Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proof-Of-Work is a Decentralized Clock

grisha.org

Post reply on HN
Print view View original

101–110 of 130 posts

Re: Proof-Of-Work is a Decentralized Clock

#101

Post by lmm »

state_less wrote: post #87
danbruc wrote: post #78

Earlier quoted context omitted.

So the entire thing starts with everyone having a balance of zero. Then A signs a transaction that he gives $1000 to B and we broadcast that transaction, new balances A $-1000, B $+1000. Now B wants to buy something for $500 from C and signs a matching transaction. What does C do? Is A a bank that provided a $1000 loan and therefore C will be able to actually get $500 from A? Or are A and B one and the same poor guy…

The important part is A signed over to B $1000. B and C may be the same person. B wanting to do business as C. If A, B and C are all the same person and there wasn't an identity attached to any account, outsiders wouldn't value the record much, especially if they were transactions of significant value. C could redeem the value with Western Union (or similar agent). They might say you have to agree to sign the closure…

> If A, B and C are all the same person and there wasn't an identity attached to any account, outsiders wouldn't value the record much, especially if they were transactions of significant value.

Right. The only way B "really" has a balance of $1000 is if A is some established, trustworthy entity - e.g. an actual bank. And trustworthy entities that offer service to anonymous people don't stay trustworthy for long.

Re: Proof-Of-Work is a Decentralized Clock

#102

Post by pdpi »

state_less wrote: post #55
pdpi wrote: post #50

Earlier quoted context omitted.

> This analysis is obviously wrong, if the important thing was establishing a global clock, you could just use GPS receivers Is it so obviously wrong? From the first paragraph of the introduction to Satoshi's Bitcoin Paper: "In this paper, we propose a solution to the double-spending problem using a peer-to-peer distributed timestamp server to generate computational proof of the chronological order of transactions".…

Couldn't we save a lot of energy and have a distributed stores of identities (public keys) with ledgers, something like a git repo per identity? Whenever I want to spend money, I just commit a changelog to my repo, I want to transfer some credit to identity X, signed with my identity (private key). I sign the ledger with my private key and commit the entry to the distributed store. Push out the changes to anyone who…

No because it’s not an identity problem: both transactions are posted by the legitimate owner of the keys.

Modified histories are not that simple to deal with, because network propagation times mean that I can broadcast two different transactions to different parts of the network and base the attack on the ensuing race to reach consensus.

Re: Proof-Of-Work is a Decentralized Clock

#103

Post by sethgecko »

state_less wrote: post #55
pdpi wrote: post #50

Earlier quoted context omitted.

> This analysis is obviously wrong, if the important thing was establishing a global clock, you could just use GPS receivers Is it so obviously wrong? From the first paragraph of the introduction to Satoshi's Bitcoin Paper: "In this paper, we propose a solution to the double-spending problem using a peer-to-peer distributed timestamp server to generate computational proof of the chronological order of transactions".…

Couldn't we save a lot of energy and have a distributed stores of identities (public keys) with ledgers, something like a git repo per identity? Whenever I want to spend money, I just commit a changelog to my repo, I want to transfer some credit to identity X, signed with my identity (private key). I sign the ledger with my private key and commit the entry to the distributed store. Push out the changes to anyone who…

That's kind of how NANO (previously Raiblocks) works. One ledger per address.

Re: Proof-Of-Work is a Decentralized Clock

#104

Post by sethgecko »

hudon wrote: post #99

> There is a separate consensus in a rare but common case of two consecutive ticks being associated with conflicting blocks. The conflict is resolved by what block will be associated with the next tick, rendering one of the disputed blocks “orphan”. How the chain will continue is a matter of chance It being a "matter of chance" may be false and thus the thesis that this clock is "decentralized" should be questioned.…

Fascinating, I found this article by Vitalik that explains what happened. In v0.8 they swapped from BerkleyDB to LevelDB but due to a bug the two chains started diverting.

https://bitcoinmagazine.com/articles/bitcoin-network-shaken-...

Re: Proof-Of-Work is a Decentralized Clock

#105

Post by ema »

rocqua wrote: post #44
gtrubetskoy wrote: post #39

Earlier quoted context omitted.

>> Mostly the claim that "The Difficulty is Intergalactic" is just flat wrong. (I wrote the article) - I see your point, but I think the article is still correct. Now communicating the winning block is a problem, as you pointed out, so as a miner on Mars you're at a disadvantage, but that statistically the probability of solving the puzzle remains same regardless of your location in the universe is still true. As som…

Hi, I hope my tone wasn't too grating. I stand by my point though, for the purpose of totally ordering blocks, the difficulty is not intergalactic because a solution on mars is much less useful than a solution on earth. The problem here is time-delay preventing simultaneity. This is the same problem that block chain time-stamping hopes to solve. Thus it seems unfair to me to ignore this problem. I wonder how tight th…

If there is no double spend between the later arriving block from mars and the block earth already mined the next block could acknowledge both. Basically making the blockchain a blocklatice. If I haven't missed anything the only reason it wasn't done like this from the beginning is that when the orphan rate is low it' not worth the additional code complexity.

Re: Proof-Of-Work is a Decentralized Clock

#106

Post by relyio »

gtrubetskoy wrote: post #64
mad44 wrote: post #42

https://muratbuffalo.blogspot.com/2018/03/anatomical-similar... Proof of work is the leader election phase of consensus. It is followed by the accept phase, where the leader broadcasts the decision to be accepted. The commit comes eventually and as probabilistic.

> Proof of work is the leader election phase of consensus. This is a common misconception stemming from looking at PoW through the Paxos/RAFT prism. In Paxos a leader is elected, then the leader decides the order of events. But that's not a valid comparison, because in PoW the supposed "leader" does not get to decide anything at all - the block has to be put together prior to "winning the election" (because the block…

> In Paxos a leader is elected, then the leader decides the order of events. But that's not a valid comparison, because in PoW the supposed "leader" does not get to decide anything at all - the block has to be put together prior to "winning the election" (because the block is the input to the SHA).

Who picks the transactions from the mempool that will be serialized into history?

Re: Proof-Of-Work is a Decentralized Clock

#107

Post by zodiac »

danbruc wrote: post #46

This analysis is obviously wrong, if the important thing was establishing a global clock, you could just use GPS receivers. Ordering transactions works also without proof of work, just including a hash of an existing transaction or block in a new transaction or block and this proofs the order of those transactions or blocks relative to each other. No clock required at all. And also exactly what Bitcoin does but which…

I think you have to be more precise when making claims of this sort; in this case "establishing a global clock" is not very precisely defined. Suppose we have an oracle that implements this protocol: it publishes a new public key every hour, and at any time someone can present it a blob of data which it will sign with the private key corresponding to the current hour's public key. Furthermore, you can query it for the set of all blobs it has signed with a given public key. It is obvious that one can implement a distributed ledger with the only security assumption (for each user) being "I trust this oracle" and "I can determine the current time". OTOH, suppose we have a weaker oracle which implements this protocol: every hour it publishes a new blob of data. Then it is probably not possible to implement a distributed ledger using only the weaker oracle.

It is well-known that pure cryptography is strictly weaker than cryptography + economic assumptions or cryptography + subjectivity assumptions, due to some inherent information-theoretic asymmetries. For instance, pure cryptography allows us to prove that the owner of the secret key of a given public key has signed a message, but it cannot let us prove that the owner of a secret key has NOT publicly signed a message. A way to do this by relying on economic and non-coordination assumptions is to offer a public bounty (ie I will pay some USD) to anyone who can provide the signature and then to wait some time to see if anyone turns up. Another example: with pure cryptography it is easy to produce "private randomness" (say between 2 people) by using a commit-guess-reveal scheme, but a third party later who cannot trust that the two were not colluding cannot be convinced that the output was random. But once again this is possible with economic assumptions.

As for the distinctions between different kinds of non-cryptographic assumptions, I don't think it's clear-cut. Timestamping is strictly weaker than proof of publication (https://petertodd.org/2014/setting-the-record-proof-of-publi...), which is equivalent in strength to a distributed ledger. I'm not sure the anti-sybil assumptions have been modeled as such, but it is well-known that anti-coordination assumptions are needed even if we assume no double-spends are possible (e.g., a pool of 70% of btc hashpower can profitably censor the other 30% by orphaning their blocks; no double-spend needed!)

Re: Proof-Of-Work is a Decentralized Clock

#108

Post by xilis »

xamuel wrote: post #2

Can someone who knows the technical details of bitcoin answer the following questions? Suppose initially A owns 1BTC and B owns 0BTC. Suppose A publishes a signed transaction that would give 1BTC to B, and simultaneously B publishes a signed transaction that would give 1BTC to C. If a miner includes both transactions in a block, is the block valid? Does it depend on the order of the transactions within the block (A's…

I believe the exact scenario you propose is not possible. It cannot happen simultaneously (so A broadcasting his tx - txA and B broadcasting his tx - txB at the same time).

However, B can broadcast txB after receiving txA (txB essentially needs to know txA in order to "use" it).

The way this works is txA essentially says "send 1BTC I received from some tx to B". txB says "send 1BTC I received from txA to C". So, when creating the txB, B needs txA in order to use it.

Keep in mind this has nothing to do with txA or txB being included in blocks. txB can use txA if txA is not yet confirmed (so not in a block), however txB can only be included in a block (so confirmed) if txA is already confirmed in a previous block, or if both transactions are in the same block (this is where the part of a miner "ordering" the transactions from some other replies comes in play).

Re: Proof-Of-Work is a Decentralized Clock

#109

Post by gtrubetskoy »

danbruc wrote: post #80
gtrubetskoy wrote: post #75

Earlier quoted context omitted.

The valid sha ties this block to the exact point in time at which the solution was found. We can't know exactly what time in hh:mm:ss that was, but we do know the chain height, and the height is how "blockchain time" is told. The fact that the block time (i.e. height) is when the conforming SHA was found is indisputable. Also that no other block happened at this same point in time.

The valid sha ties this block to the exact point in time at which the solution was found. It does not, it just sets a lower bound on the time. I can totally mine a block linking directly to the genesis block today. All it proofs is that it happened after the previous block was created. And so does SHA( ) without any mining. Also that no other block happened at this same point in time. Also not true, I can totally min…

May be to understand it better consider the blockchain (i.e. how ticks are recorded) vs the actual ticks as they happen in "real life".

At the risk of sounding like a broken record: when the SHA puzzle is solved is the exact point at which the block which is the input to the SHA is mined. I sounds almost "duh - what other time could it be?", but upon some reflection, this is quite remarkable, because a point in time is tied to a block of data.

The rest of it, e.g. what block that block points to as a parent, is secondary and not that interesting.

Re: Proof-Of-Work is a Decentralized Clock

#110

Post by ikeboy »

rocqua wrote: post #19

> The Bitcoin Difficulty adjusts dynamically so that a proper hash is found on average once every ten minutes. So here, the bitcoin network needs to defer to the actual time. The difficulty is adjusted every 2016 blocks. Then, the time it took to create those blocks is determined by looking at actual time stamps of the blocks. That is, time stamps that purport to be the time in UTC when the block was created. I never…

Bingo. Vitalik Buterin showed how to abuse this to soft fork (!) Bitcoin to have 2 minute blocks https://www.reddit.com/r/btc/comments/428tjl/softforking_the...
Post reply on HN