3 ms·

This is a silly article. Only working in a weaker security model does not, a priori, mean that proof of stake is a scam; it just means you need to convince you

This is a silly article. Only working in a weaker security model does not, a priori, mean that proof of stake is a scam; it just means you need to convince yourself that the weaker security model holds. You can read the post linked (https://blog.ethereum.org/2014/11/25/proof-stake-learned-love-weak-subjectivity/ https://blog.ethereum.org/2014/11/25/proof-stake-learned-lov...) and decide for yourself. Personally, I think this kind of "quiescent" knowledge, letting you differentiate the real chain from the fake chain on long enough timescales (which basically amounts to knowledge of a single hash, when you get right down to it), is perfectly reasonable to assume under realistic circumstances, for the same reason that synchronized time is not a remotely difficult problem on long enough timespans. The only problem lies in new nodes (that enter the system when there's not a quiescent state, and the longer chain is being withheld) being exposed to fake chains. By using a VDF as mentioned below to make sure it takes just as long to construct a new chain as it took to construct the old one, one can ensure that as long as at the time the stakers held their keys (rather than for all time) a majority were trustworthy, then the probability that they were able to maintain a longer chain becomes vanishingly small. Therefore, nodes will be able to reliably choose the longer chain on reconnecting to the system. This trust model seems pretty realistic to me, and it's not like Bitcoin can handle the case of a continuous partition to begin with. So this just reduces to "once a majority is not trustworthy, the chain can't be trusted anymore" which is the actual security tradeoff of PoW vs. PoS (PoW puts trust in hashpower rather than staked coins, so by definition it's immune to this sort of issue; if your private key is stolen you "only" lose your coins, not any voting power). I don't think this is news to anyone who's done much research into cryptocurrency.

Cantinflas 5y ago
Great comment, let's do a TL;DR of the article: - Clickbait title. - Some of the claims can be debunked with a 2014 blog post. - Tradeoffs pow/pos are known and accepted for a long time. Nothing new added except drama.
inter_netuser 5y ago
> Essentially, VDFs take a certain amount of steps to compute and cannot be parallelized. However, the correctness of their output can be verified efficiently. this...sounds exactly like proof of work? Indeed, you can probably fix plutocracy with some PoW.
- Jweb_Guru 5y ago
  It is not. At least, not in the usual environmentally destructive sense that people tend to mean by PoW. The idea behind VDFs is that they can only be computed in a single-threaded fashion, so you don't gain any benefit from computing them on giant server farms. This is the exact opposite of PoW which is designed to be computable massively in parallel. In this context, of course, not benefiting from giant server farms is good, because it means people won't wreck the environment to compute them. The tradeoff is fundamental: because VDFs don't benefit from throwing computational resources at them, there is no disadvantage to computing a bunch of them in parallel. So if you had bad intentions from the getgo (and you had a majority of stake at the time), you could still secretly compute a fake bad chain starting at time t, and then release an alternative at time t+n that was as long or longer than the real chain; the security they provide is that if someone compromises your keys later (after you already lost your majority), they can't do this. Since in practice proof of stake chains start very centralized and then distribute over time, this is a useful practical thing to care about! With PoW, on the other hand, computing a fake chain requires you to not use all your hashpower, which opens you up to economic attacks from someone else who is willing to use that hashpower. When someone uses more hashpower than you were, they'll be able to make a longer chain faster (before the difficulty readjusts again), so now all your secret chains have been made useless (and in cases of equal chain length, people tiebreak by hashpower, so you can't just maintain a little side network that eventually catches up when hashpower decreases, either). That's the theory, anyway: it's heavily based on economic incentives, so if some government decided that they didn't really care about the economics and just wanted to screw over chain users by pumping out hashpower, they could do so quite easily. Note that by contrast, proof of stake is not susceptible to this: you actually do have to compromise a majority of the active stakers no matter how much money you have. Personally, I think this is a distinction without a difference because I don't think any cryptocurency can stand up to sustained attacks by large nation-states (which is part of why I don't think it's very useful). But like I said, that's an assessment of the threat model, so it's subjective and up to you to decide.
- Dylan16807 5y ago
  > Indeed, you can probably fix plutocracy with some PoW. Uh... great! Glad you agree that this is a solution? Let's switch to this new "some PoW" system as soon as possible, because it uses less than a megawatt to calculate proofs. Total, for the entire network.
deleted 5y ago
[deleted]

Cantinflas 5y ago

Great comment, let's do a TL;DR of the article: - Clickbait title. - Some of the claims can be debunked with a 2014 blog post. - Tradeoffs pow/pos are known and accepted for a long time. Nothing new added except drama.

inter_netuser 5y ago

> Essentially, VDFs take a certain amount of steps to compute and cannot be parallelized. However, the correctness of their output can be verified efficiently. this...sounds exactly like proof of work? Indeed, you can probably fix plutocracy with some PoW.

Jweb_Guru 5y ago
It is not. At least, not in the usual environmentally destructive sense that people tend to mean by PoW. The idea behind VDFs is that they can only be computed in a single-threaded fashion, so you don't gain any benefit from computing them on giant server farms. This is the exact opposite of PoW which is designed to be computable massively in parallel. In this context, of course, not benefiting from giant server farms is good, because it means people won't wreck the environment to compute them. The tradeoff is fundamental: because VDFs don't benefit from throwing computational resources at them, there is no disadvantage to computing a bunch of them in parallel. So if you had bad intentions from the getgo (and you had a majority of stake at the time), you could still secretly compute a fake bad chain starting at time t, and then release an alternative at time t+n that was as long or longer than the real chain; the security they provide is that if someone compromises your keys later (after you already lost your majority), they can't do this. Since in practice proof of stake chains start very centralized and then distribute over time, this is a useful practical thing to care about! With PoW, on the other hand, computing a fake chain requires you to not use all your hashpower, which opens you up to economic attacks from someone else who is willing to use that hashpower. When someone uses more hashpower than you were, they'll be able to make a longer chain faster (before the difficulty readjusts again), so now all your secret chains have been made useless (and in cases of equal chain length, people tiebreak by hashpower, so you can't just maintain a little side network that eventually catches up when hashpower decreases, either). That's the theory, anyway: it's heavily based on economic incentives, so if some government decided that they didn't really care about the economics and just wanted to screw over chain users by pumping out hashpower, they could do so quite easily. Note that by contrast, proof of stake is not susceptible to this: you actually do have to compromise a majority of the active stakers no matter how much money you have. Personally, I think this is a distinction without a difference because I don't think any cryptocurency can stand up to sustained attacks by large nation-states (which is part of why I don't think it's very useful). But like I said, that's an assessment of the threat model, so it's subjective and up to you to decide.
Dylan16807 5y ago
> Indeed, you can probably fix plutocracy with some PoW. Uh... great! Glad you agree that this is a solution? Let's switch to this new "some PoW" system as soon as possible, because it uses less than a megawatt to calculate proofs. Total, for the entire network.

deleted 5y ago

[deleted]