Also, you can't even unstake your eth. The developers promise it's coming soon, but right now, you can't.
Vaccines and cars and everything else you hint at have been around a long time and the trade-offs are pretty well understood. Proof of stake (and it's various implementations) have a long way to go before they reach that status
On the other hand the hotstuff protocol is much more easy to grasp IMO (check my explanation in the book Real-World Cryptography)
PS: oh and also Bitcoin proof of security seems like a nightmare. It’s nice to create protocols that look simple but if you can’t prove their security it’s a bit dumb :) on the other hand the safety proof of hotstuff is quite comprehensive : https://www.davidwong.fr/lbft_safety/
I had to look up hotstuff proof of stake. As far as I can tell that's not what Ethereum (the coin we are discussing here) uses? Not sure where you are going with this.
Bitcoin is not complicated until you try to implement it yourself and prove it.
Compared to the likes of Ethereum, Bitcoin is super simple. Compared to others, it's still somewhat complicated.
While the use of PoW for consensus is super simple (most cumulative difficulty wins), Bitcoin script is a huge source of complexity in itself, with tons of warts. As it turns out, you don't need script to do payments, multi-signatures, atomic swaps, discreet log contracts, bidirectional payment channels etc., i.e. nearly all of the functionality that script is used for. All those can be done with so-called script-less scripts [1], which is mostly creative use of Schnorr signatures.
Bitcoin's emission is not that simple either with the reward halvings every 4 years. A fixed block subsidy (i.e. pure linear emission) is not only simpler, but arguably fairer too, avoiding a concentration of wealth on early miners/adopters, and leaving later generations more than mere crumbs.
[1] https://suredbits.com/schnorr-applications-scriptless-script...
Yet Ethereum had a premine of around 60M, roughly half of all existing coins today. Later emission seems negligible regarding fairness.
In terms of fairness of coin distribution, 100% PoS < Ethereum < Bitcoin < Pure Linear Emission.
PoS effectively ends the distribution of new coins, with everybody able to stake to just preserve their share of the pie.
With both PoS and PoW, a holder loses share when the total coin supply increases. On Ethereum at least, this is less of a problem with staking than mining, because staking is less costly so there's a tenth as much issuance.
However, with sufficient usage, the ETH supply actually shrinks, because a portion of fee revenue is burned. This means non-staking holders actually increase their share.
You can see how that's going here: https://ultrasound.money/
You are not supposed to buy ETH as a way to speculate on its price.
ETH is a resource used to represent processing and storage power. You can think of it as "AWS credits" that you can buy and use to run programs.
The absolute price of ETH is of no interest. The only meaningful number that you should care about is "what is the gas price compared to the ETH price", as in, "how expensive is it to access decentralized computing".
Speculating on ETH value is an investment strategy that is completely separate for ETH utility. People interested in the latter shouldn't care about the former. Just as people using AWS shouldn't really care about AWS stock price.
It might add a lot of implementation complexity, but in terms of conceptual complexity, it's pretty easy to understand at a high level.
I also don't find bitcoin halving complex to understand either. Whether its good is a separate question.
I think it’s quite well written and worth a look.
The halving is probably the reason for the high tides of Bitcoin prices and the inflow of capital to all of cryptocurrency.
Its faster! Its new! Its more advanced!
Strikes me as strongly analogous as to why each of us doesn't run our own email server? Which is, when email was first invented, may have not seemed like a bad idea, but in terms of scale something like federation works better?
Someday there will be another doctrinal conflict with a near 50/50 split in the community. Probably for the same reason - some DAO hack too massive to ignore. In a proof-of-work world, we can evaluate the health of each fork by measuring the scarce physical resources allocated to each.
In a proof-of-stake world, each fork can have a valid voting majority of stakers. There's no actually-scarce resource to split, so no external mechanism to decide which fork is the "real" one.
I wouldn't bet a potential future world monetary system on this scheme.
So what really happened when a PoS chain forked? Justin Sun learned the hard way.
In contrast, in PoW, there's nothing stopping miners from creating a hostile fork that is economically advantageous to them (despite maybe being "worse" overall) and then flipping back to the original chain if their fork doesn't work out. Their hash power can't be slashed in the same way stakers ETH can be in PoS.
If you do change the chain id, then by definition your chain is the new and different one, because it has a different id.
> Slashing is triggered by the evidence of the offence being included in a beacon chain block. Once the evidence is confirmed by the network, the offending validator (or validators) is slashed.
It is a powerless mechanic if the majority of validates don’t want to play along.
A chain is defined by a set of rules that everyone on the chain agrees to abide by. Braking the rules damages the economic utility of the chain, so the Ether on the chain where the validators colluded to break the rules would be worth less, as a result of their actions. The validators are locked on that chain (as they can't prevent a fork from excluding them), so they have a strong incentive against harming the chain. Ethereum is not majoritarian. I don't have to abide by the will of the majority. I only need to come to a consensus about the rules and state of the chain with the people with whom I want to share the chain.
PoS makes it much easier to escape a malicious majority compared to PoW where the hashing power majority can follow the minority anywhere unless the minority is willing to switch to a different hashing algorithm. Even then, the majority could sell their mining equipment and buy new equipment that will work on the new chain on the same terms as that chain's honest minority can. With PoS, the malicious majority would need to buy new Ether from the honest minority who can then just fork again after having made a profit on the attack, and can continue to do that until the malicious majority runs out of resources or realizes that they cannot censor a fork in Ethereum's PoS system.
So you’re going to create a new fork, remove the money from the majority of the wealthy stakeholders who are governing the system, and expect this one to be be seen as legitimate? The one that is explicitly giving the finger to the wealthy?
Good luck!
While I don't think it's meaningful to say that one chain is more legitimate than another, if I was forced to make such a deamination in this case, I would consider the chain where the rules are consistently and predictably enforced in a way that leads to predictable outcomes more legitimate than a chain where validators have colluded to arbitrarily subvert the enforcement of the rules.
The majority of validators could perhaps block this by all running forks of the various consensus client software, with some code changed to set the reward to zero, but why would they do that?
[1] https://github.com/ethereum/consensus-specs/blob/dev/specs/p...
If we imagine a 90/10 split of opinions that leads to a hard fork, the 90 majority can either be satisfied and with their fork and be nice or they can stonewall the 10% fork and refuse to approve any blocks that supports the idea that they deserve to be slashed. Because the only thing that can punish the majority is the approval of the majority. And because allowing another fork to exist reduces the value of the other forks. And because it would just be nicer if instead of having two forks we just kicked out all those annoying validates we don’t agree with.
If the 10% wants to fork off and do a completely different blockchain, what happens to the folks who aren’t colluding either way? I mean, while we’re down to just throw away people’s stakes, why not do so for everyone who isn’t explicitly on our side?
For example: migrating to a new chain ID and restarting with a validator set limited only to the public keys of the 10% who are acting honestly, and loosening that restriction slowly over time.
The attack would end up being extremely costly: not only because it makes the original chain’s token price worthless (who wants to be on a malicious chain?), but because the attacker may also have their deposit slashed in the new chain by the now-majority of honest users defending it.
Genuine question: how does that work? How does ETH mainnet know that my validator is also voting on a different chain?
Don't cite me on the details, but that is the idea
Assume I could have obfuscated the move through the many means availible.
Basically a dispute that allowed to sell the same bitcoin twice?
Here you potentially have a way to sell the same eth tokens few times. Revolutionary!
What might eventually happen is that some % of the validators exit Ethereum mainnet and enter their deposit into an another blockchain, perhaps giving it a different name and set of features and tradeoffs.
More details:
https://ethereum.stackexchange.com/a/591
https://blog.ethereum.org/2015/08/01/introducing-casper-frie...
45% of validators sign on fork A
45% of validators sign on fork B
10% of validators sign both A and B1) to validate, instead of just sitting doing nothing
2) to choose the chain with the most likely chance of being the next main, otherwise they will be slashed
As soon as even the slightiest imbalance appears between the two forks, it will bias validators to choose one against the other and thus exponentially make it the preferred fork.
I think this is actually the most commonly overlooked assumption. The protocol seems very robust, *assuming* perfect information (aka all incentives are known to the system).
I encountered this problem a few years back when trying to design a protocol for a decentralized prediction market. It's very hard to account for hedges or huge bets on other markets.
These would have to have different network or chain IDs to avoid slashing events. One of them, presumably B, would have had to actually change this number from whatever the previously standard/agreed-upon chain ID is.
I could imagine this scenario happening in a contentious split or attack, but it would create two very clearly different blockchains with different goals and needs, like what happened with Eth and EthClassic, or Eth and EthPoW.
The key is in the fact that violating the rules on Ethereum's PoS causes you to lose Ether, which means you eventually lose all your Ether and can no longer sabotage the chain. This is in contrast with PoW systems, where your mining hardware doesn't deteriorate any faster just because you are mining empty or invalid blocks, so you can do that forever and effectively shut down a chain that is small enough relative to your computer power. The only defence a PoW fork has against such an attack is to switch to a different algorithm that is less compatible to the attacker's hardware, but that harms non-attacking miners just as much. PoW has an element of "might make right" while PoS is completely consensual.
If anything happens, the fork anointed by Vitalik will prevail. Otherwise, ETH is doomed. Quite simple, really…
Simple protocols take time to land, and are often digestions of much more complicated protocols. We’ve seen that with TLS being simplified into Noise, or the sponge function for hash functions. If you look at the history of consensus protocols they are getting simpler and simpler as well, arguably hotstuff and streamlet and all the hotstuff variants are simpler and simpler to understand.
It's bizarre to me that people wrote a contract that says one can take the money in certain circumstances, but then completely refused to abide by that.
I really feel bad for the person who figured out how to get the money but then was denied by insecure bullies. What an absolute joke.
One thought it does raise in my mind, though - this is complicated.
Bitcoin is simple. The rules are simple. Simple is really good when it comes to securing a currency.
This, in comparison... I mean, oof. I get the high-level "proof of stake" idea, which (in my mind) has a similar mental complexity to Bitcoin's. But all the algorithms that need to work to support it... it introduces the idea in my mind that somewhere in one of those algorithms is a small oversight. Even if that's not the case, the thought is there.
My opinions on proof-of-stake hasn't changed (seems much better than PoW in real-world use for so many reasons) but it does seem to erode the beautiful simplicity of proof-of-work.