Comment by DennisP | Hacker News Reader

Comment by DennisP | Hacker News Reader

Parent Full thread

Why? Easy, people kept figuring out attacks so they kept working on better designs. Figuring out a solid PoS protocol is nontrivial.

A few days ago Vitalik went through the history of Ethereum's proof of stake research at the annual Devcon, if anyone's interested: https://www.youtube.com/watch?v=Km9BaxRm1wA

At this point they're pretty happy with the protocol, the spec is mostly written, and eight teams are working on clients. The new design includes blockchain sharding for about 1000X better scaling.

Regarding your analogy, regardless of protocol you have a certain amount of "weak subjectivity," in that you at least have to know what client software to run. Otherwise you might be accepting invalid blocks.

The attacks you mention can be handled by requiring stake to be locked up for several months, and slightly broadening the subjectivity you accept to include a periodic known blockhash. You have to use off-chain social means to find out the correct recent hash, but you have to do the same to find out the correct software to run. https://blog.ethereum.org/2014/11/25/proof-stake-learned-lov...

>you at least have to know what client software to run

The beauty of PoW is that you don't. By examining a PoW blockchain one can determine the relative amount of work expended. That provides trust with little to no external information. (All you need to know is the relative difficulty of hash functions and what info is hashed to form a block, both independently verifiable).

With PoS there is no analog. You must get your 'trust' externally, through deciding which codebase/client you want to use. Without external information / sidechannels, you have no way of determining which client nor which history to trust.

If a 51% attacker makes an invalid transaction, you actually don't want to accept it just because they have more hashpower; if you did then 51% attackers could arbitrarily steal funds. If you don't accept invalid transactions, then you're using external knowledge of current validation rules.

Also, if you really assume that only the chain with the most hashpower is the valid one, then you have to ignore all other blockchains. And even then, you're assuming you know the correct hash function; given ASICs it's not practical to know what hash function requires the most economic effort just by looking at it.

Knowledge of consensus rules is the knowledge you’re building consensus upon. It’s a given.

But you have to get that knowledge, and the specific software to implement it, from some source other than the blockchain. In practical terms, it barely changes the security model if the download for new users includes a known blockhash from several months back, instead of only the hash of block zero.

Barely but importantly. With bitcoin for every user it is still feasible even on raspberry pi to download and verify the whole chain for themselves. Not so for ethereum even with high end computers. I guess that is their way to phase in PoS scam, but it has nothing to do with “preserving the security model”.

Utxo commitment is definitely a shortcut that bitcoin will eventually implement, but it can only work reliably for long timeframes especially when you have “disturbances in the force” like what happened with BCH last year.

“Known” blockhash from several months back is something that can easily be faked unless you actually fetch all the history and verify.

Ouroboros Genesis solves this problem.

nope, it doesn’t.

Reply on news.ycombinator.com