4 ms·

(regarding the true randomness source) I believe there would be no trouble propagating this to all nodes, by out-of-band means if necessary. Similarly,

(regarding the true randomness source) I believe there would be no trouble propagating this to all nodes, by out-of-band means if necessary. Similarly, surviving on a deserted island is easy - I believe you'll have no trouble finding a can opener and plenty of canned food. If your solution to a distributed consensus problem starts with "assume all parties cooperate and agree on a continually-updating feed of data", it's not exactly compelling. Also, there's no need to make up words like "remurrage" - economics already has "deflation" for when HODLing currency returns a positive amount.

alextheparrot 9y ago
To be fair regarding your last critique, we could also say there’s no need to make up words such as “HODLing” when English already has “holding”. I believe the key idea the author wanted to convey with their new word is that the positive amount is returned explicitly because the quantity of the currency has decreased. This is a particular case of deflation, so it isn’t completely odd to consider introducing a word that succinctly captures that meaning.
jerf 9y ago
I think that would be easy to fix, though. Hash every X'th block in some manner, to take effect in 5X blocks or whatever, would probably be good enough. Again, if someone is manipulating literally every bit of an accepted block successfully to successfully hack you via this method, your currency already has a problem. There's enough agreed-upon entropy lying around for this to work.
- DennisP 9y ago
  A method for really strong randomness is threshold signatures, like DFinity is using. As long as you get M of N submitters you get a random result which none of them can predict or manipulate; it's the same result no matter which M submit. But I think it depends on elliptic curves, so it'd be vulnerable to quantum computers. Another possibility is for participants to submit a hash of a random number, and then submit their preimages in a second round, with a deposit that gets slashed if they fail to submit the second round. A third approach is for participants to submit random numbers, and then to use a lengthy hashing phase to generate the random result, with a trick to more quickly verify the result: https://www.reddit.com/r/ethereum/comments/4mdkku/could_ethereum_do_this_better_tor_project_is/d3v6djb/ https://www.reddit.com/r/ethereum/comments/4mdkku/could_ethe...
contravariant 9y ago
Similarly they write: >There are in fact some further issues, to do with making sure it's not cheap for a miner to re-exhibit their proof (of having performed a suitably substantial burn a suitably long time ago) on multiple competing chains. Details to follow. which kind of seems like a major omission, as this is the one thing a proof of X should protect against.
- DennisP 9y ago
  Seems like that could be defended with Casper's approach: use security deposits, slash them for burn reuse, and reward anyone who provides proof of reuse.
  - contravariant 9y ago
    Well yeah, you can use any proof of work, proof of stake system to prevent it. However if you've got one of those, what would you need the proof of burn for?
    - DennisP 9y ago
      Proof of stake is more than just that. Arguably it does make proof of burn obsolete, but it might still be worth exploring burn+slash mechanisms.
  - runeks 9y ago
    The problem is that the miners -- whose fraud is proven with a transaction -- have the responsibility of including this transaction in the chain they control. Which means the only solution is to fork: now we have two or more chains (any number of valid chains which includes this proof can exist) -- how do we reach consensus on which to follow? Before the fraud, the miners were allegedly responsible for reaching consensus. And when they commit fraud, it's assumed that the network can reach consensus without the miners (on a single, valid chain which includes the proof of miner fraud). If everyone except the miners were able to reach consensus on a single chain in the first place, why did we need the miners?

alextheparrot 9y ago

To be fair regarding your last critique, we could also say there’s no need to make up words such as “HODLing” when English already has “holding”. I believe the key idea the author wanted to convey with their new word is that the positive amount is returned explicitly because the quantity of the currency has decreased. This is a particular case of deflation, so it isn’t completely odd to consider introducing a word that succinctly captures that meaning.

jerf 9y ago

I think that would be easy to fix, though. Hash every X'th block in some manner, to take effect in 5X blocks or whatever, would probably be good enough. Again, if someone is manipulating literally every bit of an accepted block successfully to successfully hack you via this method, your currency already has a problem. There's enough agreed-upon entropy lying around for this to work.

DennisP 9y ago
A method for really strong randomness is threshold signatures, like DFinity is using. As long as you get M of N submitters you get a random result which none of them can predict or manipulate; it's the same result no matter which M submit. But I think it depends on elliptic curves, so it'd be vulnerable to quantum computers. Another possibility is for participants to submit a hash of a random number, and then submit their preimages in a second round, with a deposit that gets slashed if they fail to submit the second round. A third approach is for participants to submit random numbers, and then to use a lengthy hashing phase to generate the random result, with a trick to more quickly verify the result: https://www.reddit.com/r/ethereum/comments/4mdkku/could_ethereum_do_this_better_tor_project_is/d3v6djb/ https://www.reddit.com/r/ethereum/comments/4mdkku/could_ethe...

contravariant 9y ago

Similarly they write: >There are in fact some further issues, to do with making sure it's not cheap for a miner to re-exhibit their proof (of having performed a suitably substantial burn a suitably long time ago) on multiple competing chains. Details to follow. which kind of seems like a major omission, as this is the one thing a proof of X should protect against.

DennisP 9y ago
Seems like that could be defended with Casper's approach: use security deposits, slash them for burn reuse, and reward anyone who provides proof of reuse.
- contravariant 9y ago
  Well yeah, you can use any proof of work, proof of stake system to prevent it. However if you've got one of those, what would you need the proof of burn for?
  - DennisP 9y ago
    Proof of stake is more than just that. Arguably it does make proof of burn obsolete, but it might still be worth exploring burn+slash mechanisms.
- runeks 9y ago
  The problem is that the miners -- whose fraud is proven with a transaction -- have the responsibility of including this transaction in the chain they control. Which means the only solution is to fork: now we have two or more chains (any number of valid chains which includes this proof can exist) -- how do we reach consensus on which to follow? Before the fraud, the miners were allegedly responsible for reaching consensus. And when they commit fraud, it's assumed that the network can reach consensus without the miners (on a single, valid chain which includes the proof of miner fraud). If everyone except the miners were able to reach consensus on a single chain in the first place, why did we need the miners?