror. More worse > than any used car dealer. And the community just waits that things get > better. But that will never happen of its own accord. We are living in a > Wild West Town. So we need a Sheriff and many other things. > > We need a small but good functioning economy around the blockchain. To > create one, we have to accept a few unpleasant truths. I do not know if > the community is ready for it. > > Nevertheless, I know that some companies do a good job. But they have to > prevail against their dishonest competitors. > > People take advantage of the blockchain, because they no longer trust > anyone. But this will not scale in the long run. > > - oliver > > > > > > > > > > > > ---------- Forwarded message ---------- > From: Angel Leon <gubatron@gmail•com> > To: Oliver Egginger <bitcoin@olivere•de> > Cc: Bitcoin Dev <bitcoin-development@lists•sourceforge•net> > Date: Wed, 13 May 2015 07:25:47 -0400 > Subject: Re: [Bitcoin-development] Block Size Increase > > Personally, for privacy reasons I do not want to leave a footprint in > the blockchain for each pizza. And why should this expense be good for > trivial things of everyday life? > > Then what's the point? > Isn't this supposed to be an Open transactional network, it doesn't matter > if you don't want that, what matters is what people want to do with it, and > there's nothing you can do to stop someone from opening a wallet and buying > a pizza with it, except the core of the problem you ask yourself about, > which is, the minute this goes mainstream and people get their wallets out > the whole thing will collapse, regardless of what you want the blockchain > for. > > Why talk about the billions of unbanked and all the romantic vision if you > can't let them use their money however they want in a decentralized > fashion. Otherwise let's just go back to centralized banking because the > minute you want to put things off chain, you need an organization that will > need to respond to government regulation and that's the end for the > billions of unbanked to be part of the network. > > > http://twitter.com/gubatron > > On Wed, May 13, 2015 at 6:37 AM, Oliver Egginger <bitcoin@olivere•de> > wrote: > >> 08.05.2015 at 5:49 Jeff Garzik wrote: >> > To repeat, the very first point in my email reply was: "Agree that 7 tps >> > is too low" >> >> For interbank trading that would maybe enough but I don't know. >> >> I'm not a developer but as a (former) user and computer scientist I'm >> also asking myself what is the core of the problem? Personally, for >> privacy reasons I do not want to leave a footprint in the blockchain for >> each pizza. And why should this expense be good for trivial things of >> everyday life? >> >> If one encounters the block boundary, he or she will do more effort or >> give up. I'm thinking most people will give up because their >> transactions are not really economical. It is much better for them to >> use third-partys (or another payment system). >> >> And that's where we are at the heart of the problem. The Bitcoin >> third-party economy. With few exceptions this is pure horror. More worse >> than any used car dealer. And the community just waits that things get >> better. But that will never happen of its own accord. We are living in a >> Wild West Town. So we need a Sheriff and many other things. >> >> We need a small but good functioning economy around the blockchain. To >> create one, we have to accept a few unpleasant truths. I do not know if >> the community is ready for it. >> >> Nevertheless, I know that some companies do a good job. But they have to >> prevail against their dishonest competitors. >> >> People take advantage of the blockchain, because they no longer trust >> anyone. But this will not scale in the long run. >> >> - oliver >> >> >> >> >> >> >> >> >> >> ------------------------------------------------------------------------------ >> One dashboard for servers and applications across Physical-Virtual-Cloud >> Widest out-of-the-box monitoring support with 50+ applications >> Performance metrics, stats and reports that give you Actionable Insights >> Deep dive visibility with transaction tracing using APM Insight. >> http://ad.doubleclick.net/ddm/clk/290420510;117567292;y >> _______________________________________________ >> Bitcoin-development mailing list >> Bitcoin-development@lists•sourceforge•net >> https://lists.sourceforge.net/lists/listinfo/bitcoin-development >> > > > > ------------------------------------------------------------------------------ > One dashboard for servers and applications across Physical-Virtual-Cloud > Widest out-of-the-box monitoring support with 50+ applications > Performance metrics, stats and reports that give you Actionable Insights > Deep dive visibility with transaction tracing using APM Insight. > http://ad.doubleclick.net/ddm/clk/290420510;117567292;y > _______________________________________________ > Bitcoin-development mailing list > Bitcoin-development@lists•sourceforge•net > https://lists.sourceforge.net/lists/listinfo/bitcoin-development > >
Thank you for your response, that does make sense. It's going to be interesting to follow what is going to happen!
2015-05-14 3:41 GMT+12:00 Gavin Andresen <gavinandresen@gmail•com>:
Quoted text (35 lines)
> On Tue, May 12, 2015 at 7:48 PM, Adam Back <adam@cypherspace•org> wrote: > >> I think its fair to say no one knows how to make a consensus that >> works in a decentralised fashion that doesnt weaken the bitcoin >> security model without proof-of-work for now. >> > > Yes. > > >> I am presuming Gavin is just saying in the context of not pre-judging >> the future that maybe in the far future another innovation might be >> found (or alternatively maybe its not mathematically possible). >> > > Yes... or an alternative might be found that weakens the Bitcoin security > model by a small enough amount that it either doesn't matter or the > weakening is vastly overwhelmed by some other benefit. > > I'm influenced by the way the Internet works; packets addressed to > 74.125.226.67 reliably get to Google through a very decentralized system > that I'll freely admit I don't understand. Yes, a determined attacker can > re-route packets, but layers of security on top means re-routing packets > isn't enough to pull off profitable attacks. > > I think Bitcoin's proof-of-work might evolve in a similar way. Yes, you > might be able to 51% attack the POW, but layers of security on top of POW > will mean that won't be enough to pull off profitable attacks. > > > -- > -- > Gavin Andresen > >
On Wed, May 13, 2015 at 12:31 PM, Alex Mizrahi <alex.mizrahi@gmail•com> wrote:
Quoted text (3 lines)
> But this matters if a new node has access to the globally strongest chain. > If attacker is able to block connections to legitimate nodes, a new node > will happily accept attacker's chain.
If you get isolated from the network you may not get the longest valid chain. I don't think any other consensus mechanism deals with this better than Bitcoin.
Quoted text (6 lines)
> So PoW, by itself, doesn't give strong security guarantees. This problem is > so fundamental people avoid talking about it. > > In practice, Bitcoin already embraces "weak subjectivity" e.g. in form of > checkpoints embedded into the source code. So it's hard to take PoW purists > seriously.
Checkpoints are NOT part of the consensus rules, they're just an optimization that can be removed. Try keeping the genesis block as your only checkpoint and rebuild: it will work. You can also define your own checkpoints, there's no need for everyone to use the same ones. In a future with committed utxo the optimization could be bigger, but still, we shouldn't rely on checkpoints for consensus, they're just an optimization and you should only trust checkpoints that are buried in the chain. Trusting a committed utxo checkpoint from 2 years ago doesn't seem very risky. If the code is not already done (not really sure if it was done as part of auto-prune), we should be prepared for reorgs that invalidate checkpoints. So, no, Bitcoin does NOT rely on that "weak subjectivity" thing.
On Mon, May 11, 2015 at 7:29 PM, Gavin Andresen <gavinandresen@gmail•com> wrote:
Quoted text (9 lines)
> I think long-term the chain will not be secured purely by proof-of-work. I > think when the Bitcoin network was tiny running solely on people's home > computers proof-of-work was the right way to secure the chain, and the only > fair way to both secure the chain and distribute the coins. > > See https://gist.github.com/gavinandresen/630d4a6c24ac6144482a for some > half-baked thoughts along those lines. I don't think proof-of-work is the > last word in distributed consensus (I also don't think any alternatives are > anywhere near ready to deploy, but they might be in ten years).
Or never, nobody knows at this point.
Quoted text (5 lines)
> I also think it is premature to worry about what will happen in twenty or > thirty years when the block subsidy is insignificant. A lot will happen in > the next twenty years. I could spin a vision of what will secure the chain > in twenty years, but I'd put a low probability on that vision actually > turning out to be correct.
I think is very healthy to worry about that since we know it's something that will happen. The system should work without subsidies.
Quoted text (5 lines)
> That is why I keep saying Bitcoin is an experiment. But I also believe that > the incentives are correct, and there are a lot of very motivated, smart, > hard-working people who will make it work. When you're talking about trying > to predict what will happen decades from now, I think that is the best you > can (honestly) do.
Lightning payment channels may be a new idea, but payment channels are not, and nobody is using them. They are the best solution to scalability we have right now, increasing the block size is simply not a solution, it's just kicking the can down the road (while reducing the incentives to deploy real solutions like payment channels).
Not worrying about 10 years in the future but asking people to trust estimates and speculations about how everything will burn in 2 years if we don't act right now seems pretty arbitrary to me. One could just as well argue that there's smart hard-working people that will solve those problems before they hit us.
It is true that the more distant the future you're trying to predict is, the more difficult it is to predict it, but any threshold that separates "relevant worries" from "too far in the future to worry about it" will always be arbitrary. Fortunately we don't need to all share the same time horizon for what is worrying and what is not. What we need is a clear criterion for what is acceptable for a hardfork and a general plan to deploy them:
-Do all the hardfork changes need to be uncontroversial? How do we define uncontroversial? -Should we maintain and test implementation of hardfork whises that seem too small to justify a hardfork on their own (ie time travel fix, allowing to sign inputs values...) to also deploy them at the same time that other more necessary hardforks?
I agree that hardforks shouldn't be impossible and in that sense I'm glad that you started the hardfork debate, but I believe we should be focusing on that debate rather than the block size one. Once we have a clear criteria, hopefully the block size debate should become less noisy and more productive.
On 11 May 2015 at 18:28, Thomas Voegtlin <thomasv@electrum•org> wrote:
Quoted text (62 lines)
> The discussion on block size increase has brought some attention to the > other elephant in the room: Long-term mining incentives. > > Bitcoin derives its current market value from the assumption that a > stable, steady-state regime will be reached in the future, where miners > have an incentive to keep mining to protect the network. Such a steady > state regime does not exist today, because miners get most of their > reward from the block subsidy, which will progressively be removed. > > Thus, today's 3 billion USD question is the following: Will a steady > state regime be reached in the future? Can such a regime exist? What are > the necessary conditions for its existence? > > Satoshi's paper suggests that this may be achieved through miner fees. > Quite a few people seem to take this for granted, and are working to > make it happen (developing cpfp and replace-by-fee). This explains part > of the opposition to raising the block size limit; some people would > like to see some fee pressure building up first, in order to get closer > to a regime where miners are incentivised by transaction fees instead of > block subsidy. Indeed, the emergence of a working fee market would be > extremely reassuring for the long-term viability of bitcoin. So, the > thinking goes, by raising the block size limit, we would be postponing a > crucial reality check. We would be buying time, at the expenses of > Bitcoin's decentralization. > > OTOH, proponents of a block size increase have a very good point: if the > block size is not raised soon, Bitcoin is going to enter a new, unknown > and potentially harmful regime. In the current regime, almost all > transaction get confirmed quickly, and fee pressure does not exist. Mike > Hearn suggested that, when blocks reach full capacity and users start to > experience confirmation delays and confirmation uncertainty, users will > simply go away and stop using Bitcoin. To me, that outcome sounds very > plausible indeed. Thus, proponents of the block size increase are > conservative; they are trying to preserve the current regime, which is > known to work, instead of letting the network enter uncharted territory. > > My problem is that this seems to lacks a vision. If the maximal block > size is increased only to buy time, or because some people think that 7 > tps is not enough to compete with VISA, then I guess it would be > healthier to try and develop off-chain infrastructure first, such as the > Lightning network. > > OTOH, I also fail to see evidence that a limited block capacity will > lead to a functional fee market, able to sustain a steady state. A > functional market requires well-informed participants who make rational > choices and accept the outcomes of their choices. That is not the case > today, and to believe that it will magically happen because blocks start > to reach full capacity sounds a lot like like wishful thinking. > > So here is my question, to both proponents and opponents of a block size > increase: What steady-state regime do you envision for Bitcoin, and what > is is your plan to get there? More specifically, how will the > steady-state regime look like? Will users experience fee pressure and > delays, or will it look more like a scaled up version of what we enjoy > today? Should fee pressure be increased jointly with subsidy decrease, > or as soon as possible, or never? What incentives will exist for miners > once the subsidy is gone? Will miners have an incentive to permanently > fork off the last block and capture its fees? Do you expect Bitcoin to > work because miners are altruistic/selfish/honest/caring? > > A clear vision would be welcome. >
I am guided here by Satoshi's paper:
"Commerce on the Internet has come to rely almost exclusively on financial institutions serving as trusted third parties to process electronic payments. While the system works well enough for *most transactions*"
This suggests to me that most tx will occur off-block with the block chain used for settlement. Indeed Satoshi was working on a trust based market before he left.
If commerce works well enough off-block with zero trust settlement supporting it, people might even forget that the block chain exists, like with gold settlement. But it can be used for transactions. To this end I welcome higher fees, so that the block chain becomes the reserve currency of the internet and is used sparingly.
But as Gavin pointed out, bitcoin is still an experiment and we are all still learning. We are also learning from alt coin mechanisms. I am unsure there is huge urgency here, and would lean towards caution as bitcoin infrastructure rapidly grows.
Quoted text (13 lines)
> > > ------------------------------------------------------------------------------ > One dashboard for servers and applications across Physical-Virtual-Cloud > Widest out-of-the-box monitoring support with 50+ applications > Performance metrics, stats and reports that give you Actionable Insights > Deep dive visibility with transaction tracing using APM Insight. > http://ad.doubleclick.net/ddm/clk/290420510;117567292;y > _______________________________________________ > Bitcoin-development mailing list > Bitcoin-development@lists•sourceforge•net > https://lists.sourceforge.net/lists/listinfo/bitcoin-development >
Quoted text (3 lines)
> increasing the block size is simply not a solution, it's just kicking > the can down the road (while reducing the incentives to deploy real > solutions like payment channels).
Placing hard limits on blocksize is not the right solution. There are still plenty of options to be explored to increase fees, resulting in users voluntarily economizing on block space. It's premature to resort to destroying the reliability of propagated transaction getting into blocks.
Child-pays-for-parent is useful, but requires the recipient to spend inputs upon receipt, consuming even more block space. Replace-by-fee may also help, but users won't know the fee they are getting charged until after the fact, and it will make worse all the problems that tx malleability causes today.
We have $3billion plus of value in this system to defend. The safe, conservative course is to increase the block size. Miners already have an incentive to find ways to encourage higher fees and we can help them with standard recommended propagation rules and hybrid priority/fee transaction selection for blocks that increases confirmation delays for low fee transactions.
Aaron Voisine co-founder and CEO breadwallet.com
On Wed, May 13, 2015 at 5:11 PM, Jorge Timón <jtimon@jtimon•cc> wrote:
Quoted text (85 lines)
> On Mon, May 11, 2015 at 7:29 PM, Gavin Andresen <gavinandresen@gmail•com> > wrote: > > I think long-term the chain will not be secured purely by proof-of-work. > I > > think when the Bitcoin network was tiny running solely on people's home > > computers proof-of-work was the right way to secure the chain, and the > only > > fair way to both secure the chain and distribute the coins. > > > > See https://gist.github.com/gavinandresen/630d4a6c24ac6144482a for some > > half-baked thoughts along those lines. I don't think proof-of-work is the > > last word in distributed consensus (I also don't think any alternatives > are > > anywhere near ready to deploy, but they might be in ten years). > > Or never, nobody knows at this point. > > > I also think it is premature to worry about what will happen in twenty or > > thirty years when the block subsidy is insignificant. A lot will happen > in > > the next twenty years. I could spin a vision of what will secure the > chain > > in twenty years, but I'd put a low probability on that vision actually > > turning out to be correct. > > I think is very healthy to worry about that since we know it's > something that will happen. > The system should work without subsidies. > > > That is why I keep saying Bitcoin is an experiment. But I also believe > that > > the incentives are correct, and there are a lot of very motivated, smart, > > hard-working people who will make it work. When you're talking about > trying > > to predict what will happen decades from now, I think that is the best > you > > can (honestly) do. > > Lightning payment channels may be a new idea, but payment channels are > not, and nobody is using them. > They are the best solution to scalability we have right now, > increasing the block size is simply not a solution, it's just kicking > the can down the road (while reducing the incentives to deploy real > solutions like payment channels). > > Not worrying about 10 years in the future but asking people to trust > estimates and speculations about how everything will burn in 2 years > if we don't act right now seems pretty arbitrary to me. > One could just as well argue that there's smart hard-working people > that will solve those problems before they hit us. > > It is true that the more distant the future you're trying to predict > is, the more difficult it is to predict it, but any threshold that > separates "relevant worries" from "too far in the future to worry > about it" will always be arbitrary. > Fortunately we don't need to all share the same time horizon for what > is worrying and what is not. > What we need is a clear criterion for what is acceptable for a > hardfork and a general plan to deploy them: > > -Do all the hardfork changes need to be uncontroversial? How do we > define uncontroversial? > -Should we maintain and test implementation of hardfork whises that > seem too small to justify a hardfork on their own (ie time travel fix, > allowing to sign inputs values...) to also deploy them at the same > time that other more necessary hardforks? > > I agree that hardforks shouldn't be impossible and in that sense I'm > glad that you started the hardfork debate, but I believe we should be > focusing on that debate rather than the block size one. > Once we have a clear criteria, hopefully the block size debate should > become less noisy and more productive. > > > ------------------------------------------------------------------------------ > One dashboard for servers and applications across Physical-Virtual-Cloud > Widest out-of-the-box monitoring support with 50+ applications > Performance metrics, stats and reports that give you Actionable Insights > Deep dive visibility with transaction tracing using APM Insight. > http://ad.doubleclick.net/ddm/clk/290420510;117567292;y > _______________________________________________ > Bitcoin-development mailing list > Bitcoin-development@lists•sourceforge•net > https://lists.sourceforge.net/lists/listinfo/bitcoin-development >
On Wed, May 13, 2015 at 5:48 PM, Aaron Voisine <voisine@gmail•com> wrote:
Quoted text (7 lines)
> We have $3billion plus of value in this system to defend. The safe, > conservative course is to increase the block size. Miners already have an > incentive to find ways to encourage higher fees and we can help them with > standard recommended propagation rules and hybrid priority/fee transaction > selection for blocks that increases confirmation delays for low fee > transactions. >
You may find that the most economical solution, but I can't understand how you can call it conservative.
Suggesting a hard fork is betting the survival of the entire ecosystem on the bet that everyone will agree with and upgrade to new suggested software before a flag date.
Conservative is a relative term. Dropping transactions in a way that is unpredictable to the sender sounds incredibly drastic to me. I'm suggesting increasing the blocksize, drastic as it is, is the more conservative choice. I would recommend that the fork take effect when some specific large supermajority of the pervious 1000 blocks indicate they have upgraded, as a safer alternative to a simple flag date, but I'm sure I wouldn't have to point out that option to people here.
Aaron Voisine co-founder and CEO breadwallet.com
On Wed, May 13, 2015 at 5:58 PM, Pieter Wuille <pieter.wuille@gmail•com> wrote:
Quoted text (21 lines)
> On Wed, May 13, 2015 at 5:48 PM, Aaron Voisine <voisine@gmail•com> wrote: > >> We have $3billion plus of value in this system to defend. The safe, >> conservative course is to increase the block size. Miners already have an >> incentive to find ways to encourage higher fees and we can help them with >> standard recommended propagation rules and hybrid priority/fee transaction >> selection for blocks that increases confirmation delays for low fee >> transactions. >> > > You may find that the most economical solution, but I can't understand how > you can call it conservative. > > Suggesting a hard fork is betting the survival of the entire ecosystem on > the bet that everyone will agree with and upgrade to new suggested software > before a flag date. > > -- > Pieter > >
On Wed, May 13, 2015 at 6:13 PM, Aaron Voisine <voisine@gmail•com> wrote:
Quoted text (4 lines)
> Conservative is a relative term. Dropping transactions in a way that is > unpredictable to the sender sounds incredibly drastic to me. I'm suggesting > increasing the blocksize, drastic as it is, is the more conservative choice. >
Transactions are already being dropped, in a more indirect way: by people and businesses deciding to not use on-chain settlement. That is very sad, but it's completely inevitable that there is space for some use cases and not for others (at whatever block size). It's only a "things don't fit anymore" when you see on-chain transactions as the only means for doing payments, and that is already not the case. Increasing the block size allows for more utility on-chain, but it does not fundamentally add more use cases - only more growth space for people already invested in being able to do things on-chain while externalizing the costs to others.
Quoted text (5 lines)
> I would recommend that the fork take effect when some specific large > supermajority of the pervious 1000 blocks indicate they have upgraded, as a > safer alternative to a simple flag date, but I'm sure I wouldn't have to > point out that option to people here. >
That only measures miner adoption, which is the least relevant. The question is whether people using full nodes will upgrade. If they do, then miners are forced to upgrade too, or become irrelevant. If they don't, the upgrade is risky with or without miner adoption.
Quoted text (1 line)
> by people and businesses deciding to not use on-chain settlement.
I completely agree. Increasing fees will cause people voluntary economize on blockspace by finding alternatives, i.e. not bitcoin. A fee however is a known, upfront cost... unpredictable transaction failure in most cases will be a far higher, unacceptable cost to the user than the actual fee. The higher the costs of using the system, the lower the adoption as a store-of-value. The lower the adoption as store-of-value, the lower the price, and the lower the value of bitcoin to the world.
Quoted text (1 line)
> That only measures miner adoption, which is the least relevant.
I concede the point. Perhaps a flag date based on previous observation of network upgrade rates with a conservative additional margin in addition to supermajority of mining power.
Aaron Voisine co-founder and CEO breadwallet.com
On Wed, May 13, 2015 at 6:19 PM, Pieter Wuille <pieter.wuille@gmail•com> wrote:
Quoted text (33 lines)
> On Wed, May 13, 2015 at 6:13 PM, Aaron Voisine <voisine@gmail•com> wrote: > >> Conservative is a relative term. Dropping transactions in a way that is >> unpredictable to the sender sounds incredibly drastic to me. I'm suggesting >> increasing the blocksize, drastic as it is, is the more conservative choice. >> > > Transactions are already being dropped, in a more indirect way: by people > and businesses deciding to not use on-chain settlement. That is very sad, > but it's completely inevitable that there is space for some use cases and > not for others (at whatever block size). It's only a "things don't fit > anymore" when you see on-chain transactions as the only means for doing > payments, and that is already not the case. Increasing the block size > allows for more utility on-chain, but it does not fundamentally add more > use cases - only more growth space for people already invested in being > able to do things on-chain while externalizing the costs to others. > > >> I would recommend that the fork take effect when some specific large >> supermajority of the pervious 1000 blocks indicate they have upgraded, as a >> safer alternative to a simple flag date, but I'm sure I wouldn't have to >> point out that option to people here. >> > > That only measures miner adoption, which is the least relevant. The > question is whether people using full nodes will upgrade. If they do, then > miners are forced to upgrade too, or become irrelevant. If they don't, the > upgrade is risky with or without miner adoption. > > -- > Pieter > >
Quoted text (1 line)
> I concede the point. Perhaps a flag date based on previous observation of
network upgrade rates with a conservative additional margin in addition to supermajority of mining power.
It occurs to me that this would allow for a relatively small percentage of miners to stop the upgrade if the flag date turns out to be poorly chosen and a large number of non-mining nodes haven't upgraded yet. Would be a nice safety fallback.
Aaron Voisine co-founder and CEO breadwallet.com
On Wed, May 13, 2015 at 6:31 PM, Aaron Voisine <voisine@gmail•com> wrote:
Quoted text (58 lines)
> > by people and businesses deciding to not use on-chain settlement. > > I completely agree. Increasing fees will cause people voluntary economize > on blockspace by finding alternatives, i.e. not bitcoin. A fee however is a > known, upfront cost... unpredictable transaction failure in most cases will > be a far higher, unacceptable cost to the user than the actual fee. The > higher the costs of using the system, the lower the adoption as a > store-of-value. The lower the adoption as store-of-value, the lower the > price, and the lower the value of bitcoin to the world. > > > That only measures miner adoption, which is the least relevant. > > I concede the point. Perhaps a flag date based on previous observation of > network upgrade rates with a conservative additional margin in addition to > supermajority of mining power. > > > Aaron Voisine > co-founder and CEO > breadwallet.com > > On Wed, May 13, 2015 at 6:19 PM, Pieter Wuille <pieter.wuille@gmail•com> > wrote: > >> On Wed, May 13, 2015 at 6:13 PM, Aaron Voisine <voisine@gmail•com> wrote: >> >>> Conservative is a relative term. Dropping transactions in a way that is >>> unpredictable to the sender sounds incredibly drastic to me. I'm suggesting >>> increasing the blocksize, drastic as it is, is the more conservative choice. >>> >> >> Transactions are already being dropped, in a more indirect way: by people >> and businesses deciding to not use on-chain settlement. That is very sad, >> but it's completely inevitable that there is space for some use cases and >> not for others (at whatever block size). It's only a "things don't fit >> anymore" when you see on-chain transactions as the only means for doing >> payments, and that is already not the case. Increasing the block size >> allows for more utility on-chain, but it does not fundamentally add more >> use cases - only more growth space for people already invested in being >> able to do things on-chain while externalizing the costs to others. >> >> >>> I would recommend that the fork take effect when some specific large >>> supermajority of the pervious 1000 blocks indicate they have upgraded, as a >>> safer alternative to a simple flag date, but I'm sure I wouldn't have to >>> point out that option to people here. >>> >> >> That only measures miner adoption, which is the least relevant. The >> question is whether people using full nodes will upgrade. If they do, then >> miners are forced to upgrade too, or become irrelevant. If they don't, the >> upgrade is risky with or without miner adoption. >> >> -- >> Pieter >> >> >
On 05/13/2015 09:31 PM, Aaron Voisine wrote:
Quoted text (4 lines)
> > by people and businesses deciding to not use on-chain settlement. > > I completely agree. Increasing fees will cause people voluntary > economize on blockspace by finding alternatives, i.e. not bitcoin.
This strikes me as a leap. There are alternatives that still use bitcoin as the unit of value, such as sidechains, offchain, etc. To say that these are "not bitcoin" is misleading.
Quoted text (3 lines)
> A fee however is a known, upfront cost... unpredictable transaction failure in > most cases will be a far higher, unacceptable cost to the user than the > actual fee.
Are we sure that raising the block size is the only way to avoid "unpredictable transaction failure"? If so, and it's as bad as you say it is, aren't we screwed anyway when we inevitably start hitting the cap (even if it's raised 10x or 20x)? And if that's the case, then don't we do a disservice to users by continuing to pretend that we can make this problem go away?
Quoted text (2 lines)
> The higher the costs of using the system, the lower the > adoption as a store-of-value.
On what do you base this? Gold has a very high cost of using (storage, transport) and yet is perhaps the most widely accepted store of value.
On 5/16/2015 1:35 PM, Owen Gunden wrote:
Quoted text (3 lines)
> There are alternatives that still use bitcoin as the unit of value, > such as sidechains, offchain, etc. To say that these are "not bitcoin" > is misleading.
Is it? Nobody thinks "euro accepted" implies Visa is ok, even though Visa is just a bunch of extra protocol surrounding an eventual bank deposit.
On Sat, May 16, 2015 at 1:35 PM, Owen Gunden <ogunden@phauna•org> wrote:
Quoted text (5 lines)
> > This strikes me as a leap. There are alternatives that still use bitcoin > as the unit of value, such as sidechains, offchain, etc. To say that > these are "not bitcoin" is misleading. >
The only options available today and in the near future that I'm aware of are of the centralized custody variety, which is pretty bad in my opinion, but your point is taken.
Quoted text (8 lines)
> > Are we sure that raising the block size is the only way to avoid > "unpredictable transaction failure"? If so, and it's as bad as you say > it is, aren't we screwed anyway when we inevitably start hitting the cap > (even if it's raised 10x or 20x)? And if that's the case, then don't we > do a disservice to users by continuing to pretend that we can make this > problem go away? >
When we start bumping up against the block size limit, the transactions at the margins will experience failure in a way that will be unpredictable to current wallet software. We can slow blockchain growth by increasing fees alone, without introducing the additional cost of unpredictability around confirmation failure, which when it comes down to it is just another (extreme) way to keep usage low. Instead of fees and unpredictable confirmation, why not just have fees alone. A single, upfront, known cost.
Quoted text (5 lines)
> > > On what do you base this? Gold has a very high cost of using (storage, > transport) and yet is perhaps the most widely accepted store of value. >
I would argue that the reason gold is not the one world global currency that it once was is because of those costs. That's why people shifted over time to gold backed bank notes and eventually fiat.
I think the basic reality is that a) an arbitrarily elevated level of hashing is fundamental to a truly decentralised, autonomous network, and is an essential cost to maintaining Bitcoin, b) there are no signs that this fact will change, c) there must be some replacement to the current system of incentivisation through debasement (inflation).
Arguments about limiting block size versus setting minimum fees are confused because ultimately both mechanisms should ideally achieve the same outcome: a market price for transactions which means that a) not everyone who would make a TX if TXs were unpriced does so (reduced number of TXs) and b) the market price is used to fund hashing. This is just the nature of prices, it always reduces effective demand, but without prices supply must collapse and the market must fail.
Regardless, if every time the network gets close to reaching the block size limit the development community gets scared and raises the limit, then such a limit will never be an effective tool for setting a market price. Personally I think trying to artificially limit supply to create a price for transactions is a needlessly complicated way of trying to achieve this goal. I think minimum fees for transactions is a better, simpler option.
I would go a step further and say that the development community will struggle forever if it tries to play the role of the centralised economic planner in setting prices for network services. The community should look at more dynamic ways to let network users express their preferences for security and their willingness to pay for it. I've written on the issue - https://medium.com/@mike0/securing-bitcoin-5-determing-an-optimal-funding-level-9873fa1322a7
As far as the argument that fees will drive people away from Bitcoin, I can't believe that. Everything we desire has to be paid for somehow. People will accept a fee for making Bitcoin transactions if Bitcoin as a result is a stable, useful service. Bitcoin as both a currency and as a transaction network has strong network effects, so, ignoring sidechains, it's highly unrealistic that a mandatory fee will drive people away from Bitcoin when the alternatives are dubious knock-offs with no network effect, and fiat, which is even worse in regards to the hidden and malignant costs it exacts.
Hi Thomas,
My problem is that this seems to lacks a vision.
Quoted text (1 line)
>
Are you aware of my proposal for network assurance contracts?
There is a discussion here:
https://www.mail-archive.com/bitcoin-development@lists.sourceforge.net/msg07552.html
But I agree with Gavin that attempting to plan for 20 years from now is ambitious at best. Bitcoin might not even exist 20 years from now, or might be an abandoned backwater a la USENET.
Hello Mike,
Quoted text (3 lines)
> > Are you aware of my proposal for network assurance contracts? >
Yes I am aware of that; sorry for not mentioning it. I think it is an interesting proposal, but I would not rely on it today, because it includes a large share of unproven social experiment.
(Bitcoin too is a social experiment, but so far it has been working)
Quoted text (3 lines)
> But I agree with Gavin that attempting to plan for 20 years from now is > ambitious at best. Bitcoin might not even exist 20 years from now, or might > be an abandoned backwater a la USENET.
I agree with that, but I don't think it can be used as a way to justify how decisions are made today.
The opposition to block size increase comes from two things: (1) The perceived risk of increased centralization. (2) Long-term considerations on the need for fee pressure.
I believe you and Gavin have properly addressed (1). Concerning (2), I think the belief that miners can eventually be funded by a fee market is wishful thinking. Thus, I am not against the proposed block size increase.
However, the issue of long-term mining incentives remains. So far, the only proven method to incentivize mining has been direct block reward.
The easiest solution to ensure long-term viability of Bitcoin would be to put an end to the original block halving schedule, and to keep the block reward constant (this is what Monero does, btw). That solution is inflationary, but in practice, users happen to lose private keys all the time. The rate of coins loss would eventually converge to whatever rate of emission is chosen, because the care people take of their coins depends on their value.
Another solution, that does not break Bitcoin's social contract, would be to keep the original block halving schedule, but to allow miners to also redeem lost coins (defined as: coins that have not moved for a fixed number of years. Some time averaging of the lost coins may be needed in order to prevent non-productive miner strategies). That solution would create less uncertainty on the actual money supply, and better acceptability.
I do not expect such a solution to be adopted before miner incentives become a problem. Neither am I attempting to predict the future; a completely different solution might be found before the problem arises, or Bitcoin might stop to exist for some other reason.
However, if I had to decide today, I would choose such a solution, instead of relying on completely unproven mechanisms.
More important, since we need to decide about block size today, I want to make it clear that my support is motivated by that long-term possibility. I believe that the "we will need fee pressure" argument can reasonably be dismissed, not because we don't know how Bitcoin will work in 20 years, but because we know how it works today, and it is not thanks to fee pressure.
Thomas
I wrote an article that explains the hashing assurance contract concept:
https://medium.com/@octskyward/hashing-7d04a887acc8
(it doesn't contain an in depth protocol description)
On Wed, May 27, 2015 at 9:59 PM, Mike Hearn <mike@plan99•net> wrote:
Quoted text (5 lines)
> I wrote an article that explains the hashing assurance contract concept: > > https://medium.com/@octskyward/hashing-7d04a887acc8 > > (it doesn't contain an in depth protocol description)
The prior (and seemingly this) assurance contract proposals pay the miners who mines a chain supportive of your interests and miners whom mine against your interests identically.
There is already a mechanism built into Bitcoin for paying for security which doesn't have this problem, and which mitigates the common action problem of people just sitting around for other people to pay for security: transaction fees. Fixing the problem with assurance contracts effectively makes them end up working like transaction fees in any case. Considering the near-failure in just keeping development funded, I'm not sure where the believe this this model will be workable comes from; in particular unlike a lighthouse (but like development) security is ongoing and not primarily a fixed one time cost. I note that many existing crowdfunding platforms (including your own) do not do ongoing costs with this kind of binary contract.
Also work reminding people that mining per-contract is a long identified existential risk to Bitcoin which has been seeing more analysis lately: http://www.jbonneau.com/doc/BFGKN14-bitcoin_bribery.pdf
Quoted text (5 lines)
> > The prior (and seemingly this) assurance contract proposals pay the > miners who mines a chain supportive of your interests and miners whom > mine against your interests identically. >
The same is true today - via inflation I pay for blocks regardless of whether they contain or double spend my transactions or not. So I don't see why it'd be different in future.
Quoted text (4 lines)
> There is already a mechanism built into Bitcoin for paying for > security which doesn't have this problem, and which mitigates the > common action problem of people just sitting around for other people > to pay for security: transaction fees.
The article states quite clearly that assurance contracts are proposed only if people setting transaction fees themselves doesn't work. There's some reasonably good arguments that it probably won't work, but I don't assign very high weight to game theoretic arguments these days so it wouldn't surprise me if Satoshi's original plan worked out OK too.
Of course, by the time this matters I plan to be sipping a pina colada on my private retirement beach :) It's a problem the next generation can tackle, as far as I am concerned.
Quoted text (2 lines)
> Considering the near-failure in just keeping development funded, I'm not > sure where the believe this this model will be workable comes from
Patience :)
Right now it's a lot easier to get development money from VC funds and rich benefactors than raising it directly from the community, so unsurprisingly that's what most people do.
Despite that, the Hourglass design document project now has sufficient pre-pledges that it should be possible to crowdfund it successfully once I get around to actually doing the work. And BitSquare was able to raise nearly half of their target despite an incredibly aggressive deadline and the fact that they hadn't shipped a usable prototype. I think as people get better at crafting their contracts and people get more experience with funding work this way, we'll see it get more common.
But yes. Paying for things via assurance contracts is a long term and very experimental plan, for sure.
Quoted text (4 lines)
> one time cost. I note that many existing crowdfunding platforms > (including your own) do not do ongoing costs with this kind of binary > contract. >
Lighthouse wasn't written to do hashing assurance contracts, so no, it doesn't have such a feature. Perhaps in version 2.