5 ms·

The difference is that there exists no proof that PoS is even possible. It exists purely as a rhetorical tool, used to attack the energy consumption of PoW.

viraptor 8y ago
What do you mean no proof? I'm not saying any of these are worth much in global economy, but they definitely exist as a proof PoS works: https://www.poslist.org/ https://www.poslist.org/
xref 8y ago
Soooo, how about we try it? There existed no proof PoW was even possible, and then Bitcoin tried it and here we are today.
- icelancer 8y ago
  Nothing is stopping you from doing exactly that.
DennisP 8y ago
Actually there are formal proofs for the properties of various PoS designs, both in the Ethereum research community and outside it with academic projects. It's a fairly active area of research.
latchkey 8y ago
There are 500+ coins implementing some variation of PoS. Some are just copies, so the actual number is lower. Some are really innovative ideas that enable a whole new class of functionality that could not be accomplished with just PoW.
Sargos 8y ago
IOHK (Cardano) has proven that PoS is just as safe as PoW with actual mathematical proofs that are peer reviewed by actual cryptography professors. This is actually a big step forward as we now have trust that there's a system that acts the exact same way as PoW but in a vastly more energy efficient way in PoS. This almost relegates PoW to a legacy technology as there's no reason to use it anymore. https://twitter.com/IOHK_Charles/status/989540452322836480 https://twitter.com/IOHK_Charles/status/989540452322836480
- dlubarov 8y ago
  I think that Ouroboros paper [1] is a bit overhyped. A common criticism of proof of stake is that an attacker could acquire private keys to old accounts whose coins have already been spent, then use those to build a long fork. It has been shown [2] that these attacks are not wholly preventable if we assume that posterior corruption will happen: > We shall formally prove that absent additional trust assumptions, it is impossible to achieve consensus in the presence of posterior corruptions when nodes can join or rejoin late. The only tool we have to defend against posterior corruption attacks is checkpointing. If we treat blocks beyond a certain age T as irreversible checkpoints, and posterior corruption requires going back farther than T (because of staker withdrawal delays), then continuously running nodes won't be fooled by posterior corruption forks. New nodes, or nodes which went offline for a long period, could still be fooled, but they can always "ask a friend" for a recent checkpoint. This approach is what Vitalik [3] and others call weak subjectivity. Charles et al. like to imply that they've solved this problem without resorting to weak subjectivity, but their "solution" to posterior corruption attacks is to mandate that honest parties delete private keys after using them: > in order to achieve adaptive security the blocks are signed using a key-evolving signature scheme F_KES instead of a standard signature, and honest parties are mandated to update their private key in each slot. It isn't much of a solution, since users have no incentive to delete their old private keys. [1] https://eprint.iacr.org/2018/378 https://eprint.iacr.org/2018/378 [2] https://eprint.iacr.org/2016/919 https://eprint.iacr.org/2016/919 [3] https://blog.ethereum.org/2014/11/25/proof-stake-learned-love-weak-subjectivity/ https://blog.ethereum.org/2014/11/25/proof-stake-learned-lov...
pontifier 8y ago
I'm still unconvinced about proof of stake. I've never seen a satisfactory answer to what happens if the chosen stakeholders are unwilling or unable to forge the next block in a timely manner. I'll do some more research, but this problem still nags at me.
- DennisP 8y ago
  There's a similar attack in PoW: a 51% attacker can just make empty blocks. Either way, if your attacker is persistent and too dominant to beat, you can fix it with a hard fork. In PoW you change hash functions; you can generally do this only once for each hash implemented in ASICs and then you're down to general-purpose hardware and new functions don't help you. In PoS, you can make a fork that simply eliminates the attacker's stake. You can continue this as many times as necessary. This is, of course, the last-ditch remedy, applicable to any PoS protocol. Researchers do aim for "liveness," and can prove how dominant an attacker has to be to break it.

viraptor 8y ago

What do you mean no proof? I'm not saying any of these are worth much in global economy, but they definitely exist as a proof PoS works: https://www.poslist.org/ https://www.poslist.org/

xref 8y ago

Soooo, how about we try it? There existed no proof PoW was even possible, and then Bitcoin tried it and here we are today.

icelancer 8y ago
Nothing is stopping you from doing exactly that.

DennisP 8y ago

Actually there are formal proofs for the properties of various PoS designs, both in the Ethereum research community and outside it with academic projects. It's a fairly active area of research.

latchkey 8y ago

There are 500+ coins implementing some variation of PoS. Some are just copies, so the actual number is lower. Some are really innovative ideas that enable a whole new class of functionality that could not be accomplished with just PoW.

Sargos 8y ago

IOHK (Cardano) has proven that PoS is just as safe as PoW with actual mathematical proofs that are peer reviewed by actual cryptography professors. This is actually a big step forward as we now have trust that there's a system that acts the exact same way as PoW but in a vastly more energy efficient way in PoS. This almost relegates PoW to a legacy technology as there's no reason to use it anymore. https://twitter.com/IOHK_Charles/status/989540452322836480 https://twitter.com/IOHK_Charles/status/989540452322836480

dlubarov 8y ago
I think that Ouroboros paper [1] is a bit overhyped. A common criticism of proof of stake is that an attacker could acquire private keys to old accounts whose coins have already been spent, then use those to build a long fork. It has been shown [2] that these attacks are not wholly preventable if we assume that posterior corruption will happen: > We shall formally prove that absent additional trust assumptions, it is impossible to achieve consensus in the presence of posterior corruptions when nodes can join or rejoin late. The only tool we have to defend against posterior corruption attacks is checkpointing. If we treat blocks beyond a certain age T as irreversible checkpoints, and posterior corruption requires going back farther than T (because of staker withdrawal delays), then continuously running nodes won't be fooled by posterior corruption forks. New nodes, or nodes which went offline for a long period, could still be fooled, but they can always "ask a friend" for a recent checkpoint. This approach is what Vitalik [3] and others call weak subjectivity. Charles et al. like to imply that they've solved this problem without resorting to weak subjectivity, but their "solution" to posterior corruption attacks is to mandate that honest parties delete private keys after using them: > in order to achieve adaptive security the blocks are signed using a key-evolving signature scheme F_KES instead of a standard signature, and honest parties are mandated to update their private key in each slot. It isn't much of a solution, since users have no incentive to delete their old private keys. [1] https://eprint.iacr.org/2018/378 https://eprint.iacr.org/2018/378 [2] https://eprint.iacr.org/2016/919 https://eprint.iacr.org/2016/919 [3] https://blog.ethereum.org/2014/11/25/proof-stake-learned-love-weak-subjectivity/ https://blog.ethereum.org/2014/11/25/proof-stake-learned-lov...

pontifier 8y ago

I'm still unconvinced about proof of stake. I've never seen a satisfactory answer to what happens if the chosen stakeholders are unwilling or unable to forge the next block in a timely manner. I'll do some more research, but this problem still nags at me.

DennisP 8y ago
There's a similar attack in PoW: a 51% attacker can just make empty blocks. Either way, if your attacker is persistent and too dominant to beat, you can fix it with a hard fork. In PoW you change hash functions; you can generally do this only once for each hash implemented in ASICs and then you're down to general-purpose hardware and new functions don't help you. In PoS, you can make a fork that simply eliminates the attacker's stake. You can continue this as many times as necessary. This is, of course, the last-ditch remedy, applicable to any PoS protocol. Researchers do aim for "liveness," and can prove how dominant an attacker has to be to break it.