6 ms·
Why Scaling Bitcoin with Sharding Is Very Hard (2015)
- davidgerard 9y agothis is pretty good. Key line for me: > How do you prove that a coin has validly been spent? First, prove that it hasn’t already been spent! How do you do that if you don’t have the blockchain data? You can’t, and no amount of fancy math can change that. and also, something Bitcoin devs realise that Bitcoin fans often don't seem to: > On the other hand, decentralization isn’t cheap: using PayPal is one or two orders of magnitude simpler than the Bitcoin protocol.
- janitor61 9y agoWhy couldn't you use a sufficiently large bloom filter to determine if a coin has been spent?
- deleted 9y ago[deleted]
- thinkloop 9y agoHow do you verify the authenticity of the bloom filter?
- teddyh 9y agoThat’s not really a problem – anyone could verify it by downloading the full blockchain. The important thing is that you don’t need the full blockchain to get a negative answer from a bloom filter, which helps. The problem happens when you get a positive answer from the bloom filter; i.e. a coin might have been previously spent. As far as I know you then still need the full blockchain to verify.
- deleted 9y ago[deleted]
- mrb 9y ago> How do you prove that a coin has validly been spent? First, prove that it hasn’t already been spent! How do you do that if you don’t have the blockchain data? You can't There is actually a trivial way to do it. We could prune ~98% of the blockchain data by committing to a UTXO set. We call this UTXO set commitment. Here is a very brief overview of how it works (this is not classic "pruning", and this is something I wrote before being aware of UTXO set commitment, but still it's a good introduction to the general concept): https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-November/015296.html https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017... I'm actually surprised Peter doesn't touch the subject since he's been researching this idea himself. IMHO, UTXO set commitment is one of the most promising, if not most promising way to scale the blockchain. Sadly it seems to be under-researched compared to other alternatives.
- indolering 9y agoIt was the great hope early on, but it turned out to be impractical to implement.
- rocqua 9y agoWhat are the practical issues? Serialization of the UTXO set? Dealing with large rollbacks? Time spent computing the hash? None of those seem impractical.
- apo 9y agoThere's some detail here: TXO commitments aren’t a new idea - the author proposed them years ago2 in response to UTXO commitments. However it’s critical for small miners’ orphan rates that block validation be fast, and so far it has proven difficult to create (U)TXO implementations with acceptable performance; updating and recalculating cryptographicly hashed merkelized datasets is inherently more work than not doing so. Fortunately if we maintain a UTXO set for recent outputs, TXO commitments are only needed when spending old, archived, outputs. We can take advantage of this by delaying the commitment, allowing it to be calculated well in advance of it actually being used, thus changing a latency-critical task into a much easier average throughput problem. https://petertodd.org/2016/delayed-txo-commitments https://petertodd.org/2016/delayed-txo-commitments
- DennisP 9y agoIt's hard but not necessarily impossible. Here's Ethereum's sharding FAQ: https://github.com/ethereum/wiki/wiki/Sharding-FAQ https://github.com/ethereum/wiki/wiki/Sharding-FAQ
- Frogolocalypse 9y agoThe fact that it isn't working yet, if it ever works at all, is a good indication of the problems faced.
- x3sphere 9y agoYes it's not implemented yet. I think Vitalik said the first phase of sharding is planned to be implemented later next year. So we'll see.
- vmialik 9y agoHi Dennis, a friend recommended you to me for Ethereum smart contract audit, are you open/available for a project?
- DennisP 9y agoWilling to talk at least, how do I contact you?
- wyldfire 9y agoSome coins do sharding by not using a blockchain at all. e.g. RaiBlocks [1] uses a "block-lattice" approach. It is a Proof-of-stake-secured coin. [1] https://raiblocks.net/media/RaiBlocks_Whitepaper.pdf https://raiblocks.net/media/RaiBlocks_Whitepaper.pdf
- Frogolocalypse 9y agoProof of stake is not trustless.
- wyldfire 9y agoIndeed, that's the case. It's an important distinction, but one which may not matter as much as it used to.
- nerdponx 9y agoThere's also the Iota "Tangle": https://iota.org/IOTA_Whitepaper.pdf https://iota.org/IOTA_Whitepaper.pdf
- xorcist 9y agoSharding isn't any easier with the Tangle.
- epx 9y agoBitcoin is over.
- quickthrower2 9y ago... $15,000
- wslh 9y agoSPECTRE: https://medium.com/@avivzohar/the-spectre-protocol-7dbbebb707b5 https://medium.com/@avivzohar/the-spectre-protocol-7dbbebb70...
- tfha 9y agoThat is not a sharded blockchain and shares the same fundamental restriction: all nodes must verify all blocks. (though it does offer some nice improvements, we're taking factors of 2-5, not 100-1000)