I find the complexity of that algorithm both impressive ( since they seem to have made it work), but also quite worrying. I'm really not sure how such a beast can't be filled with bugs, not in the implementation but rather in the protocol.

I know a lot of very smart people are working on this, but i'd rather have something conceptually simpler to work as the base layer for a whole new economy.

There is large areas in cryptography where if you don’t do it right the whole thing won’t work at all - in that sense there are large parts that are self verifying which collapses complexity. I’m not saying it’s all easy, just that experts can navigate through complexity because they know what to ignore by abstracting it and thinking about properties it holds, not keeping in mind all the guts underneath. Maybe good example is that you can use sha256 effectively in your code without knowing or focusing on how it works internally. You’re interfacing with it through relatively easy properties it has.

There are even larger areas in cryptography where if you don't do it right the whole thing will work, and after a few months someone will make $1B by crashing your currency into oblivion.

Edit: if you want to see how that can happen, I like to take apart weak cryptocurrencies and show what's wrong with them. Someone paid me to do a public review of a thing called Stratis a while back, and I went to town. Here's a highlight. https://twitter.com/PLT_cheater/status/1235036182284820481

I still accept commissions doing code review. It's just too much fun.

Except cryptography usually rely on mathematical proofs. I'm not aware of such possibility for distributed systems. I know Lamport did work on that subject, but i'm not sure if you can equate a TLA+ proof on some properties to a mathematical proof about the structure of numbers, nor do i know if ethereum even has a TLA+ proof or equivalent of anything regarding the PoS protocol (i honestly don't know, so i may be completely wrong).

There has been some work on the topic, for instance https://eprint.iacr.org/2014/765.pdf

But the main issue in provable security is that you're trying to prove real world things with math, and so far we're quite bad at it. The more mathematical the thing you want to prove is, the better.

I wouldn't rely on experts being able to navigate through complexity as it happens quite a bit that a major bug in a protocol obliterating it completely is found 15 years after its inception...

Alternative being what exactly? Giving up on the whole "computers" idea?

Formal? Computer assisted proof checkers? Building strong cryptosystems is notoriously hard, especially when you start composing different systems since some are only secure given certain preconditions which are on you to remember and ensure.

Proof checkers only check for invariants you knew to check for. They're not future proofing against exploits, they're merely a solidification of what you knew about your attack surface at a time.

Good cryptography should be auditable, that means it should be simple. It should not rely on experts knowing their way through the complexity but should rely on mathematical guarantees.

Yes the cryptography primitives should act like black boxes, no need to peak inside but when a number of these black boxes are used together to form a high level protocol allot of subtle things can go wrong for example see the history of SSL/TLS https://www.feistyduck.com/ssl-tls-and-pki-history/

Agreed that conceptual simplicity is always best, and the current Casper FFG + LMD-GHOST doesn't have provable guarantees yet (though seems to be working in practice). I'm excited to see slight modifications to the consensus/forkchoice algo that do have provable guarantees, like [Goldfish](https://www.paradigm.xyz/2022/09/goldfish) from Paradigm Research.

Cryptocurrencies impose some complex constraints on themselves that require complex solutions.

Conceptually banks and exchanges solved the consensus problem decades ago and they did it with a highly secured simple database and lots of crosschecks.

But if you trust nobody (except some developers somehwere) then things get tricky

Could you go into more detail or provide references on where I could read up more on how banks do this? I've always wondered why we hear a lot about crypto exchanges getting hacked, but seldom about banks. What is it that banks are doing right (or crypto exchanges doing wrong) in terms of security?

Banking systems do not require consensus. So, it is a single party that has to make a trust decision with a counterparty that it partially trusts, but may potentially be a fraudulent party masquerading as a trusted party.

Crypto requires consensus amongs millions of untrusted and possibly malicious parties i.e., no trust, all cryptography.

Both require cryptography to work (eg: online banking transaction vis-a-vis crypto currency transfer). But the former is well-known (Public Key Encryption and Symmetric Encryption) client and server with established trust relationships that can be cryptographically verified whereas the latter is a distributed system with untrusted nodes and has different dynamics.

The other issue is about correctness. If there is an error (system or human) in the banking system, there are compensatory transactions/procedures possible. Crypto has not evolved yet to accommodate these real world issues. It is also not proven that the crypto protocols are 100% correct. Therein lies the rub. The banking system is also not 100% correct, but has procedures to address the failures (complaint system, appeals, courts etc.,) but with crypto, there is no way to address the failure cases (hacks, lost wallets, corrupted drives, 51% attacks etc.,)

First things that come to mind reading GP are the existing interbank payment clearing networks: Fedwire, CHIPS, SWIFT, etc.

And, on the contrary, SWIFT was hacked not so long ago: https://en.wikipedia.org/wiki/2015%E2%80%932016_SWIFT_bankin...

I'm not sure if you're half joking, but banks authentify every single tenant in the transaction (from account owners, to institutions) in the most rigid way. Fraud usually happens at the edge (credit card), but everything "inside" the system is a legally registered entity. It is completely integrated with the legal system.

> everything "inside" the system is a legally registered entity. It is completely integrated with the legal system.

Well then, that's not at all solving the same consensus problem that crypto solves.

They do solve the consensus problem but don't have the same constraints crypto does.

The consensus (of who owns what and how did that happen) is whatever the banking says it is at the moment. This works because society places a lot of trust in the actors and the checks and regulations surrounding them (e.g. liability regimes) as well as the ways to rectify mistakes (through the legal system).

Crypto adds the additional requirement that every participant of the system (even end users) can independently come up with the same state without a single entity being the arbitrator of truth. The tradeoff is added technical complexity and inefficiency (storage and computation)

Oh ok, yes from that point of view they're solving entirely different problems, for sure.

This is all about ledgers, traditional banks have a centralized ledger that only they can edit. Blockchains the ledger is decentralized, anyone can edit the ledger (based on specific rules) this provides allot of avenues of attack.

Making PoS scale to hundreds of thousands of nodes with commodity hardware is not simple though. Few projects managed so far, and Ethereum wasn‘t designed for it from the outset, so it‘s even more difficult.

Of course they aren't really scaling to hundreds of thousands of nodes. At any given time only 120 nodes are involved in consensus.

But of course no system can scale to O(100k) nodes and retain reasonable availability and consistency properties.

>ly not sure how such a beast can't be filled with bugs

The one nice thing about crypto is that if there are bugs, the incentive to exploit them is large, they will get found quickly.

How the problem is dealt with after the fact (e.g. ETH Classic hard fork) i.e. the governance model is the real interesting part.

The incentive is to discover them but exploit them after the switch to the new chain

> The incentive is to discover them but exploit them after the switch to the new chain

You're always at the mercy of a hard fork that "fixes" the bug after the exploit.

This is what the Ethereum classic fork was about.

What if you get half the validators to conspire to benefit from the scam

I'm a crypto skeptic, but I have to admit, one of the cool things about crypto-currencies is that they come with their own built-in bug bounty. If there's a bug, it will most certainly be found.

I'm not sure a criminal mind would advertize having found a bug in the algorithm. Instead it would probably try to capitalize on that bug for as long as possible while remaining quiet about it (assuming it's possible, of course).

Most people aren't bashing the tech, but bashing the excessive hype, fraudulent scams and money chasing.

It’s like… I can be fascinated by the creativity that goes into designing and making credit card skimmers that blend invisibly into an ATM, that doesn’t mean I like the theft…

Ref: https://news.ycombinator.com/item?id=32843961

Having read your article, I still don't understand one part. The claim that the honest validators in the face of a malicious superminority can eventually leak them out, but a malicious supermajority cannot do the same to an honest superminority. I figure there would need to be some other mechanism that would tip the balance in favor of the honest validators, otherwise it seems like majority should always win.

If you run a node, you're also checking that every block follows the rules.

A malicious supermajority cannot break the rules your client enforces, because your client will reject it.

Think of it as everyone running ethereum has a bunch of asserts() each block or communication it receives.

What are these rules? Say for instance 51% of validators decide to include a malicious transaction inside of a block, what rules would that be breaking?

Depends on what way the transaction is "malicious". If malicious means transferring funds that don't exists, it'll be noticed. If malicious means transfer funds out of an address it doesn't hold the key for, it'll be noticed, and so on.

> If malicious means transferring funds that don't exists, it'll be noticed.

who cares?

As far as I can tell, a majority that wants to block a vote can do so freely and the only resolution is a fork where people just assume that the honest fork will win out.

I also think it's not a majority but actually just a little more than a third to block a vote for eth

And in the case that the malicious supermajority isn't breaking the rules? In the stated instance where they're omitting certain transactions, what rule would they be breaking?

I have a question if I may.

What mechanism is deciding who pays inactivity leaks?

It says that if a minority stop attesting then they will leak until eventually the attestors get to a supermajority. That makes sense.

It also says that, if a dishonest minority start a soft fork, the fact that they stop attesting on the honest fork means that they eventually leak out until the honest fork gets a supermajority.

That implies that, unless some mechanism has decided which is the honest fork, then all attestors will leak assuming that they aren't trying to attest to both blocks (which is illegal). But if all attestors are leaking then that supermajority won't occur will it?

So something must be deciding which is honest. But it can't be using number of attestors/deniers because of USAF ie where the honest fork is the less attested one.

So how does that work? How is honesty determined given that both forks are legal wrt rules and failed attestation is penalised but cannot be shown to be malicious (according to the doc).

Also, as an aside, how are leaks actually transacted? They can't be using the main transaction or none of the above would work. Is there some sort of shadow transaction system for staked ETH? If so, what mechanism decides the validity of the leak transactions?

Very interesting mechanism. Clearly a lot of thought has been put into it.

In case anyone's interested, from what i can tell from reading other writeups, there is no "honest fork" check. Each fork will independently deal with inactivity until they're able to finalise.

If that's the case, the article is correct in saying that a minority honest fork will finalise as would an honest supermajority fork. What it didn't mention is that the respective dishonest forks would too. If I've understood correctly.

Not really sure I get why this is a good thing.

Guess you can update this part now!

>3. PoS (Ethereum, soon™)

Indeed! :)

Isn't it a little unfortunate that the acronym for Proof of Stake would be PoS? Couldn't they think of something else?

You mean people might confuse it with Point of Sale? /s

Don't be obtuse. They clearly imply people might think it means Point of Service.

I don’t think that’s an obtuse comment. I understood the article to be talking about Point of Sale the entire time because I live off the blockchain hype.

Hopefully the new algorithm is not a Piece of Shit.

I think you missed the joke. Or was it? Hmm, now I'm wondering!

I'm sure you can find a naughty word or phrase, or some other semantic collision, out of almost any 3-letter combination, in some language somewhere. Sure it's one of the more well known ones in a very common lingua franca, but we humans are smart and can context switch.

Edit: Actually not sure if you are talking about Point of Sale, Place of Service, Piece of $#!7, or something else. Case in point: context matters.

Ty for your service foo.

What's Substack? Is that new Medium?

It'll be okay like Medium used to be until it isn't and the funders turn it into Medium while seeking that return on investment. You're still better off owning your own blog in the long run.

Yeah it's like Medium except it has less fluff/self-promotion.

It's like Medium but wants you to pay for newsletters.

Which is fairer imo than paying for the whole site. I prefer creator control on which content is paid and which content is not.

That’s how I always thought about it yeah.