4 ms·

Is the threat of long range attacks in PoS any worse than PoW in practice? Bitcoin for example still relies on a list of hardcoded nodes for bootstrapping clie

Is the threat of long range attacks in PoS any worse than PoW in practice? Bitcoin for example still relies on a list of hardcoded nodes for bootstrapping clients. Not to mention very few people actually bother to verify the full chain (360GB and counting) from genesis. As for auditing the the integrity of the code or binary, it is signed by GPG keys hosted on public key servers accessed using X509 certificates pinned by a a couple of trust anchors preloaded in your OS. So much for distributed consensus...

ricardolopes 5y ago
The Bitcoin Core client includes a hardcoded list of DNS servers that point to thousands of nodes. These lists get updated frequently by different people. Other clients may use other lists. What is the threat model you're suggesting here, exactly? Do you know any other way to bootstrap a peer to peer network without centralised authorities? All network participants are forced to verify the full chain from genesis. Some might be OK with validating block header signatures only, and not the full transaction set. It's a tradeoff. You don't need to use those public key servers if you somehow distrust the CA certificates in your OS. Feel free to contact the repository maintainers or whatever else floats your boat. Anyway, bitcoin is an open source protocol, not a particular client implementation. If you distrust everything and everyone, no one can stop you from building your own client that works with the rest of the network.
- comex 5y ago
  > Do you know any other way to bootstrap a peer to peer network without centralised authorities? I’m not the parent, but – no, I don’t. But that’s exactly the point. The need to bootstrap from centralized authorities is what’s supposedly so bad about weak subjectivity in proof-of-stake. Yet in practice, it’s needed with proof-of-work as well.
  - Laforet 5y ago
    Hi Nick, very well said and this is precisely my point as well. Satoshi tried to convince us that we could decentralise trust by doing honest work instead of relying on authority. It turns out that doing work is actually pretty hard, people are lazy, and security is still the nemesis of efficiency.
  - ricardolopes 5y ago
    Maybe I didn't word it right, but I wasn't calling bitcoin's method reliant on centralised authorities, just asking if there were more methods out there that weren't as well. Bitcoin is an open source permissionless protocol, so you have multiple clients to chose from, each with their own list of bootstrapping nodes, many open source where you can submit a PR to add your node too. You can even build your own client and point to whatever you want. You can also just ignore them and just point directly to nodes in a list from a public forum, a private chat, whatever. Also, you're not just connected to those bootstrapping nodes: you use them to find the rest of the peers in the network.
    - colordrops 5y ago
      It seems that PoW is like recursion. You don't get it at all until you completely get it. It's a leap to understand it and somehow many very technical people don't understand a seemingly simple protocol even a decade after it became mainstream and is threatening national banks due to the very characteristics these people claim it doesn't have.
      - inter_netuser 5y ago
        Indeed, a very strange phenomena. Willful ignorance?
    - comex 5y ago
      > Bitcoin is an open source permissionless protocol, so you have multiple clients to chose from, each with their own list of bootstrapping nodes, many open source where you can submit a PR to add your node too. You can even build your own client and point to whatever you want. You can also just ignore them and just point directly to nodes in a list from a public forum, a private chat, whatever. I characterized this as relying on centralized authorities (albeit several of them), but sure, it can also be considered decentralized to some extent. The point is that it's a mechanism outside of the proof-of-work network itself. Instead of relying on a machine to reach consensus via a formal protocol, you the human are probing for a social consensus by evaluating statements made by other humans (via GitHub, public forums, or private chats, or just talking to people in person). In both proof-of-work and proof-of-stake, you need to find social consensus in order to initially obtain the software, after which point you can rely on the network's consensus. The difference with proof-of-stake is that you have to redo this if you disconnect from the network for months on end. In practice, for a variety of reasons, practically all users of cryptocurrencies download regular software updates, and thus continue to rely on social consensus, regardless of whether the currency is proof-of-work or proof-of-stake.
  - hackernews777 5y ago
    It's not actually needed, its simply a convenience for users who just want it to work out of the box. You can hand configure the bootstrapping process with -connect and -addnode if you wish.
- benlivengood 5y ago
  > Do you know any other way to bootstrap a peer to peer network without centralised authorities? In IPv4 a client might have a chance at auto-discovering peers. It's also not necessary to rely on a single centralized authority. There are many things (DNS, Encyclopedias, Linux kernel mirrors, etc.) where the majority of existing centralized authorities agree with each other.
  - jimmydorry 5y ago
    DNS is based around central authority though. Every root zone has name servers that serve as the authority. Their responses get cached at various levels but take those servers offline until TTLs start expiring and everything breaks. What part of DNS do you feel is possible without a centralized authority?
yanmaani 5y ago
> Bitcoin for example still relies on a list of hardcoded nodes for bootstrapping clients. It does, but it doesn't have to. You can use any mechanism you want to obtain one initial node and take it from there. You will still be connected to the network just as well, and you will be guaranteed to obtain the same results. This differs from Proof of Stake, where the quality of the results will be influenced by the quality of the bootstrap.
inter_netuser 5y ago
> As for auditing the the integrity of the code or binary, it is signed by GPG keys > hosted on public key servers accessed using X509 certificates pinned by a a > couple of trust anchors preloaded in your OS. So much for distributed consensus... You can literally validate the entire chain with a simple python script. Millions of those on github. >Not to mention very few people actually bother to verify the full chain (360GB and counting) from genesis. Absolutely wrong. The chain is validated in its entirety upon first sync. 100% from genesis to tip. >Bitcoin for example still relies on a list of hardcoded nodes for bootstrapping clients. It doesn't. Longest valid chain with most work is the canonical chain. Hardcoded seed nodes exist to speed up the discovery.
- tromp 5y ago
  > You can literally validate the entire chain with a simple python script. I challenge you to present a "simple python script" that implements the exact bitcoin consensus rules (as codified in bitcoin core). Bitcoin is not all that simple and there's a nontrivial amount of complexity in bitcoin script alone [1]. > The chain is validated in its entirety upon first sync. 100% from genesis to tip. The default behavior is to skip signature verification for all signatures before some relatively recent block [2]. [1] https://github.com/bitcoin/bitcoin/blob/master/src/script/interpreter.cpp https://github.com/bitcoin/bitcoin/blob/master/src/script/in... [2] https://github.com/bitcoin/bitcoin/pull/9484 https://github.com/bitcoin/bitcoin/pull/9484
  - Kranar 5y ago
    You're misunderstanding the default behavior which is fine becaue it's commonly misunderstood and discussed. At any rate signature verification is not skipped by default, what assumevalid skips is script verification. Everything else including UXTO, proof of work, the transactions themselves, are validated.
    - dlubarov 5y ago
      That seems a bit pedantic; the client itself prints > Assuming ancestors of block %s have valid signatures. when using -assumevalid. I agree it's imprecise, but it's not exactly wrong, since skipping scripts implies skipping signatures.
madacol 5y ago
I verified the full chain a couple of weeks ago (But I admit I trusted umbrel to choose the "correct" bitcoin-core software to run), It took less than 3 days to sync on a Rpi4

ricardolopes 5y ago

The Bitcoin Core client includes a hardcoded list of DNS servers that point to thousands of nodes. These lists get updated frequently by different people. Other clients may use other lists. What is the threat model you're suggesting here, exactly? Do you know any other way to bootstrap a peer to peer network without centralised authorities? All network participants are forced to verify the full chain from genesis. Some might be OK with validating block header signatures only, and not the full transaction set. It's a tradeoff. You don't need to use those public key servers if you somehow distrust the CA certificates in your OS. Feel free to contact the repository maintainers or whatever else floats your boat. Anyway, bitcoin is an open source protocol, not a particular client implementation. If you distrust everything and everyone, no one can stop you from building your own client that works with the rest of the network.

comex 5y ago
> Do you know any other way to bootstrap a peer to peer network without centralised authorities? I’m not the parent, but – no, I don’t. But that’s exactly the point. The need to bootstrap from centralized authorities is what’s supposedly so bad about weak subjectivity in proof-of-stake. Yet in practice, it’s needed with proof-of-work as well.
- Laforet 5y ago
  Hi Nick, very well said and this is precisely my point as well. Satoshi tried to convince us that we could decentralise trust by doing honest work instead of relying on authority. It turns out that doing work is actually pretty hard, people are lazy, and security is still the nemesis of efficiency.
- ricardolopes 5y ago
  Maybe I didn't word it right, but I wasn't calling bitcoin's method reliant on centralised authorities, just asking if there were more methods out there that weren't as well. Bitcoin is an open source permissionless protocol, so you have multiple clients to chose from, each with their own list of bootstrapping nodes, many open source where you can submit a PR to add your node too. You can even build your own client and point to whatever you want. You can also just ignore them and just point directly to nodes in a list from a public forum, a private chat, whatever. Also, you're not just connected to those bootstrapping nodes: you use them to find the rest of the peers in the network.
  - colordrops 5y ago
    It seems that PoW is like recursion. You don't get it at all until you completely get it. It's a leap to understand it and somehow many very technical people don't understand a seemingly simple protocol even a decade after it became mainstream and is threatening national banks due to the very characteristics these people claim it doesn't have.
    - inter_netuser 5y ago
      Indeed, a very strange phenomena. Willful ignorance?
  - comex 5y ago
    > Bitcoin is an open source permissionless protocol, so you have multiple clients to chose from, each with their own list of bootstrapping nodes, many open source where you can submit a PR to add your node too. You can even build your own client and point to whatever you want. You can also just ignore them and just point directly to nodes in a list from a public forum, a private chat, whatever. I characterized this as relying on centralized authorities (albeit several of them), but sure, it can also be considered decentralized to some extent. The point is that it's a mechanism outside of the proof-of-work network itself. Instead of relying on a machine to reach consensus via a formal protocol, you the human are probing for a social consensus by evaluating statements made by other humans (via GitHub, public forums, or private chats, or just talking to people in person). In both proof-of-work and proof-of-stake, you need to find social consensus in order to initially obtain the software, after which point you can rely on the network's consensus. The difference with proof-of-stake is that you have to redo this if you disconnect from the network for months on end. In practice, for a variety of reasons, practically all users of cryptocurrencies download regular software updates, and thus continue to rely on social consensus, regardless of whether the currency is proof-of-work or proof-of-stake.
- hackernews777 5y ago
  It's not actually needed, its simply a convenience for users who just want it to work out of the box. You can hand configure the bootstrapping process with -connect and -addnode if you wish.
benlivengood 5y ago
> Do you know any other way to bootstrap a peer to peer network without centralised authorities? In IPv4 a client might have a chance at auto-discovering peers. It's also not necessary to rely on a single centralized authority. There are many things (DNS, Encyclopedias, Linux kernel mirrors, etc.) where the majority of existing centralized authorities agree with each other.
- jimmydorry 5y ago
  DNS is based around central authority though. Every root zone has name servers that serve as the authority. Their responses get cached at various levels but take those servers offline until TTLs start expiring and everything breaks. What part of DNS do you feel is possible without a centralized authority?

yanmaani 5y ago

> Bitcoin for example still relies on a list of hardcoded nodes for bootstrapping clients. It does, but it doesn't have to. You can use any mechanism you want to obtain one initial node and take it from there. You will still be connected to the network just as well, and you will be guaranteed to obtain the same results. This differs from Proof of Stake, where the quality of the results will be influenced by the quality of the bootstrap.

inter_netuser 5y ago

> As for auditing the the integrity of the code or binary, it is signed by GPG keys > hosted on public key servers accessed using X509 certificates pinned by a a > couple of trust anchors preloaded in your OS. So much for distributed consensus... You can literally validate the entire chain with a simple python script. Millions of those on github. >Not to mention very few people actually bother to verify the full chain (360GB and counting) from genesis. Absolutely wrong. The chain is validated in its entirety upon first sync. 100% from genesis to tip. >Bitcoin for example still relies on a list of hardcoded nodes for bootstrapping clients. It doesn't. Longest valid chain with most work is the canonical chain. Hardcoded seed nodes exist to speed up the discovery.

tromp 5y ago
> You can literally validate the entire chain with a simple python script. I challenge you to present a "simple python script" that implements the exact bitcoin consensus rules (as codified in bitcoin core). Bitcoin is not all that simple and there's a nontrivial amount of complexity in bitcoin script alone [1]. > The chain is validated in its entirety upon first sync. 100% from genesis to tip. The default behavior is to skip signature verification for all signatures before some relatively recent block [2]. [1] https://github.com/bitcoin/bitcoin/blob/master/src/script/interpreter.cpp https://github.com/bitcoin/bitcoin/blob/master/src/script/in... [2] https://github.com/bitcoin/bitcoin/pull/9484 https://github.com/bitcoin/bitcoin/pull/9484
- Kranar 5y ago
  You're misunderstanding the default behavior which is fine becaue it's commonly misunderstood and discussed. At any rate signature verification is not skipped by default, what assumevalid skips is script verification. Everything else including UXTO, proof of work, the transactions themselves, are validated.
  - dlubarov 5y ago
    That seems a bit pedantic; the client itself prints > Assuming ancestors of block %s have valid signatures. when using -assumevalid. I agree it's imprecise, but it's not exactly wrong, since skipping scripts implies skipping signatures.

madacol 5y ago

I verified the full chain a couple of weeks ago (But I admit I trusted umbrel to choose the "correct" bitcoin-core software to run), It took less than 3 days to sync on a Rpi4