Peter Todd

I am not searching down all the whitepapers for you, if you truly want to learn then you will need to dig into the myriad mathematician's white papers against Proof of Stake. Here is one link, and you can find several more. https://download.wpsoftware.net/bitcoin/pos.pdf Now, that is a PDF, and I do not recommend blindly opening PDFs. This is by Andrew Poelstra, who is a mathematician at Blockstream.

https://download.wpsoftware.net/bitcoin/pos.pdf Most bitcoin heavyweights who have researched proof of stake have concluded that it's not viable, and not worth further research in the context to trustless and decentralized systems.

> It's been around a long time and bitcoin hasn't been changed to take advantage of it. Of course it hasn't, Bitcoin is decentralized and Peercoin requires the developer of the system to continually sign the chain. Proof of stake sounds lovely, but it doesn't work and attempts to rescue it have at best resulted in things with very different security assumptions and properties from Bitcoin. https://download.wpsoftware.net/bitcoin/pos.pdf

I don't think there has been any empirical evidence regarding the idea that proof-of-stake method can reach consensus, so I'm not sure about the quality of this document. It is sort of implied, but in reality one can easily fake n chains and there would be no way for a peer to independently figure out which one is valid. In proof-of-work a peer can always rely on the idea that the chain with the most work is the valid chain. Proof-of-stake is an interesting idea, but until I see empirical evidence showing that it actually works, I remain skeptical. Here's a good read on the subject: https://download.wpsoftware.net/bitcoin/pos.pdf

>I seem to recall the proposed staking minimum being around $200,000... No, it's 32 eth, which is a bit over $4k. >https://download.wpsoftware.net/bitcoin/pos.pdf Stake grinding is an obsolete attack (solved by randao, in the future strengthened with VDF asics). The second argument that weak subjectivity is somehow unsafe is at odds with reality: it assumes some far away hermit that runs an old node after 10 years of hibernation, with no ability to communicate with others otherwise. In reality, crypto is a technology for resource allocation among humans also participating in that specific system, which means the only constraint is to make the bonding period sufficiently long that manual decisions are feasible and not overly costly. A system that requires a node to run for few minutes every few months to follow the same chain fulfills those conditions. >Moreover, as was recently demonstrated with "steem" PoS No, steem has DPoS, which is very different in practice. It has inherent centralization because there are only 21 witnesses, as opposed to potentially millions. It has stake delegation baked in the protocol which ensures all witnesses are public figures that know each other, which makes a cartel the expected outcome. Nodes are by design heavy which makes outside verification very hard. Eth2 has to support up to millions of nodes at once. It has pro-decentralization penalties - penalties grow if others are misbehaving at the same time - which means if most of the…

> sufficiently trustworthy Trustworthiness always depends on your use case. If you are transacting small amounts of money (less than is spent on mining a block) then waiting for 3 confirmations is probably sufficient to consider the transaction settled. But what if you send a transaction with a 100 times higher value than goes into mining a block then you will need to wait for over 100 confirmations till you can be sure it doesn't make economical sense for anyone to try to double spend your transaction by orphaning the first block your transaction was in (with a very simplified incentive model not taking into account other transactions in these blocks). Thus the money spent on mining blocks determines how much value can be transferred in one block. Allowing for higher value transactions is good thing imo, is necessary for its success as digital gold and therefore justifies the higher energy consumption (especially since there don't seem to be any alternatives with similarly good or better robustness against attacks yet, proof of stake can't work under the same assumptions bitcoin does [1]). [1] https://download.wpsoftware.net/bitcoin/new-pos.pdf

This really doesn't make any sense. >blockchains introduced three new characteristics: centralized / shared control, immutable / audit trails, and native assets / exchanges. Blockchains aren't immutable, they are just expensive to mutate. Blockchains aren't centralized. Blockchains didn't introduce audit trails, these have always been possible simply through having a transaction table that is only appended to. This of course does require trust in the central authority. >(4) Leads to provenance on training/testing data & models, to improve the trustworthiness of the data & models. Data wants reputation too. Is training set fraud really an issue in training AI? >(1) Leads to more data, and therefore better models. >(2) Leads to qualitatively new data, and therefore qualitatively new models. >(3) Allows for shared control of AI training data & models. The author has a poor understanding of both AI and blockchain technology[1]. Blockchains are for decentralized consensus, but it seems the author is vaguely proposing using a blockchain as a mass datastore (with ownership labels) for both training data and AI algorithms. Of course AI is an exciting field so this means you can generate hype by implying the field of AI has yet to solve the problem of sharing data with fellow researchers until now. [1] https://download.wpsoftware.net/bitcoin/alts.pdf

>Generally the nothing at stake problem will result in the problem of requiring some trusted source to not lie, regardless of the implementation, see https://download.wpsoftware.net/bitcoin/pos/ Which means infinitely better security than PoW. PoS is resistant to nothing at stake attack as long as at least one smallest stake is indefinitely honest in each block. It doesn't have to be the same, just so that there's no way for an attacker to achieve 100% at any one point. That's because the stakes of true owners have the same voting power, so they cancel. To not cancel, the attacker has to own something in all histories, but now the cost is real. Even 0.1% of bitcoins is worth more than what ~17 days of mining power costs. He needs to own more than minimum stake of honest parties over all blocks. The practicality of that is another matter, as is quality of existing implementations, but that's a much much more realistic requirement than using >half of all worldwide available energy for PoW. If someone still thinks PoW is more secure, consider this: two countries are at war. One uses PoW currency, another one PoS, owned overwhelmingly by citizens from its creation. Which currency system gets destroyed by the enemy country, wrecking their economy as a result? Related point: which one is likely to be wealthier? P.S. I think in practice all cryptocurrencies are driven purely by social consensus, with pow/pos/other as false rationalization for it. If bitcoin had serious…

> Man, I wish I'd kept my Extropy magazines. I ditched them in a move about 15 years ago. Well, for what it's worth, here's the archives I have been collecting. I also have other extropians-related files, but this is somewhat of a "I don't know what I have" issue, so it will just take some more poking and prodding for me to categorize and upload the rest. extropians: http://diyhpl.us/~bryan/irc/extropians/ cypherpunks: http://diyhpl.us/~bryan/irc/cypherpunks/cypherpunks-199209-199812.tar.… > but I've lost track of whatever group is on the broader picture of extreme technological ambition. Mostly it's the same groups, except not where you first found them. For example, the cypherpunks and cryptography mailing lists haven't degraded as terribly as extropy-chat/extropians. There is a transhumanism/biohacking channel on irc.freenode.net ##hplusroadmap which has logs here http://gnusha.org/logs/ since 2008. (Disclaimer, I am the resident optroll.) ... and there's a bitcoin/cryptography wizardry channel on the same server in #bitcoin-wizards (but also #bitcoin is reasonable), logs can be found here: https://download.wpsoftware.net/bitcoin/wizards/ In general, I would recommend #bitcoin for most messages. As for the rest of the cryptocurrency world, that's a little more difficult to explain and keep track of... You know, the weird thing is that looking back on the extropians, they weren't really all that ambitious. Sure, they would talk about DNA or something, but did…

Yep, it didn't take long for Bitcoiners to arrive at this idea. Here's Andrew Poelstra arguing in 2015 that PoW should approach the thermodynamic limit: https://download.wpsoftware.net/bitcoin/asic-faq.pdf

Bitcoin and PoW is our only shot at decentralized monetary system. PoS has many problems, and it can't provide the same level of confidence in the system as PoW. There's no way to reach objective consensus in a PoS system.[0] From this angle, I see PoS as an adversarial attack against decentralization. Failing to understand this is dangerous. Bitcoin mining uses increasingly clean or otherwise wasted energy, which solves the actual problem, which is unclean energy production. Ethereum has many problems, which prevent it ever competing with bitcoin as money. It can do NFTs and games, sure. However, there are many competitors who do these better, like BSC and Solana, and other more centralized blockchains. So, in the end there is really no place for Ethereum to be competitive in. [0] https://download.wpsoftware.net/bitcoin/old-pos.pdf

> Someone should write "BTC respects the second law of thermodynamics" Knut Svanholm: https://medium.com/hackernoon/bitcoin-and-thermodynamics-63f46b90627 Andy Poelstra: https://download.wpsoftware.net/bitcoin/asic-faq.pdf

> simply transition to proof As opposed to Proof-of-Work, Proof-of-Stake is not as simple as it sounds. Any implementation faces a myriad of design challenges and potential attacks. Things like "nothing-at-stake", "costless simulation", "stake grinding", and "long-range attacks" [1]. And in the end, there is no objective truth about the state of the chain, as there is with PoW's simple longest chain rule. There is nothing simple about a Bitcoin "transition" either, as should be evident from the endless blocksize debates, and resulting Bitcoin Cash chain splits. That was only about changing a single parameter. Now you're talking about changing the very essence of Bitcoin, with dozens if not hundreds more dimensions of choices and opportunities for disagreements. [1] https://download.wpsoftware.net/bitcoin/alts.pdf

Proof of Stake not only replicates the same dynamics that Bitcoin was designed to eliminate (more wealth -> more power in system) but also can only be made secure against a maximum of ⅓ byzantine actors, compared to Proof of Work's superior ½. As for using it for Layer 1 systems, Andrew Poelstra nailed it in his conclusion [0]: "We showed that by depending only on resources within the system, proof of stake cannot be used to form a distributed consensus, since it depends on the very history it is trying to form to enforce loss of value." Proof of Stake might be useful at Layer 2 (becoming equivalent to voting stock in a company), but not as a base-layer consensus mechanism. [0]: https://download.wpsoftware.net/bitcoin/pos.pdf

1. There is no proven alternative to Proof-of-Work. No, not even Proof-of-Stake: https://download.wpsoftware.net/bitcoin/pos.pdf. Most PoS fans admit this. 2. Thanks to second-layer scaling solutions, there can be arbitrarily many off-chain transactions powered by an on-chain transactions. For more information, visit http://lightning.network/ 3. Bitcoin was not invented as a cheap transaction medium, although it was mistakenly marketed as such for a long time. It was invented to serve as a uncensorable sound money. The cost calculation needs to reflect that aspect, otherwise we are measuring the aerodynamics of a tank.

https://download.wpsoftware.net/bitcoin/pos.pdf This paper does a pretty good job of laying out a formal, mathematical proof that pos doesn't work

It would solve this problem, but it will introduce new, exciting problems in the process: https://download.wpsoftware.net/bitcoin/pos.pdf (skip ahead to costless simulation)

Counterpoint, on the thermodynamics of PoW: https://download.wpsoftware.net/bitcoin/asic-faq.pdf

No one has yet created a Proof of Stake system that offers the same guarantees that Proof of Work offers. In fact, there are arguments that it's not possible [1] You can implement any feature you want in Bitcoin, but for a feature like this (hard fork), you need to convince all users to upgrade. I think it's really unlikely you could sell a switch that drastic in Bitcoin land, especially considering the current unknowns. [1] https://download.wpsoftware.net/bitcoin/pos.pdf

https://download.wpsoftware.net/bitcoin/pos.pdf is one source.

In the Bitcoin space, I'm most excited about the Lightning Network [0][1] and MimbleWimble [2][3], which are in my view the two most groundbreaking technologies that really push the limits of what blockchains are capable of. [0] https://en.bitcoin.it/wiki/Lightning_Network [1] https://lightning.network/ [2] https://download.wpsoftware.net/bitcoin/wizardry/mimblewimble.txt [3] https://bitcoinmagazine.com/articles/mimblewimble-how-a-stripped-down-…

Proof of stake has been around for decades in some form or another (Quorum based consensus was what it was originally called) Andrew Poelstra has compiled a pretty decent list of reasons why it's an uninteresting idea: https://download.wpsoftware.net/bitcoin/pos.pdf (He's created other documents on the subject)

Proof of Stake does not work. https://download.wpsoftware.net/bitcoin/pos.pdf

Far less secure you mean? https://download.wpsoftware.net/bitcoin/pos.pdf

The terminology used in #bitcoin-wizards is to call it a merkelized dag, or merkle-dag. Similarly, we also refer to "Merkelized Abstract Syntax Trees", a way of hashing code originally proposed by Pieter Wuille and Russel O'connor(1) that will probably be added to Bitcoin's scripting system eventually. Pretty much any data structure can have hash functions added to it to "merkelize" it, producing an authenticated data structure: http://www.cs.umd.edu/~amiller/gpads/ 1) https://download.wpsoftware.net/bitcoin/wizards/2014-12-16.html

Sadly, proof-of-stake has some fundamental flaws undermining its reliability as a consensus mechanism: https://download.wpsoftware.net/bitcoin/pos.pdf

There's many more times that, my estimates put it between two and three thousand. > using algorithms unsuitable for ASIC or GPU implementation You don't want that. Give this a read. https://download.wpsoftware.net/bitcoin/asic-faq.pdf

It's meaningless for a reason. https://download.wpsoftware.net/bitcoin/asic-faq.pdf

Proof-of-stake isn't being adopted because it simply doesn't solve the Byzayntine General's problem [1]. [1] http://download.wpsoftware.net/bitcoin/pos.pdf

There are a bunch of ways in which you're not exactly correct here. First, you're describing a very particular implementation of PoS. Not all PoS implementations include slashing. This isn't a mere technicality: the most popular implementation of PoS (as measured by market cap) is Cardano's and it doesn't include slashing. And not all PoS implementations involve randomly choosing a validator. The bigger problem here is that proof of stake is actually a misnomer because doesn't actually provide proof, period--it's a consensus algorithm, not a proof algorithm. That's fine if you're actively connected to a bunch of nodes, because you can resolve double spends by polling the network to find out the consensus. But if you're only connected to two nodes and those two nodes are showing you two different spends of the same balance, you have no way to resolve that conflict. In PoW (a real proof algorithm) you simply look at the longer chain. In PoS, there's no way to actually enforce the longer chain, because there's no cost to producing a longer chain. This is a problem which occurs in practice when nodes newly connect to a network or reconnect after a long absence. Slashing does nothing to address this issue. If I'm running a PoS validator node, I can stake coins, unstake them, and then spend the coins. Now I've got a free license to mine blocks without risk of slashing. I can mine blocks by simply validating blocks that say that I never unstaked. And I'm at no risk of slashing…