10 ms·

Minimum Viable Block Chain

335 points by vikrum 12y ago

sadfaceunread 12y ago
Excellent read. This is not for a general audience, but helped me get a nicer grasp on the fundamentals technology than I had before without getting too particular in the under the hood stuff. The "blocks are never final" idea is what I believe has led to some of the proposed 51% attacks on the bitcoin network. Question: Does proof of work have to be a near 'lottery' system? Obviously it needs to be asymmetric, but are there other good options than hash collision?
- NoMoreNicksLeft 12y ago
  At scale, some of the distributed problems are asymmetrical. When they're doing the protein folding stuff or checking for pharmaceutical activity in simulated drugs, it's much easier to confirm a hit than it is to find one... but the reason those are distributed is because they are such incredibly difficult problems.
- tromp 12y ago
  The described proof-of-work system is known as hashcash http://www.hashcash.org/docs/hashcash.html http://www.hashcash.org/docs/hashcash.html which asks for a partial preimage of a hash function. There are indeed other proof-of-work algorithms. Probably the first one is Primecoin, which asks for a Cunningham chain of prime-numbers. My own Cuckoo Cycle, asking for a cycle in a huge graph, is another example, in which a single proof attempt takes hundreds of MB of memory, but verification is instant and takes no memory.
- theswan 12y ago
  Some other proof of work protocols: http://en.wikipedia.org/wiki/Proof-of-work_system#List_of_proof-of-work_functions http://en.wikipedia.org/wiki/Proof-of-work_system#List_of_pr...
  - tromp 12y ago
    Or on the more detailed cryptocurrency wiki: https://en.bitcoin.it/wiki/Proof_of_work https://en.bitcoin.it/wiki/Proof_of_work
- awestroke 12y ago
  It has to be trivial to verify yet really really hard to solve in the first place. Hash collisions has the added benefit of allowing variable difficulty
- igrigorik 12y ago
  Wikipedia has a nice list of various proof-of-work functions: https://en.wikipedia.org/wiki/Proof-of-work_system#List_of_proof-of-work_functions https://en.wikipedia.org/wiki/Proof-of-work_system#List_of_p... As for "lottery", I believe the answer is yes and no. The basic point is to raise the cost of "faking" a confirmation, and how you do that is completely up to you - e.g. captchas are a great example! That said, the random part of the non-deterministic process provides a lot of really nice properties for a distributed system - fairness claims, etc. That said, this is a deep topic (with lots of caveats) in its own right.
- olalonde 12y ago
  There are even alternatives to PoW for obtaining consensus such as Proof of Stake which doesn't consume much CPU power in theory.
EGreg 12y ago
I like that this actually covers why each piece is needed. My only beef with this system is the proof of work, which leads to an arms race in electricity consumption. Proof of stake is better, and frankly, distributed timestamps don't need a race to solve a problem every time something has to be timestamped. For currency, it would actually be nicer to have a system that treats trust/credit/reputation as the scarce resource. It would help people who aren't rich in the traditional sense nevertheless organize and help each other, and would allow people to "create their own currency" in communities, or the equivalent of that, that they aren't able to do now.
- bjitty 12y ago
  I'm familiar with proof of work and how it works within a blockchain to secure blocks. I keep hearing about prof of stake. I'm very interested in it, however I haven't found an explanation that clearly explains to me how it works. I've looked at the Wiki article and read a little about Peercoin. Do you know of any article, video or source that may help explain exactly how proof of stake works?
  - flatline 12y ago
    If you haven't read the peercoin whitepaper[1], it may get you a bit closer to an understanding. That being said, I still don't have a solid grasp of exactly how coins destroyed results in solving blocks... [1] http://www.peercoin.net/whitepaper http://www.peercoin.net/whitepaper
    - bjitty 12y ago
      Thank you! I can't believe I missed it and didn't think to check for a white paper for this. Especially since that's what really cleared up bitcoin's proof of work blockchain to me.
  - bachback 12y ago
    proof of stake was first proposed in 2011 on bitcointalk, the go-to reference for everything bitcoin/altcoin. https://en.bitcoin.it/wiki/Proof_of_Stake https://en.bitcoin.it/wiki/Proof_of_Stake http://wiki.nxtcrypto.org/ http://wiki.nxtcrypto.org/ http://bitshares.org/security/delegated-proof-of-stake.php http://bitshares.org/security/delegated-proof-of-stake.php If any coins make it you can see at watching the marketcap of the coins at http://coinmarketcap.com http://coinmarketcap.com
maaaats 12y ago
Somewhat related: The size of a chain will be constantly growing, right? How fast, and will it be a problem?
- igrigorik 12y ago
  Yes, it will be. The rate itself obviously depends on number of transactions and amount of data per transaction.. Both of those are specific to your implementation. That said, as a reference, a Bitcoin transaction today is anywhere between ~160~1000 bytes, and the full block chain is on the order of tens of GBs. Is that a problem? It can be. To address this, Bitcoin uses Merkle trees and "Simple Payment Verification" (SPV) -- worth looking into, if you're interested.. long discussion on its own. I'll just note that SPV changes what you can say about integrity/security of the transaction.
  - uptown 12y ago
    Do implementations such as BitMessage avoid this problem by setting a finite "life" of messages in the network? I believe after about two days messages expire.
    - sirsar 12y ago
      Bitmessage does not use a blockchain. Rather, every peer receives an encrypted copy of every recent message, then attempts to decrypt it. Messages not intended for a specific peer are deleted from its memory after 2.5 days. This does mean that storage is proportional to message rate, rather than total number of messages, essentially solving the storage problem until someone with a lot of resources decides to flood the network with a high rate.
      - deleted 12y ago
        [deleted]
- shazow 12y ago
  It depends on what the chain is storing and whether there is value in archiving the full history. There are really two parts to the Blockchain: 1. Header, which includes the hash of the contents and other metadata like the previous node in the chain, etc. 2. Contents, which is what the miner chose to validate when the block was mined. In Bitcoin, this includes a set of transactions (a step from a graph of inputs and outputs). The contents could potentially be pruned by only keeping track of unspent transaction outputs, but this removes the ability to validating the headers (ie. hashing all the transactions to check if the header metadata matches) except for the fact that there are other headers on top of it. The set of blockchain headers will continue to grow, unless there is a new genesis block—this is like a forced snapshot of the current state of the relevant content of the network. In Bitcoin, it would include all the current unspent transaction inputs. There are several blockchain technologies like Mastercoin which attempt to completely decouple the notion of a content specification from the blockchain headers themselves. That means you could conceivably send all kinds of garbage that would get happily signed by the miner but the contents would be ignored by any client that is not interested in it. (Disclaimer: This is written off the top of my head and I gotta run, so it may be somewhat inaccurate.)
deathhand 12y ago
As much as I hate the concept of "trusted computing" I believe it could help with Sybil attacks. http://en.wikipedia.org/wiki/Trusted_Computing#Endorsement_key http://en.wikipedia.org/wiki/Trusted_Computing#Endorsement_k...
- benmanns 12y ago
  Except that now the power is in the hands of the manufacturer, who can now execute Sybil attacks.
- wmf 12y ago
  Then you have other problems as described in Vinge's Rainbows End. http://vrinimi.org/front9uns.jpg http://vrinimi.org/front9uns.jpg http://vrinimi.org/back9rev.jpg http://vrinimi.org/back9rev.jpg
- deleted 12y ago
  [deleted]
mey 12y ago
For handling distributed convergence in an entirely trusted space, take a look at Vector Clocks https://en.wikipedia.org/wiki/Vector_clock https://en.wikipedia.org/wiki/Vector_clock Blockchains build off the general concept by introducing proof of work and consistent design to handle forks (longest blockchain wins)
nwh 12y ago
The author seems to have mildly misunderstood the technicalities of hashcash-like systems. They seem to have thought that the hex representation of the hash matters when mining, when really we're talking about large integers. If you just do the former "look for a hash with two 0 at the start", you end up with almost no granularity in the difficulty needed. You end up in the situation where 0000 is too easy, but 00000 is too hard. Bitcoin uses integers, and can therefor adjust the target difficulty down to an arbitrary number of digits if required. Seems to be a common misconception when people have been told a simplified version of what is going on.
- nadaviv 12y ago
  Technically, you could say that you're looking for an hash with N zero bits at the beginning. But yes, a lot of people seem to think that you're looking for N zero bytes instead.
  - oleganza 12y ago
    Even granularity of 1 bit is too big. It is 2x increase or decrease in difficulty while the actual hashing rate grows by 10-20% every 2 weeks even during today's crazy time of land grabbing.
tsmith 12y ago
Excellent write-up, but having taken Corporate Accounting courses the "triple-entry bookkeeping" moniker tripped me up a bit - it's an inaccurate metaphor (see http://en.wikipedia.org/wiki/Double-entry_bookkeeping_system http://en.wikipedia.org/wiki/Double-entry_bookkeeping_system to understand why).
- igrigorik 12y ago
  Curious, could you elaborate? The wiki page is long, not sure what I'm looking for... It seems like "triple-entry" is often used alongside "momentum accounting", but its not clear to me why they are conflated. Disclaimer: I'm no accountant, so the simple terms are good. :)
  - comrade1 12y ago
    double-entry means the transaction cancels out at both ends. The result is a transaction of 0. Triple-entry is meaningless. atm-withdrawal + cash $100 - bankaccount $100
  - thefreeman 12y ago
    fyi comrade your hellbanned
    - thefreeman 12y ago
      Uhh, I was just trying to let comrade1 know that all of his comments were appearing dead. It seems to have been fixed now though. I guess that is somehow deserving of downvotes...
  - tsmith 12y ago
    In the OP, double-entry accounting is taken to mean that the two parties to a transaction each keep a record of it (and by extension triple-entry accounting is if three parties keep a record of it). This is a mis-use of the term "double-entry accounting" to mean "two-party recordkeeping". Double-entry accounting means that for each transaction, there will be two (sometimes more) entries in the ledger (set of accounts) - one on the "credit" side, and one on the "debit" side. For example, when you withdraw $100 from your bank account, from the bank's perspective it is crediting an Asset (Cash) and debiting a Liability (Customer Accounts), so a credit entry of $100 would go into the Cash "account" and a debit entry of $100 would go into the Customer Accounts "account". Triple-entry accounting implies that a third entry would go... somewhere else in the ledger; but OP isn't describing a classic set-of-accounts ledger.
oleganza 12y ago
Note that blockchain is more than a currency, but it must contain a collectible within itself in order to be. New blocks will appear and will be backed by the maximum computing power only if miners are competing for the rare collectible that exists within the blockchain. Such collectible must tend to become a universally accepted money (i.e. most marketable commodity) to guarantee maximum amount of CPU time. If that collectible is too inflationary or sucks at something (poorly transferrable, or poorly divisible), then the entire blockchain is at risk. In other words, if there could be a long-term viable and secure blockchain, there will only be one. Everything else will be insecure and fall victim of the law of opportunity cost. See also: http://blog.oleganza.com/post/54121516413/the-universe-wants-one-money http://blog.oleganza.com/post/54121516413/the-universe-wants...
- panabee 12y ago
  i'm new to bitcoin, so forgive me if this is a silly question. is it possible to compensate miners in another way beyond offering a rare collectible?
  - oleganza 12y ago
    Blockchain is a decentralized consensus. It must contain all information relevant to determining consensus in itself, so every node can have all the data necessary to determine which chain is the main chain. That's why any incentive to maintain the chain must be produced by the chain itself. You can't peg the reward to a USD bank account, or a Facebook stock, or some Folding@Home tasks. They exist outside of the chain and thus can't be trusted/verified by every peer. So you need to create some incentive in form of a valuable reward that is purely informational, can be verified independently by anyone, contains all necessary information in the blockchain and does not consume enormous amount of bandwidth/time/energy in order to be verified. This could only be a fungible cryptographic token and this token must be rare. This does not guarantee that it will be valuable, but fungibility and scarcity are necessary to start with. This token must be created in a way that can't be counterfeited and can be independently verified using only the blockchain data (because one can only trust what's in the blockchain). So far it was proof-of-work that provided scarcity. I don't think there is a drastically different way to solve this problem.
rumcajz 12y ago
The article fails to mention that while separation of a blockchain from the currency is technically possible, in reality a blockchain without associated currency won't work as nobody's going to spend their CPU time maintaining it without getting something (money) in return.
- wmf 12y ago
  The article has a whole section on transaction fees, but non-monetary blockchains do tend to raise the question of what currency fees should be paid in and how they can be paid securely.
- 3pt14159 12y ago
  This isn't actually true. In theory a blockchain could be maintained by interested parties only. For example, if an honest blockchain solved a problem of great importance to me (value = x) and even by putting a small amount of work (value < x) into mining the blockchain I could protect myself (say withdraw from action during double action attacks) then you can create a system where many people are mining, making the entire blockchain more secure each while guarding their own interests. The closest analogy would be people setting up water sprinklers in their home. Sure it helps keep the whole town safe, but the reason they do it is for their own protection. Similarly, in theory there are some other blockchain applications that give each miner a gain just from mining. For example, imagine that scientific communities around the world built a blockchain that checked folded proteins for applications in medicine. In order to compactly represent this they use a proof of work algorithm that solves these protein problems. The blockchain allows them to quickly share paths that do (or do not!) bear fruit in a specific direction, but it also coordinates search efforts along various veins of discovery. These are just two examples I thought of in the span of 5 minutes, I'm sure there are countless ways of using blockchains, PoW algorithms, and cryptographic techniques for communication, synchronization, and commerce.
  - wmf 12y ago
    For example, if an honest blockchain solved a problem of great importance to me (value = x) and even by putting a small amount of work (value < x) into mining the blockchain I could protect myself (say withdraw from action during double action attacks) then you can create a system where many people are mining, making the entire blockchain more secure each while guarding their own interests. Wouldn't a rational actor free ride instead of mining? Also, the total hash rate needs to be high enough to prevent 51% attacks, so there's no guarantee that your cost of mining would be smaller than your benefit. A blockchain that doesn't pay miners seems to have an equilibrium where trolls 51% it into oblivion (as has already happened with some scamcoins AFAIK).
deleted 12y ago
[deleted]
neil_s 12y ago
Finally an analogy-based explanation of cryptocurrencies/blockchains that I read all the way through! Two questions: Currently, bitcoin transactions don't have any transaction fees. In this case, where are these 'mined' coins coming from? Is it by adding a transaction from 'the ether' to the miner? Also, if there are transaction fees but the person who verifies the block adds their own fee to the block, what's stopping them from verifying that Alice and Bob have offered the miner a transaction fee of 100 BTC instead of 1 BTC?
- wmf 12y ago
  Many Bitcoin transactions do pay fees today because miners are deprioritizing no-fee transactions. But yes, each block contains a coinbase[1] transaction that creates 25 BTC out of nowhere. [1] No relation to the company of the same name.
- benmanns 12y ago
  Alice or Bob have to sign the fee (in addition to the rest of their transaction) with their private key in order for the miner to spend it later.
- maaku 12y ago
  Yes, the first transaction of a block is allowed to "overspend" by up to the subsidy amount, currently 25btc. Obviously the miners pay these newly minted coins to themselves.
  - maaku 12y ago
    Why the downvotes? What I wrote is correct: https://github.com/bitcoin/bitcoin/blob/master/src/main.cpp#L1838 https://github.com/bitcoin/bitcoin/blob/master/src/main.cpp#...
eridius 12y ago
> The critical property of the above workflow is that the output of the cryptographic hash function (SHA-256 in this case) is completely different every time we modify the input: the hash value of the previous attempt does not tell us anything about what the hash value of the next attempt when we increment our counter - i.e. its a non-deterministic algorithm. It's a fully-deterministic algorithm. It would be quite useless if it were not. I believe what the author is trying to say is that it's not predictable.
bshanks 12y ago
I propose that someone create a proof-of-work system that creates a distributed auction of the computing power of the miners. This has the twin benefits of not wasting electricity on doing useless hashes, and of providing a backing for the value of the created currency (because the currency can be used to purchase computing power from miners). A standardized NP-complete problem formulation could be used. I haven't worked out exactly how to do this (specifically: if the problems posed to the miners are not random, what is to prevent a miner from posing a problem to which they already know the answer?), it's just an idea. more rumination at https://en.bitcoin.it/wiki/Intrinsic_worth_brainstorming#pseudo-BTC_that_uses_computational_power_in_service_of_some_problem https://en.bitcoin.it/wiki/Intrinsic_worth_brainstorming#pse...

335 points by vikrum 12y ago

Excellent read. This is not for a general audience, but helped me get a nicer grasp on the fundamentals technology than I had before without getting too particular in the under the hood stuff. The "blocks are never final" idea is what I believe has led to some of the proposed 51% attacks on the bitcoin network. Question: Does proof of work have to be a near 'lottery' system? Obviously it needs to be asymmetric, but are there other good options than hash collision?

NoMoreNicksLeft 12y ago
At scale, some of the distributed problems are asymmetrical. When they're doing the protein folding stuff or checking for pharmaceutical activity in simulated drugs, it's much easier to confirm a hit than it is to find one... but the reason those are distributed is because they are such incredibly difficult problems.
tromp 12y ago
The described proof-of-work system is known as hashcash http://www.hashcash.org/docs/hashcash.html http://www.hashcash.org/docs/hashcash.html which asks for a partial preimage of a hash function. There are indeed other proof-of-work algorithms. Probably the first one is Primecoin, which asks for a Cunningham chain of prime-numbers. My own Cuckoo Cycle, asking for a cycle in a huge graph, is another example, in which a single proof attempt takes hundreds of MB of memory, but verification is instant and takes no memory.
theswan 12y ago
Some other proof of work protocols: http://en.wikipedia.org/wiki/Proof-of-work_system#List_of_proof-of-work_functions http://en.wikipedia.org/wiki/Proof-of-work_system#List_of_pr...
- tromp 12y ago
  Or on the more detailed cryptocurrency wiki: https://en.bitcoin.it/wiki/Proof_of_work https://en.bitcoin.it/wiki/Proof_of_work
awestroke 12y ago
It has to be trivial to verify yet really really hard to solve in the first place. Hash collisions has the added benefit of allowing variable difficulty
igrigorik 12y ago
Wikipedia has a nice list of various proof-of-work functions: https://en.wikipedia.org/wiki/Proof-of-work_system#List_of_proof-of-work_functions https://en.wikipedia.org/wiki/Proof-of-work_system#List_of_p... As for "lottery", I believe the answer is yes and no. The basic point is to raise the cost of "faking" a confirmation, and how you do that is completely up to you - e.g. captchas are a great example! That said, the random part of the non-deterministic process provides a lot of really nice properties for a distributed system - fairness claims, etc. That said, this is a deep topic (with lots of caveats) in its own right.
olalonde 12y ago
There are even alternatives to PoW for obtaining consensus such as Proof of Stake which doesn't consume much CPU power in theory.

EGreg 12y ago

I like that this actually covers why each piece is needed. My only beef with this system is the proof of work, which leads to an arms race in electricity consumption. Proof of stake is better, and frankly, distributed timestamps don't need a race to solve a problem every time something has to be timestamped. For currency, it would actually be nicer to have a system that treats trust/credit/reputation as the scarce resource. It would help people who aren't rich in the traditional sense nevertheless organize and help each other, and would allow people to "create their own currency" in communities, or the equivalent of that, that they aren't able to do now.

bjitty 12y ago
I'm familiar with proof of work and how it works within a blockchain to secure blocks. I keep hearing about prof of stake. I'm very interested in it, however I haven't found an explanation that clearly explains to me how it works. I've looked at the Wiki article and read a little about Peercoin. Do you know of any article, video or source that may help explain exactly how proof of stake works?
- flatline 12y ago
  If you haven't read the peercoin whitepaper[1], it may get you a bit closer to an understanding. That being said, I still don't have a solid grasp of exactly how coins destroyed results in solving blocks... [1] http://www.peercoin.net/whitepaper http://www.peercoin.net/whitepaper
  - bjitty 12y ago
    Thank you! I can't believe I missed it and didn't think to check for a white paper for this. Especially since that's what really cleared up bitcoin's proof of work blockchain to me.
- bachback 12y ago
  proof of stake was first proposed in 2011 on bitcointalk, the go-to reference for everything bitcoin/altcoin. https://en.bitcoin.it/wiki/Proof_of_Stake https://en.bitcoin.it/wiki/Proof_of_Stake http://wiki.nxtcrypto.org/ http://wiki.nxtcrypto.org/ http://bitshares.org/security/delegated-proof-of-stake.php http://bitshares.org/security/delegated-proof-of-stake.php If any coins make it you can see at watching the marketcap of the coins at http://coinmarketcap.com http://coinmarketcap.com

maaaats 12y ago

Somewhat related: The size of a chain will be constantly growing, right? How fast, and will it be a problem?

igrigorik 12y ago
Yes, it will be. The rate itself obviously depends on number of transactions and amount of data per transaction.. Both of those are specific to your implementation. That said, as a reference, a Bitcoin transaction today is anywhere between ~160~1000 bytes, and the full block chain is on the order of tens of GBs. Is that a problem? It can be. To address this, Bitcoin uses Merkle trees and "Simple Payment Verification" (SPV) -- worth looking into, if you're interested.. long discussion on its own. I'll just note that SPV changes what you can say about integrity/security of the transaction.
- uptown 12y ago
  Do implementations such as BitMessage avoid this problem by setting a finite "life" of messages in the network? I believe after about two days messages expire.
  - sirsar 12y ago
    Bitmessage does not use a blockchain. Rather, every peer receives an encrypted copy of every recent message, then attempts to decrypt it. Messages not intended for a specific peer are deleted from its memory after 2.5 days. This does mean that storage is proportional to message rate, rather than total number of messages, essentially solving the storage problem until someone with a lot of resources decides to flood the network with a high rate.
    - deleted 12y ago
      [deleted]
shazow 12y ago
It depends on what the chain is storing and whether there is value in archiving the full history. There are really two parts to the Blockchain: 1. Header, which includes the hash of the contents and other metadata like the previous node in the chain, etc. 2. Contents, which is what the miner chose to validate when the block was mined. In Bitcoin, this includes a set of transactions (a step from a graph of inputs and outputs). The contents could potentially be pruned by only keeping track of unspent transaction outputs, but this removes the ability to validating the headers (ie. hashing all the transactions to check if the header metadata matches) except for the fact that there are other headers on top of it. The set of blockchain headers will continue to grow, unless there is a new genesis block—this is like a forced snapshot of the current state of the relevant content of the network. In Bitcoin, it would include all the current unspent transaction inputs. There are several blockchain technologies like Mastercoin which attempt to completely decouple the notion of a content specification from the blockchain headers themselves. That means you could conceivably send all kinds of garbage that would get happily signed by the miner but the contents would be ignored by any client that is not interested in it. (Disclaimer: This is written off the top of my head and I gotta run, so it may be somewhat inaccurate.)

deathhand 12y ago

As much as I hate the concept of "trusted computing" I believe it could help with Sybil attacks. http://en.wikipedia.org/wiki/Trusted_Computing#Endorsement_key http://en.wikipedia.org/wiki/Trusted_Computing#Endorsement_k...

benmanns 12y ago
Except that now the power is in the hands of the manufacturer, who can now execute Sybil attacks.
wmf 12y ago
Then you have other problems as described in Vinge's Rainbows End. http://vrinimi.org/front9uns.jpg http://vrinimi.org/front9uns.jpg http://vrinimi.org/back9rev.jpg http://vrinimi.org/back9rev.jpg
deleted 12y ago
[deleted]

mey 12y ago

For handling distributed convergence in an entirely trusted space, take a look at Vector Clocks https://en.wikipedia.org/wiki/Vector_clock https://en.wikipedia.org/wiki/Vector_clock Blockchains build off the general concept by introducing proof of work and consistent design to handle forks (longest blockchain wins)

nwh 12y ago

The author seems to have mildly misunderstood the technicalities of hashcash-like systems. They seem to have thought that the hex representation of the hash matters when mining, when really we're talking about large integers. If you just do the former "look for a hash with two 0 at the start", you end up with almost no granularity in the difficulty needed. You end up in the situation where 0000 is too easy, but 00000 is too hard. Bitcoin uses integers, and can therefor adjust the target difficulty down to an arbitrary number of digits if required. Seems to be a common misconception when people have been told a simplified version of what is going on.

nadaviv 12y ago
Technically, you could say that you're looking for an hash with N zero bits at the beginning. But yes, a lot of people seem to think that you're looking for N zero bytes instead.
- oleganza 12y ago
  Even granularity of 1 bit is too big. It is 2x increase or decrease in difficulty while the actual hashing rate grows by 10-20% every 2 weeks even during today's crazy time of land grabbing.

tsmith 12y ago

Excellent write-up, but having taken Corporate Accounting courses the "triple-entry bookkeeping" moniker tripped me up a bit - it's an inaccurate metaphor (see http://en.wikipedia.org/wiki/Double-entry_bookkeeping_system http://en.wikipedia.org/wiki/Double-entry_bookkeeping_system to understand why).

igrigorik 12y ago
Curious, could you elaborate? The wiki page is long, not sure what I'm looking for... It seems like "triple-entry" is often used alongside "momentum accounting", but its not clear to me why they are conflated. Disclaimer: I'm no accountant, so the simple terms are good. :)
- comrade1 12y ago
  double-entry means the transaction cancels out at both ends. The result is a transaction of 0. Triple-entry is meaningless. atm-withdrawal + cash $100 - bankaccount $100
- thefreeman 12y ago
  fyi comrade your hellbanned
  - thefreeman 12y ago
    Uhh, I was just trying to let comrade1 know that all of his comments were appearing dead. It seems to have been fixed now though. I guess that is somehow deserving of downvotes...
- tsmith 12y ago
  In the OP, double-entry accounting is taken to mean that the two parties to a transaction each keep a record of it (and by extension triple-entry accounting is if three parties keep a record of it). This is a mis-use of the term "double-entry accounting" to mean "two-party recordkeeping". Double-entry accounting means that for each transaction, there will be two (sometimes more) entries in the ledger (set of accounts) - one on the "credit" side, and one on the "debit" side. For example, when you withdraw $100 from your bank account, from the bank's perspective it is crediting an Asset (Cash) and debiting a Liability (Customer Accounts), so a credit entry of $100 would go into the Cash "account" and a debit entry of $100 would go into the Customer Accounts "account". Triple-entry accounting implies that a third entry would go... somewhere else in the ledger; but OP isn't describing a classic set-of-accounts ledger.

oleganza 12y ago

Note that blockchain is more than a currency, but it must contain a collectible within itself in order to be. New blocks will appear and will be backed by the maximum computing power only if miners are competing for the rare collectible that exists within the blockchain. Such collectible must tend to become a universally accepted money (i.e. most marketable commodity) to guarantee maximum amount of CPU time. If that collectible is too inflationary or sucks at something (poorly transferrable, or poorly divisible), then the entire blockchain is at risk. In other words, if there could be a long-term viable and secure blockchain, there will only be one. Everything else will be insecure and fall victim of the law of opportunity cost. See also: http://blog.oleganza.com/post/54121516413/the-universe-wants-one-money http://blog.oleganza.com/post/54121516413/the-universe-wants...

panabee 12y ago
i'm new to bitcoin, so forgive me if this is a silly question. is it possible to compensate miners in another way beyond offering a rare collectible?
- oleganza 12y ago
  Blockchain is a decentralized consensus. It must contain all information relevant to determining consensus in itself, so every node can have all the data necessary to determine which chain is the main chain. That's why any incentive to maintain the chain must be produced by the chain itself. You can't peg the reward to a USD bank account, or a Facebook stock, or some Folding@Home tasks. They exist outside of the chain and thus can't be trusted/verified by every peer. So you need to create some incentive in form of a valuable reward that is purely informational, can be verified independently by anyone, contains all necessary information in the blockchain and does not consume enormous amount of bandwidth/time/energy in order to be verified. This could only be a fungible cryptographic token and this token must be rare. This does not guarantee that it will be valuable, but fungibility and scarcity are necessary to start with. This token must be created in a way that can't be counterfeited and can be independently verified using only the blockchain data (because one can only trust what's in the blockchain). So far it was proof-of-work that provided scarcity. I don't think there is a drastically different way to solve this problem.

rumcajz 12y ago

The article fails to mention that while separation of a blockchain from the currency is technically possible, in reality a blockchain without associated currency won't work as nobody's going to spend their CPU time maintaining it without getting something (money) in return.

wmf 12y ago
The article has a whole section on transaction fees, but non-monetary blockchains do tend to raise the question of what currency fees should be paid in and how they can be paid securely.
3pt14159 12y ago
This isn't actually true. In theory a blockchain could be maintained by interested parties only. For example, if an honest blockchain solved a problem of great importance to me (value = x) and even by putting a small amount of work (value < x) into mining the blockchain I could protect myself (say withdraw from action during double action attacks) then you can create a system where many people are mining, making the entire blockchain more secure each while guarding their own interests. The closest analogy would be people setting up water sprinklers in their home. Sure it helps keep the whole town safe, but the reason they do it is for their own protection. Similarly, in theory there are some other blockchain applications that give each miner a gain just from mining. For example, imagine that scientific communities around the world built a blockchain that checked folded proteins for applications in medicine. In order to compactly represent this they use a proof of work algorithm that solves these protein problems. The blockchain allows them to quickly share paths that do (or do not!) bear fruit in a specific direction, but it also coordinates search efforts along various veins of discovery. These are just two examples I thought of in the span of 5 minutes, I'm sure there are countless ways of using blockchains, PoW algorithms, and cryptographic techniques for communication, synchronization, and commerce.
- wmf 12y ago
  For example, if an honest blockchain solved a problem of great importance to me (value = x) and even by putting a small amount of work (value < x) into mining the blockchain I could protect myself (say withdraw from action during double action attacks) then you can create a system where many people are mining, making the entire blockchain more secure each while guarding their own interests. Wouldn't a rational actor free ride instead of mining? Also, the total hash rate needs to be high enough to prevent 51% attacks, so there's no guarantee that your cost of mining would be smaller than your benefit. A blockchain that doesn't pay miners seems to have an equilibrium where trolls 51% it into oblivion (as has already happened with some scamcoins AFAIK).

deleted 12y ago

[deleted]

neil_s 12y ago

Finally an analogy-based explanation of cryptocurrencies/blockchains that I read all the way through! Two questions: Currently, bitcoin transactions don't have any transaction fees. In this case, where are these 'mined' coins coming from? Is it by adding a transaction from 'the ether' to the miner? Also, if there are transaction fees but the person who verifies the block adds their own fee to the block, what's stopping them from verifying that Alice and Bob have offered the miner a transaction fee of 100 BTC instead of 1 BTC?

wmf 12y ago
Many Bitcoin transactions do pay fees today because miners are deprioritizing no-fee transactions. But yes, each block contains a coinbase[1] transaction that creates 25 BTC out of nowhere. [1] No relation to the company of the same name.
benmanns 12y ago
Alice or Bob have to sign the fee (in addition to the rest of their transaction) with their private key in order for the miner to spend it later.
maaku 12y ago
Yes, the first transaction of a block is allowed to "overspend" by up to the subsidy amount, currently 25btc. Obviously the miners pay these newly minted coins to themselves.
- maaku 12y ago
  Why the downvotes? What I wrote is correct: https://github.com/bitcoin/bitcoin/blob/master/src/main.cpp#L1838 https://github.com/bitcoin/bitcoin/blob/master/src/main.cpp#...

eridius 12y ago

> The critical property of the above workflow is that the output of the cryptographic hash function (SHA-256 in this case) is completely different every time we modify the input: the hash value of the previous attempt does not tell us anything about what the hash value of the next attempt when we increment our counter - i.e. its a non-deterministic algorithm. It's a fully-deterministic algorithm. It would be quite useless if it were not. I believe what the author is trying to say is that it's not predictable.

bshanks 12y ago

I propose that someone create a proof-of-work system that creates a distributed auction of the computing power of the miners. This has the twin benefits of not wasting electricity on doing useless hashes, and of providing a backing for the value of the created currency (because the currency can be used to purchase computing power from miners). A standardized NP-complete problem formulation could be used. I haven't worked out exactly how to do this (specifically: if the problems posed to the miners are not random, what is to prevent a miner from posing a problem to which they already know the answer?), it's just an idea. more rumination at https://en.bitcoin.it/wiki/Intrinsic_worth_brainstorming#pseudo-BTC_that_uses_computational_power_in_service_of_some_problem https://en.bitcoin.it/wiki/Intrinsic_worth_brainstorming#pse...