Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proof of stake is incapable of producing a consensus

yanmaani.github.io

Post reply on HN
Print view View original

701–710 of 822 posts

Re: Proof of stake is incapable of producing a consensus

#701

Post by mlyle »

xg15 wrote: post #439
mlyle wrote: post #186

Earlier quoted context omitted.

You need to fork at low difficulty if you want to significantly lengthen the chain from that point, because creating a high difficulty, long chain that is valid is hard. But-- there's nothing to preclude you making big steps up in difficulty at the end of the chain. It means that one evaluating the length of the chain for authenticity really needs to integrate the difficulty over the entire chain and not just look at…

I was wondering about that bit actually. Suppose I'm a new node and want to verify the blockchain. How do I verify that each block was mined with the correct difficulty? I'd need some record about the actual real-world timestamps for each block. Then I could say something like "duration between block x and block x+1 was > 10 min, so the down-adjustment in block x+5 is justified". But if those timestamps were stored o…

Yes, Bitcoin effectively integrates the difficulty over the entire chain.

Re: Proof of stake is incapable of producing a consensus

#702

Post by yellowapple »

The author's objection to proof-of-stake seems to be based entirely on some ostensibly-inherent vulnerability to the nothing-at-stake problem, but at least one consensus protocol¹ has had explicit mitigations against that vulnerability (and numerous others) for almost half a decade now, and I'd be very surprised if other protocols haven't adopted any mitigations at all.

¹: https://eprint.iacr.org/2016/889.pdf

Re: Proof of stake is incapable of producing a consensus

#703

Post by mattalex »

yanmaani wrote: post #634
EthanHeilman wrote: post #628

Earlier quoted context omitted.

A trust assumption of PoS (Proof of Stake) is that >66% of the stake is honest. If you violate this trust assumption then yes PoS breaks. This is a similar trust assumption to requiring that 51% of the mining power in PoW (Proof of Work) is not malicious. This risk can be mitigated: 1. The network should halt if a fork is detected. A fork with more than 66% of the stake behaving maliciously means a fundamental trust…

> This is a similar trust assumption to requiring that 51% of the mining power in PoW (Proof of Work) is not malicious. Yeah, but you're glossing over an important detail: It's not 66% of the stake that has to be good, it's 66% of anyone who has ever staked . In PoW, I only need to trust the miners of today to tell me the truth about what happened today. In PoS, I need that, plus the miners of yesterday, plus the min…

> It's not 66% of the stake that has to be good, it's 66% of anyone who has ever staked. In PoW, I only need to trust the miners of today to tell me the truth about what happened today.

I don't quite get that. As far as I understand it the "nothing at stake" problem works by a malicious party inducing a fork, one of which they double-spend in. Since it's in the best interest for everyone else to mine both forks, you can force your double-spend fork to become the longest chain by only validating the double-spend fork.

This means you have to trust that nobody part of your current chain has double-spent in this way. But isn't this the same as in PoW where you have to trust that nobody has launched a 51% attack to disrupt the network in the past?

Also, can't you just prevent people from mining all forks? I.e. for becoming a validator you have to deposit X as a security beforehand and you can only earn at most X via staking (so it is in the history before you can attack with nothing at stake). If it is recognised that you mine on more than one fork at a time, you lose the security deposit you gave before the fork. X goes to the person who found the fork, incentivising that the mallicious fork is identified on all forks (miners on competing forks are incentivised to look at all forks and quickly add the mallicious fork detection for their own benefit). If you want to retrieve your security and money earned, you have to announce this on all forks (you immediatly seize to be a validator). You are only allowed to retrieve the funds, if it is confirmed on all forks, or the forks are sufficiently behind the longest chain. This allows everybody ample time to look for dual-fork work and also incentivizes rapid solution of forks.

Re: Proof of stake is incapable of producing a consensus

#704

Post by DennisP »

yanmaani wrote: post #651
DennisP wrote: post #429

Earlier quoted context omitted.

PoS is more quantum-resistant though. If someone were to build a quantum computer capable of running Grover's algorithm on bitcoin hashes, they would get a quadratic speedup over classical miners. That's a threat that doesn't exist on PoS. (Both would be vulnerable to Shor's but post-quantum signatures would fix that.)

PoS is not more quantum-resistant, because of the situation with Shor's algorithm, and that a key compromise would be much more damaging. It might be, in the future, if you replaced the keys, but it isn't now. Words mean things, and it really is important to use them correctly. (Also, wouldn't the network respond by just raising the difficulty, miners respond by buying quantum computers, and the world to spin as usua…

PoS is a class of consensus protocol, not any particular blockchain. It's orthogonal to signature algorithms. A blockchain can incorporate any combination of consensus algorithm and signature algorithm. So yes, please use your terms correctly.

If sufficiently powerful quantum computers become readily available to anyone, sure, everybody will upgrade. Given the exotic hardware they typically require, it seems likely that for a while only a few large organizations will have them.

Re: Proof of stake is incapable of producing a consensus

#705

Post by danlugo92 »

lukifer wrote: post #580
littlestymaar wrote: post #413

Earlier quoted context omitted.

There's also an alternative: 3. cryptocurrencies stop the Austrian economics fetishism and index the coin reward to the mining difficulty. That means getting rid of the fixed coin supply. That would stabilize the price of the token a lot (since price going up would increase the mining appeal, thus expanding the money supply, driving the price down) and also make it much more usable as a mean of payment (the number of…

The focus on fixed money supply seems a little absurd to me anyway, given the triviality of creating new crypto-currencies, and the relatively low transaction costs of trading between them. Imagine making a case for returning to the gold standard, when thousands of other choices for new precious metals, all with the same performance characteristics, were literally just lying around, and a network of drones would let…

Bitcoin is safe and decentralized, all of the other coins are not.

Re: Proof of stake is incapable of producing a consensus

#707

Post by bshanks »

yanmaani wrote: post #636
comex wrote: post #611

Earlier quoted context omitted.

> But it's a threat for single nodes not for the network as a whole. Indeed, but the same is true for attacks on "weak subjectivity" proof-of-stake. They're only a threat for nodes that have been disconnected for a long time (months) before they try to reconnect.

Except for the part where eclipse attacks can be resolved by simply feeding my node more data (it's not a problem if some of it is lies), while "weak subjectivity" requires recourse to an external authority.

i don't know as much about this as you, but it seems to me that the attack you describe in the blog post would also require a successful eclipse attack?

My understanding is that the attack you describe involves a cabal of "evil" validators signing some alternate chain (call it the "fake" chain) long after their stake is withdrawn, creating a fork in the distant past. Before they did this, they pretended to be good validators, which meant they signed the "real" chain's blocks and then signed the withdraw transaction. So after the attack, there are two conflicting sets of signatures signed using the evil cabal's private keys; those on the fake chain, and those on the real chain. So anyone in possession of both of these sets of signatures can conclude that the validators in the cabal are "evil", and then they can see that once the cabal's support is removed from consideration, the real chain had more valid validator support (at the time of the fork, in the distant past). If this line of reasoning is correct, that suggests that anyone who is aware of both sets of signatures can identify the real chain?

Re: Proof of stake is incapable of producing a consensus

#708

Post by wcoenen »

keymone wrote: post #293
wcoenen wrote: post #268

Whether PoS will work, I don't know. But the author didn't realize that PoW is certainly doomed. PoW miners tend to spend more and more resources on finding blocks, until the cost approaches the rewards. But the rewards go up as the cryptocurrency becomes more popular, because the price and transaction fees go up. Therefore, a PoW cryptocurrency tends to "eat the world" as it becomes bigger. That's why Bitcoin is alr…

It’s a system with feedback loops, it’ll eventually level out at some equilibrium. You didn’t provide an actual argument for why it should definitely collapse.

I think you're right. I phrased my argument like all PoW must necessarily collapse once they get too popular, and that may not be true exactly.

E.g. if Bitcoin had no block rewards, then the income from transaction fees alone might provide a more reasonable ceiling for miner activity. Users will only pay fees that make sense vs the utility they get.

However, for Bitcoin that's not the case right now. The combination of high price and block rewards provide an enormous subsidy for miner activity. (Some back of the envelope numbers elsewhere in this thread[1].)

And if Bitcoin gets banned, all PoW will likely get banned, so it doesn't matter if other PoW systems can behave better.

[1] https://news.ycombinator.com/item?id=29373653

Re: Proof of stake is incapable of producing a consensus

#709

Post by sp332 »

suikadayo wrote: post #684
sp332 wrote: post #495

Earlier quoted context omitted.

The merge was going to happen by the end of this year, but miners complained https://news.ycombinator.com/item?id=26441399 and then it was delayed again. https://www.coinhighlight.com/2021/10/ethereum-eth-devs-look...

The merge was expedited over miner concerns, prioritizing it over sharding as originally planned, so it’s actually the opposite of what you are saying.

Sorry, I didn't mean to draw such a straight line between the two things. My point is just that it didn't happen last year, and even after being expedited, it won't happen this year either.

Re: Proof of stake is incapable of producing a consensus

#710

Post by xorcist »

EthanHeilman wrote: post #628
hedora wrote: post #616

Earlier quoted context omitted.

This is the “nothing at stake problem” from the article. Warren Buffet buys up 70% of the network, induces a network partition, and then double spends it all, signing both transaction histories. By the time he’s caught, he’s converted 2x the value of the POS network to POW bitcoins. Replace “warren buffet” with “crypto exchanges selling bundled securities”, and the above is not just plausible, it’s inevitable. The sa…

A trust assumption of PoS (Proof of Stake) is that >66% of the stake is honest. If you violate this trust assumption then yes PoS breaks. This is a similar trust assumption to requiring that 51% of the mining power in PoW (Proof of Work) is not malicious. This risk can be mitigated: 1. The network should halt if a fork is detected. A fork with more than 66% of the stake behaving maliciously means a fundamental trust…

> Stop everything! Let humans figure out what is going on.

What does this mean in practice? Who are these humans? When can the network get going again? Would a consensus rule change be part of it, and what type of changes would be allowed in that situation?

It sounds hard to manage this type of maintenance breaks in a trustless way. Surely consensus rule changes during outages should not be handled any differently than changes when under normal operations.

> clients could be programmed to have hardcoded 6th month checkpoints

Who signs these checkpoints? Once you have established the trust required for checkpointing the entire blockchain regularly, wouldn't it be much easier to checkpoint every block instead and in an instant do away with all the hard problems of blockchain networks?

Post reply on HN