It is certainly possible for someone to modify a block and try to mine it. There's no required consensus process in advance; you can just try to generate a block that has the data you want, and find a hash that starts with enough zeros. (You can't alter a block so that money is spent without the consent of the money-holder, since each expenditure requires a digital signature. But if, say, Alice's key has signed both "Transfer this bitcoin to Bob" and "Transfer this bitcoin to Carol", you can mine either of those.)

The trouble with trying to do that is that mining is slow. The math problem is timed so that it takes roughly 10 minutes for someone, somewhere to successfully find an answer. So the CPU time is 10 minutes times the number of mining nodes on the Bitcoin network. If you, on your own computer, start trying to mine a block that's different from what everyone else is trying to mine, you are going to have to be extraordinarily lucky to be able to get the math problem solved on your own within 10 minutes. The entire rest of the Bitcoin network is trying to mine a different block, and they'll probably win.

Let's say that you are extraordinarily lucky, or maybe you control like 30% of the network and you're slightly lucky. What you've accomplished is to make a fork in the block chain: there are two blocks with the same parent. You can now send your fork to people, because there's no way to to tell which one was "real" and which one wasn't. But now you need to keep mining on your fork, because people will notice if the block chain mysteriously stops updating. You need to be incorporating everyone else's transactions onto your fork. So not only do you need to be lucky, you need to be repeatedly lucky, all the time, so that your mining keeps up with the other fork. This is only feasible if you actually control 50% of the network.

But still, what have you accomplished? There's no "merge" in Bitcoin. Everyone sees a single history. If they see two blockchains updating at the same speed, they know that something is up and it can be resolved by humans; no program is going to simultaneously trust both histories. So either Alice transferred a bitcoin to Bob (and thus not to Carol), as she authorized, or she transferred a bitcoin to Carol (and therefore not to Bob), as she authorized, or the bitcoin remains with Alice and no transaction happened. The best you can do is prevent people from spending their money, if you reliably control 50% or more of the network. You can't cause money to be double-spent.

And yes, it is common to wait 10 minutes or often 60 minutes to wait out an attacker's luck, at least for large transactions. The official Bitcoin client calls transactions "unconfirmed" until it sees six blocks mined on top, at which point it's assumed infeasible for you to have a separate history from the rest of the network. For smaller transactions, people tend not to wait as long. But the same thing happens with conventional currency. Most stores don't check small bills with counterfeit pens. Most credit card readers support offline transactions, but you get the product immediately. Personal checks can take up to a month to clear or bounce. If there's something high-value, you get a cashier's check or you run a credit report on the person. Otherwise you trade off the risk for convenience.

See the Bitcoin wiki article on confirmation for a bit more discussion about how long to wait vs. how strong an attacker is: https://en.bitcoin.it/wiki/Confirmation

Let me know if I understood you correctly and whether that was answering the question you asked.

And that's pretty damn good, because if you want to do the most damage to someone, you cut them off from their money.

So, most of the time these threads are abandoned, but I really do appreciate your thoughtful responses, and I'd like to continue, because I think I'm finally able to articulate my concern clearly: the trouble is that there is a distinct, separate group of miners who can form out-of-band cabals and cooperate to effectively cut anyone they want off from their money. All it would take would be for a majority of them to agree to ignore transfers from a public key, and the ledger would continue along just fine.

So, the root of banking power is currently institutional and legal, and all bitcoin is doing is giving that control to people with the most compute power. Bitcoin turns CPUs into the new gold standard (although ASICs function more like tulips).

On a related note, I'd like to understand on a practical level how people reach "the miners" and whether or not the miners have incentive to share transactions with each other once they learn of one, or whether the system relies on a "neutral" third party clearing house for unintegrated transactions. Presumably there are lots of endpoints in the world where you can put transactions, but what guarantee do you have that anyone will bother integrating yours? Do you push it to lots of endpoints to reduce the chance that happens (intentionally or by accident)? Or, another way to ask this, is: how do miners learn of unintegrated transactions?

Hmmmm. So, in order for someone to spend money, they just need one transaction in the blockchain moving the money to someone else. In order to cut them off, you need to make sure that transaction never gets mined.

Since there are lots of miners, even if you control part of the network, someone in the rest of the network could mine the transaction. Then you're in the position of having to refuse that block and maintain a fork. That's probably tenable if you control like 95% of the mining power. I'm not convinced that's tenable if you control even 50% of the mining power. If your victim keeps trying to transfer their money, you'll fairly often find the other 50% of the network having a block that you refuse to accept, and (I think) you won't be able to get your fork to reliably win automatically. IF you keep refusing blocks, it'll involve human intervention on the other 50% of nodes to consider your history the "real" history, and people will notice that something strange is happening.

You could, of course, accept the transaction, track their coin, and consider all money from its recipient tainted. But there are enough large wallets, like large exchanges and even tumblers (essentially money-launderers) that obfuscate the relationship between inputs and outputs. You're going to have to start blacklisting a lot of money if you want that approach to work.

> So, the root of banking power is currently institutional and legal, and all bitcoin is doing is giving that control to people with the most compute power.

Yes, this is basically my biggest personal disbelief about Bitcoin: many governments could out-mine the entire Bitcoin network right now if they decided that it was important to national security. I'm not convinced this is a fundamentally unsolvable problem (there are some alternative models, Stellar's consensus protocol probably being the most interesting) so I'm not a cryptocurrency skeptic, but I am a Bitcoin / proof-of-work skeptic. There do seem to be a bunch of people in the Bitcoin community interested in alternatives to proof-of-work, which I think is healthy.

(And relatedly, if we don't need proof-of-work for security, either because something else works or nothing possibly works, let's stop building a world in which we have to burn energy for currency transfer.)

> On a related note, I'd like to understand on a practical level how people reach "the miners" ... how do miners learn of unintegrated transactions?

I don't understand this clearly and I'm currently the wrong person to ask. The best I can find is https://en.bitcoin.it/wiki/Transaction_broadcasting plus https://en.bitcoin.it/wiki/Network (there's some IRC-style way of learning about nodes, and I think at the network level, ~everyone is a node and considered capable of mining). I suppose the paper might know more; we could look.

I would consider understanding this to be a necessary condition for advocating for (or using) BitCoin.

Also, one of the interesting outgrowths of focusing on the reachability of the network is that a few features of the network. Assuming the network is accepting all transactions, miners must be working on different subsets of transactions routinely. This implies that there's quite a lot of computation getting thrown out, routinely, as different miners start working on different subsets of transactions.

It also implies that there is a miner-to-miner DOS method, where the majority of the miner network blackballs a miner - no longer accepts their integrations. This is serious, but much less serious than an arbitrary public key freeze, which can affect anyone (your tumblers aside, it's always possible).

Finally, I begin to understand why Satoshi started with money. I suspect at some level this is not about money, but he needed to incent people to get this ball rolling. What is it about? It's about coherent, persistent truth. Transactions are just one kind of event that happens in the world. The pattern is valid for any global data-structure that you want to have great survivability and coherence. You might use something like the blockchain (adding back a little jargon) to store, for example, the mind state of an AI. The proof of work, rather than a mechanistic search for arbitrary hashes, might be somehow related to the operation of the AI's "mind".