<unnamed>

Public Key

npub1r8mnta5rneza3ujqtckuz6m8es0mvvzq35ec7v4nz3lq99l3wzlsrtu3an

Profile Code

nprofile1qqspnae476peu3wc7fq9utwpddnuc8akxpqg6vu0x2e3glszjlchp0cpz4mhxue69uhhyetvv9ujumn0wd68ytnwv46qz9rhwden5te0wfjkccte9ejxzmt4wvhxjmcpp4mhxue69uhkummn9ekx7mq7gnrrl

Publishing to

relay.nostr.net

relay.damus.io

nos.lol

Last Notes

2023-06-08 01:16:19 CEST

- reply

📅 Original date posted:2022-11-08
📝 Original message:Peter,
It sounds like there are two attack vectors; neither of which require
full-rbf (correct me if I'm wrong).
1) Bob has staked liquidity in a payment channel with Alice who later
double spends the same inputs (at a very low feerate) resulting in a
stalemate where neither can spend the UTXOs. The TX that creates the
payment channel with Bob will never be mined since the mining pool sees
the double spend?
2) Alice spams the network with a double spend wide enough that the
double spend makes it into a block before the remainder of the network
sees the first spend.
In that case of 1), what if Bob required a opt-in rbf? Wouldn't that
solve the issue? Bob could just create a replacement transaction with
enough fee to get back his UTXO?
For 2) it seems to me that neither full-rbf or opt-in rbf resolves this,
although it's a probabilistic attack and requires spamming many nodes.
Cheers,
-Yancy
On 2022-11-07 15:32, Peter Todd wrote:
> On November 3, 2022 5:06:52 PM AST, yancy via bitcoin-dev
> <bitcoin-dev at lists.linuxfoundation.org> wrote:
> AJ/Antoine et al
>
> What should folks wanting to do coinjoins/dualfunding/dlcs/etc do to
> solve that problem if they have only opt-in RBF available?
> Assuming Alice is a well funded advisory, with enough resources to spam
> the network so that enough nodes see her malicious transaction first,
> how does full-rbf solve this vs. opt-in rbf?
First of all, to make things clear, remember that the attacks were
talking about are aimed at _preventing_ a transaction from getting
mined. Alice wants to cheaply broadcast something with low fees that
won't get mined soon (if ever), that prevents a protocol from making
forward progress.
With full-rbf, who saw what transaction first doesn't matter: the
higher fee paying transaction will always(*) replace the lower fee
one. With opt-in RBF, spamming the network can beat out the
alternative.
*) So what's the catch? Well, due to limitations in today's mempool
implementation, sometimes we can't fully evaluate which tx pays the
higher fee. For example, if Alice spams the network with very _large_
numbers transactions spending that input, the current mempool code
doesn't even try to figure out if a replacement is better.
But those limitations are likely to be fixable. And even right now,
without fixing them, Alice still has to use a lot more money to pull
off these attacks with full-rbf. So full-rbf definitely improves the
situation even if it doesn't solve the problem completely.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20221108/b618d371/attachment.html>

2023-06-08 01:16:17 CEST

- reply

📅 Original date posted:2022-11-03
📝 Original message:AJ/Antoine et al
> What should folks wanting to do coinjoins/dualfunding/dlcs/etc do to
> solve that problem if they have only opt-in RBF available?
Assuming Alice is a well funded advisory, with enough resources to spam
the network so that enough nodes see her malicious transaction first,
how does full-rbf solve this vs. opt-in rbf?
Cheers,
-Yancy
On 2022-10-27 19:21, Anthony Towns via bitcoin-dev wrote:
> On Thu, Oct 27, 2022 at 11:56:45AM +0200, John Carvalho via bitcoin-dev
> wrote:
>
>> I took the time to read your whole post. Despite a diplomatic tone, I
>> find
>> your takeaways from all your references to remain conveniently biased
>> for
>> protecting the plan of RBF
>
> Yes, I am heavily biased against zeroconf: there's no way I'd
> personally
> be willing to trust it for my own incoming funds, no matter how much
> evidence you show me that it's safe in practice. Show me a million
> transactions where every single one worked fine, and I'm still going to
> assume that the payment going to me is going to be the one that makes
> the error rate tick up from 0% to 0.0001%. That's okay; just because I
> wouldn't do something, doesn't mean other people shouldn't.
>
> It does mean I'm not going to be a particularly good advocate for
> zeroconf
> though. I mean, I might still be a fine advocate for giving people time
> to react, making it clear what's going on, finding ways that might make
> everyone happy, or just digging it to random technical details; but,
> for me, I'm more interested in a world where chargebacks are
> impossible,
> not where we just make the best of what was possible with technology
> from five or ten years ago.
>
> But that's fine: it just means that people, like yourself, who will
> tolerate the risks of zeroconf, should be involved in the discussion.
>
>> You show multiple examples where, when I read them, I assume the next
>> thing
>> you will say will be "so we really should stop trying to impose
>> optional
>> features, particularly when they affect existing use cases" but
>> instead you
>> persist.
>
> Sure, that's natural: you read a sign saying "you can have any ice
> cream
> you want for 5c" and think "Awesome, who wouldn't want cheap chocolate
> ice cream!!" and see me going for a Golden Gaytime and think "wtf
> dude".
> Different strokes.
>
> For me, I see the gmaxwell github comment I quoted saying:
>
> There is also a matter of driving competent design rather than lazy
> first thing that works.
>
> and think "yeah, okay, maybe we should be working harder to push
> lightning
> adoption, rather than letting people stick with wallet UX from 2015"
> and have altcoins take over >50% of payment volume.
>
> Likewise,
>
> There is also a very clear pattern we've seen in the past where
> people take anything the system lets them do as strong evidence that
> they have a irrevocable right to use the system in that way, and that
> their only responsibility-- and if their usage harms the system it's
> the responsibility of the system to not permit it.
>
> seems a pretty good match against your claim "I expect the things I do
> with Bitcoin today to work FOREVER." Better to nip that thinking in the
> bud; and even if the best time to do that was years ago, the second
> best
> time to do it is still now.
>
> By contrast, from the same post, I'd guess you're focussing on:
>
> Network behavior is one of the few bits of friction
> driving good technical design rather than "move fast, break things, and
> force everyone else onto my way of doing thing rather than discussing
> the design in public".
>
> and thinking "yeah, move fast, break things, force everyone else --
> that's exactly what's going on here, and shouldn't be".
>
> But that's also okay: even when there is common ground to be found,
> sometimes it requires actual work to get people who start from
> different
> views to get there.
>
>> The problem is that RBF has already been an option for years, and
>> anyone
>> that wants to use it can.
>
> Is that true? Antoine claims [1 [1]] that opt-in RBF isn't enough to
> avoid
> a DoS issue when utxos are jointly funded by untrusting partners, and,
> aiui, that's the main motivation for addressing this now.
>
> [1]
> https://lists.linuxfoundation.org/pipermail/lightning-dev/2021-May/003033.html
>
> The scenario he describes is: A, B, C create a tx:
>
> inputs: A1, B1, C1 [opts in to RBF]
> fees: normal
> outputs:
> [lightning channel, DLC, etc, who knows]
>
> they all analyse the tx, and agree it looks great; however just before
> publishing it, A spams the network with an alternative tx, double
> spending her input:
>
> inputs: A1 [does not opt in to RBF]
> fees: low
> outputs: A
>
> If A gets the timing right, that's bad for B and C because they've
> populated their mempool with the 1st transaction, while everyone else
> sees the 2nd one instead; and neither tx will replace the other. B and
> C can't know that they should just cancel their transaction, eg:
>
> inputs: B1, C1 [opts in to RBF]
> fees: 50% above normal
> outputs:
> [smaller channel, refund, whatever]
>
> and might instead waste time trying to fee bump the tx to get it mined,
> or similar.
>
> What should folks wanting to do coinjoins/dualfunding/dlcs/etc do to
> solve that problem if they have only opt-in RBF available?
>
> If you're right that opt-in RBF is enough, that question has a good
> answer. I don't believe anyone's presented an answer to it in the 17
> months since Antoine raised the concern.
>
>> passive aggression
>> escalation
>> unfair advantage
>> oppressive, dark-pattern design
>> strong-arming and shoe-horning
>
> Do you really think any of that was helping your cause?
>
> Cheers,
> aj
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
Links:
------
[1]
https://lists.linuxfoundation.org/pipermail/lightning-dev/2021-May/003033.html
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20221103/bccd03d2/attachment-0001.html>

2023-06-08 01:15:13 CEST

- reply

📅 Original date posted:2022-10-17
📝 Original message:Hi Jeremy,
Thanks for the reply. I do find the semantics of mempool and block org
interesting (although there's a lot on the topic I don't know).
> E.g., suppose:
>
> Block N: Fees = 10, reward = 1
>
> Mempool: Fees = 2
>
> Mining block N+1 with the mempool leads to reward 2+1 = 3, reorging
> leads to reward of up to 10 + 1 + c, (c < 2, where c is the extra
> transactions that fit).
If I'm reading this correctly, Block N was already mined, but the miner
who mined block N+1 repacks the transactions from block N because they
have more to gain. Wouldn't such a situation be resolved in the same
way as two miners who find a block at a similar time? E.g the network
will choose depending on when block N+2 is created.
> Assume instead your reward is 8, leaving 3+c on the table.
Mining block N+1 with the mempool leads to reward 2+8 = 10, reorging
leads to 10 + 8 + c? Wouldn't that leave 8+c?
> If you assume all other miners are tip miners, and there are two
> conflicting tips, they should pick the one with the more profit for
> them, which is the new one you made as a non-tip miner since you
> "shared" some fee.
I'm curious how the "fee sharing" would be organized. To see if I
understand, You're asking what would happen if one of the two miners
incentives (bribes in this case) the next miner (block N+1) to choose
one of the competing tip miners?
> You aren't particularly more likely to remine block N or N+1, before
> someone builds on it, as opposed to deeper reorgs (which require
> larger incentive).
Agree.
> However, as many have pointed out, perhaps not following the simple
> "honest tip mining" strategy is bad for bitcoin, so maybe we should
> expect it not to happen often?
The idea that people won't do something because it's "bad for Bitcoin"
doesn't fit an adversarial model. Even in the above examples (which I
think wouldn't expect to happen often), I would argue the network still
conforms to a Nash Equilibrium without requiring trust. Although It's
mostly speculation without some empirical data.
Cheers,
-Yancy
On 2022-10-17 21:10, Jeremy Rubin wrote:
> Building on the most work chain is perhaps not rational in many normal
> circumstances that can come up today under the stated reference
> strategy:
>
> 1) Take highest paying transactions that fit
> 2) Mine on tips
>
> E.g., suppose:
>
> Block N: Fees = 10, reward = 1
>
> Mempool: Fees = 2
>
> Mining block N+1 with the mempool leads to reward 2+1 = 3, reorging
> leads to reward of up to 10 + 1 + c, (c < 2, where c is the extra
> transactions that fit). Assume instead your reward is 8, leaving 3+c
> on the table.
>
> If you assume all other miners are tip miners, and there are two
> conflicting tips, they should pick the one with the more profit for
> them, which is the new one you made as a non-tip miner since you
> "shared" some fee.
>
> You aren't particularly more likely to remine block N or N+1, before
> someone builds on it, as opposed to deeper reorgs (which require
> larger incentive).
>
> However, as many have pointed out, perhaps not following the simple
> "honest tip mining" strategy is bad for bitcoin, so maybe we should
> expect it not to happen often? Or other strategies to emerge around
> selecting transactions so that the next M blocks have a similar fee
> profile, as opposed to picking greedily for the next block.
>
> --
> @JeremyRubin [1 [1]]
>
> On Sun, Oct 16, 2022 at 3:03 PM <email at yancy.lol> wrote:
>
> The proof-of-work also solves the problem of determining
> representation in majority decision
> making. If the majority were based on one-IP-address-one-vote, it
> could be subverted by anyone
> able to allocate many IPs. Proof-of-work is essentially
> one-CPU-one-vote. The majority
> decision is represented by the longest chain, which has the
> greatest
> proof-of-work effort invested
> in it. If a majority of CPU power is controlled by honest nodes,
> the
> honest chain will grow the
> fastest and outpace any competing chains. To modify a past block,
> an
> attacker would have to
> redo the proof-of-work of the block and all blocks after it and
> then
> catch up with and surpass the
> work of the honest nodes. We will show later that the probability
> of a
> slower attacker catching up
> diminishes exponentially as subsequent blocks are added.
> It's interesting that Nash Equilibrium isn't mentioned here. Since
> each miner has the option to either contribute to the longest chain
> or not, even if the miners know what strategy the other miners will
> use, they still wouldn't change their decision to contribute to the
> majority.
>
> For example, if I run a shop that takes rain checks, but I sell an
> item to a higher bidder who didn't have a hold on the item, that
> is
> not honest, but it may be selfish profit maximizing.
> It would be honest if the store policy said ahead of time they are
> allowed to sell rain checks for more in such an occurrence.
> Although this is a good example of the difference between honest and
> rational. I think this means it's not a Nash Equilibrium if we
> needed to rely on the store owner to be honest.
>
> Satoshi said an honest majority is required for the chain to be
> extended. Honest is not really defined though. Honesty, in my
> definition, is that you follow a pre specified rule, rational or
> not.
> My take is that "rational" is probably a better word than honest.
> In terms of a Nash Equilibrium, each participant is simply trying to
> maximize their outcome and honesty doesn't matter (only that
> participants are rational).
>
> It seems a lot of the RBF controversy is that Protocol developers
> have
> aspired to make the honest behavior also be the rational behavior.
> This is maybe a good idea because, in theory, if the honest
> behavior
> is rational then we can make a weaker assumption of selfishness
> maximizing a parameter.
> I'm curious, can RBF can be described by a Nash Equilibrium? If
> yes, then it also shouldn't matter if participants are honest?
>
> Overall, it might be nice to more tightly document what bitcoins
> assumptions are in practice and what those assumptions do in terms
> of
> properties of Bitcoin, as well as pathways to weakening the
> assumptions without compromising the behaviors users expect the
> network to have. An "extended white paper" if you will.
> White paper 1.1 :D
>
> A last reflection is that Bitcoin is specified with an honest
> majority
> assumption, but also has a rational dishonest minority assumption
> over
> both endogenous (rewards) and exogenous (electricity) costs.
> Satoshi
> did not suggest, at least as I read it, that Bitcoin works with an
> rational majority assumption. (If anyone thinks these three are
> similar properties you can make some trivial counterexamples)
> My take is the opposite unless I'm missing something. Participants
> are always incentivized to choose the rational solution (Not to
> waste electricity on a minority chain).
>
> Cheers,
> -Yancy
>
> On 2022-10-16 19:35, Jeremy Rubin via bitcoin-dev wrote:
>
> The Bitcoin white paper says:
>
> The proof-of-work also solves the problem of determining
> representation in majority decision
> making. If the majority were based on one-IP-address-one-vote, it
> could be subverted by anyone
> able to allocate many IPs. Proof-of-work is essentially
> one-CPU-one-vote. The majority
> decision is represented by the longest chain, which has the
> greatest
> proof-of-work effort invested
> in it. If a majority of CPU power is controlled by honest nodes,
> the
> honest chain will grow the
> fastest and outpace any competing chains. To modify a past block,
> an
> attacker would have to
> redo the proof-of-work of the block and all blocks after it and
> then
> catch up with and surpass the
> work of the honest nodes. We will show later that the probability
> of a
> slower attacker catching up
> diminishes exponentially as subsequent blocks are added.
>
> This, Satoshi (who doesn't really matter anyways I guess?) claimed
> that for Bitcoin to function properly you need a majority honest
> nodes.
>
> There are multiple behaviors one can describe as honest, and
> economically rational or optimizing is not necessarily rational.
>
> For example, if I run a shop that takes rain checks, but I sell an
> item to a higher bidder who didn't have a hold on the item, that
> is
> not honest, but it may be selfish profit maximizing.
>
> Satoshi said an honest majority is required for the chain to be
> extended. Honest is not really defined though. Honesty, in my
> definition, is that you follow a pre specified rule, rational or
> not.
>
> It seems a lot of the RBF controversy is that Protocol developers
> have
> aspired to make the honest behavior also be the rational behavior.
> This is maybe a good idea because, in theory, if the honest
> behavior
> is rational then we can make a weaker assumption of selfishness
> maximizing a parameter.
>
> However, Satoshi did not particularly bound what aspects of
> honesty
> are important for the network, because there isn't a spec defining
> exactly what is honest or not. And also as soon as people are
> honest,
> you can rely on that assumption for good effect.
>
> And sometimes, defining an honest behavior can be creating a
> higher
> utility system because most people are "law abiding citizens" who
> might not be short term rational. For example, one might expect
> that
> miners would be interested in making sure lightning closes are
> "accurate" because increasing the utility of lightning is good for
> Bitcoin, even if it is irrational.
>
> It seems that the NoRBF crowd want to rely on an honest majority
> assumption where the honest behavior is not doing replacement if
> not
> requested. This is really not much different than trying to close
> lightning channels "the right way".
>
> However, where it may be different, is that even in the presence
> of
> honest majority, the safety of 0conf isn't assured given the
> potential
> of race conditions in the mempool. Therefore it's not clear to me
> that
> 0conf working well is something you can drive from the Honest
> Majority
> Assumption (where honest includes first seen).
>
> Overall, it might be nice to more tightly document what bitcoins
> assumptions are in practice and what those assumptions do in terms
> of
> properties of Bitcoin, as well as pathways to weakening the
> assumptions without compromising the behaviors users expect the
> network to have. An "extended white paper" if you will.
>
> It's somewhat clear to me that we shouldn't weaken assumptions
> that
> only seem local to one subsystem of Bitcoin if they end up
> destabilizing another system. In particular, things that decrease
> "transaction utility" for end users decrease the demand for
> transactions which hurts the fee market's longer term viability,
> even
> if we feel good about making an honest policy assumption into a
> self
> interested policy assumption.
>
> A last reflection is that Bitcoin is specified with an honest
> majority
> assumption, but also has a rational dishonest minority assumption
> over
> both endogenous (rewards) and exogenous (electricity) costs.
> Satoshi
> did not suggest, at least as I read it, that Bitcoin works with an
> rational majority assumption. (If anyone thinks these three are
> similar properties you can make some trivial counterexamples)
>
> Cheers,
>
> Jeremy
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
Links:
------
[1] https://twitter.com/JeremyRubin
Links:
------
[1] https://twitter.com/JeremyRubin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20221018/227ec446/attachment-0001.html>

2023-06-08 01:15:11 CEST

- reply

📅 Original date posted:2022-10-16
📝 Original message:> The proof-of-work also solves the problem of determining
> representation in majority decision
> making. If the majority were based on one-IP-address-one-vote, it
> could be subverted by anyone
> able to allocate many IPs. Proof-of-work is essentially
> one-CPU-one-vote. The majority
> decision is represented by the longest chain, which has the greatest
> proof-of-work effort invested
> in it. If a majority of CPU power is controlled by honest nodes, the
> honest chain will grow the
> fastest and outpace any competing chains. To modify a past block, an
> attacker would have to
> redo the proof-of-work of the block and all blocks after it and then
> catch up with and surpass the
> work of the honest nodes. We will show later that the probability of a
> slower attacker catching up
> diminishes exponentially as subsequent blocks are added.
It's interesting that Nash Equilibrium isn't mentioned here. Since each
miner has the option to either contribute to the longest chain or not,
even if the miners know what strategy the other miners will use, they
still wouldn't change their decision to contribute to the majority.
> For example, if I run a shop that takes rain checks, but I sell an
> item to a higher bidder who didn't have a hold on the item, that is
> not honest, but it may be selfish profit maximizing.
It would be honest if the store policy said ahead of time they are
allowed to sell rain checks for more in such an occurrence. Although
this is a good example of the difference between honest and rational. I
think this means it's not a Nash Equilibrium if we needed to rely on the
store owner to be honest.
> Satoshi said an honest majority is required for the chain to be
> extended. Honest is not really defined though. Honesty, in my
> definition, is that you follow a pre specified rule, rational or not.
My take is that "rational" is probably a better word than honest. In
terms of a Nash Equilibrium, each participant is simply trying to
maximize their outcome and honesty doesn't matter (only that
participants are rational).
> It seems a lot of the RBF controversy is that Protocol developers have
> aspired to make the honest behavior also be the rational behavior.
> This is maybe a good idea because, in theory, if the honest behavior
> is rational then we can make a weaker assumption of selfishness
> maximizing a parameter.
I'm curious, can RBF can be described by a Nash Equilibrium? If yes,
then it also shouldn't matter if participants are honest?
> Overall, it might be nice to more tightly document what bitcoins
> assumptions are in practice and what those assumptions do in terms of
> properties of Bitcoin, as well as pathways to weakening the
> assumptions without compromising the behaviors users expect the
> network to have. An "extended white paper" if you will.
White paper 1.1 :D
> A last reflection is that Bitcoin is specified with an honest majority
> assumption, but also has a rational dishonest minority assumption over
> both endogenous (rewards) and exogenous (electricity) costs. Satoshi
> did not suggest, at least as I read it, that Bitcoin works with an
> rational majority assumption. (If anyone thinks these three are
> similar properties you can make some trivial counterexamples)
My take is the opposite unless I'm missing something. Participants are
always incentivized to choose the rational solution (Not to waste
electricity on a minority chain).
Cheers,
-Yancy
On 2022-10-16 19:35, Jeremy Rubin via bitcoin-dev wrote:
> The Bitcoin white paper says:
>
> The proof-of-work also solves the problem of determining
> representation in majority decision
> making. If the majority were based on one-IP-address-one-vote, it
> could be subverted by anyone
> able to allocate many IPs. Proof-of-work is essentially
> one-CPU-one-vote. The majority
> decision is represented by the longest chain, which has the greatest
> proof-of-work effort invested
> in it. If a majority of CPU power is controlled by honest nodes, the
> honest chain will grow the
> fastest and outpace any competing chains. To modify a past block, an
> attacker would have to
> redo the proof-of-work of the block and all blocks after it and then
> catch up with and surpass the
> work of the honest nodes. We will show later that the probability of a
> slower attacker catching up
> diminishes exponentially as subsequent blocks are added.
>
> This, Satoshi (who doesn't really matter anyways I guess?) claimed
> that for Bitcoin to function properly you need a majority honest
> nodes.
>
> There are multiple behaviors one can describe as honest, and
> economically rational or optimizing is not necessarily rational.
>
> For example, if I run a shop that takes rain checks, but I sell an
> item to a higher bidder who didn't have a hold on the item, that is
> not honest, but it may be selfish profit maximizing.
>
> Satoshi said an honest majority is required for the chain to be
> extended. Honest is not really defined though. Honesty, in my
> definition, is that you follow a pre specified rule, rational or not.
>
> It seems a lot of the RBF controversy is that Protocol developers have
> aspired to make the honest behavior also be the rational behavior.
> This is maybe a good idea because, in theory, if the honest behavior
> is rational then we can make a weaker assumption of selfishness
> maximizing a parameter.
>
> However, Satoshi did not particularly bound what aspects of honesty
> are important for the network, because there isn't a spec defining
> exactly what is honest or not. And also as soon as people are honest,
> you can rely on that assumption for good effect.
>
> And sometimes, defining an honest behavior can be creating a higher
> utility system because most people are "law abiding citizens" who
> might not be short term rational. For example, one might expect that
> miners would be interested in making sure lightning closes are
> "accurate" because increasing the utility of lightning is good for
> Bitcoin, even if it is irrational.
>
> It seems that the NoRBF crowd want to rely on an honest majority
> assumption where the honest behavior is not doing replacement if not
> requested. This is really not much different than trying to close
> lightning channels "the right way".
>
> However, where it may be different, is that even in the presence of
> honest majority, the safety of 0conf isn't assured given the potential
> of race conditions in the mempool. Therefore it's not clear to me that
> 0conf working well is something you can drive from the Honest Majority
> Assumption (where honest includes first seen).
>
> Overall, it might be nice to more tightly document what bitcoins
> assumptions are in practice and what those assumptions do in terms of
> properties of Bitcoin, as well as pathways to weakening the
> assumptions without compromising the behaviors users expect the
> network to have. An "extended white paper" if you will.
>
> It's somewhat clear to me that we shouldn't weaken assumptions that
> only seem local to one subsystem of Bitcoin if they end up
> destabilizing another system. In particular, things that decrease
> "transaction utility" for end users decrease the demand for
> transactions which hurts the fee market's longer term viability, even
> if we feel good about making an honest policy assumption into a self
> interested policy assumption.
>
> A last reflection is that Bitcoin is specified with an honest majority
> assumption, but also has a rational dishonest minority assumption over
> both endogenous (rewards) and exogenous (electricity) costs. Satoshi
> did not suggest, at least as I read it, that Bitcoin works with an
> rational majority assumption. (If anyone thinks these three are
> similar properties you can make some trivial counterexamples)
>
> Cheers,
>
> Jeremy
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20221016/ade1e6a6/attachment-0001.html>

2023-06-07 20:30:18 CEST

- reply

📅 Original date posted:2021-03-13
📝 Original message:My mistake for thinking your text was generated text, and my humor was not meant to be directed at you, so apologies if you took it personally.
PS: The AI overlord is no joke
Cheers,
-Yancy
On Saturday, March 13, 2021 18:11 CET, Lonero Foundation <loneroassociation at gmail.com> wrote:
Hi, no worries. I made the changes now in the GitHub repository and pull request. I'm hoping for a BIP # soon. Thanks for the feedback, and I guess the sense of humor. Best regards, Andrew On Sat, Mar 13, 2021, 10:45 AM yancy <email at yancy.lol> wrote:Ok thanks. Using the correct terminology helps people understand what you're talking about and take you seriously.
Cheers,
-Yancy
Mar 13, 2021 4:02:18 PM Lonero Foundation <loneroassociation at gmail.com>:Hi, I know the differences between the cryptographic hashing algorithm and key validation. I know hashing is for SHA, but was referring to asymmetric cryptography in regards to the key validation. I should have used a different term though instead of, "In regards to cryptographic hashing,", I should have stated in regards to cryptographic key validation. There are a few other dubious clarifications or minor edits I should make in order to not draw confusion. I will do a repo update today. Honest mistake, but enough with the sarcasm. Best regards, Andrew On Sat, Mar 13, 2021, 3:13 AM email at yancy.lol <email at yancy.lol> wrote:
My email was not intended as an insult. Your proposal seemed a bit like gibberish and made some obvious mistakes as pointed out before (such as conflating secp256k1 with sha256), and so I was genuinely curious if you were a bot spamming the list.
Maybe a more interesting topic is, can GPT3 be used to generate a BIP? How long before our AI overlord produces improvements to Bitcoin? At what point will the AI have more than 51% of commit frequency? Will we have lost the war to our new centralized overlord?
Cheers,
-Yancy
On Saturday, March 13, 2021 00:31 CET, Lonero Foundation <loneroassociation at gmail.com> wrote:
Also, I already stated I was referring to signature validation cryptography in that aspect: https://wizardforcel.gitbooks.io/practical-cryptography-for-developers-book/content/digital-signatures/ecdsa-sign-verify-examples.htmlMy BIP has a primary purpose in regards to what I want to develop proofs for and the different cryptographic elements I want to develop proofs for.That said to those who disagree with the premise, I do prefer constructive feedback over insults or making fun of one another. After all this is an improvement proposal with a specific purpose aiming to develop a specific thing, not a guy who is just wanting to copy and paste a repository and call it a day. Best regards, Andrew On Fri, Mar 12, 2021 at 6:21 PM Lonero Foundation <loneroassociation at gmail.com> wrote:Hi, I also want to emphasize that my main point isn't just to create a BTC hardfork or become another Bitcoin Cash, Gold, or SV. The main point in regards to this BIP actually expands POW rather than replaces or creates an alternative. Many of the problems faced in regards to security in the future as well as sustainability is something I believe lots of the changes I am proposing can fix. In regards to technological implementation, once this is assigned draft status I am more than willing to create preprints explaining the cryptography, hashing algorithm improvements, and consensus that I am working on. This is a highly technologically complex idea that I am willing to "call my bluff on" and expand upon. As for it being a draft, I think this is a good starting point at least for draft status prior to working on technological implementation. Best regards, Andrew On Fri, Mar 12, 2021 at 5:37 PM email at yancy.lol <email at yancy.lol> wrote:I think Andrew himself is an algo. The crypto training set must not be very good.
Cheers,
-Yancy
On Friday, March 12, 2021 17:54 CET, Lonero Foundation via bitcoin-dev <bitcoin-dev at lists.linuxfoundation.org> wrote:
…
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20210313/770b3f9d/attachment.html>

2023-06-07 20:30:13 CEST

- reply

📅 Original date posted:2021-03-12
📝 Original message:I think Andrew himself is an algo. The crypto training set must not be very good.
Cheers,
-Yancy
On Friday, March 12, 2021 17:54 CET, Lonero Foundation via bitcoin-dev <bitcoin-dev at lists.linuxfoundation.org> wrote:
Hi, I awkwardly phrased that part, I was referring to key validation in relation to that section as well as the hashing related to those keys. I might rephrase it. In regards to technical merit, the main purpose of the BIP is to get a sense of the idea. Once I get assigned a BIP draft #, I am willing to follow it up with many preprints or publications to go in the references implementation section and start dev work before upgrading to final status. This will take about 400 hours of my time, but is something I am personally looking into developing as a hard fork. Keep in mind this is a draft, so after it is assigned a number to references I do at the very least hope to describe various parts of the cryptographic proofs and algorithmic structure I am hoping for. Best regards, Andrew On Fri, Mar 12, 2021, 10:03 AM Erik Aronesty <erik at q32.com> wrote:secp236k1 isn't a hashing algo. your BIP needs about 10 more pages
and some degree of technical merit.
i suggest you start here:
https://en.bitcoin.it/wiki/Proof_of_burn
https://bitcointalk.org/index.php?topic=225690.0
proof-of-burn is a nice alternative to proof-of-work. i always
suspected that, if designed correctly, it could be a proven
equivalent. you could spin up a fork of bitcoin that allows aged,
burned, coins instead of POW that would probably work just fine.
- erik
On Thu, Mar 11, 2021 at 11:56 AM Lonero Foundation via bitcoin-dev
<bitcoin-dev at lists.linuxfoundation.org> wrote:
>
> Hi, I have submitted the BIP Pull Request here: https://github.com/bitcoin/bips/pull/1084
>
> Hoping to receive a BIP # for the draft prior to development/reference implementation.
>
> Best regards, Andrew
>
> On Mon, Mar 8, 2021, 6:40 PM Lonero Foundation <loneroassociation at gmail.com> wrote:
>>
>> Hi, here is the list to the BIP proposal on my own repo: https://github.com/Mentors4EDU/bip-amkn-posthyb/blob/main/bip-draft.mediawiki
>> Can I submit a pull request on the BIPs repo for this to go into draft mode? Also, I think this provides at least some more insight on what I want to work on.
>>
>> Best regards, Andrew
>>
>> On Sat, Mar 6, 2021, 10:42 AM Lonero Foundation <loneroassociation at gmail.com> wrote:
>>>
>>> [off-list]
>>>
>>> Okay. I will do so and post the link here for discussion before doing a pull request on BIP's repo as the best way to handle it.
>>>
>>> Best regards, Andrew
>>>
>>> On Sat, Mar 6, 2021, 10:21 AM Ricardo Filipe <ricardojdfilipe at gmail.com> wrote:
>>>>
>>>> As said before, you are free to create the BIP in your own repository
>>>> and bring it to discussion on the mailing list. then you can do a PR
>>>>
>>>> Lonero Foundation via bitcoin-dev
>>>> <bitcoin-dev at lists.linuxfoundation.org> escreveu no dia sábado,
>>>> 6/03/2021 à(s) 08:58:
>>>> >
>>>> > I know Ethereum had an outlandishly large percentage of nodes running on AWS, I heard the same thing is for Bitcoin but for mining. Had trouble finding the article online so take it with a grain of salt. The point though is that both servers and ASIC specific hardware would still be able to benefit from the cryptography upgrade I am proposing, as this was in relation to the disinfranchisemet point.
>>>> >
>>>> > That said, I think the best way to move forward is to submit a BIP pull request for a draft via GitHub using BIP #2's draft format and any questions people have can be answered in the reqeust's comments. That way people don't have to get emails everytime there is a reply, but replies still get seen as opposed to offline discussion. Since the instructions say to email bitcoin-dev before doing a bip draft, I have done that. Since people want to see the draft beforehand and it isn't merged manually anyways, I think it is the easiest way to handle this.
>>>> >
>>>> > I'm also okay w/ continuing the discussion on bitcoin-dev but rather form a discussion on git instead given I don't want to accidentally impolitely bother people given this is a moderated list and we already established some interest for at least a draft.
>>>> >
>>>> > Does that seem fine?
>>>> >
>>>> > Best regards, Andrew
>>>> >
>>>> > On Fri, Mar 5, 2021, 7:41 PM Keagan McClelland <keagan.mcclelland at gmail.com> wrote:
>>>> >>
>>>> >> > A large portion of BTC is already mined through AWS servers and non-asic specific hardware anyways. A majority of them would benefit from a hybrid proof, and the fact that it is hybrid in that manner wouldn't disenfranchise currently optimized mining entities as well.
>>>> >>
>>>> >> My instincts tell me that this is an outlandish claim. Do you have supporting evidence for this?
>>>> >>
>>>> >> Keagan
>>>> >>
>>>> >> On Fri, Mar 5, 2021 at 3:22 PM Lonero Foundation via bitcoin-dev <bitcoin-dev at lists.linuxfoundation.org> wrote:
>>>> >>>
>>>> >>> Actually I mentioned a proof of space and time hybrid which is much different than staking. Sorry to draw for the confusion as PoC is more commonly used then PoST.
>>>> >>> There is a way to make PoC cryptographically compatible w/ Proof of Work as it normally stands: https://en.wikipedia.org/wiki/Proof_of_space
>>>> >>> It has rarely been done though given the technological complexity of being both CPU compatible and memory-hard compatible. There are lots of benefits outside of the realm of efficiency, and I already looked into numerous fault tolerant designs as well and what others in the cryptography community attempted to propose. The actual argument you have only against this is the Proof of Memory fallacy, which is only partially true. Given how the current hashing algorithm works, hard memory allocation wouldn't be of much benefit given it is more optimized for CPU/ASIC specific mining. I'm working towards a hybrid mechanism that fixes that. BTW: The way Bitcoin currently stands in its cryptography still needs updating regardless. If someone figures out NP hardness or the halting problem the traditional rule of millions of years to break all of Bitcoin's cryptography now comes down to minutes. Bitcoin is going to have to eventually radically upgrade their cryptography and hashing algo in the future regardless. I want to integrate some form of NP complexity in regards to the hybrid cryptography I'm aiming to provide which includes a polynomial time algorithm in the cryptography. More than likely the first version of my BTC hard fork will be coded in a way where integrating such complexity in the future only requires a soft fork or minor upgrade to its chain.
>>>> >>>
>>>> >>> In regards to the argument, "As a separate issue, proposing a hard fork in the hashing algorithm will invalidate the enormous amount of capital expenditure by mining entities and disincentivize future capital expenditure into mining hardware that may compute these more "useful" proofs of work."
>>>> >>>
>>>> >>> A large portion of BTC is already mined through AWS servers and non-asic specific hardware anyways. A majority of them would benefit from a hybrid proof, and the fact that it is hybrid in that manner wouldn't disenfranchise currently optimized mining entities as well.
>>>> >>>
>>>> >>> There are other reasons why a cryptography upgrade like this is beneficial. Theoretically one can argue BItcoin isn't fully decentralized. It is few unsolved mathematical proofs away from being entirely broken. My goal outside of efficiency is to build cryptography in a way that prevents such an event from happening in the future, if it was to ever happen. I have various research in regards to this area and work alot with distributed computing. I believe if the BTC community likes such a proposal, I would single handedly be able to build the cryptographic proof myself (though would like as many open source contributors as I can get :)
>>>> >>>
>>>> >>> Anyways just something to consider. We are in the same space in regards to what warrants a shitcoin or the whole argument against staking.
>>>> >>> https://hackernoon.com/ethereum-you-are-a-centralized-cryptocurrency-stop-telling-us-that-you-arent-pi3s3yjl
>>>> >>>
>>>> >>> Best regards, Andrew
>>>> >>>
>>>> >>> On Fri, Mar 5, 2021 at 4:11 PM Keagan McClelland <keagan.mcclelland at gmail.com> wrote:
>>>> >>>>
>>>> >>>> It is important to understand that it is critical for the work to be "useless" in order for the security model to be the same. If the work was useful it provides an avenue for actors to have nothing at stake when submitting a proof of work, since the marginal cost of block construction will be lessened by the fact that the work was useful in a different context and therefore would have been done anyway. This actually degrades the security of the network in the process.
>>>> >>>>
>>>> >>>> As a separate issue, proposing a hard fork in the hashing algorithm will invalidate the enormous amount of capital expenditure by mining entities and disincentivize future capital expenditure into mining hardware that may compute these more "useful" proofs of work. This is because any change in the POW algorithm will be considered unstable and subject to change in the future. This puts the entire network at even more risk meaning that no entity is tying their own interests to that of the bitcoin network at large. It also puts the developers in a position where they can be bribed by entities with a vested interest in deciding what the new "useful" proof of work should be.
>>>> >>>>
>>>> >>>> All of these things make the Bitcoin network worse off.
>>>> >>>>
>>>> >>>> Keagan
>>>> >>>>
>>>> >>>> On Fri, Mar 5, 2021 at 1:48 PM Lonero Foundation via bitcoin-dev <bitcoin-dev at lists.linuxfoundation.org> wrote:
>>>> >>>>>
>>>> >>>>> Also in regards to my other email, I forgot to iterate that my cryptography proposal helps behind the efficiency category but also tackles problems such as NP-Completeness or Halting which is something the BTC network could be vulnerable to in the future. For sake of simplicity, I do want to do this BIP because it tackles lots of the issues in regards to this manner and can provide useful insight to the community. If things such as bigger block height have been proposed as hard forks, I feel at the very least an upgrade regarding the hashing algorithm and cryptography does at least warrant some discussion. Anyways I hope I can send you my BIP, just let me know on the preferred format?
>>>> >>>>>
>>>> >>>>> Best regards, Andrew
>>>> >>>>>
>>>> >>>>> On Fri, Mar 5, 2021, 10:12 AM Lonero Foundation <loneroassociation at gmail.com> wrote:
>>>> >>>>>>
>>>> >>>>>> Hi, this isn't about the energy efficient argument in regards to renewables or mining devices but a better cryptography layer to get the most out of your hashing for validation. I do understand the arbitrariness of it, but do want to still propose a document. Do I use the Media Wiki format on GitHub and just attach it as my proposal?
>>>> >>>>>>
>>>> >>>>>> Best regards, Andrew
>>>> >>>>>>
>>>> >>>>>> On Fri, Mar 5, 2021, 10:07 AM Devrandom <c1.devrandom at niftybox.net> wrote:
>>>> >>>>>>>
>>>> >>>>>>> Hi Ryan and Andrew,
>>>> >>>>>>>
>>>> >>>>>>> On Fri, Mar 5, 2021 at 5:42 AM Ryan Grant via bitcoin-dev <bitcoin-dev at lists.linuxfoundation.org> wrote:
>>>> >>>>>>>>
>>>> >>>>>>>>
>>>> >>>>>>>> https://www.truthcoin.info/blog/pow-cheapest/
>>>> >>>>>>>> "Nothing is Cheaper than Proof of Work"
>>>> >>>>>>>> on | 04 Aug 2015
>>>> >>>>>>>>
>>>> >>>>>>>
>>>> >>>>>>> Just to belabor this a bit, the paper demonstrates that the mining market will tend to expend resources equivalent to miner reward. It does not prove that mining work has to expend *energy* as a primary cost.
>>>> >>>>>>>
>>>> >>>>>>> Some might argue that energy expenditure has negative externalities and that we should move to other resources. I would argue that the negative externalities will go away soon because of the move to renewables, so the point is likely moot.
>>>> >>>>>>>
>>>> >>>>> _______________________________________________
>>>> >>>>> bitcoin-dev mailing list
>>>> >>>>> bitcoin-dev at lists.linuxfoundation.org
>>>> >>>>> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>>>> >>>
>>>> >>> _______________________________________________
>>>> >>> bitcoin-dev mailing list
>>>> >>> bitcoin-dev at lists.linuxfoundation.org
>>>> >>> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>>>> >
>>>> > _______________________________________________
>>>> > bitcoin-dev mailing list
>>>> > bitcoin-dev at lists.linuxfoundation.org
>>>> > https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20210312/2bb54cd8/attachment-0001.html>