18 ms·

Proof-of-stake is inherently self-referential

147 points by stickfigure 5y ago

dangerface 5y ago
Proof of work determines who can mint a block its not the nakamoto consensus algorithm bitcoin uses its just part of it. Proof of stake determines who can mint a block same as proof of work, the consensus algorithm is then one of many different algorithms people use for consensus. Talking about proof of stake/work as if its the sole consensus is like when people call the case of their computer the hard drive part. I mean it does have a hard drive sure but your not really getting it.
fshbbdssbbgdd 5y ago
I think this article is saying that proof of stake doesn’t work because the community can decide to ignore the consensus algorithm and pick a different, modified chain. Proof of work has the same property though, as exhibited by the author’s own example of ETH vs ETC.
- slownews45 5y ago
  And both chains continue - but it usually becomes very clear which chain is stronger - and the weaker chain can be killed off because it can be attacked more easily - which devales the value of that chain. 24 vs 520 in this case is the has rate difference, or a 20x difference.
  - codyb 5y ago
    I guess... how long does it take to determine this? I have a transaction on a PoS PoS (lol) chain, and then... I guess... I've given my goods away for some coins. Now... it turns out my coins are lost because it was on the weaker chain? Not trying to be disingenuous here. Is this occurring in a matter of a few blocks, a few days? Does this bring crypto closer or further from potentially being an actual currency one day? I tend to think this centralizes things (PoS as opposed to PoW). I can't imagine I'd want to put my money into some whale controlled currency personally. But I'm not sure that part has really changed considering I think of PoW as relatively whale controlled (and rather centralized, and against all of the generally accepted Keynesian economic theories).
    - slownews45 5y ago
      A POS POS chain may not have a ton of value or attacks. But when splitting off, ETC for example probably was hit by some attacks until the value was gone. The way it works is whoever accepted your coins can have them lost and you could respend them if you were the attacker. https://www.coindesk.com/ethereum-classic-blockchain-subject-to-yet-another-51-attack https://www.coindesk.com/ethereum-classic-blockchain-subject...
- gruez 5y ago
  I think the difference here is that doing so would be a hardfork and would require everyone to opt into the change. Contrast this with PoS where if 51% of the stakers woke up one morning and decided to rewrite the last 2 weeks of the chain they can immediately do so, and anyone who disagrees must opt out.
  - everfree 5y ago
    With slashing PoS, if stakers tried to rewrite the left 2 weeks of the chain they could have their stake taken away as a penalty for signing votes on multiple forks.
    - gruez 5y ago
      According to this other comment[1], it looks like as long as you're on the winning side you're not punished? [1] https://news.ycombinator.com/item?id=27237610 https://news.ycombinator.com/item?id=27237610
- datadata 5y ago
  I think the author's point is that in a PoW fork, the hash power is a fixed resource and must split between forks. In a PoS fork, prefork holders can stake the same amount of coins on both forks, thereby "doubling" the total coin being staked. With PoW, the fact that the hash power has to split between forks gives a mechanism for a consensus between forks to be found. With PoS forks, you might as well just continue to stake both forks.
  - dstaley 5y ago
    There's already a solution to this: https://eth.wiki/concepts/proof-of-stake-faqs#what-is-the-nothing-at-stake-problem-and-how-can-it-be-fixed https://eth.wiki/concepts/proof-of-stake-faqs#what-is-the-no...
    - gruez 5y ago
      >This can be solved via two strategies. The first, described in broad terms under the name “Slasher” here and developed further by Iddo Bentov here, involves penalizing validators if they simultaneously create blocks on multiple chains, by means of including proof of misbehavior (ie. two conflicting signed block headers) into the blockchain as a later point in time at which point the malfeasant validator’s deposit is deducted appropriately. [...] The second strategy is to simply punish validators for creating blocks on the wrong chain. Which one does ethereum use?
      - dstaley 5y ago
        I believe Casper (Ethereum's PoW protocol) uses the second strategy.
        deleted 5y ago
        [deleted]
      - deleted 5y ago
        [deleted]
    - Dzugaru 5y ago
End_the_Fed 5y ago
Always thought Vitalik was a nudist at heart tbh
bradleyjg 5y ago
I think articles on cryptocoins should include disclosures. A gold rush is bound to produce a lot of motivated reasoning.
henriquez 5y ago
The author makes a hand-wavey argument criticizing a claimed hand-wavey ("complexity") justification for PoS. I don't think there is any way of deriving valuable info from this beyond just a personal opinion and some interesting illustrations.
- Spivak 5y ago
  The author addresses this and I think is right about it. It doesn’t at all really matter about what happens in step 2 and what weird complex rules you put in place because fundamentally votes on the network are now coin instead of compute power. It’s the same with PoW chains. How you turn “I have some compute” into votes doesn’t change that the fact that compute is the thing that produces votes.
  - henriquez 5y ago
    That's a good point but it seems like fiat currency has similar snake-eats-tail flaws (he who has the gold makes the rules), but somehow the global economy hasn't completely collapsed, yet.
    - ragona 5y ago
      Fiat currency is backed by something like “proof of military,” or “proof of governmental power.”
      - htrp 5y ago
        I think you're looking for "proof of gun" by either the military in a macro sense or the police in a more micro sense.
        philwelch 5y ago
        Proof of gun happens to be the ultimate answer in real life, though. I’m bullish on blockchain and cryptocurrency in general, but eventually it’s going to have to be backed up with guns. In that respect every currency is a fiat currency.
IshKebab 5y ago
I know nothing about proof of stake but it sounds like he's saying it is vulnerable to the same kind of 51% attack as proof of work but you need 51% of the coins instead of 51% of the hashing power? If so that sounds safer than proof of work. What am I missing?
- jiveturkey 5y ago
  You're not missing anything. TFA is wrong.
  - SubiculumCode 5y ago
    exactly right. That is why I flagged this low quality article.
- uberswe 5y ago
  Given enough time he is saying a single bad actor could amass 51% and attack the chain. It would also be a very expensive attack as they would risk the value of their stake. A PoW attack doesn’t require the same amount of investment.
  - DennisP 5y ago
    Not only would it risk the market value of the stake, but in Ethereum's version a double-spend attempt would result in near-immediate destruction of the stake.
    - codyb 5y ago
      If a coin is worth a trillion dollars, could a nation state just start buying up huge amounts, essentially indicating a 51% attack will occur soon, causing a rush for the door, causing prices to drop, despite the clear demand? Or would prices go up because there'd be a guaranteed buyer and a group buying at the moment.
      - uberswe 5y ago
dannyw 5y ago
Ethereum PoS has finality. It doesn't matter if someone later comes out with a different version: full nodes accept the first valid block it sees as final and immutable, after a short period of time. Is this perfect? No, but maybe its worth all the energy savings? If you run a node, by definition you can never end up on the "wrong" chain, because your node,s chain is immutably the chain, and so is everyone else running a full node, thus making it the canonical chain.
- deleted 5y ago
  [deleted]
- Dzugaru 5y ago
  As a newcomer - how can I tell the "right" chain apart? In Bitcoin I simply choose the one that burned the most work - it's trivial. In PoS I do what? The longest? Its trivial to produce a long chain. The longest and that have many different public signatures?
  - bhaak 5y ago
    The chain your bank or your exchange trust.
  - miloignis 5y ago
    The one that everyone else is using. Look at websites, ask friends, etc. After you do that once, you've got the right one from then on. Kinda trust-on-first-use, which most of us use for SSH anyway, and you can verify that you and the people you know are on the same chain beforehand. I feel like the "I would just choose the chain with the most hashpower" idea kinda falls down in that you still have to choose which crypto - Bitcoin, any of the bitcoin forks, Ethereum, Ethereum Classic, etc. You're relying on the internet etc for information to help you decide which cryptocurrency you're going to use when you start out, you can do the same thing for which Proof-of-Stake chain. Most of the time, there should be one obvious choice, more obvious than which crypto to use, I imagine.
    - Dzugaru 5y ago
endisneigh 5y ago
What's fascinating about the proof-of-stake vs. proof-of-work debate is that there's sometimes (not always) a tinge of anti-government sort of sentiment. The ultimate irony, though, is that even with proof-of-stake, the entire crypto-economy becomes owned by a bunch of pseudo-anonymous elites. The end result is the exact same as our current system. At least with our current system we can pretend to have a democracy and kick out people who are being too visibly corrupt. i assert there is no scenario in which cryptocurrencies, or any economy, doesn't devolve into what we currently have. as long as people are involved it is impossible to not have a government, in one form or another. the question is - do you want to be governed by a bunch of anonymous people or do you want to have some modicum of ability to hold them accountable? ugh
- smt88 5y ago
  I'd put it like this: you always have a government and regulators if you live in civilization. Best-case scenario, you get to participate in a free election to choose them. Crypto governance claims to be democratic, but it practice it is plutocratic.
- fartcannon 5y ago
  I want a Star Trek TNG style utopia.
  - buzzert 5y ago
    If scarcity is eliminated (with technology like the replicator), we won’t need cryptocurrency or any currency at all. I always wondered how much is The Federation actually involved in people’s lives. With no businesses to regulate, it really seems like their government is almost entirely consumed with Starfleet affairs (i.e., diplomacy with other non-federation peoples).
    - hinkley 5y ago
      Star Trek spent a lot of time dealing with scarcity problems for a show about people who don't get paid a salary. Waste is a problem that has its own friction built into it. As long as waste costs you something, you have some greater incentive to end it. Until we have some better way to prevent waste, the opposite of scarcity is excess, not satiation. There are not an infinite number of things, and there are not an infinite number of places to externalize the consequences without feeling them. On a ship in the literal middle of nowhere, scarcity is still breathing down your neck at every turn, and there is a strong group incentive to controlling waste, otherwise everybody dies. I'm not sure the STNG utopia plays out the same way on inhabited worlds.
deleted 5y ago
[deleted]
jdauriemma 5y ago
> Similarly reduced, proof-of-stake systems work like this: > 1. The list of valid transactions determines who has coin. > 2. <complexity> > 3. People with coin decide which transactions are valid. > You don't need to know any more detail about proof-of-stake systems to be instantly suspicious. I am instantly suspicious of the author's reasoning here.
- toomuchredbull 5y ago
  Obviously the people who have the most to lose are most motivated to maintain the currencies stability/trustworthiness no? Isn't that the idea? If the people with the most start screwing around, everybody will stop using the currency and they will be left with nothing.
  - hanniabu 5y ago
    Yup, and unlike with PoW where you can go mine another coin or sell your equipment, your investment is gone
  - haskman 5y ago
    "If the people with the most money start screwing around with other people's money, then everybody will just abandon using money altogether, societal structure will collapse, and they will be left with nothing". Great argument.
  - jdauriemma 5y ago
    > Obviously It's not obvious to me. Can you provide evidence that we can rely on the social dynamics you're describing?
  - kbsspl 5y ago
    Unless people with the most something have hedged/shorted it against something else.
- enraged_camel 5y ago
  Yep. It's a logical fallacy: https://www.logicallyfallacious.com/logicalfallacies/Appeal-to-Complexity https://www.logicallyfallacious.com/logicalfallacies/Appeal-...
2bitencryption 5y ago
My biggest confusion about 'proof-of-stake' is... if there was never any 'work' done, where does the 'stake' come from? Does 'proof-of-stake' need to be 'bootstrapped' by a period of 'proof-of-work'? If the 'work' part is very simple and requires little effort, then couldn't I generate a 'stake' that's just as large as someone else's very easily?
- deleted 5y ago
  [deleted]
- billytetrud 5y ago
  It certainly can be bootstrapped by PoW, but doesn't need to be (and usually isn't in practice). The initial stake if it's not bootstrapped by a different consensus mechanism is simply created (not too differently than PoW creates coins). You have an initial block that anyone can create (but in practice, it's generally the creators of the coin who do that), and then the coin created in that and subsequent blocks is distributed in some way (sale, give aways, etc). The fairness of the distribution is always something highly scrutinized by the larger cryptocurrency community, and many coins (pow and pos) have massively unfair distributions of their currency (ie to themselves as a money making or "funding" scheme).
- tastyfreeze 5y ago
  Some proof of stake coins tried to do fountain or giveaway distribution. Proof of work doesnt need to precede proof of stake.
- chrisco255 5y ago
  > Does 'proof-of-stake' need to be 'bootstrapped' by a period of 'proof-of-work'? I think it's optimal if they do, because proof-of-work is more fair in the beginning, so it's easier to do a fair distribution launch with PoW. With Proof-of-stake, I've never seen a network launch that didn't result in a cartel. PoW algos adjust difficulty based on how much hash power is in the network. So you could do this, but people would see it and react to the demand plus you'd also have to sell most of the mined coin in order to cover your electricity costs.
lwansbrough 5y ago
I’ll preface by saying I think Proof of Waste schemes should be illegal. Proof of Stake schemes eventually over time become de-decentralized because as with PoW there is incentive to having a large stake (as demonstrated by the large private mining pools.) Eventually what you have is a clique of large powerful players in control of the financial system. You’ve basically reinvented banks but you made them extremely inefficient along the way. I don’t see any way how decentralization schemes eliminate the potential for organization, as centralizing inside a decentralized system is beneficial and highly efficient vs. remaining disorganized/decentralized. Decentralization seems fundamentally at odds with natural order and thus maintaining its decentralization costs energy. Compare that to USD which backpacks on the energy spent maintaining a nation, the cost of USD is essentially amortized by the simple existence of the US.
- enchiridion 5y ago
  Following this line, wouldn't corporations form around the large stakes? So essentially banks, but with transparent holdings? I'm not well versed enough in financial systems to game out the implications of this, but as someone who believes in the efficiency of free markets, it seems like a good thing to have more transparent banks.
  - lwansbrough 5y ago
    Yes I think so. I'm a strong supporter of free markets* -- meaning, free markets are efficient and good, but efficiency isn't the only consideration for society so reasonable regulation is just and necessary. I'm not convinced you get any additional transparency from a blockchain that the government doesn't already get into any organization it wants to. Public ledgers also have remarkably poor privacy, which is necessary for some transactions and/or individuals.
    - enchiridion 5y ago
      That is an interesting point. The purpose of government access to that information in this case is to protect the public from shady practices, right? Potentially the benefit is the distribution of the information. As in it becomes standard for these new banks to make public which addresses/transactions they are associated with. The market will probably do a much better job at detecting especially harmful practices. Especially given that the asymmetry of information in fraud is often the only thing that makes it work. The privacy question is an interesting one. It seems like it pretty quickly reduces to some fundamental problems in crypto-system design. How can we design a system that is totally open on one end and totally anonymous on the other? And furthermore how do we guarantee that the banks won't set up addresses on the anonymous side to do shady things with? Not really sure how to align the incentives here. Potentially a combo of escrow and batching transactions. It would be interesting to hear ideas from people who work in this space.
encoderer 5y ago
Proof of work and proof of stake are both ultimately the same thing: proof of capital. Between the two, staking the capital directly is a lot more efficient than having to first convert the capital to hash rate.
- rawtxapp 5y ago
  Except only one of them requires ongoing capital investment which means you can't hold on to the return on your capital because you got it with practically no effort.
- timdaub 5y ago
  I disagree: If you summarize the difficulty of all Bitcoin blocks from the chain's tip and you're trying to "rebase" the chain at point x, you'd have to calculate at least the amount of hashes between x and the current tip to display a convincing fork with a similar cummulative difficulty. In proof of stake, since there's no "work" that's connecting the blocks, but just a sortition of who gets to submit a block, this ever growing hash tree doesn't gain more difficulty over time to rebase. That's what Bitcoin Maximalists always cry about and are never able to express in words.
- privilegizer 5y ago
  No. PoS is a trust-based system. No different than fiat. PoW is a work-based system. Similar to gold. You can't have a free lunch. Sorry.
  - silentsea90 5y ago
    I am trying to learn. In both cases, user A has to invest some amount of money. In PoS, user A stakes money to make more money but gets penalized for breaking trust. Overall, user A makes say 10 coins over a 1000 staked coins ending up with 1010 coins. In PoW, user A loses some money to make more money. User spends 3 coins to make 13 coins, so user ends up with 1010 coins I don't see the difference yet.
    - splix 5y ago
sterlind 5y ago
This just seems like handwringing at the circularity of using stake (i.e. past transactions) to decide what blocks get validated (i.e. future transactions.) But it's wrong: First, attackers would need to collude to control 51% of the staked coin on the network to double-spend. There's no disincentive to stake (you won't lose coin if you're acting honestly), so stakes should approach the market cap of ETH itself. Second, even with a 51% attack you can't keep giving yourself money to solidify your stranglehold on the network. All you can do is double-spend, which doesn't help you raise your stake. And when your attack eventually fails, you're punished by losing your entire stake - wiping out 51% of ethereum. Finally, the "healing" the author alluded to of ETH would still happen. If an attack were carried out, and somehow managed to persist, honest miners would fork ethereum and blacklist all the coins that went into the malicious stake, rendering it impossible to mount again. Just because security is circular in a sense doesn't mean it's insecure.
- anthony_r 5y ago
  This is not directly about 51% attacks. This is about chain splits.
  - sterlind 5y ago
    can you elaborate? how can malicious actors split the chains over an extended period without controlling 51% of the stake?
    - stickfigure 5y ago
      It's not about malicious actors. The community is perfectly capable of splitting on its own. See: ETC/ETH.
- qecez 5y ago
  Double-spends should be the least of your worries.
  - everfree 5y ago
zaptheimpaler 5y ago
This is not even an argument, there's no substance at all, just "I don't know how this works, I won't bother to learn and I don't trust it". Even a 1 minute skim of Ethereum's docs on proof of stake[1] would prove him wrong. Proof of stake means the you have to hold ETH to validate transactions, meaning defrauding the network and causing a fork would destroy the value of your own stake. [1] https://ethereum.org/en/developers/docs/consensus-mechanisms/pos/ https://ethereum.org/en/developers/docs/consensus-mechanisms...
- optymizer 5y ago
  How would your stake get devalued? If the whole currency gets devalued then it would be devalued for everyone, not just for you. You'd end up holding the same % stake in the original network, and the same or greater stake in the fork as well.
  - zaptheimpaler 5y ago
    The attackers percentage of stake would obviously not change but all tokens on that entire chain would be worth nothing once the public realized it had been hacked. They would hold 51%, or even 100% of a $0 token. All the verifiers who took part in the fraud and all the accounts linked to them would be traced and not given any stake in the new fork.
- jml7c5 5y ago
  I don't believe the author is talking about something like double-spending. They're describing a situation where major holders want to change something about the protocol, especially a change that is to their advantage.
  - koonsolo 5y ago
    Same deal. If the other smaller half decides it's worth less because of it, your big stake will decrease in value.
- mumblemumble 5y ago
dkarras 5y ago
Nobody has been able to explain this to me WRT cryptocurrencies and their "digital scarcity" quality: If people are free to create new chains out of thin air and build networks around it, how is anything digital "scarce"? Like, bitcoin set out to be deflationary, a "limited" amount of bitcoins till the end of eternity. ...except for the fact that I can create a new blockchain independent of bitcoin and it is the SAME thing, breaking the inflation proof quality of it. The new chain has a new "name", a new "brand" but that is just a conceptual difference, not a practical one. All the cryptocurrencies created after bitcoin creates "inflation" for bitcoin. If bitcoin was the only possible cryptocurrency but the hype around cryptocurrencies was the same, a bitcoin would cost substantially more today. If people are not happy with the "xcoin" billionaires at some time in the future, they can create just another currency to inflate the cryptocoin space (I'm saying "in the future" but that is what is happening since the beginning of this story). In that sense, they all are practically infinitely issuable. Different chains are just technically different, not practically. All are different forks of the same "cryptocurrency-token" of humankind, with no protection against additional and additional forks (new cryptocurrencies). So while this enormous efforts about the fork protections on a single chain is a fantastic academic and intellectual exercise... in the end one can create a new "cryptocurrency", a new network to create more "money" - that is the ultimate fork that can't be prevented by any on-chain methods. It is all futile in the end.
- chrisco255 5y ago
  Have you ever seen or heard of anyone pay $1M or $100K for a .com address? Why do they do that when there's like 256 TLDs? Why does anyone pay $20M to live in a box in Manhattan when they could buy a huge ranch in Montana and live like a king? Some blockchains are more valuable than others. And their blockspace is limited, just like Manhattan real estate. The reasons for this are numerous, but a big part of it comes down to security and liquidity. If you are going to create a digital agreement, you want a blockchain with a high degree of security and predictability. You also want composability with other applications so you can have access to an ecosystem and other financial services.
  - dkarras 5y ago
billytetrud 5y ago
There seems to be a cult of proof of stake haters with basically no deep knowledge of the consensus mechanism who bash it with increasingly inane arguments. This is one of the worst I've seen. Basically: 1. Create bad metaphor 2. Relate it to your target 3. Claim the target of your criticism has no additional nuances than your bad metaphor. Perpetual motion machines, for example, have absolutely nothing to do with cryptocurrencies or proof of stake. Perpetual motion machines are impossible because of conservation of energy. There is no equivalent physical law that prevents proof of stake from being secure. What the author of this poorly conceived rant doesn't seem to understand is the concept of bootstrapping and incremental validation. Computers for example bootstrap every time they.. well.. boot, which is why they call it that. The program basically asks "what program should the computer run" and the program then tells it. No one would take a perpetual motion machine argument seriously if used to argue that computers can't work because they're self referential. But maybe the article is satire and I just missed the joke?
- aeternum 5y ago
  Computers bootstrap every time they boot, but few do it securely every time. The more complexity, in that incremental validation, the more likelihood there's a flaw. Take iphone for example, it's bootstrapped by keys within the tamper-proof hardware tpm, then all software is incrementally validated from there. Yet jailbreaks still frequently appear.
  - billytetrud 5y ago
    There's a difference between saying "its impossible to do it securely" and "few currently do it securely". Also, I'm not trying to make the same mistake as the OP and claim that bootstrapping computers is at all relevant to analyzing whether PoS is secure. I'm just pointing out the absurdity of the OP's argument by showing that his metaphor trivially breaks down: reductio ad absurdum.
- tarsinge 5y ago
  > There seems to be a cult of proof of stake haters with basically no deep knowledge of the consensus mechanism who bash it with increasingly inane arguments. It’s not hard to see why: it’s an existential treat to Bitcoin that’s becoming more plausible every day. If PoS is proven to work at scale (e.g. with Eth2), it’s over, the energy usage of PoW will be unjustifiable. Disclaimer: I own a bit of BTC and ETH (50/50).
thebean11 5y ago
This criticism doesn't seem very substantial, what exact problem does PoS have that PoW doesn't have? Why doesn't PoW have the exact same "50/50 consensus split issue"? Bitcoin nodes can _also_ choose to pick an alternate chain, see every hard fork.
- ric2b 5y ago
  A Bitcoin node simply doesn't consider BSV blocks to be valid, they break Bitcoin's rules, that's what makes them hard-forks and is not related to this discussion. When there are multiple competing valid chains, with PoW the main chain is whichever one has the largest amount of work done. Eventually everyone converges to the same chain automatically. With PoS, how do you objectively chose between two competing chains?
  - thebean11 5y ago
    Wouldn't it be whichever has more attestations by stakers?
armchairhacker 5y ago
Honestly, I don't understand why crypto, and especially PoW, is so special. My understanding is that crypto is good because 1) you can't "forge" crypto (mining is different since it takes resources), and 2) you can make transactions that are harder to track. Particularly because governments "forge" (print) money all the time, and heavily track how we spend. Ultimately, currency only has meaning because we assign value to it. The only intrinsic currencies are food, shelter, luxuries, etc. If people stop accepting Bitcoin, "I can prove that I have X bitcoin" no longer means anything. If government outlaws bitcoin and forces you to use USD, it doesn't matter that they can't forge or track bitcoin, because you have to use USD. A lot of people argue that PoS is bad because roughly "the people who control the most etherium can dictate the rules", but the people who control the resources we need will always dictate the rules. > Forking a proof-of-stake chain can create two chains, each of which is endorsed by a majority of stakers in that chain. This split can repeat ad infinitum. Which will be the “real” one? Isn't this the same as Bitcoin vs. Dogecoin vs. etcCoin?
- chrisco255 5y ago
  The author is poorly informed. Splits have happened and do happen, there's about 3 or 4 direct Bitcoin forks but they have little use. Social consensus is what ultimately controls which blockchain is viewed as the legitimate one. So if some plurality of rich stakers wanted to do a hostile takeover of a network, the community could create a fork where the oligarch coins are frozen and continue from there.
  - gtyras2mrs 5y ago
    > So if some plurality of rich stakers wanted to do a hostile takeover of a network, the community could create a fork where the oligarch coins are frozen and continue from there. What's the "community" here? What would incentivise users to consider the new fork to be the legitimate one? If rich oligarchs control the first one - how do you build trust in the new one as opposed the current one? As a fiat currency - I would assume the rich oligarchs would have a great chance of leveraging wealth into ensuring that the current coin gets marketed and hence holds trust? The USD holds its current position because the US Gov stands behind it - what would keep the oligarchs propping the current coin up as opposed to the forked coin? I'm sorry if this sounds silly - as I'm not very into crypto.
wyldfire 5y ago
Proof of stake might have problems. But there aren't any identified here. Let's try and find the real problems instead of just posting FUD. Btw the smug portrait at the bottom (of the author?) seems out of place.
- i_am_new_here 5y ago
  The profile-picture is usually on the right, but "gets put below", if there is not enough screen-space.
lgrapenthin 5y ago
"People with coin" in step 3 is way too broad. And indeed, ETH PoS has a consensus protocol to decide which "people with coin" get to validate, and that doesn't work by "because the blockchain says so".
ItsMonkk 5y ago
I've done a little bit of research into event-sourced databases and journaling filesystems, but not nearly enough to be on expert on them. I think this article touches on exactly the crucial point. If I have a private key to my coins, why is someone else allowed to disallow a transfer of them? When I announce a transaction, because of the way mining works, that transaction gets sent to every miner, so that if they were to solve the block they could include my transaction. Why is Bitcoin made up of back-links to previous blocks? Isn't a block no more than a memoization of a event-sourced log at a point of time? That's just a really badly constructed journaling filesystem. Instead there should be no cryptographic mining PoW or PoS, all online miners would track all transactions since the last block was created. If at any point they did not have all of the transaction(which means if anyone else has reported a transaction that they have disallowed, easily compared by simply checking every miners head hash), they are considered to be offline and do not receive a mining share. All miners who are online when a new memoization is created gets a share of the reward. Help me out here, why do we need to solve the Byzantine General's problem for this?
- eeegnu 5y ago
  > Why is Bitcoin made up of back-links to previous blocks? Isn't a block no more than a memoization of a event-sourced log at a point of time? That's just a really badly constructed journaling filesystem. My understanding is that the chain of blocks, whereby each successor block is dependent on the hash of the previous one, acts as a self contained proof that a huge amount of work went into generating this. The rule that everyone needs to follow then is to simply always trust the longest chain presented to them (or the one that was most difficult to build depending on the amount of solutions at every difficulty.) By only looking at the last block, you lose this consensus mechanism. Not sure exactly how that isn't an issue with PoS though since they aren't verifying with work, and it seems that they can just keep track of the head of the transactions.
  - ItsMonkk 5y ago
    The Byzantine General's problem states that messages can be corrupt, missing, misinformation, or otherwise unreliable. Thus to avoid exploitation by the few, we need some PoW mechanism. The Bitcoin network is not this. The Bitcoin network is everyone meeting at a central square, fully able to communicate - all having a full list of all transactions - and the dude with the password takes the reward and decides which transactions make it in. But they have no messaging problems! Bitcoin is not the same difficulty as Byzantine Generals! The work is meaningless when everyone is always communicating. There is no possibility of any miscommunication. The rules of a miner are simple: Add all transactions to the list. Make sure no one spends more than they have. That's it. If there is ever a merge conflict(a double spend) based on those rules, first transaction wins. It will most likely be known that it fails instantly, but if not by the time the memoization happens it will be known. Consensus becomes whichever one has all the transactions. If there is a firewall issue such that you can not reach the main chain, you can simply not issue any transactions. Same as today. I can see a potential that I am in the wrong here, not knowing about a crucial detail, but I don't know what that detail is.
cblconfederate 5y ago
The self-referntial part is not the biggest problem, in the past money was created to fund an army which then made the money stronger in a virtuous cycle. Its biggest flaw is that it removes the friction from switching sides, and makes it a subject of politics. BTC was created to be the opposite, to take the power back from politics
narush 5y ago
This post raises two common criticisms against proof-of-stake: it's self-referential (and therefore cannot work), and it's subjective (and therefore cannot work). Each of them have a bit of truth to them, but (spoilers) I strongly disagree with the conclusions. ------------ The "proof-of-steak is self-referential (and therefore cannot work)" argument goes like this: 1. Proof-of-Stake chains claim to be secure because there is value at risk. 2. The value at risk are the coins _on chain_, which only have value because the chain is secure. Therefore, as the "thing" giving the coins value is the coins having value themselves, this is self-referential, and so cannot work. Two quick responses. First, PoW has the same dynamics, albeit a bit more obfuscated. 1. The PoW chain is secure because there are miners willing to mine on the chain. 2. The miners are willing to mine on the chain because they get paid in coins that have value. 3. The coins have value for a multitude of reasons (duh, speculation), but one seemingly necessary one is that the chain is secure enough to allow transfers (aka, the chain is secure). So in PoW, we have the same self-referential dynamic. Second, there's no reason why self-referential systems don't work in the first place. I'd argue that a much more informative way of thinking about PoS/PoW as mechanisms is in a recursive way: 1. Value at time T -> Security at time T 2. Security at time T -> Value at time T + 1 etc. You can call anything that references itself a "perpetual motion machines." Merge sort references itself - that doesn't make it one. I would argue the recursive bootstrapping described above is one of the most interesting mechanisms public blockchains have currently (rivaled only by the crazy composability of programs you see on smart contract chains like Ethereum). --------- The "it's subjective (and therefore cannot work)" argument goes like this. 1. Stake is defined on the chain. 2. Stake determines which chain is the real chain. 3. Thus, if you have two chains that claim to each be the real chain, you cannot tell them apart. I'll note: this is pretty much true. For most modern PoS protocols that exist today, some form of initial "checkpoint" is needed to sync the chain. You need a blockhash to start from. However, after you sync your node for the first time using this has, this is no longer the case: as long as you sync your node to the chain more than once a month or so, you never need to do this again. Aka: you only need to get a hash of the chain upon initial sync. Practically, IMO, this pretty much changes nothing. 99.99999999% of users don't read the source code of the nodes they run (in fact, most people don't run nodes :() - and since node releases are on the order of once a month [1], users can just get the block hashed packaged with the software anyways. In most realistic security models, not much is different. --------- IMO, the biggest argument against PoS is it's complexity. Making a secure PoS protocol requires a lot more work than a basic PoW one. Managing this complexity appropriately is hard, and takes time + incremental steps if you want to do it well (and not fuck an existing network). That's mostly why Ethereum's PoS has been so delayed. But it's coming soon :). Shout out to the awesome people working on it! Source: I spent 3 years working on a variant of Casper (Ethereum's PoS protocol) at the Ethereum Foundation.
Cyril_HN 5y ago
I'll take some fiat, some proof of work, and some proof of stake. That's a better risk profile than only having 2 of 3.
- qecez 5y ago
  Don't forget to "diversify" into shitcoins, too.
AntiFreemason 5y ago
I prefer freedom from a global mafia that openly worships lucifer, aka the masons ...does it alarm you that 90% of police in the UK are Masons and their bosses worship lucifer?Does it bother you that 200 countries are closed down for a the corona virus with the pretext of covi.d..."Certificate of Vacunation ID" which has never even been isolated or seperated in a lab...ie does not exist.Oh no I cant even say that can, the sheep might wake up and hate so desperately wants to put their DARPA nanotechnology o sorry vacccccine into the blind and lost.The zombies who think the bible is irrelevant and the gov and tv are the forces that created the heaven and earth.This planet is drowning in conspiracy and we need crypto to breathe and be free.Those of you who talk like the government is some kind of god and we can not be against are sick in the head or soul.The government is a group of humans they are not sacred. The idea that some small elite controls crypto is a baseless argument, it is individual people who have the ability to live and control their resources on this earth in the middle of a massive enslaving conspiracy to literally change the dna code of the entire human race with their gene therapy disguised as a vax.I will be surprised if this comment stays up, in this world there is no space allowed for those who are awake.This world is a lie controlled by possessed people and the end is coming 7 years after they deceive you with their ufo technology.Pray to god to receive the holy spirit you can be saved..Pray Dear GOD I pray that you will forgive me of my sins send the holy spirit to live inside me, save me from my demons and the sin that lives in me, make me new as you want me to be and make me a born again christian.I pray this in Jesus name Amen
mrkramer 5y ago
In US all cryptocurrencies are treated as commodities and regulated by Commodity Futures Trading Commission under the U.S. Commodity Exchange Act but when Ethereum switches to Proof of Stake they will be regulated as security by Securities and Exchange Commission (SEC) and all "stake" holders will need to register their stakes and comply with the laws that govern the Securities Industry[1]. Under the US law "security" is "The term “security” means any note, stock, treasury stock, security future, security-based swap, bond, debenture, evidence of indebtedness, certificate of interest or participation in any profit-sharing agreement etc."[2] Ethereum falls under this since it is "profit-sharing agreement", it is an investment(stake) which allows other investors(stakeholders) to profit off of that owned security. Proof of stake cryptocurrency allows stakeholders to profit by holding their coins(stake) and if they do not comply with all aforementioned security laws(reporting, market controls etc.) all their coins(stake) can be seized and Etherum can be shut down by SEC as an unregistered security. [1] https://www.investor.gov/introduction-investing/investing-basics/role-sec/laws-govern-securities-industry https://www.investor.gov/introduction-investing/investing-ba... [2] https://uscode.house.gov/view.xhtml?req=(title:15%20section:77b%20edition:prelim) https://uscode.house.gov/view.xhtml?req=(title:15%20section:...
- hanniabu 5y ago
  That's simply false. When you stake you're being rewarded for your work securing the network, no different than mining. Further, if you do not stake you do not "profit".
  - mrkramer 5y ago
    If you "stake" you invest and you are a stakeholder if you do not "stake" you are simply a user of Ethereum and all investments, stakes and stakeholders need to be regulated in order to protect investors and market. Cryptocurrencies and crypto tokens are not outside the law in particular not outside of financial and capital market regulation laws.
    - hanniabu 5y ago
      It's literally no different than mining and they have already stated the bitcoin and ethereum are not securities.
dathinab 5y ago
> Similarly reduced, proof-of-work systems work like this: > > 1. The list of valid transactions determines who has coin. > 2. <complexity> > 3. People with computers decide which transactions are valid. > You don't need to know any more detail about proof-of-work systems to be instantly suspicious. Hm, I think this misquote says all there is to say about the reasoning in this blog.
deleted 5y ago
[deleted]
jude- 5y ago
The author's central argument has been formally proven: https://eprint.iacr.org/2016/919.pdf https://eprint.iacr.org/2016/919.pdf. PoS protocols cannot offer a client with no a priori knowledge of the history of transactions a way to distinguish between an honest validator set and a corrupt validator set. There's no way to compare chain quality in-band.
- hanniabu 5y ago
  > There's no way to compare chain quality in-band. Just like with PoW where the longest chain and greatest hash power is the "honest" chain (even that is arguable), PoS functions similarly where the greatest staking power is the "honest" chain.
  - jude- 5y ago
    Try reading the paper. They address that.
mrkramer 5y ago
Bitfury company did a research on PoW vs PoS [1] and their conclusion was "Pure proof of stake approaches pose substantial security threats that cannot be recreated in proof of work systems (including Bitcoin). These problems are inherent to proof of stake algorithms, as proof of stake consensus is not anchored in the physical world (cf. with hashing equipment in proof of work). That is why virtually all of currencies relying on proof of stake use additional mechanisms to address security issues." On top of that even Vitalik said "proof-of-stake systems are ultimately permanent nobilities where the members of the genesis block allocation always have the ultimate say. No matter what happens ten million blocks down the road, the genesis block members can always come together and launch an alternate fork with an alternate transaction history and have that fork take over." [2] [1] https://bitfury.com/content/downloads/pos-vs-pow-1.0.2.pdf https://bitfury.com/content/downloads/pos-vs-pow-1.0.2.pdf [2] https://blog.ethereum.org/2014/07/05/stake/ https://blog.ethereum.org/2014/07/05/stake/
spark3k 5y ago
Seems Jeff has launched a malicious attack on proof-of-stake, been unsuccessful, and has lost his stake. In this case his reputation. You can't hand-wave over "complexity" and then call it "opaque" and self referential using a bunch of vague and imprecise analogies. The "step 2 complexity" is where the system justifies itself. It's where it's proven sound. Just because you're too lazy to get into the weeds and technicals of it does not make the system flawed. A casual read of the overview of Ethereum 2's proof-of-stake mechanism[1] would have helped Jeff save his reputation staked on his blog post. [1] https://ethereum.org/en/developers/docs/consensus-mechanisms/pos/ https://ethereum.org/en/developers/docs/consensus-mechanisms...
tantaman 5y ago
Pure Proof of Stake is interesting in that the "stakers" are literally every single person in the economy -- mitigating much of this problem of the "pool" of stakers deciding that they don't agree with one another. https://www.algorand.com/resources/blog/proof-of-stake-vs-pure-proof-of-stake-consensus?utm_term=pure%20proof%20of%20stake&utm_campaign=Algorand+Proof+of+Stake&utm_source=adwords&utm_medium=ppc&hsa_acc=3295499188&hsa_cam=13089725985&hsa_grp=123713499833&hsa_ad=521469718012&hsa_src=g&hsa_tgt=aud-830523078124:kwd-936304957379&hsa_kw=pure%20proof%20of%20stake&hsa_mt=p&hsa_net=adwords&hsa_ver=3&gclid=CjwKCAjwtJ2FBhAuEiwAIKu19u_8s2qq2Dv3AFfoOHAzXvchwrOjqXoGrBf7YsksMAsqXrcLkkSUJBoCrw4QAvD_BwE https://www.algorand.com/resources/blog/proof-of-stake-vs-pu...
nazgulnarsil 5y ago
Proof of Stake is Proof of Work with more steps, it just pushes the work into non transparent processes.
- mvolfik 5y ago
  I'm new to PoS, so please apologize my lack of knowledge - but which part of the system will consume as much power as a medium sized country?
sktrdie 5y ago
One thing that PoW has for it is the idea brought up in the paper: where the coin is not just based on popularity of usage, fame or hype but its usage is actually measurable in a very real sense: through how much energy it consumes. The paper mentions how CPU power gives you (in a way) the ability to vote within the system. With a famous PoS coin you can measure its popularity based on number of transactions and usage across the globe - but who can really tell that those transactions were just not very few users pretending to makeup a busy network? With PoW on the other hand you have a very tangible way to measure interest in the network: they’re literally consuming energy and they’re literally many different entities since no single entity could ever consume that much energy. That’s a quite important difference imho.
oblinger333 5y ago
Annoyingly, this guy's reasoning is faulty, but one cannot comment on his 'blog' An inductive proof (which most mathematicians accept as valid) has exactly the structure he wants to call invalid. You prove N(0) case, then you prove N(i+1) case in terms of the N(i) case. This is how proof of stake is structured. It is true that one must START a proof of stake system in a valid state but then the correctness of a state depends upon the correctness of the state prior. The argument for POS is not quite a simple as that, but this just shows there is nothing inherently invalid about having the validity of a system depend upon the validity of an earlier state of that system. MANY, MANY systems have just this kind of guarantee. p.s. I dont own any ETH, I just hate bone headed thinking...

147 points by stickfigure 5y ago

Proof of work determines who can mint a block its not the nakamoto consensus algorithm bitcoin uses its just part of it. Proof of stake determines who can mint a block same as proof of work, the consensus algorithm is then one of many different algorithms people use for consensus. Talking about proof of stake/work as if its the sole consensus is like when people call the case of their computer the hard drive part. I mean it does have a hard drive sure but your not really getting it.

fshbbdssbbgdd 5y ago

I think this article is saying that proof of stake doesn’t work because the community can decide to ignore the consensus algorithm and pick a different, modified chain. Proof of work has the same property though, as exhibited by the author’s own example of ETH vs ETC.

slownews45 5y ago
And both chains continue - but it usually becomes very clear which chain is stronger - and the weaker chain can be killed off because it can be attacked more easily - which devales the value of that chain. 24 vs 520 in this case is the has rate difference, or a 20x difference.
- codyb 5y ago
  I guess... how long does it take to determine this? I have a transaction on a PoS PoS (lol) chain, and then... I guess... I've given my goods away for some coins. Now... it turns out my coins are lost because it was on the weaker chain? Not trying to be disingenuous here. Is this occurring in a matter of a few blocks, a few days? Does this bring crypto closer or further from potentially being an actual currency one day? I tend to think this centralizes things (PoS as opposed to PoW). I can't imagine I'd want to put my money into some whale controlled currency personally. But I'm not sure that part has really changed considering I think of PoW as relatively whale controlled (and rather centralized, and against all of the generally accepted Keynesian economic theories).
  - slownews45 5y ago
    A POS POS chain may not have a ton of value or attacks. But when splitting off, ETC for example probably was hit by some attacks until the value was gone. The way it works is whoever accepted your coins can have them lost and you could respend them if you were the attacker. https://www.coindesk.com/ethereum-classic-blockchain-subject-to-yet-another-51-attack https://www.coindesk.com/ethereum-classic-blockchain-subject...
gruez 5y ago
I think the difference here is that doing so would be a hardfork and would require everyone to opt into the change. Contrast this with PoS where if 51% of the stakers woke up one morning and decided to rewrite the last 2 weeks of the chain they can immediately do so, and anyone who disagrees must opt out.
- everfree 5y ago
  With slashing PoS, if stakers tried to rewrite the left 2 weeks of the chain they could have their stake taken away as a penalty for signing votes on multiple forks.
  - gruez 5y ago
    According to this other comment[1], it looks like as long as you're on the winning side you're not punished? [1] https://news.ycombinator.com/item?id=27237610 https://news.ycombinator.com/item?id=27237610
datadata 5y ago
I think the author's point is that in a PoW fork, the hash power is a fixed resource and must split between forks. In a PoS fork, prefork holders can stake the same amount of coins on both forks, thereby "doubling" the total coin being staked. With PoW, the fact that the hash power has to split between forks gives a mechanism for a consensus between forks to be found. With PoS forks, you might as well just continue to stake both forks.
- dstaley 5y ago
  There's already a solution to this: https://eth.wiki/concepts/proof-of-stake-faqs#what-is-the-nothing-at-stake-problem-and-how-can-it-be-fixed https://eth.wiki/concepts/proof-of-stake-faqs#what-is-the-no...
  - gruez 5y ago
    >This can be solved via two strategies. The first, described in broad terms under the name “Slasher” here and developed further by Iddo Bentov here, involves penalizing validators if they simultaneously create blocks on multiple chains, by means of including proof of misbehavior (ie. two conflicting signed block headers) into the blockchain as a later point in time at which point the malfeasant validator’s deposit is deducted appropriately. [...] The second strategy is to simply punish validators for creating blocks on the wrong chain. Which one does ethereum use?
    - dstaley 5y ago
      I believe Casper (Ethereum's PoW protocol) uses the second strategy.
      - deleted 5y ago
        [deleted]
    - deleted 5y ago
      [deleted]
  - Dzugaru 5y ago

End_the_Fed 5y ago

Always thought Vitalik was a nudist at heart tbh

bradleyjg 5y ago

I think articles on cryptocoins should include disclosures. A gold rush is bound to produce a lot of motivated reasoning.

henriquez 5y ago

The author makes a hand-wavey argument criticizing a claimed hand-wavey ("complexity") justification for PoS. I don't think there is any way of deriving valuable info from this beyond just a personal opinion and some interesting illustrations.

Spivak 5y ago
The author addresses this and I think is right about it. It doesn’t at all really matter about what happens in step 2 and what weird complex rules you put in place because fundamentally votes on the network are now coin instead of compute power. It’s the same with PoW chains. How you turn “I have some compute” into votes doesn’t change that the fact that compute is the thing that produces votes.
- henriquez 5y ago
  That's a good point but it seems like fiat currency has similar snake-eats-tail flaws (he who has the gold makes the rules), but somehow the global economy hasn't completely collapsed, yet.
  - ragona 5y ago
    Fiat currency is backed by something like “proof of military,” or “proof of governmental power.”
    - htrp 5y ago
      I think you're looking for "proof of gun" by either the military in a macro sense or the police in a more micro sense.
      - philwelch 5y ago
        Proof of gun happens to be the ultimate answer in real life, though. I’m bullish on blockchain and cryptocurrency in general, but eventually it’s going to have to be backed up with guns. In that respect every currency is a fiat currency.

IshKebab 5y ago

I know nothing about proof of stake but it sounds like he's saying it is vulnerable to the same kind of 51% attack as proof of work but you need 51% of the coins instead of 51% of the hashing power? If so that sounds safer than proof of work. What am I missing?

jiveturkey 5y ago
You're not missing anything. TFA is wrong.
- SubiculumCode 5y ago
  exactly right. That is why I flagged this low quality article.
uberswe 5y ago
Given enough time he is saying a single bad actor could amass 51% and attack the chain. It would also be a very expensive attack as they would risk the value of their stake. A PoW attack doesn’t require the same amount of investment.
- DennisP 5y ago
  Not only would it risk the market value of the stake, but in Ethereum's version a double-spend attempt would result in near-immediate destruction of the stake.
  - codyb 5y ago
    If a coin is worth a trillion dollars, could a nation state just start buying up huge amounts, essentially indicating a 51% attack will occur soon, causing a rush for the door, causing prices to drop, despite the clear demand? Or would prices go up because there'd be a guaranteed buyer and a group buying at the moment.
    - uberswe 5y ago

dannyw 5y ago

Ethereum PoS has finality. It doesn't matter if someone later comes out with a different version: full nodes accept the first valid block it sees as final and immutable, after a short period of time. Is this perfect? No, but maybe its worth all the energy savings? If you run a node, by definition you can never end up on the "wrong" chain, because your node,s chain is immutably the chain, and so is everyone else running a full node, thus making it the canonical chain.

deleted 5y ago
[deleted]
Dzugaru 5y ago
As a newcomer - how can I tell the "right" chain apart? In Bitcoin I simply choose the one that burned the most work - it's trivial. In PoS I do what? The longest? Its trivial to produce a long chain. The longest and that have many different public signatures?
- bhaak 5y ago
  The chain your bank or your exchange trust.
- miloignis 5y ago
  The one that everyone else is using. Look at websites, ask friends, etc. After you do that once, you've got the right one from then on. Kinda trust-on-first-use, which most of us use for SSH anyway, and you can verify that you and the people you know are on the same chain beforehand. I feel like the "I would just choose the chain with the most hashpower" idea kinda falls down in that you still have to choose which crypto - Bitcoin, any of the bitcoin forks, Ethereum, Ethereum Classic, etc. You're relying on the internet etc for information to help you decide which cryptocurrency you're going to use when you start out, you can do the same thing for which Proof-of-Stake chain. Most of the time, there should be one obvious choice, more obvious than which crypto to use, I imagine.
  - Dzugaru 5y ago

endisneigh 5y ago

What's fascinating about the proof-of-stake vs. proof-of-work debate is that there's sometimes (not always) a tinge of anti-government sort of sentiment. The ultimate irony, though, is that even with proof-of-stake, the entire crypto-economy becomes owned by a bunch of pseudo-anonymous elites. The end result is the exact same as our current system. At least with our current system we can pretend to have a democracy and kick out people who are being too visibly corrupt. i assert there is no scenario in which cryptocurrencies, or any economy, doesn't devolve into what we currently have. as long as people are involved it is impossible to not have a government, in one form or another. the question is - do you want to be governed by a bunch of anonymous people or do you want to have some modicum of ability to hold them accountable? ugh

smt88 5y ago
I'd put it like this: you always have a government and regulators if you live in civilization. Best-case scenario, you get to participate in a free election to choose them. Crypto governance claims to be democratic, but it practice it is plutocratic.
fartcannon 5y ago
I want a Star Trek TNG style utopia.
- buzzert 5y ago
  If scarcity is eliminated (with technology like the replicator), we won’t need cryptocurrency or any currency at all. I always wondered how much is The Federation actually involved in people’s lives. With no businesses to regulate, it really seems like their government is almost entirely consumed with Starfleet affairs (i.e., diplomacy with other non-federation peoples).
  - hinkley 5y ago
    Star Trek spent a lot of time dealing with scarcity problems for a show about people who don't get paid a salary. Waste is a problem that has its own friction built into it. As long as waste costs you something, you have some greater incentive to end it. Until we have some better way to prevent waste, the opposite of scarcity is excess, not satiation. There are not an infinite number of things, and there are not an infinite number of places to externalize the consequences without feeling them. On a ship in the literal middle of nowhere, scarcity is still breathing down your neck at every turn, and there is a strong group incentive to controlling waste, otherwise everybody dies. I'm not sure the STNG utopia plays out the same way on inhabited worlds.

deleted 5y ago

[deleted]

jdauriemma 5y ago

> Similarly reduced, proof-of-stake systems work like this: > 1. The list of valid transactions determines who has coin. > 2. <complexity> > 3. People with coin decide which transactions are valid. > You don't need to know any more detail about proof-of-stake systems to be instantly suspicious. I am instantly suspicious of the author's reasoning here.

toomuchredbull 5y ago
Obviously the people who have the most to lose are most motivated to maintain the currencies stability/trustworthiness no? Isn't that the idea? If the people with the most start screwing around, everybody will stop using the currency and they will be left with nothing.
- hanniabu 5y ago
  Yup, and unlike with PoW where you can go mine another coin or sell your equipment, your investment is gone
- haskman 5y ago
  "If the people with the most money start screwing around with other people's money, then everybody will just abandon using money altogether, societal structure will collapse, and they will be left with nothing". Great argument.
- jdauriemma 5y ago
  > Obviously It's not obvious to me. Can you provide evidence that we can rely on the social dynamics you're describing?
- kbsspl 5y ago
  Unless people with the most something have hedged/shorted it against something else.
enraged_camel 5y ago
Yep. It's a logical fallacy: https://www.logicallyfallacious.com/logicalfallacies/Appeal-to-Complexity https://www.logicallyfallacious.com/logicalfallacies/Appeal-...

2bitencryption 5y ago

My biggest confusion about 'proof-of-stake' is... if there was never any 'work' done, where does the 'stake' come from? Does 'proof-of-stake' need to be 'bootstrapped' by a period of 'proof-of-work'? If the 'work' part is very simple and requires little effort, then couldn't I generate a 'stake' that's just as large as someone else's very easily?

deleted 5y ago
[deleted]
billytetrud 5y ago
It certainly can be bootstrapped by PoW, but doesn't need to be (and usually isn't in practice). The initial stake if it's not bootstrapped by a different consensus mechanism is simply created (not too differently than PoW creates coins). You have an initial block that anyone can create (but in practice, it's generally the creators of the coin who do that), and then the coin created in that and subsequent blocks is distributed in some way (sale, give aways, etc). The fairness of the distribution is always something highly scrutinized by the larger cryptocurrency community, and many coins (pow and pos) have massively unfair distributions of their currency (ie to themselves as a money making or "funding" scheme).
tastyfreeze 5y ago
Some proof of stake coins tried to do fountain or giveaway distribution. Proof of work doesnt need to precede proof of stake.
chrisco255 5y ago
> Does 'proof-of-stake' need to be 'bootstrapped' by a period of 'proof-of-work'? I think it's optimal if they do, because proof-of-work is more fair in the beginning, so it's easier to do a fair distribution launch with PoW. With Proof-of-stake, I've never seen a network launch that didn't result in a cartel. PoW algos adjust difficulty based on how much hash power is in the network. So you could do this, but people would see it and react to the demand plus you'd also have to sell most of the mined coin in order to cover your electricity costs.

lwansbrough 5y ago

I’ll preface by saying I think Proof of Waste schemes should be illegal. Proof of Stake schemes eventually over time become de-decentralized because as with PoW there is incentive to having a large stake (as demonstrated by the large private mining pools.) Eventually what you have is a clique of large powerful players in control of the financial system. You’ve basically reinvented banks but you made them extremely inefficient along the way. I don’t see any way how decentralization schemes eliminate the potential for organization, as centralizing inside a decentralized system is beneficial and highly efficient vs. remaining disorganized/decentralized. Decentralization seems fundamentally at odds with natural order and thus maintaining its decentralization costs energy. Compare that to USD which backpacks on the energy spent maintaining a nation, the cost of USD is essentially amortized by the simple existence of the US.

enchiridion 5y ago
Following this line, wouldn't corporations form around the large stakes? So essentially banks, but with transparent holdings? I'm not well versed enough in financial systems to game out the implications of this, but as someone who believes in the efficiency of free markets, it seems like a good thing to have more transparent banks.
- lwansbrough 5y ago
  Yes I think so. I'm a strong supporter of free markets* -- meaning, free markets are efficient and good, but efficiency isn't the only consideration for society so reasonable regulation is just and necessary. I'm not convinced you get any additional transparency from a blockchain that the government doesn't already get into any organization it wants to. Public ledgers also have remarkably poor privacy, which is necessary for some transactions and/or individuals.
  - enchiridion 5y ago
    That is an interesting point. The purpose of government access to that information in this case is to protect the public from shady practices, right? Potentially the benefit is the distribution of the information. As in it becomes standard for these new banks to make public which addresses/transactions they are associated with. The market will probably do a much better job at detecting especially harmful practices. Especially given that the asymmetry of information in fraud is often the only thing that makes it work. The privacy question is an interesting one. It seems like it pretty quickly reduces to some fundamental problems in crypto-system design. How can we design a system that is totally open on one end and totally anonymous on the other? And furthermore how do we guarantee that the banks won't set up addresses on the anonymous side to do shady things with? Not really sure how to align the incentives here. Potentially a combo of escrow and batching transactions. It would be interesting to hear ideas from people who work in this space.

encoderer 5y ago

Proof of work and proof of stake are both ultimately the same thing: proof of capital. Between the two, staking the capital directly is a lot more efficient than having to first convert the capital to hash rate.

rawtxapp 5y ago
Except only one of them requires ongoing capital investment which means you can't hold on to the return on your capital because you got it with practically no effort.
timdaub 5y ago
I disagree: If you summarize the difficulty of all Bitcoin blocks from the chain's tip and you're trying to "rebase" the chain at point x, you'd have to calculate at least the amount of hashes between x and the current tip to display a convincing fork with a similar cummulative difficulty. In proof of stake, since there's no "work" that's connecting the blocks, but just a sortition of who gets to submit a block, this ever growing hash tree doesn't gain more difficulty over time to rebase. That's what Bitcoin Maximalists always cry about and are never able to express in words.
privilegizer 5y ago
No. PoS is a trust-based system. No different than fiat. PoW is a work-based system. Similar to gold. You can't have a free lunch. Sorry.
- silentsea90 5y ago
  I am trying to learn. In both cases, user A has to invest some amount of money. In PoS, user A stakes money to make more money but gets penalized for breaking trust. Overall, user A makes say 10 coins over a 1000 staked coins ending up with 1010 coins. In PoW, user A loses some money to make more money. User spends 3 coins to make 13 coins, so user ends up with 1010 coins I don't see the difference yet.
  - splix 5y ago

sterlind 5y ago

This just seems like handwringing at the circularity of using stake (i.e. past transactions) to decide what blocks get validated (i.e. future transactions.) But it's wrong: First, attackers would need to collude to control 51% of the staked coin on the network to double-spend. There's no disincentive to stake (you won't lose coin if you're acting honestly), so stakes should approach the market cap of ETH itself. Second, even with a 51% attack you can't keep giving yourself money to solidify your stranglehold on the network. All you can do is double-spend, which doesn't help you raise your stake. And when your attack eventually fails, you're punished by losing your entire stake - wiping out 51% of ethereum. Finally, the "healing" the author alluded to of ETH would still happen. If an attack were carried out, and somehow managed to persist, honest miners would fork ethereum and blacklist all the coins that went into the malicious stake, rendering it impossible to mount again. Just because security is circular in a sense doesn't mean it's insecure.

anthony_r 5y ago
This is not directly about 51% attacks. This is about chain splits.
- sterlind 5y ago
  can you elaborate? how can malicious actors split the chains over an extended period without controlling 51% of the stake?
  - stickfigure 5y ago
    It's not about malicious actors. The community is perfectly capable of splitting on its own. See: ETC/ETH.
qecez 5y ago
Double-spends should be the least of your worries.
- everfree 5y ago

zaptheimpaler 5y ago

This is not even an argument, there's no substance at all, just "I don't know how this works, I won't bother to learn and I don't trust it". Even a 1 minute skim of Ethereum's docs on proof of stake[1] would prove him wrong. Proof of stake means the you have to hold ETH to validate transactions, meaning defrauding the network and causing a fork would destroy the value of your own stake. [1] https://ethereum.org/en/developers/docs/consensus-mechanisms/pos/ https://ethereum.org/en/developers/docs/consensus-mechanisms...

optymizer 5y ago
How would your stake get devalued? If the whole currency gets devalued then it would be devalued for everyone, not just for you. You'd end up holding the same % stake in the original network, and the same or greater stake in the fork as well.
- zaptheimpaler 5y ago
  The attackers percentage of stake would obviously not change but all tokens on that entire chain would be worth nothing once the public realized it had been hacked. They would hold 51%, or even 100% of a $0 token. All the verifiers who took part in the fraud and all the accounts linked to them would be traced and not given any stake in the new fork.
jml7c5 5y ago
I don't believe the author is talking about something like double-spending. They're describing a situation where major holders want to change something about the protocol, especially a change that is to their advantage.
- koonsolo 5y ago
  Same deal. If the other smaller half decides it's worth less because of it, your big stake will decrease in value.
mumblemumble 5y ago

dkarras 5y ago

Nobody has been able to explain this to me WRT cryptocurrencies and their "digital scarcity" quality: If people are free to create new chains out of thin air and build networks around it, how is anything digital "scarce"? Like, bitcoin set out to be deflationary, a "limited" amount of bitcoins till the end of eternity. ...except for the fact that I can create a new blockchain independent of bitcoin and it is the SAME thing, breaking the inflation proof quality of it. The new chain has a new "name", a new "brand" but that is just a conceptual difference, not a practical one. All the cryptocurrencies created after bitcoin creates "inflation" for bitcoin. If bitcoin was the only possible cryptocurrency but the hype around cryptocurrencies was the same, a bitcoin would cost substantially more today. If people are not happy with the "xcoin" billionaires at some time in the future, they can create just another currency to inflate the cryptocoin space (I'm saying "in the future" but that is what is happening since the beginning of this story). In that sense, they all are practically infinitely issuable. Different chains are just technically different, not practically. All are different forks of the same "cryptocurrency-token" of humankind, with no protection against additional and additional forks (new cryptocurrencies). So while this enormous efforts about the fork protections on a single chain is a fantastic academic and intellectual exercise... in the end one can create a new "cryptocurrency", a new network to create more "money" - that is the ultimate fork that can't be prevented by any on-chain methods. It is all futile in the end.

chrisco255 5y ago
Have you ever seen or heard of anyone pay $1M or $100K for a .com address? Why do they do that when there's like 256 TLDs? Why does anyone pay $20M to live in a box in Manhattan when they could buy a huge ranch in Montana and live like a king? Some blockchains are more valuable than others. And their blockspace is limited, just like Manhattan real estate. The reasons for this are numerous, but a big part of it comes down to security and liquidity. If you are going to create a digital agreement, you want a blockchain with a high degree of security and predictability. You also want composability with other applications so you can have access to an ecosystem and other financial services.
- dkarras 5y ago

billytetrud 5y ago

There seems to be a cult of proof of stake haters with basically no deep knowledge of the consensus mechanism who bash it with increasingly inane arguments. This is one of the worst I've seen. Basically: 1. Create bad metaphor 2. Relate it to your target 3. Claim the target of your criticism has no additional nuances than your bad metaphor. Perpetual motion machines, for example, have absolutely nothing to do with cryptocurrencies or proof of stake. Perpetual motion machines are impossible because of conservation of energy. There is no equivalent physical law that prevents proof of stake from being secure. What the author of this poorly conceived rant doesn't seem to understand is the concept of bootstrapping and incremental validation. Computers for example bootstrap every time they.. well.. boot, which is why they call it that. The program basically asks "what program should the computer run" and the program then tells it. No one would take a perpetual motion machine argument seriously if used to argue that computers can't work because they're self referential. But maybe the article is satire and I just missed the joke?

aeternum 5y ago
Computers bootstrap every time they boot, but few do it securely every time. The more complexity, in that incremental validation, the more likelihood there's a flaw. Take iphone for example, it's bootstrapped by keys within the tamper-proof hardware tpm, then all software is incrementally validated from there. Yet jailbreaks still frequently appear.
- billytetrud 5y ago
  There's a difference between saying "its impossible to do it securely" and "few currently do it securely". Also, I'm not trying to make the same mistake as the OP and claim that bootstrapping computers is at all relevant to analyzing whether PoS is secure. I'm just pointing out the absurdity of the OP's argument by showing that his metaphor trivially breaks down: reductio ad absurdum.
tarsinge 5y ago
> There seems to be a cult of proof of stake haters with basically no deep knowledge of the consensus mechanism who bash it with increasingly inane arguments. It’s not hard to see why: it’s an existential treat to Bitcoin that’s becoming more plausible every day. If PoS is proven to work at scale (e.g. with Eth2), it’s over, the energy usage of PoW will be unjustifiable. Disclaimer: I own a bit of BTC and ETH (50/50).

thebean11 5y ago

This criticism doesn't seem very substantial, what exact problem does PoS have that PoW doesn't have? Why doesn't PoW have the exact same "50/50 consensus split issue"? Bitcoin nodes can _also_ choose to pick an alternate chain, see every hard fork.

ric2b 5y ago
A Bitcoin node simply doesn't consider BSV blocks to be valid, they break Bitcoin's rules, that's what makes them hard-forks and is not related to this discussion. When there are multiple competing valid chains, with PoW the main chain is whichever one has the largest amount of work done. Eventually everyone converges to the same chain automatically. With PoS, how do you objectively chose between two competing chains?
- thebean11 5y ago
  Wouldn't it be whichever has more attestations by stakers?

armchairhacker 5y ago

Honestly, I don't understand why crypto, and especially PoW, is so special. My understanding is that crypto is good because 1) you can't "forge" crypto (mining is different since it takes resources), and 2) you can make transactions that are harder to track. Particularly because governments "forge" (print) money all the time, and heavily track how we spend. Ultimately, currency only has meaning because we assign value to it. The only intrinsic currencies are food, shelter, luxuries, etc. If people stop accepting Bitcoin, "I can prove that I have X bitcoin" no longer means anything. If government outlaws bitcoin and forces you to use USD, it doesn't matter that they can't forge or track bitcoin, because you have to use USD. A lot of people argue that PoS is bad because roughly "the people who control the most etherium can dictate the rules", but the people who control the resources we need will always dictate the rules. > Forking a proof-of-stake chain can create two chains, each of which is endorsed by a majority of stakers in that chain. This split can repeat ad infinitum. Which will be the “real” one? Isn't this the same as Bitcoin vs. Dogecoin vs. etcCoin?

chrisco255 5y ago
The author is poorly informed. Splits have happened and do happen, there's about 3 or 4 direct Bitcoin forks but they have little use. Social consensus is what ultimately controls which blockchain is viewed as the legitimate one. So if some plurality of rich stakers wanted to do a hostile takeover of a network, the community could create a fork where the oligarch coins are frozen and continue from there.
- gtyras2mrs 5y ago
  > So if some plurality of rich stakers wanted to do a hostile takeover of a network, the community could create a fork where the oligarch coins are frozen and continue from there. What's the "community" here? What would incentivise users to consider the new fork to be the legitimate one? If rich oligarchs control the first one - how do you build trust in the new one as opposed the current one? As a fiat currency - I would assume the rich oligarchs would have a great chance of leveraging wealth into ensuring that the current coin gets marketed and hence holds trust? The USD holds its current position because the US Gov stands behind it - what would keep the oligarchs propping the current coin up as opposed to the forked coin? I'm sorry if this sounds silly - as I'm not very into crypto.

wyldfire 5y ago

Proof of stake might have problems. But there aren't any identified here. Let's try and find the real problems instead of just posting FUD. Btw the smug portrait at the bottom (of the author?) seems out of place.

i_am_new_here 5y ago
The profile-picture is usually on the right, but "gets put below", if there is not enough screen-space.

lgrapenthin 5y ago

"People with coin" in step 3 is way too broad. And indeed, ETH PoS has a consensus protocol to decide which "people with coin" get to validate, and that doesn't work by "because the blockchain says so".

ItsMonkk 5y ago

I've done a little bit of research into event-sourced databases and journaling filesystems, but not nearly enough to be on expert on them. I think this article touches on exactly the crucial point. If I have a private key to my coins, why is someone else allowed to disallow a transfer of them? When I announce a transaction, because of the way mining works, that transaction gets sent to every miner, so that if they were to solve the block they could include my transaction. Why is Bitcoin made up of back-links to previous blocks? Isn't a block no more than a memoization of a event-sourced log at a point of time? That's just a really badly constructed journaling filesystem. Instead there should be no cryptographic mining PoW or PoS, all online miners would track all transactions since the last block was created. If at any point they did not have all of the transaction(which means if anyone else has reported a transaction that they have disallowed, easily compared by simply checking every miners head hash), they are considered to be offline and do not receive a mining share. All miners who are online when a new memoization is created gets a share of the reward. Help me out here, why do we need to solve the Byzantine General's problem for this?

eeegnu 5y ago
> Why is Bitcoin made up of back-links to previous blocks? Isn't a block no more than a memoization of a event-sourced log at a point of time? That's just a really badly constructed journaling filesystem. My understanding is that the chain of blocks, whereby each successor block is dependent on the hash of the previous one, acts as a self contained proof that a huge amount of work went into generating this. The rule that everyone needs to follow then is to simply always trust the longest chain presented to them (or the one that was most difficult to build depending on the amount of solutions at every difficulty.) By only looking at the last block, you lose this consensus mechanism. Not sure exactly how that isn't an issue with PoS though since they aren't verifying with work, and it seems that they can just keep track of the head of the transactions.
- ItsMonkk 5y ago
  The Byzantine General's problem states that messages can be corrupt, missing, misinformation, or otherwise unreliable. Thus to avoid exploitation by the few, we need some PoW mechanism. The Bitcoin network is not this. The Bitcoin network is everyone meeting at a central square, fully able to communicate - all having a full list of all transactions - and the dude with the password takes the reward and decides which transactions make it in. But they have no messaging problems! Bitcoin is not the same difficulty as Byzantine Generals! The work is meaningless when everyone is always communicating. There is no possibility of any miscommunication. The rules of a miner are simple: Add all transactions to the list. Make sure no one spends more than they have. That's it. If there is ever a merge conflict(a double spend) based on those rules, first transaction wins. It will most likely be known that it fails instantly, but if not by the time the memoization happens it will be known. Consensus becomes whichever one has all the transactions. If there is a firewall issue such that you can not reach the main chain, you can simply not issue any transactions. Same as today. I can see a potential that I am in the wrong here, not knowing about a crucial detail, but I don't know what that detail is.

cblconfederate 5y ago

The self-referntial part is not the biggest problem, in the past money was created to fund an army which then made the money stronger in a virtuous cycle. Its biggest flaw is that it removes the friction from switching sides, and makes it a subject of politics. BTC was created to be the opposite, to take the power back from politics

narush 5y ago

This post raises two common criticisms against proof-of-stake: it's self-referential (and therefore cannot work), and it's subjective (and therefore cannot work). Each of them have a bit of truth to them, but (spoilers) I strongly disagree with the conclusions. ------------ The "proof-of-steak is self-referential (and therefore cannot work)" argument goes like this: 1. Proof-of-Stake chains claim to be secure because there is value at risk. 2. The value at risk are the coins _on chain_, which only have value because the chain is secure. Therefore, as the "thing" giving the coins value is the coins having value themselves, this is self-referential, and so cannot work. Two quick responses. First, PoW has the same dynamics, albeit a bit more obfuscated. 1. The PoW chain is secure because there are miners willing to mine on the chain. 2. The miners are willing to mine on the chain because they get paid in coins that have value. 3. The coins have value for a multitude of reasons (duh, speculation), but one seemingly necessary one is that the chain is secure enough to allow transfers (aka, the chain is secure). So in PoW, we have the same self-referential dynamic. Second, there's no reason why self-referential systems don't work in the first place. I'd argue that a much more informative way of thinking about PoS/PoW as mechanisms is in a recursive way: 1. Value at time T -> Security at time T 2. Security at time T -> Value at time T + 1 etc. You can call anything that references itself a "perpetual motion machines." Merge sort references itself - that doesn't make it one. I would argue the recursive bootstrapping described above is one of the most interesting mechanisms public blockchains have currently (rivaled only by the crazy composability of programs you see on smart contract chains like Ethereum). --------- The "it's subjective (and therefore cannot work)" argument goes like this. 1. Stake is defined on the chain. 2. Stake determines which chain is the real chain. 3. Thus, if you have two chains that claim to each be the real chain, you cannot tell them apart. I'll note: this is pretty much true. For most modern PoS protocols that exist today, some form of initial "checkpoint" is needed to sync the chain. You need a blockhash to start from. However, after you sync your node for the first time using this has, this is no longer the case: as long as you sync your node to the chain more than once a month or so, you never need to do this again. Aka: you only need to get a hash of the chain upon initial sync. Practically, IMO, this pretty much changes nothing. 99.99999999% of users don't read the source code of the nodes they run (in fact, most people don't run nodes :() - and since node releases are on the order of once a month [1], users can just get the block hashed packaged with the software anyways. In most realistic security models, not much is different. --------- IMO, the biggest argument against PoS is it's complexity. Making a secure PoS protocol requires a lot more work than a basic PoW one. Managing this complexity appropriately is hard, and takes time + incremental steps if you want to do it well (and not fuck an existing network). That's mostly why Ethereum's PoS has been so delayed. But it's coming soon :). Shout out to the awesome people working on it! Source: I spent 3 years working on a variant of Casper (Ethereum's PoS protocol) at the Ethereum Foundation.

Cyril_HN 5y ago

I'll take some fiat, some proof of work, and some proof of stake. That's a better risk profile than only having 2 of 3.

qecez 5y ago
Don't forget to "diversify" into shitcoins, too.

AntiFreemason 5y ago

I prefer freedom from a global mafia that openly worships lucifer, aka the masons ...does it alarm you that 90% of police in the UK are Masons and their bosses worship lucifer?Does it bother you that 200 countries are closed down for a the corona virus with the pretext of covi.d..."Certificate of Vacunation ID" which has never even been isolated or seperated in a lab...ie does not exist.Oh no I cant even say that can, the sheep might wake up and hate so desperately wants to put their DARPA nanotechnology o sorry vacccccine into the blind and lost.The zombies who think the bible is irrelevant and the gov and tv are the forces that created the heaven and earth.This planet is drowning in conspiracy and we need crypto to breathe and be free.Those of you who talk like the government is some kind of god and we can not be against are sick in the head or soul.The government is a group of humans they are not sacred. The idea that some small elite controls crypto is a baseless argument, it is individual people who have the ability to live and control their resources on this earth in the middle of a massive enslaving conspiracy to literally change the dna code of the entire human race with their gene therapy disguised as a vax.I will be surprised if this comment stays up, in this world there is no space allowed for those who are awake.This world is a lie controlled by possessed people and the end is coming 7 years after they deceive you with their ufo technology.Pray to god to receive the holy spirit you can be saved..Pray Dear GOD I pray that you will forgive me of my sins send the holy spirit to live inside me, save me from my demons and the sin that lives in me, make me new as you want me to be and make me a born again christian.I pray this in Jesus name Amen

mrkramer 5y ago

In US all cryptocurrencies are treated as commodities and regulated by Commodity Futures Trading Commission under the U.S. Commodity Exchange Act but when Ethereum switches to Proof of Stake they will be regulated as security by Securities and Exchange Commission (SEC) and all "stake" holders will need to register their stakes and comply with the laws that govern the Securities Industry[1]. Under the US law "security" is "The term “security” means any note, stock, treasury stock, security future, security-based swap, bond, debenture, evidence of indebtedness, certificate of interest or participation in any profit-sharing agreement etc."[2] Ethereum falls under this since it is "profit-sharing agreement", it is an investment(stake) which allows other investors(stakeholders) to profit off of that owned security. Proof of stake cryptocurrency allows stakeholders to profit by holding their coins(stake) and if they do not comply with all aforementioned security laws(reporting, market controls etc.) all their coins(stake) can be seized and Etherum can be shut down by SEC as an unregistered security. [1] https://www.investor.gov/introduction-investing/investing-basics/role-sec/laws-govern-securities-industry https://www.investor.gov/introduction-investing/investing-ba... [2] https://uscode.house.gov/view.xhtml?req=(title:15%20section:77b%20edition:prelim) https://uscode.house.gov/view.xhtml?req=(title:15%20section:...

hanniabu 5y ago
That's simply false. When you stake you're being rewarded for your work securing the network, no different than mining. Further, if you do not stake you do not "profit".
- mrkramer 5y ago
  If you "stake" you invest and you are a stakeholder if you do not "stake" you are simply a user of Ethereum and all investments, stakes and stakeholders need to be regulated in order to protect investors and market. Cryptocurrencies and crypto tokens are not outside the law in particular not outside of financial and capital market regulation laws.
  - hanniabu 5y ago
    It's literally no different than mining and they have already stated the bitcoin and ethereum are not securities.

dathinab 5y ago

> Similarly reduced, proof-of-work systems work like this: > > 1. The list of valid transactions determines who has coin. > 2. <complexity> > 3. People with computers decide which transactions are valid. > You don't need to know any more detail about proof-of-work systems to be instantly suspicious. Hm, I think this misquote says all there is to say about the reasoning in this blog.

deleted 5y ago

[deleted]

jude- 5y ago

The author's central argument has been formally proven: https://eprint.iacr.org/2016/919.pdf https://eprint.iacr.org/2016/919.pdf. PoS protocols cannot offer a client with no a priori knowledge of the history of transactions a way to distinguish between an honest validator set and a corrupt validator set. There's no way to compare chain quality in-band.

hanniabu 5y ago
> There's no way to compare chain quality in-band. Just like with PoW where the longest chain and greatest hash power is the "honest" chain (even that is arguable), PoS functions similarly where the greatest staking power is the "honest" chain.
- jude- 5y ago
  Try reading the paper. They address that.

mrkramer 5y ago

Bitfury company did a research on PoW vs PoS [1] and their conclusion was "Pure proof of stake approaches pose substantial security threats that cannot be recreated in proof of work systems (including Bitcoin). These problems are inherent to proof of stake algorithms, as proof of stake consensus is not anchored in the physical world (cf. with hashing equipment in proof of work). That is why virtually all of currencies relying on proof of stake use additional mechanisms to address security issues." On top of that even Vitalik said "proof-of-stake systems are ultimately permanent nobilities where the members of the genesis block allocation always have the ultimate say. No matter what happens ten million blocks down the road, the genesis block members can always come together and launch an alternate fork with an alternate transaction history and have that fork take over." [2] [1] https://bitfury.com/content/downloads/pos-vs-pow-1.0.2.pdf https://bitfury.com/content/downloads/pos-vs-pow-1.0.2.pdf [2] https://blog.ethereum.org/2014/07/05/stake/ https://blog.ethereum.org/2014/07/05/stake/

spark3k 5y ago

Seems Jeff has launched a malicious attack on proof-of-stake, been unsuccessful, and has lost his stake. In this case his reputation. You can't hand-wave over "complexity" and then call it "opaque" and self referential using a bunch of vague and imprecise analogies. The "step 2 complexity" is where the system justifies itself. It's where it's proven sound. Just because you're too lazy to get into the weeds and technicals of it does not make the system flawed. A casual read of the overview of Ethereum 2's proof-of-stake mechanism[1] would have helped Jeff save his reputation staked on his blog post. [1] https://ethereum.org/en/developers/docs/consensus-mechanisms/pos/ https://ethereum.org/en/developers/docs/consensus-mechanisms...

tantaman 5y ago

Pure Proof of Stake is interesting in that the "stakers" are literally every single person in the economy -- mitigating much of this problem of the "pool" of stakers deciding that they don't agree with one another. https://www.algorand.com/resources/blog/proof-of-stake-vs-pure-proof-of-stake-consensus?utm_term=pure%20proof%20of%20stake&utm_campaign=Algorand+Proof+of+Stake&utm_source=adwords&utm_medium=ppc&hsa_acc=3295499188&hsa_cam=13089725985&hsa_grp=123713499833&hsa_ad=521469718012&hsa_src=g&hsa_tgt=aud-830523078124:kwd-936304957379&hsa_kw=pure%20proof%20of%20stake&hsa_mt=p&hsa_net=adwords&hsa_ver=3&gclid=CjwKCAjwtJ2FBhAuEiwAIKu19u_8s2qq2Dv3AFfoOHAzXvchwrOjqXoGrBf7YsksMAsqXrcLkkSUJBoCrw4QAvD_BwE https://www.algorand.com/resources/blog/proof-of-stake-vs-pu...

nazgulnarsil 5y ago

Proof of Stake is Proof of Work with more steps, it just pushes the work into non transparent processes.

mvolfik 5y ago
I'm new to PoS, so please apologize my lack of knowledge - but which part of the system will consume as much power as a medium sized country?

sktrdie 5y ago

One thing that PoW has for it is the idea brought up in the paper: where the coin is not just based on popularity of usage, fame or hype but its usage is actually measurable in a very real sense: through how much energy it consumes. The paper mentions how CPU power gives you (in a way) the ability to vote within the system. With a famous PoS coin you can measure its popularity based on number of transactions and usage across the globe - but who can really tell that those transactions were just not very few users pretending to makeup a busy network? With PoW on the other hand you have a very tangible way to measure interest in the network: they’re literally consuming energy and they’re literally many different entities since no single entity could ever consume that much energy. That’s a quite important difference imho.

oblinger333 5y ago

Annoyingly, this guy's reasoning is faulty, but one cannot comment on his 'blog' An inductive proof (which most mathematicians accept as valid) has exactly the structure he wants to call invalid. You prove N(0) case, then you prove N(i+1) case in terms of the N(i) case. This is how proof of stake is structured. It is true that one must START a proof of stake system in a valid state but then the correctness of a state depends upon the correctness of the state prior. The argument for POS is not quite a simple as that, but this just shows there is nothing inherently invalid about having the validity of a system depend upon the validity of an earlier state of that system. MANY, MANY systems have just this kind of guarantee. p.s. I dont own any ETH, I just hate bone headed thinking...