4 ms·

If folks are interested in the old Monero PoW function (and, uh, the reason they changed it), I wrote up a thing about it a long time ago: https://da-data.blog

by dgacmu 6mo ago

If folks are interested in the old Monero PoW function (and, uh, the reason they changed it), I wrote up a thing about it a long time ago: https://da-data.blogspot.com/2014/08/minting-money-with-monero-and-cpu.html https://da-data.blogspot.com/2014/08/minting-money-with-mone... The history of people trying to design GPU or ASIC-resistant proof-of-work functions is long and mostly unsuccessful. I haven't looked into RandomX; it's possible they've succeeded here (or possible that with the alt-coin market mining profitability tanking after Ethereum moved to proof-of-stake, it just wasn't worth it).

alcazar 6mo ago
This was a super interesting read, and it highlights exactly the strength of cryptocurrencies. They turn game theory in their favor, so egoistic players (I don't mean this in an offensive tone) contribute to making it stronger and safer for everyone else. Thank you for sharing!
- dgacmu 6mo ago
  They kinda do - I'll admit honestly that the final game I played in the cryptocurrency space I played solely to profit. (It was a minor, uh, **coin that didn't have a lot of redeeming value to start with). Though it turns out the incentives remained somewhat aligned: I ended up providing the developer with some security bug fixes to make sure someone couldn't mess with the cash cow. :) (To be clear: We were just optimizing mining; in the process of looking for ways to mine it faster, I found some security bugs and fixed them. We weren't exploiting the bugs, that crosses a line for me.)
AureliusMA 6mo ago
There was a proposal on Ethereum that didn't succeed (progpow) since they were already in the late stage of transitionning to PoS. Ethereum did quite a good job at keeping asic advantage moderate (the speedup was 100% max - not orders of magnitude). RandomX is basically progpow that succeeded. You might be interested in Chia's Proof of Space and Time... and how it collapsed!
- hyc_symas 6mo ago
  ProgPow was ridiculously simple and would never have accomplished its goal. I covered it briefly in my Monerokon talk as well.
- idiotsecant 6mo ago
  I don't know if PoW based approaches make much sense in the modern environment, anyhow -even very clever ones that provide ASIC resistance. Ethereum has been doing real proof of stake (and not delegated proof of stake which is both easier and terrible from a system safety perspective) for quite a while and it's seemingly cheap, effective, and robust.
  - hyc_symas 6mo ago
    PoW is useful in far more situations than PoS. A derivative of RandomX is now used to protect TOR too (Equi-X). https://github.com/tevador/equix/blob/master/devlog.md https://github.com/tevador/equix/blob/master/devlog.md
    - idiotsecant 6mo ago
      Yes I suppose it's difficult to stake something of value when the system you're securing is not stapled to a currency.
- jancsika 6mo ago
  > You might be interested in Chia's Proof of Space and Time... and how it collapsed! Because it was written by Bram Cohen, I'd be interested in reading two or three sentences about how it collapsed. Because it's a blockchain-based cryptocurrency, feel free to stop writing after three or four sentences.
tardedmeme 6mo ago
RandomX is designed so that if you design a RandomX ASIC then you've designed a CPU. It writes and then executes random programs. To minimize the possible efficiency gains from matching the instruction set architecture, the same program is executed several thousand times, reducing the relative overhead of translating it to a different ISA.
ProllyInfamous 6mo ago
I partially heat my home by running the default Monero client on old Xeons (heat ejects near my desktoes). As I only mine when it's cold outside (otherwise using resistive heating), there is no actual net electricity cost. IMHO it's not "worth it" for an individual to buy equipment specifically to mine crypto... but if you already have an old machine AND you heat without a heatpump, it's a free hobby/heater. ---- To anybody else that is syncing a fresh monero blockchain copy (i.e. installing the official client), I recommend using the custom node flag ` --db-sync-mode safe ` — which is slower but corruption-avoiding — before node's initial bootup. Without safemode, any halt of the client will [most likely] corrupt the local blockchain (losing days of DL/verification). Also, if you use an SSD for storing any blockchain (as recommended by monero team... but not by me), know that its lifespan will be greatly reduced from the constant IO/access. Personally, I recommend safemode (see above) on a 7200RPM spinner (HDDs effectively don't wear during IO/access). ---- What are your thoughts on running xmrig vs. the default getmonero.org client? Would you in general agree that monero remains ASIC-resistant?
- hyc_symas 6mo ago
  Just use a Linux laptop with a working battery so you never have to worry about power outages or other system crashes. In that case, you don't need safe sync mode, and you don't have to kill your SSD.
  - ProllyInfamous 6mo ago
    Working battery ≠= avoiding system crashes | my local node has a UPS, and still Monero's client is dicey (Mac & Linux distros). Particularly on its initial sync, Monero's daemon is flakeyAF. If you (e.g.) don't allow `sync in background` (why is this not the default behavior?!), the official Monero client is notorious for locking up on wakeup. Once you kill the process, your local blockchain is [most likely] unusable. Another reason to use safe-sync is (e.g.) if your system (Linux or whatnot) decides to update/restart during the several days it takes to sync-initially. ---- Just out of curiosity, why do you abuse an SSD so (safe-mode, or not)? For SSD-diehards, I'd recomment getting a very large size because this'll last longer, presuming the drive self-levels.
tomjen3 6mo ago
They had to design a specialized verification function, which I imagine would be the easy way to break it. The brilliant part of Bitcoin is that it uses very widely known crypto primitives - verification is the same as getting the right seed (you just happen to be told what the right seed is, rather than having to pay for it to be discovered).
- hyc_symas 6mo ago
  You must be on drugs. There is no separate specialized verification function. It's the same algorithm for verification as for mining.
  - tromp 6mo ago
    Correct; both Bitcoin and Monero use Hashcash as PoW, only differing in the choice of hash function. Verification is only different from a solution attempt in asymmetric (i.e. non-Hashcash) PoW, such as Cuckoo Cycle or (the poorly named) Equihash.
- fluffypony 6mo ago
  lolwut. There is no specialised verification function.
fluffypony 6mo ago
Hmmm. That's not the reason we changed it. We just got tired of tweaking things to prevent ASICs. I'll add that there was such a large influx of miners at the outset, that (statistically) it seems any crippling of the original algorithm was fairly futile - the edge was both short-lived and minimally impactful. We're over a decade later, and nobody mining in the first month (even with that unfair advantage) was able to gain any meaningful percentage of Monero's emission. I'll add that RandomX has proven that it is indeed possible to create a GPU and ASIC-resistant PoW algorithm. I'd encourage you to dig in further - the closest to an "ASIC" is a multi-CPU miner (Bitmain X9) with a bunch of RISC-V CPUs in it.
- dgacmu 6mo ago
  Sorry, I was not quite saying my fun was the reason, but that the failure to create something GPU/ASIC resilient was the more general underlying cause. But be careful about "proven" in that last sentence - the absence of a solution isn't exactly proof, it's more of a proof that _either_ it is possible to create an ASIC-resistant algo _or_ it has not been worthwhile to ASIC-ify it given the economics of mining XMR and the research & NRE required to do so. I haven't the foggiest which of those two it is, mind you, just that there are a few remaining valid explanations.
  - rschneid 6mo ago
    It's a proof that something is possible to show one example. In this case the claim was ASIC-resistant PoW is possible, and the proof has been the historical behavior of miners after years of RandomX. Nobody said it would be eternally or entirely resistant to optimizations...
    - Nevermark 6mo ago
      You are twisting words beyon any coherent meaning. > It's a proof that something is possible to show one example. Agreed. > the proof has been the historical behavior of miners after years of RandomX. > Nobody said it would be eternally or entirely resistant to optimizations... These are contradictory statements. If historical behavior was a proof, then it would be eternally and entirely resistant.
yieldcrv 6mo ago
Monero has used Random X for 7 years Why even mention that era? Your fascinating by that time was shorter than its post Random X lifecycle

by dgacmu 6mo ago

alcazar 6mo ago

This was a super interesting read, and it highlights exactly the strength of cryptocurrencies. They turn game theory in their favor, so egoistic players (I don't mean this in an offensive tone) contribute to making it stronger and safer for everyone else. Thank you for sharing!

dgacmu 6mo ago
They kinda do - I'll admit honestly that the final game I played in the cryptocurrency space I played solely to profit. (It was a minor, uh, **coin that didn't have a lot of redeeming value to start with). Though it turns out the incentives remained somewhat aligned: I ended up providing the developer with some security bug fixes to make sure someone couldn't mess with the cash cow. :) (To be clear: We were just optimizing mining; in the process of looking for ways to mine it faster, I found some security bugs and fixed them. We weren't exploiting the bugs, that crosses a line for me.)

AureliusMA 6mo ago

There was a proposal on Ethereum that didn't succeed (progpow) since they were already in the late stage of transitionning to PoS. Ethereum did quite a good job at keeping asic advantage moderate (the speedup was 100% max - not orders of magnitude). RandomX is basically progpow that succeeded. You might be interested in Chia's Proof of Space and Time... and how it collapsed!

hyc_symas 6mo ago
ProgPow was ridiculously simple and would never have accomplished its goal. I covered it briefly in my Monerokon talk as well.
idiotsecant 6mo ago
I don't know if PoW based approaches make much sense in the modern environment, anyhow -even very clever ones that provide ASIC resistance. Ethereum has been doing real proof of stake (and not delegated proof of stake which is both easier and terrible from a system safety perspective) for quite a while and it's seemingly cheap, effective, and robust.
- hyc_symas 6mo ago
  PoW is useful in far more situations than PoS. A derivative of RandomX is now used to protect TOR too (Equi-X). https://github.com/tevador/equix/blob/master/devlog.md https://github.com/tevador/equix/blob/master/devlog.md
  - idiotsecant 6mo ago
    Yes I suppose it's difficult to stake something of value when the system you're securing is not stapled to a currency.
jancsika 6mo ago
> You might be interested in Chia's Proof of Space and Time... and how it collapsed! Because it was written by Bram Cohen, I'd be interested in reading two or three sentences about how it collapsed. Because it's a blockchain-based cryptocurrency, feel free to stop writing after three or four sentences.

tardedmeme 6mo ago

RandomX is designed so that if you design a RandomX ASIC then you've designed a CPU. It writes and then executes random programs. To minimize the possible efficiency gains from matching the instruction set architecture, the same program is executed several thousand times, reducing the relative overhead of translating it to a different ISA.

ProllyInfamous 6mo ago

I partially heat my home by running the default Monero client on old Xeons (heat ejects near my desktoes). As I only mine when it's cold outside (otherwise using resistive heating), there is no actual net electricity cost. IMHO it's not "worth it" for an individual to buy equipment specifically to mine crypto... but if you already have an old machine AND you heat without a heatpump, it's a free hobby/heater. ---- To anybody else that is syncing a fresh monero blockchain copy (i.e. installing the official client), I recommend using the custom node flag ` --db-sync-mode safe ` — which is slower but corruption-avoiding — before node's initial bootup. Without safemode, any halt of the client will [most likely] corrupt the local blockchain (losing days of DL/verification). Also, if you use an SSD for storing any blockchain (as recommended by monero team... but not by me), know that its lifespan will be greatly reduced from the constant IO/access. Personally, I recommend safemode (see above) on a 7200RPM spinner (HDDs effectively don't wear during IO/access). ---- What are your thoughts on running xmrig vs. the default getmonero.org client? Would you in general agree that monero remains ASIC-resistant?

hyc_symas 6mo ago
Just use a Linux laptop with a working battery so you never have to worry about power outages or other system crashes. In that case, you don't need safe sync mode, and you don't have to kill your SSD.
- ProllyInfamous 6mo ago
  Working battery ≠= avoiding system crashes | my local node has a UPS, and still Monero's client is dicey (Mac & Linux distros). Particularly on its initial sync, Monero's daemon is flakeyAF. If you (e.g.) don't allow `sync in background` (why is this not the default behavior?!), the official Monero client is notorious for locking up on wakeup. Once you kill the process, your local blockchain is [most likely] unusable. Another reason to use safe-sync is (e.g.) if your system (Linux or whatnot) decides to update/restart during the several days it takes to sync-initially. ---- Just out of curiosity, why do you abuse an SSD so (safe-mode, or not)? For SSD-diehards, I'd recomment getting a very large size because this'll last longer, presuming the drive self-levels.

tomjen3 6mo ago

They had to design a specialized verification function, which I imagine would be the easy way to break it. The brilliant part of Bitcoin is that it uses very widely known crypto primitives - verification is the same as getting the right seed (you just happen to be told what the right seed is, rather than having to pay for it to be discovered).

hyc_symas 6mo ago
You must be on drugs. There is no separate specialized verification function. It's the same algorithm for verification as for mining.
- tromp 6mo ago
  Correct; both Bitcoin and Monero use Hashcash as PoW, only differing in the choice of hash function. Verification is only different from a solution attempt in asymmetric (i.e. non-Hashcash) PoW, such as Cuckoo Cycle or (the poorly named) Equihash.
fluffypony 6mo ago
lolwut. There is no specialised verification function.

fluffypony 6mo ago

Hmmm. That's not the reason we changed it. We just got tired of tweaking things to prevent ASICs. I'll add that there was such a large influx of miners at the outset, that (statistically) it seems any crippling of the original algorithm was fairly futile - the edge was both short-lived and minimally impactful. We're over a decade later, and nobody mining in the first month (even with that unfair advantage) was able to gain any meaningful percentage of Monero's emission. I'll add that RandomX has proven that it is indeed possible to create a GPU and ASIC-resistant PoW algorithm. I'd encourage you to dig in further - the closest to an "ASIC" is a multi-CPU miner (Bitmain X9) with a bunch of RISC-V CPUs in it.

dgacmu 6mo ago
Sorry, I was not quite saying my fun was the reason, but that the failure to create something GPU/ASIC resilient was the more general underlying cause. But be careful about "proven" in that last sentence - the absence of a solution isn't exactly proof, it's more of a proof that _either_ it is possible to create an ASIC-resistant algo _or_ it has not been worthwhile to ASIC-ify it given the economics of mining XMR and the research & NRE required to do so. I haven't the foggiest which of those two it is, mind you, just that there are a few remaining valid explanations.
- rschneid 6mo ago
  It's a proof that something is possible to show one example. In this case the claim was ASIC-resistant PoW is possible, and the proof has been the historical behavior of miners after years of RandomX. Nobody said it would be eternally or entirely resistant to optimizations...
  - Nevermark 6mo ago
    You are twisting words beyon any coherent meaning. > It's a proof that something is possible to show one example. Agreed. > the proof has been the historical behavior of miners after years of RandomX. > Nobody said it would be eternally or entirely resistant to optimizations... These are contradictory statements. If historical behavior was a proof, then it would be eternally and entirely resistant.

yieldcrv 6mo ago

Monero has used Random X for 7 years Why even mention that era? Your fascinating by that time was shorter than its post Random X lifecycle