10 ms·

As a new user in a Proof-of-Stake protocol, how do I determine which chain to follow? With PoW I can choose the 'longest' chain (chain with the most total work

As a new user in a Proof-of-Stake protocol, how do I determine which chain to follow? With PoW I can choose the 'longest' chain (chain with the most total work).

stale2002 8y ago
Easy. You'd probably pick the one with the biggest market cap. The whole point of money is that it is useful because everyone else is using it. So the one with the biggest market cap is almost certainly the one that you'd want to follow. Or you could not do that. You could instead pick a different one. There is nothing stopping you. If there are multiple networks, it would be obvious, and you can merely make up your own mind about which to follow. Interestingly enough, this also applies to POW chains. There is nothing stopping you from picking a shorter chain. But if I had to guess, I would say that almost nobody would be following the shorter one. This applies to POS coins as well. There would likely be 1 chain, that everyone is following. And this one chain would be obvious.
CryptoPunk 8y ago
The client you download tells you, by giving you an accurate recent snapshot of the state.
- keymone 8y ago
  So one has to trust distributors of the software? I mean it’s been known about PoS systems since inception, it’s just funny how it’s supporters never like to admit it.
  - CryptoPunk 8y ago
    Yes but you have to trust the distributors of the software anyway, even in PoW.
    - keymone 8y ago
      No you don’t. You only need to know consensus rules. You can use any software, you can build it yourself, you can order an audit, you can write software yourself. Proof of work committed to the chain that is valid according to consensus rules you know is universal and objective measure that everyone will observe equally. That’s where bitcoin’s security comes from and that’s how you can avoid to rely on trusting third parties.
      - bhaak 8y ago
        How do you know the consensus rules?
        keymone 8y ago
        from the internet. are you now going to argue that there is no difference between knowing a couple pages of text that describe how a system should work from downloading and running opaque binary from untrusted source?
        bhaak 8y ago
        I would like to see that couple pages of text that describe the Bitcoin consensus rules in such a detail that you could do a clean room implementation of a Bitcoin client. Hint: They don't exist. That's because the specification of the consensus rules are in the reference implementation of Bitcoin and every other implementation has to implement the same behavior as the C++ client, including any possible programming mistakes. So you only know if your re-implementation works "correctly" if you download and run it against an opaque binary from an untrusted(?) source. Whatever you do, you need to anchor your trust somewhere. You should always be aware where you anchor it and what trade-offs there are.
        keymone 8y ago
        it is true that bitcoin has a reference specification, but only a small subset of that code is actual consensus code, but the rest of your message is just bs. knowing consensus rules is the easy bit - code is open source, there are multiple implementations, there is community, there are users, merchants, exchanges - they all agree what consensus rules are. but what's most important - I CAN VALIDATE FULL BITCOIN BLOCKCHAIN IN REASONABLE AMOUNT OF TIME AND VERIFY THAT I FOLLOW THE CORRECT CHAIN. you seem to have forgotten what this thread is about. it's a short one - i'm sure you can track back and read it again, carefully. edit: clarification.
rictic 8y ago
I haven't looked into this in quite some time, but as I recall, a new user can look at the available chains and determine which has the majority of stake behind it. Is there a subtlety that makes that unworkable?
- runeks 8y ago
  > Is there a subtlety that makes that unworkable? The reason this can’t work is because it has no cost to create a new chain from scratch. I can create a thousand valid PoS chains in virtually no time, and there’s no decentralized way for you to choose the one everyone else chooses. The only way to solve this is to give special rights to some set of stakers.
  - rictic 8y ago
    Isn't that only an issue for a chain that's starting from PoS from the beginning? Ethereum already has a PoW chain that they plan to turn into PoS. If the ethereum protocol agreement is to switch to PoS at block N, then I don't see how you can create a valid-looking N+1 block without yourself putting a large amount of real eth at stake.
    - runeks 8y ago
      That’s a good point. I’ll have to think about that.
regisg 8y ago
It's solved for Cardano (Genesis). A new user can determine which chain to follow without relying on third parties.
- phlip9 8y ago
  I'm skeptical of this claim. From the Cardano paper [1] p. 47, > Even if the attacker could find a strategy to generate an alternative chain with valid leader selection data, presenting this chain and its blocks generated at slots that are far ahead of time would not result in a successful attack since those blocks far ahead of time would be rejected by the honest stakeholders and the final alternative chain would be shorter than the main chain. At first glance, the attacker then needs to gain the keys for almost all of the bonded stake at some point in the past. This is obviously a stricter requirement than holding keys for 2/3+ of the stake at some point in the past, but still seems remotely plausible when targeting the small set of validators in the early bootstrapping period. Remember also that these early validators could be totally cashed out of the system and thus have actually have no disincentive not to sell their keys. Actually, even controlling only 2/3+ of some past stake, the attacker can likely grind on the randomness beacon outputs (since they control all the shares) to ensure his controlled keys have near 100% of the slots in the next epoch. Then the long range fork would be of a similar or possibly even greater length than the honest fork. [1] https://eprint.iacr.org/2016/889.pdf https://eprint.iacr.org/2016/889.pdf
- runeks 8y ago
  How?

As a new user in a Proof-of-Stake protocol, how do I determine which chain to follow? With PoW I can choose the 'longest' chain (chain with the most total work).

stale2002 8y ago

Easy. You'd probably pick the one with the biggest market cap. The whole point of money is that it is useful because everyone else is using it. So the one with the biggest market cap is almost certainly the one that you'd want to follow. Or you could not do that. You could instead pick a different one. There is nothing stopping you. If there are multiple networks, it would be obvious, and you can merely make up your own mind about which to follow. Interestingly enough, this also applies to POW chains. There is nothing stopping you from picking a shorter chain. But if I had to guess, I would say that almost nobody would be following the shorter one. This applies to POS coins as well. There would likely be 1 chain, that everyone is following. And this one chain would be obvious.

CryptoPunk 8y ago

The client you download tells you, by giving you an accurate recent snapshot of the state.

keymone 8y ago
So one has to trust distributors of the software? I mean it’s been known about PoS systems since inception, it’s just funny how it’s supporters never like to admit it.
- CryptoPunk 8y ago
  Yes but you have to trust the distributors of the software anyway, even in PoW.
  - keymone 8y ago
    No you don’t. You only need to know consensus rules. You can use any software, you can build it yourself, you can order an audit, you can write software yourself. Proof of work committed to the chain that is valid according to consensus rules you know is universal and objective measure that everyone will observe equally. That’s where bitcoin’s security comes from and that’s how you can avoid to rely on trusting third parties.
    - bhaak 8y ago
      How do you know the consensus rules?
      - keymone 8y ago
        from the internet. are you now going to argue that there is no difference between knowing a couple pages of text that describe how a system should work from downloading and running opaque binary from untrusted source?
        bhaak 8y ago
        I would like to see that couple pages of text that describe the Bitcoin consensus rules in such a detail that you could do a clean room implementation of a Bitcoin client. Hint: They don't exist. That's because the specification of the consensus rules are in the reference implementation of Bitcoin and every other implementation has to implement the same behavior as the C++ client, including any possible programming mistakes. So you only know if your re-implementation works "correctly" if you download and run it against an opaque binary from an untrusted(?) source. Whatever you do, you need to anchor your trust somewhere. You should always be aware where you anchor it and what trade-offs there are.
        keymone 8y ago
        it is true that bitcoin has a reference specification, but only a small subset of that code is actual consensus code, but the rest of your message is just bs. knowing consensus rules is the easy bit - code is open source, there are multiple implementations, there is community, there are users, merchants, exchanges - they all agree what consensus rules are. but what's most important - I CAN VALIDATE FULL BITCOIN BLOCKCHAIN IN REASONABLE AMOUNT OF TIME AND VERIFY THAT I FOLLOW THE CORRECT CHAIN. you seem to have forgotten what this thread is about. it's a short one - i'm sure you can track back and read it again, carefully. edit: clarification.

rictic 8y ago

I haven't looked into this in quite some time, but as I recall, a new user can look at the available chains and determine which has the majority of stake behind it. Is there a subtlety that makes that unworkable?

runeks 8y ago
> Is there a subtlety that makes that unworkable? The reason this can’t work is because it has no cost to create a new chain from scratch. I can create a thousand valid PoS chains in virtually no time, and there’s no decentralized way for you to choose the one everyone else chooses. The only way to solve this is to give special rights to some set of stakers.
- rictic 8y ago
  Isn't that only an issue for a chain that's starting from PoS from the beginning? Ethereum already has a PoW chain that they plan to turn into PoS. If the ethereum protocol agreement is to switch to PoS at block N, then I don't see how you can create a valid-looking N+1 block without yourself putting a large amount of real eth at stake.
  - runeks 8y ago
    That’s a good point. I’ll have to think about that.

regisg 8y ago

It's solved for Cardano (Genesis). A new user can determine which chain to follow without relying on third parties.

phlip9 8y ago
I'm skeptical of this claim. From the Cardano paper [1] p. 47, > Even if the attacker could find a strategy to generate an alternative chain with valid leader selection data, presenting this chain and its blocks generated at slots that are far ahead of time would not result in a successful attack since those blocks far ahead of time would be rejected by the honest stakeholders and the final alternative chain would be shorter than the main chain. At first glance, the attacker then needs to gain the keys for almost all of the bonded stake at some point in the past. This is obviously a stricter requirement than holding keys for 2/3+ of the stake at some point in the past, but still seems remotely plausible when targeting the small set of validators in the early bootstrapping period. Remember also that these early validators could be totally cashed out of the system and thus have actually have no disincentive not to sell their keys. Actually, even controlling only 2/3+ of some past stake, the attacker can likely grind on the randomness beacon outputs (since they control all the shares) to ensure his controlled keys have near 100% of the slots in the next epoch. Then the long range fork would be of a similar or possibly even greater length than the honest fork. [1] https://eprint.iacr.org/2016/889.pdf https://eprint.iacr.org/2016/889.pdf
runeks 8y ago
How?