7 ms·

This may be misunderstanding the function of PoW. Bitcoin PoW provides three things: selection, security, and incentive. The compute resource burn is an externa

by jl2718 6y ago

This may be misunderstanding the function of PoW. Bitcoin PoW provides three things: selection, security, and incentive. The compute resource burn is an externality, although, it also ends up providing an important function, economic distribution. For PoW to work,it has to be hard to produce, easy to verify, and most importantly, attest to one and only one state of the blockchain. The last part is where this fails as PoW. The solution to a puzzle is meaningless if the same solution can be shown as the result of two different inputs. So the puzzle must be practically unique to each proposed block (infinite possibilities), and ‘fair’ to each proposal. If you can find a useful puzzle with these properties, please don’t hold back.

dfgdghdf 6y ago
Exactly this. The PoW scheme must commit you to a particular chain.
Robotbeat 6y ago
Can you just hash a new solution to the puzzle with the new proposed block?
- proto-n 6y ago
  Solution has to depend on the proposed block, so that a solution is not reusable for the next block
  - Robotbeat 6y ago
    The solution is also announced in cleartext, so you can check against previous solutions.
    - AgentME 6y ago
      The problem is that when a miner announces a block with a solution, an attacker could immediately announce their own alternative block with the same solution and there would be a chance that the network would take up their block first.
      - Robotbeat 6y ago
        But if the legitimate miner announces & signs a hash of the solution well beforehand, they can prove theirs is the legitimate solution.
        AgentME 6y ago
        Then that adds a delay to each block being broadcast to the network. It also means that the longer a miner waits to broadcast the block, the more time a different miner has to finish a proof-of-work and claim the next block first. Miners are all racing each other, so they're all going to try to wait the most minimum amount. The logic around only accepting a block if you previously saw a signed hash is vulnerable to sybil attacks. An attacker could run thousands of nodes on the p2p network, never relay anyone else's signed hashes, steal the proof-of-works from completed blocks and then broadcast signed hashes of its own blocks with the stolen pows and then broadcast those blocks. Many users might find themselves connected to only nodes run by the attacker and would get tricked into accepting the attacker's chain. The proof-of-work not depending on the blockchain state means that a miner could queue up lots of complete proof-of-works and then mint a ton of blocks with them all at once to do a 51% attack. Any solution to this is either going to be centralized or look like proof-of-stake, and at that point, the proof-of-work is extra and not actually load-bearing at all.
    - proto-n 6y ago
      Ok, not being usable for the next block is not enough. It must not be usable for any other block. Competing chains, forks, other miners stealing your rewards, etc. Has to depend on the hash of the previous block, and also the transaction where you send the reward to yourself (-> even if someone else "steals it", you get the reward so it doesn't matter).
roboticmind 6y ago
The coin is proof of stake based. The rewards for BOINC come on top of staking. Each BOINC project that is rewarded has its stats looked up by a system of oracles and each node verifies that the oracles match up. The project themselves can be removed if they act up and there's a system for voting on which project to add and remove If you have any more questions feel free to ask me or check out the Gridcoin website https://gridcoin.us https://gridcoin.us Note: I help work on the gridcoin.us website and have ~5000 Gridcoin, so I may be biased in my view of the coin :)
- lappa 6y ago
  In that case, why have proof of stake at all? Wouldn't it be simpler to just have the set of oracles alone facilitate the currency, since they already effectively have the power to?
  - vmception 6y ago
    The market didnt tolerate oracle controlled coins when Gridcoin was released The market does tolerate that now Today you wouldnt use a new blockchain you would just issue an erc20 token with an oracle server having an admin key for distribution. You could have people merkle mine to accumulate a stake, but this is primarily to keep the “crypto/computational” branding for that audience, as the oracle aspect would still be centralized
  - roboticmind 6y ago
    The oracles don't have the power to completely run everything. With the current split for rewards, 25% of new coins is from just staking. As well, because new blocks are made only proof of stake, a 51% type attack would be also be much tougher for the oracles conspire and to pull off. Even if they tried to redirect 100% of research rewards (28750 GRC/day) to one address, it would take over 900 days to even reach the same amount as the address with the largest balance (~6% of current coin supply) [1]. Further, there's also more resiliency. If the oracles somehow broke or conspired and all said everyone did zero work, the network would still run. Now granted it would not be great that only previously pending research and PoS rewards would be given out, but you could still send coins, run polls, etc. [1] https://main.gridcoinstats.eu/address/ https://main.gridcoinstats.eu/address/ (excluding the very largest one (the foundation) because it's multisig and can't stake. In its case it would take 1000 days to reach)
DavidHilbert 6y ago
> The solution to a puzzle is meaningless if the same solution can be shown as the result of two different inputs. This isn't true. There are an infinite number of inputs that result in the same solution for bitcoin (or any hash)
- jl2718 6y ago
  Okay let’s see an example. ;)
  - powerbutton65 6y ago
    Like it or not they are technically correct. SHA-256 is a one way compression and furthermore the PoW for bitcoin doesn't require a match for the entire hash. There's loads of examples of this in the bitcoin network whenever there's been a fork and eventually orphaned blocks.
    - jl2718 6y ago
      Those are different solutions to the puzzle. Nobody has ever published a sha-256 hash collision. It has happened once with sha-1.
      - neolefty 6y ago
        The principles are the same — it's just harder to find collisions for larger digest sizes. (Although bugs in sha-1 add an interesting wrinkle to the discussion.) In fact one could argue that encryption without requiring infinite bandwidth or computation requires finite difficulty in math puzzles. So our current approach to encryption is fundamentally vulnerable to (vastly) more powerful adversary computers. Only things like quantum cryptography break free of that limitation, by changing the ground rules.
        jl2718 6y ago
        Algorithmic cryptography depends on a computation time approaching infinity for perfect security. Quantum cryptography depends on a data transmission rate approaching zero for perfect security. Either way, perfect security takes forever.
Moodles 6y ago
I once saw another example coin like this where the "useful PoW" was finding chains of prime numbers or something. However, PoW solutions were not dependent on the current blockchain sate, which rendered it insecure as someone could just stockpile solutions and then hijack the blockchain. Is it the case here too? The closest I've seen to a useful PoW coin is one which relied in intel SGX to prove that the work done was useful and honest, but of course the central root of trust is really Intel's SGX in that case.
fogof 6y ago
One of the more famous examples of a BOINC project is Rosetta@home, which asks users to determine how proteins fold. Isn't this exactly what you stipulate? You just let the binary hash of the block encode a sequence of amino acids, and then have the output be a valid block hash if the hash of the corresponding protein fold data has enough 0 bits at the beginning.
- bowmessage 6y ago
  who validates that the protein was folded correctly? Validating that the hash of some nonce contains enough leading zeroes is very easy for the network to validate. But verifying that users are correctly computing the protein folding (rather than quickly dumping out invalid folds to test hash values) seems like a difficult problem for the network to validate.
  - fogof 6y ago
    This is a good point. I was assuming that computing a protein fold was something that could be done relatively quickly, but it seems like these simulations are actually much more computationally intensive than that. This is obviously not my area of expertise, but I wonder if there is any way to make more efficient but still useful computational questions about protein folding. For example, if we try to fold just part of a protein (only 100 or so amino acids, say) and do it at a much lower fidelity of simulation, is the result still helpful?
  - jmngomes 6y ago
    BOINC tasks are validated by running multiple executions on different hosts/users and comparing results; credit, and hence GRC, is only attributed to tasks with valid results: https://boinc.berkeley.edu/trac/wiki/CreditNew https://boinc.berkeley.edu/trac/wiki/CreditNew

by jl2718 6y ago

dfgdghdf 6y ago

Exactly this. The PoW scheme must commit you to a particular chain.

Robotbeat 6y ago

Can you just hash a new solution to the puzzle with the new proposed block?

proto-n 6y ago
Solution has to depend on the proposed block, so that a solution is not reusable for the next block
- Robotbeat 6y ago
  The solution is also announced in cleartext, so you can check against previous solutions.
  - AgentME 6y ago
    The problem is that when a miner announces a block with a solution, an attacker could immediately announce their own alternative block with the same solution and there would be a chance that the network would take up their block first.
    - Robotbeat 6y ago
      But if the legitimate miner announces & signs a hash of the solution well beforehand, they can prove theirs is the legitimate solution.
      - AgentME 6y ago
        Then that adds a delay to each block being broadcast to the network. It also means that the longer a miner waits to broadcast the block, the more time a different miner has to finish a proof-of-work and claim the next block first. Miners are all racing each other, so they're all going to try to wait the most minimum amount. The logic around only accepting a block if you previously saw a signed hash is vulnerable to sybil attacks. An attacker could run thousands of nodes on the p2p network, never relay anyone else's signed hashes, steal the proof-of-works from completed blocks and then broadcast signed hashes of its own blocks with the stolen pows and then broadcast those blocks. Many users might find themselves connected to only nodes run by the attacker and would get tricked into accepting the attacker's chain. The proof-of-work not depending on the blockchain state means that a miner could queue up lots of complete proof-of-works and then mint a ton of blocks with them all at once to do a 51% attack. Any solution to this is either going to be centralized or look like proof-of-stake, and at that point, the proof-of-work is extra and not actually load-bearing at all.
  - proto-n 6y ago
    Ok, not being usable for the next block is not enough. It must not be usable for any other block. Competing chains, forks, other miners stealing your rewards, etc. Has to depend on the hash of the previous block, and also the transaction where you send the reward to yourself (-> even if someone else "steals it", you get the reward so it doesn't matter).

roboticmind 6y ago

The coin is proof of stake based. The rewards for BOINC come on top of staking. Each BOINC project that is rewarded has its stats looked up by a system of oracles and each node verifies that the oracles match up. The project themselves can be removed if they act up and there's a system for voting on which project to add and remove If you have any more questions feel free to ask me or check out the Gridcoin website https://gridcoin.us https://gridcoin.us Note: I help work on the gridcoin.us website and have ~5000 Gridcoin, so I may be biased in my view of the coin :)

lappa 6y ago
In that case, why have proof of stake at all? Wouldn't it be simpler to just have the set of oracles alone facilitate the currency, since they already effectively have the power to?
- vmception 6y ago
  The market didnt tolerate oracle controlled coins when Gridcoin was released The market does tolerate that now Today you wouldnt use a new blockchain you would just issue an erc20 token with an oracle server having an admin key for distribution. You could have people merkle mine to accumulate a stake, but this is primarily to keep the “crypto/computational” branding for that audience, as the oracle aspect would still be centralized
- roboticmind 6y ago
  The oracles don't have the power to completely run everything. With the current split for rewards, 25% of new coins is from just staking. As well, because new blocks are made only proof of stake, a 51% type attack would be also be much tougher for the oracles conspire and to pull off. Even if they tried to redirect 100% of research rewards (28750 GRC/day) to one address, it would take over 900 days to even reach the same amount as the address with the largest balance (~6% of current coin supply) [1]. Further, there's also more resiliency. If the oracles somehow broke or conspired and all said everyone did zero work, the network would still run. Now granted it would not be great that only previously pending research and PoS rewards would be given out, but you could still send coins, run polls, etc. [1] https://main.gridcoinstats.eu/address/ https://main.gridcoinstats.eu/address/ (excluding the very largest one (the foundation) because it's multisig and can't stake. In its case it would take 1000 days to reach)

DavidHilbert 6y ago

> The solution to a puzzle is meaningless if the same solution can be shown as the result of two different inputs. This isn't true. There are an infinite number of inputs that result in the same solution for bitcoin (or any hash)

jl2718 6y ago
Okay let’s see an example. ;)
- powerbutton65 6y ago
  Like it or not they are technically correct. SHA-256 is a one way compression and furthermore the PoW for bitcoin doesn't require a match for the entire hash. There's loads of examples of this in the bitcoin network whenever there's been a fork and eventually orphaned blocks.
  - jl2718 6y ago
    Those are different solutions to the puzzle. Nobody has ever published a sha-256 hash collision. It has happened once with sha-1.
    - neolefty 6y ago
      The principles are the same — it's just harder to find collisions for larger digest sizes. (Although bugs in sha-1 add an interesting wrinkle to the discussion.) In fact one could argue that encryption without requiring infinite bandwidth or computation requires finite difficulty in math puzzles. So our current approach to encryption is fundamentally vulnerable to (vastly) more powerful adversary computers. Only things like quantum cryptography break free of that limitation, by changing the ground rules.
      - jl2718 6y ago
        Algorithmic cryptography depends on a computation time approaching infinity for perfect security. Quantum cryptography depends on a data transmission rate approaching zero for perfect security. Either way, perfect security takes forever.

Moodles 6y ago

I once saw another example coin like this where the "useful PoW" was finding chains of prime numbers or something. However, PoW solutions were not dependent on the current blockchain sate, which rendered it insecure as someone could just stockpile solutions and then hijack the blockchain. Is it the case here too? The closest I've seen to a useful PoW coin is one which relied in intel SGX to prove that the work done was useful and honest, but of course the central root of trust is really Intel's SGX in that case.

fogof 6y ago

One of the more famous examples of a BOINC project is Rosetta@home, which asks users to determine how proteins fold. Isn't this exactly what you stipulate? You just let the binary hash of the block encode a sequence of amino acids, and then have the output be a valid block hash if the hash of the corresponding protein fold data has enough 0 bits at the beginning.

bowmessage 6y ago
who validates that the protein was folded correctly? Validating that the hash of some nonce contains enough leading zeroes is very easy for the network to validate. But verifying that users are correctly computing the protein folding (rather than quickly dumping out invalid folds to test hash values) seems like a difficult problem for the network to validate.
- fogof 6y ago
  This is a good point. I was assuming that computing a protein fold was something that could be done relatively quickly, but it seems like these simulations are actually much more computationally intensive than that. This is obviously not my area of expertise, but I wonder if there is any way to make more efficient but still useful computational questions about protein folding. For example, if we try to fold just part of a protein (only 100 or so amino acids, say) and do it at a much lower fidelity of simulation, is the result still helpful?
- jmngomes 6y ago
  BOINC tasks are validated by running multiple executions on different hosts/users and comparing results; credit, and hence GRC, is only attributed to tasks with valid results: https://boinc.berkeley.edu/trac/wiki/CreditNew https://boinc.berkeley.edu/trac/wiki/CreditNew