No, you are incorrect. The important aspect of proof of work is that it is very expensive to create an alternate history (maybe one where you didn't send $15,000,000 to the exchange, for example). If you are doing useful work, someone can pay for it, and you can use that payment to make an alternate history for free, defeating the security assumption of blockchains.

Blockchains only work by probably wasting in order to build a history. If you aren't wasting, then it wasn't expensive to build the history (it was subsidised), and it wouldn't be expensive to build a different history (that one could also be subsidized)

But "socially useful" does not imply saleable (to the bane of venture capitalists everywhere).

It's possible for something to provide a social benefit but not make sense for anyone to pay for as a for-profit business because others would get the same benefit and free ride off them. (Hence the problem of public goods in economics.)

So if the proof of work is only solving some general research problem, then it might not be feasible to double dip like you've described. That's why primecoin was able to avoid the problem.

There are very few things that are actually useful (socially or otherwise) but don't provide economic incentive. As pointed out by others primecoin isn't really a very good example. A good application to shoot for, if there are any budding cryptographers in the audience, is a ticking timelock encryption. A set of keys known in advance, and each block solves the next key. This would let you encrypt messages into the future, where the cost to decrypt is equal to the cost of minting that many blocks.

I've seen partial schemes for this, but no complete ones that would justify implementation. If a full and workable scheme could be devised, I would bet on it replacing sha256 based proof of work, eventually.

Every public goods problem is mathematical research is a case where the solutions are socially useful but not saleable. The problem (pointed out by the sibling) with primecoin was that it worked too well, such that further solutions were uninteresting and past the point of diminishing returns.

Edit: See my here for a model of how NP complete problems could fill the role of you could predict difficulty in advance. There wouldn't be double dipping because the person wanting the answer wouldn't pay both bounties.

https://news.ycombinator.com/item?id=15107653

No the problem with primecoin is the mathematical "problem" it is solving isn't scientifically interesting.

Primecoin also ultimately had limited utility. It found the world's largest prime number thousands of times, continually beating it's own record. At some point we had more prime numbers than had mathematical utility.

My unprovable guess is that any other non-sellable problem will ultimately have the same outcome. It's interesting and useful for a bit, but when you have a billion dollars of hardware grinding nonstop for years in a row, you eventually exhaust everything interesting about the original problem and then it's back to the same waste you started with.

Doesn't that mean it worked too well, and we just need to make a Coin with harder and more useful problems?

It doesn't matter if the work is profitable because you only need to create an alternate history for a few blocks.

If you attack the network you can steal billions - so if you have that much computing power available for your useful work, you can temporarially use it against the block chain.

As long as that mining power is available anywhere the chain isn't secure.

But there is no known function that has these properties and is useful in real world.

Sure and that puts it in the same camp as PoS and other currently unworkable schemes. A possible way forward; we don't know yet.