> Maybe I'm over-interpreting "work", in the physics sense, but won't any proof-of-work scheme have the same problem? To get more coins, miners need to do more work, and that takes more energy.

Only if we assume mining, in it's current BTC implementation, is the only acceptable PoW.

I think there are other PoW alternatives that could be used. And they'll be identified and implemented soon, in the next couple years, as people realize we can swap out SHA hashing for an algorithm that does something productive, and use the output of that algorithm to be the proof of work.

The amount of computing power in ASIC miners running today is quite large, and has grown quickly. If we think of those computing resources running something else, and verifying work across nodes, then this is quite possible.

I'm very skeptical that some task can be found that's really useful in itself and is predictable and cheat-proof enough to be usable for something like Bitcoin.

I mean, are you thinking of something like SETI or Folding@home? Those are arguably useful, but there's a ton of scope for playing around with the problem scope and developing new variants that might require far fewer resources but remain useful -- and that's a good thing! But it surely makes them less usable as PoW systems.

Yes, exactly. I don't think requiring fewer computing resources is a bad thing, having multiple nodes in the blockchain come to the same conclusion could provide a level of trust similar to the existing mining algorithm. That's wasteful as well, but not as wasteful.

But how do you address the fundamental problem of an arms race between miners? They could end up burning 90% of the world's energy production madly calculating protein folds. Is that a good return on investment?

In my opinion, it's a better return than calculating SHA hashes with no aim other than to do work.

We could prioritize computing problems by increasing the reward for working "more important" problems (find asteroids that are going to hit us?).

It's better but not much better. How do you avoid an arms race? Who gets to decide what problems are important?

Depends on the incentive scheme to stop malicious actors. Current form of "PoW" relies on computational hahsing to stop the attacks.

PoS, an alternative "work" scheme, relies on staking and risk of losing coins to stop bad actors. The person who gets to mine the block is still hashing and creating the block.

Ethereum, as an example, started out with PoW but soon moves to PoS. So, it is trying to avoid a situation like Bitcoin were highpowered hashing (a word coined by Satoshi) and electricity is in focus.

I'm probably just nitpicking over words then. If it's not PoW don't call it PoW.

Somebody mentioned the use of SHA as a specific problem, as if a different hash function could be better. My point is just that any work function at all would be just as bad.

PoS sounds worth investigating.