Plus, PoW is nothing but wasted, needless computation. Computing is not free. Every watt spent doing anything PoW is just that much more intensification of our current climate crisis.
As someone with temps of 109 with heat index of 120 coming in the next few days, with all due respect, fuck anyone who proposes PoW is a good idea for anything.
It isn't interesting. It's the most egregious example of conspicuous consumption on the planet.
That's an appeal to authority and an attempt to shut down inquisitive thought and investigation.
Imo, this goes against the spirit of HN.
A better response might have been to point out that the level of POW is reactive. If there are no attacks ongoing it will use little to no resources. If it's effective, the attacks will largely stop (no point in attempting an attack that won't work) and so paradoxically this can potentially provide its benefit without actually having much usage.
If it works out that way the benefit vs costs are very good for pretty much any way of evaluating the costs. This is the kind of nuanced thinking that you'd expect from smart people, as the prior poster suggested (and, in fact, is pointed out in the design document).
That's the whole point.
Everything has drawbacks. It's always a tradeoff in software. You want a really simple interface? Now you can't do complex things. And so on.
Instead of complaining loudly, why not be the change you want to see? Proof of CPU makes you hot? How about proof of RAM? How about about something else, which you thought of yourself, which is a great idea, which you shared with their team, which they would eagerly accept as a superior solution to proof of work?
If this is the case and in practice PoW is never required, then your rant is moot, and instead it is interesting that this effect occurs.
The premise here is that if Bitcoin mining uses an energy source that inherently captures carbon or methane, then it's "carbon negative?" This ignores the fact that the energy budget is shared. We could just as well use that same energy for something else currently on carbon-based sources. So, energy is still being wasted on crypto speculation - you've just fudged the total energy budget calculations by pretending it doesn't apply here.
Burning methane has positive effects on global warming since methane is way way waaaaaaay worse than CO2. Taking care of landfills that are largely untouched, just spewing methane is a good thing. If Bitcoin ends up having a net-negative effect on global warming, how is that a bad thing?
You're assuming that all energy sources are well-connected to a grid that can handle the electricity that is generated, that's not the case at all. You can't "use that same energy for something else currently on carbon-based sources" without major infrastructure costs.
See for example what Ercot has to say about Bitcoin mining: https://www.youtube.com/watch?v=gKnRfDeFgr0
Also, batteries don't help when the electricity is in the middle of nowhere and not connected to the grid.
With the proof of work, I think the assumption is that a legitimate user will be willing to accept a sufficient delay to make botnet DoS attack impossible.
The counter argument might be that the botnet can generate arbitrarily hard proof of work, but this isn't true. Assuming some fixed capacity by the botnet, and that the botnet needs to send some amount of requests per time in order for the attack to be effective (e.g., if they only send one proof of work request per minute, then the "bid" for the rest of the time is quite low), then there's some maximum effective "price" based on the capacity of the botnet past which a user is guaranteed access.
For example say a botnet has access to a million compute nodes, so they have 1 million proof of work seconds per second.
If there's a service which can serve 1000 requests per second, then the average proof of work seconds they have per request is 1000 seconds of proof, so as long as the user is able to provide 17 minutes of proof of work, they can get access. In reality, the user's hardware is likely more capable than the attacker's botnet (which is probably IoT devices etc.,) so the ratio is more favorable.
I find it amusing that this approach is pretty on brand for onion services, as an invisible hand type market solution from what I'd consider to be a fairly libertarian leaning group.
It's not even impossible for increased consumption to lower carbon emissions, because to meet the higher peak demand you may need to add more generating capacity. When the new capacity is renewables or nuclear then it adds no carbon emissions during peak usage times and allows for a reduction in carbon emissions whenever the grid is at less than full capacity by assigning the remaining load to the new plants and spinning down the legacy fossil fuel ones that would otherwise have been used.
Remember that this PoW proposal is a market. If the server has unconsumed cycles (eg. Is not saturated), the POW spot price can remain 0. The server only needs to set a PoW price after the server’s resources near saturation. For the same reason auctions end because nobody is willing to pay infinity dollars, clients can forego PoW and can opt to check back in on the server later when costs subside.
> It isn't interesting. It's the most egregious example of conspicuous consumption on the planet.
This cannot be overstated. PoW needs to die. It is a lazy implementation that just sounds clever but is nothing of the sort. It kills our habitat. It has to go.
Every watt spent doing anything, period, right? Like using your computer to send comments on HN?
Or streaming video? Or any one of a million things that humans do which aren't strictly necessary for survival but we do them anyway?
The tirade against PoW is absurd. It's useful, get over it.
> The service would give the request a priority value based on the "difficulty" of the puzzle solution.
Seems like single clients could increase the difficulty to higher than what the bot net would do (so it gets priority), and hence get access. Operators of the bot net would probably hard code one value as the difficulty, and it would be lower than what you could typically set on consumer hardware.
Maybe user agents could even do this increase automatically?
Bad assumption.
Assumptions like these never last. People who say “I don’t have any money” are still valuable to hackers as phishing senders, legitimate social media accounts, residential + non-cloud + regionally convenient IP space, etc. If consuming connection / server resources becomes valuable then botnet controllers will find a way to pay the cost. It’s easy because someone else is paying for the hardware, bandwidth, and power costs.
But the effect of a market of PoW is the same — there is game theory involved in bidding (just like a silent auction). Even if a botnet uses a dynamic priority bid system, the cost increases as the botnet tries to starve the server of resources. The server’s resources are always zero-sum and the bidding will get progressively more expensive until the opportunity cost of the botnet changes behavior.
> The large botnet is a serious operation with many thousands of computers organized to do this attack. Assuming 100k medium-range computers, we are talking about an attacker with total access to 200 THz of CPU and 200 TB of RAM. The upfront cost for this attacker is about $36k.
They appear to define it by compute capacity, so I'd expect the attacker can solve harder puzzles than legitimate users would attempt.
This version is good, don't get me wrong, but adding value transfer would be better imo.
There might be legal issues for the users too-- e.g. upgrading copyright infringement into criminally prosecutable commercial copyright infringement.
Obtaining the funds creates extra friction, yes, but it’s possible the benefit outweighs the cost — e.g. because an attacker can no longer utilize the idle CPUs of botnet devices.
Ultimately, any form of anti-DoS protection also punishes legitimate users. The question is (1) how much it punishes attackers relative to this, and (2) whether this punishment for legitimate users deters them, too.
> make it harder for attackers to overload the service with introduction request
> We hope that this proposal can help us defend against the script-kiddie attacker and small botnets.
Sets expectations: does not counter large botnets.
> We hope that this proposal will allow the motivated user to always connect
A user who really wants to connect can get through durring a DoS attack, but it may still take work.
Interesting choice of PoW algorithm: https://github.com/tevador/equix
> Hence, instead of forcing clients to go below a static target like in Bitcoin to be successful, we ask clients to "bid" using their PoW effort. Effectively, a client gets higher priority the higher effort they put into their proof-of-work. This is similar to how proof-of-stake works but instead of staking coins, you stake work.
[1] https://gitlab.torproject.org/tpo/core/torspec/-/raw/main/pr...