61–70 of 72 posts
Earlier quoted context omitted.
That's why there are KES keys.
For people like me who haven't heard of this feature: https://docs.cardano.org/projects/cardano-node/en/latest/sta... It's true that this prevents an attacker from using current keys to perform a long-range attack but old keys can still be used for attacks.
Earlier quoted context omitted.
What is running in parallel is just a heartbeat chain that doesn't do anything of what ETH1 does (no EVM). It will be much longer than a year. 2-3, at best.
Yes but what's running now is the hard part. Fundamentally, once you have reliable consensus, the data you reach consensus on is just an extra hash in each block. There's software engineering to merge the client software, but from a research perspective it's not a big deal at all.
One major hard part, imho, is the zkSNARKs. Nobody is talking about the fact that they are hardware dependent because they are so computationally expensive. My guess right now is that we're going to need (or they will get developed some how)... ASIC's. Talk about kicking the puck down the road.
The other hard part is that this is a decentralized development project managed by humans. What happens when someone wants to flip the switch on billions of value? The ProgPoW debate proved how contentious decisions turn into a total clusterf*ck. You want to trust your funds to that?
Finally, the best one. There is insane pressure to rush eth2 out now that billions of value is locked up. 737 max levels of pressure.
I love ETH and ETH2. More than anything I want to see it happen. I'm just in the camp that we should have worked on ETH 1.5 first.
[0] https://twitter.com/VitalikButerin/status/133392262085774540...
Earlier quoted context omitted.
> Ethereum is trying to switch mid-flight (yikes) but others like Cardano have incorporated it foundationally. Why yikes? If its a legacy transition, with a flight plan and testing, then it should be fine.
Well, as one example, what happens to all the miners and their infrastructure? Seems like they get hung out to dry. Second, the technical complexity involved seems challenging. I'm not a dev, and I'm not saying it's impossible, but making substantial core changes on a live, decentralized system running all sort of layer two infrastructure seems really dicey.
This is really the beauty of ethash being asic resistant and gpu friendly. I have so much computational power built up, that someone will always be available to buy it. It isn't e-waste. We already run on older generation GPU's because they are higher ROI, which proves that they have useful life, even as they age.
Earlier quoted context omitted.
> There is no legitimate sense in which PoS _is_ an instance of "rich have more power and get richer" but PoW is not. In PoW, miners must sell their tokens to buy capital-intensive mining equipment and power to stay competitive. In PoS, stakers have no incentive to sell enough tokens to anyone who could turn around and stake them as a competitor, since that would cut into the seller's future staking rewards. > The 1/…
> Second, any consensus protocol can only remain live as long as there are no more than f faults out of 3f+1 replicas. This is again irrespective of the network model We actually know of consensus protocols that require synchrony including between participants and clients that go up to 99% fault tolerance for both liveness and safety; in fact Lamport himself described one in his original paper (remember that it's "wr…
The "written messages" protocol does not tell the whole story. If you go back and re-read Lamport '82 [1], the assumptions that make the SM(m) algorithm ("written messages") work at all also make it a practically useless result. In particular, assumption A4(b) (top of page 391) requires that anyone can authenticate any general's messages at all times. How the generals are supposed to learn each other's public keys _without_ an instance of SM(m) is not addressed, but presumably they would need to fall back to OM(m) ("oral messages") to do so. So if you take a BFT system as a whole, where you can't assume the existence of a magical fool-proof way for generals to learn each other's keys a priori, my original claim stands.
> The original definition of consensus did not have a notion of passive clients needing to learn the result, so the "active participants synchronous, passive clients asynchronous" model common in blockchain land was not really analyzed well back then.
Prior literature doesn't consider "passive clients" because they're not protocol participants in the first place. Clients do not participate in deciding agreement; otherwise they wouldn't be called clients.
Last I checked this is very much still the case in blockchain-land. Your wallet (client) does not do anything to help miners/stakers determine the best chain tip or the next block, for example.
So, I'm not sure what you're trying to say here?
> It turns out that with a synchronous network, the passive client requirement is what brings safety and liveness down from 99% to 50%. And it also happens that the 50% fault tolerance protocols are less fragile in the case that the synchrony assumption breaks temporarily.
Unless you're assuming the existence of the magic fool-proof public-key distribution mechanism required for SM(m) to work, you're not going to get liveness unless you're either (a) assuming nodes do not exhibit arbitrary failure modes, or (b) requiring at least 2/3+e nodes are honest.
[1] https://people.eecs.berkeley.edu/~luca/cs174/byzantine.pdf
EDIT: wrong date for Lamport
Proof of Stake not only replicates the same dynamics that Bitcoin was designed to eliminate (more wealth -> more power in system) but also can only be made secure against a maximum of ⅓ byzantine actors, compared to Proof of Work's superior ½. As for using it for Layer 1 systems, Andrew Poelstra nailed it in his conclusion [0]: "We showed that by depending only on resources within the system, proof of stake cannot be…
Bitcoin may have been _aimed_ at eliminating the "rich get richer" system, but in fact it failed at it, as others comment below. It has been formally shown [1] that investors who have enough money to buy the most efficient ASICs out there earn disproportionately more, compared to smaller investors who can only afford less efficient ASICs/GPUs; in contrast, in PoS every investor has a fixed ROI for each one of their $ (regardless of their total investment); as also shown in that paper, this is the best you can hope for in an anonymous system. In other words, unless you can authenticate users and distribute rewards in a democratic (and possibly egalitarian) manner, the rich will always get richer, and the rate with which this happens is actually worse in PoW than PoS.
Earlier quoted context omitted.
Yes but what's running now is the hard part. Fundamentally, once you have reliable consensus, the data you reach consensus on is just an extra hash in each block. There's software engineering to merge the client software, but from a research perspective it's not a big deal at all.
The hard part? Oh god no. Not even close. Have you seen V's roadmap? [0] One major hard part, imho, is the zkSNARKs. Nobody is talking about the fact that they are hardware dependent because they are so computationally expensive. My guess right now is that we're going to need (or they will get developed some how)... ASIC's. Talk about kicking the puck down the road. The other hard part is that this is a decentralized…
I'm not worried about the social aspects at all, but in the context of an Ouroboros discussion I don't really want to get into a broad Ethereum debate.
Earlier quoted context omitted.
Oooh. Its the man himself! Curious about what you think about ourboros/cardano! Pros cons vs eth?
When I last looked at Ouroboros it still had the property that there's only "one confirmation per slot", so you need to wait ~log(n) slots before an attacker has a <1/n probability of reversing the chain. I personally think that a good PoS system should strive to have hundreds of confirmations per slot the way eth2's LMD GHOST does. That said, it's very possible that there's an improved version of Ouroboros that alre…
Earlier quoted context omitted.
There's a couple things wrong here: > Proof of Stake not only replicates the same dynamics that Bitcoin was designed to eliminate (more wealth -> more power in system) There is no legitimate sense in which PoS _is_ an instance of "rich have more power and get richer" but PoW is not. In fact, PoW is _worse_ than PoS in this regard, because PoW has economies of scale (if someone with a $100k investment earns $10k/year,…
FYI - this is the founder of Ethereum
Earlier quoted context omitted.
They claim (via formal verification, I cannot speak to their threat model with much accuracy) that they are able to achieve the same or better security properties as ETH 2.0 without lockups (staked funds earning income are like demand deposits) or slashing (penalties for bad behavior / bad network performance). The project as a whole (Cardano) has some other notable advantages. Personally, it has a built in governanc…
Without slashing, I'm wondering whether they've adequately accounted for attacks motivated by extraneous factors, rather than simply for profit within the system. The abstract says "we prove that, given this mechanism, honest behavior is an approximate Nash equilibrium," but does that still hold if an attacker has shorted the coin? With slashing, even if someone finds it advantageous to attack, you quickly take away…
Earlier quoted context omitted.
Oooh. Its the man himself! Curious about what you think about ourboros/cardano! Pros cons vs eth?
When I last looked at Ouroboros it still had the property that there's only "one confirmation per slot", so you need to wait ~log(n) slots before an attacker has a <1/n probability of reversing the chain. I personally think that a good PoS system should strive to have hundreds of confirmations per slot the way eth2's LMD GHOST does. That said, it's very possible that there's an improved version of Ouroboros that alre…