4 ms·

I don't care much if the waste is in energy or hardware or in any other resource. And the level of waste depends only on the block reward and the price of ETH,

by zby 8y ago

I don't care much if the waste is in energy or hardware or in any other resource. And the level of waste depends only on the block reward and the price of ETH, not the algorithm used, because as long as it is profitable people will burn resources to get the rewards. In free competition people will do that until it gets unprofitable and it gets unprofitable when they burn as much value as they get from the reward. This is MC=MR argument - first presented in: http://www.truthcoin.info/blog/pow-cheapest/ http://www.truthcoin.info/blog/pow-cheapest/ . I believe it is possible that PoS is still more efficient than PoW - by being more secure with the same block reward: https://medium.com/@zby/proof-of-stake-can-be-cheaper-than-proof-of-work-da14223a965 https://medium.com/@zby/proof-of-stake-can-be-cheaper-than-p... , but still the main point holds: the waste depends on the reward not the algo.

DennisP 8y ago
Yes but the waste in PoS is just the opportunity cost of locking up capital, not anything physical. Your first link argues that the cost is still physical because of stake grinding, but there are solutions to stake grinding.
- keymone 8y ago
  > opportunity cost of locking up capital that's one part and it is also paid by PoW miners by buying the hardware. then there is another part - block rewards. where's MC=MR int hat for PoS? > solutions to stake grinding only ones that involve trusted third parties.
  - DennisP 8y ago
    So the basic idea of stake grinding is that by trying lots of different things, the staker can increase his odds of being the one to create a new block. This can be prevented without trusted third parties if you have a collaborative way to generate random numbers, which cannot be manipulated by the stakers. For example, in Dfinity they use threshold signatures. If any m of n stakers submit their part of the signature, a random number is created; no smaller subset of stakers can predict what that number will be, and the number is the same regardless of which stakers submit. (The number is used to choose the staker who produces the block.) A similar attack is to sign multiple histories, so regardless of which is accepted, you get some reward. In Ethereum, if you do this then you're penalized, losing some or all of your stake (depending on size of the attack). Any staker can see the evidence that you signed conflicting histories, and submit the evidence to the winning chain, receiving a small reward for doing so and destroying your stake.
    - keymone 8y ago
      > If any m of n stakers submit their part of the signature, a random number is created; no smaller subset of stakers can predict what that number will be, and the number is the same regardless of which stakers submit. so the number is known just from who is participating in the scheme? who controls the `n`? > Any staker can see the evidence that you signed conflicting histories what if there is a temporary network split? everybody who signed on chain A is now malicious actor if they sign on chain B and vice versa.
      - DennisP 8y ago
        The number isn't known until all m submit their signatures. I think n is a protocol parameter, so the community will decide by the software they agree to run. If you sign conflicting blocks you get penalized, but "conflicting" is tightly defined. E.g. signing two different blocks at the same block height is a conflict. That's not something you can do if you're on one side of a network split, and it's certainly something you can avoid doing.
        keymone 8y ago
        > signing two different blocks at the same block height is a conflict i don't need to sign at same height to be a participant in an attack.
        DennisP 8y ago
        That's true. There are several specific slashing conditions, and I forget the exact details, but they're all similarly well-defined and limited. There are proofs that the network converges properly as long as most stake obeys those conditions, and that's why only violations of those conditions are penalized.
        keymone 8y ago
        > There are proofs that the network converges properly as long as people don't violate those conditions do you have a link to those proofs? i've seen proofs already where underlying assumptions were something like "majority of nodes are honest" or "network is reliable", etc.

by zby 8y ago

DennisP 8y ago

Yes but the waste in PoS is just the opportunity cost of locking up capital, not anything physical. Your first link argues that the cost is still physical because of stake grinding, but there are solutions to stake grinding.

keymone 8y ago
> opportunity cost of locking up capital that's one part and it is also paid by PoW miners by buying the hardware. then there is another part - block rewards. where's MC=MR int hat for PoS? > solutions to stake grinding only ones that involve trusted third parties.
- DennisP 8y ago
  So the basic idea of stake grinding is that by trying lots of different things, the staker can increase his odds of being the one to create a new block. This can be prevented without trusted third parties if you have a collaborative way to generate random numbers, which cannot be manipulated by the stakers. For example, in Dfinity they use threshold signatures. If any m of n stakers submit their part of the signature, a random number is created; no smaller subset of stakers can predict what that number will be, and the number is the same regardless of which stakers submit. (The number is used to choose the staker who produces the block.) A similar attack is to sign multiple histories, so regardless of which is accepted, you get some reward. In Ethereum, if you do this then you're penalized, losing some or all of your stake (depending on size of the attack). Any staker can see the evidence that you signed conflicting histories, and submit the evidence to the winning chain, receiving a small reward for doing so and destroying your stake.
  - keymone 8y ago
    > If any m of n stakers submit their part of the signature, a random number is created; no smaller subset of stakers can predict what that number will be, and the number is the same regardless of which stakers submit. so the number is known just from who is participating in the scheme? who controls the `n`? > Any staker can see the evidence that you signed conflicting histories what if there is a temporary network split? everybody who signed on chain A is now malicious actor if they sign on chain B and vice versa.
    - DennisP 8y ago
      The number isn't known until all m submit their signatures. I think n is a protocol parameter, so the community will decide by the software they agree to run. If you sign conflicting blocks you get penalized, but "conflicting" is tightly defined. E.g. signing two different blocks at the same block height is a conflict. That's not something you can do if you're on one side of a network split, and it's certainly something you can avoid doing.
      - keymone 8y ago
        > signing two different blocks at the same block height is a conflict i don't need to sign at same height to be a participant in an attack.
        DennisP 8y ago
        That's true. There are several specific slashing conditions, and I forget the exact details, but they're all similarly well-defined and limited. There are proofs that the network converges properly as long as most stake obeys those conditions, and that's why only violations of those conditions are penalized.
        keymone 8y ago
        > There are proofs that the network converges properly as long as people don't violate those conditions do you have a link to those proofs? i've seen proofs already where underlying assumptions were something like "majority of nodes are honest" or "network is reliable", etc.