Ethereum “Dagger” proof-of-work function is flawed | Hacker News Reader

Ethereum “Dagger” proof-of-work function is flawed

bitslog.wordpress.com

50 pointswslh30 comments

I suspect these attempts to design a computation that cannot efficiently be performed by 'hardware' (ASICs, or even graphics cards or whatever) are doomed to fail. Furthermore, they're essentially pointless.

Even if you end up with a scheme that can only run efficiently on a general purpose computer, it will probably be through making the computation utilise all the features of the computer. Which means that the computer won't be very good at doing anything else while it is mining. End result: people will have to dedicate machines to mining.

What end benefit does this give to the users or to the currency? People either spend money on dedicated computers or dedicated ASIC miners.

(I guess, at least if/when the currency crashes and burns, those machines could then be reused for other things... but it's still 'wasted' on the owner, who wouldn't have otherwise bought the computer)

joosters wrote: "I suspect these attempts to design a computation that cannot efficiently be performed by 'hardware' (ASICs, or even graphics cards or whatever) are doomed to fail."

For sure. Each time someone figures out something that can not be done on current ASICs/GPUs, a bunch of smart people throw themselves at figuring out a way to modify the GPUs/ASICs in order to enable it. It is an arms race scenario, where these inefficiencies for 'hardware' are just temporarily.

> Each time someone figures out something that can not be done on current ASICs/GPUs, a bunch of smart people throw themselves at figuring out a way to modify the GPUs/ASICs in order to enable it.

Well, yes and no. Litecoin was invented in 2011 and still no one has successfully built ASICs for LTC mining.

This was just released: http://www.gridseed.com/main.php

It's time to bring back the good old polymorphic code. If there is one thing that ASICs can't do faster than generic CPUs, it's executing code that constantly undergoes changes.

Many people could mine on their desktop PCs (if they have one) while they sleep or are at work with little impact on their normal usage. The Bitcoin ASIC market has so many problems that the more mature PC supply chain would be a huge improvement.

Primecoin has set several records for longest known chains of Cunningham primes. That's at least interesting, if not especially useful.

That's interesting. I didn't realise that there were some currencies that involved useful calculations (OK so not useful, but practical in some way at least).

Reminds me of http://www.distributed.net/ - it's like their distributed computing but with a currency as a side effect!

>What end benefit does this give to the users or to the currency? People either spend money on dedicated computers or dedicated ASIC miners.

Once a currency switches to ASIC the mining power becomes a more centralized.

> What end benefit does this give to the users or to the currency?

It lowers the risk of investing in mining gear since it is more likely to be able to be repurposed should one chose to abandon mining. Lowering the risk of entry encourages entry.

If a crypto-currency PoW is such that ASICs have an enormous advantage, then you're in a situation where just a tiny handful of companies with top-tier chip fabs can control the currency by refusing outright to make the ASICs, or worse, only making them if those ASICs include specified features. For instance, you could only allow blocks to be mined if the block itself has a Intel - or US government - signature on it showing that it is approved by them. It's not uncommon for the supply of specialized hardware to be tightly controlled and regulated - just try buying a top-tier inertial guidance system with accuracy suitable for weapons use.

Unfortunately the economics of ASIC manufacture is such that the entire world economy appears to be unable to support more than a small handful of top-tier chip fabrication facilities.

Having said that, currently it's unknown if an "ASIC-hard" PoW algorithm is possible, or more concretely, how much we can narrow the gap between dedicated ASICs and off-the-shelf, or at least semi-custom, hardware.

Is this akin to saying it's a problem for the gold market that relatively few companies with specialized investments mine gold?

The problem is that you don't want mining to be too efficient. You cannot scale a GP mining operation easily. you want decentralized multi node network. Probably even better crypto currency will be one with logarithmic returns and not linear on computing power invested per actor - but I am not sure if this thing is even theoretically possible.

TLDR: Existing cryptocurrencies already implement something resembling your idea, and anything that more closely resembles your idea gets sunk by Sibyls.

Most cryptocurrencies have an adaptive difficulty, where the amount of hash power required to mine a block is proportional to the average total power of the network in the recent past. So if Bob controls x units of hash power, the rest of the network controls N, and each block pays an expected reward R, then Bob's expected return per block is:

    f(x) = R x / (N + x)

Of course, if Bob is small enough, f(x) is approximately equal to R x / N when x ~ 0. That is, small miners see expected returns proportional to their computational power [1], but miners large enough to represent a significant fraction of the network see nonlinear diminishing returns, at least until they get big enough to do a 51% attack and simply take over the whole network.

I guess your idea is to make each individual miner's curve exhibit diminishing returns on a smaller scale than "a significant fraction of the network." The problem with trying to do this on the scale of a single miner is that the network has no way of "knowing" the identity of a miner. So if a single selfish miner named Sibyl with 1000 machines gets penalized by your system relative to 1000 independent miners with equally powerful machines, she can just have her machines pretend to be 1000 independent miners and get out of the "diminishing returns" region and back in the "linear" region near zero. There's no way the network can "know" that Sibyl's thousand accounts should be grouped together when it figures out what her diminishing returns should be [2]. Under the existing whole-network-power based diminishing returns system, Sibyl can't convince the network to increase her marginal return per unit computational power by pretending to be a thousand people.

[1] Assuming R and N remain constant, and when returns are measured in the currency being mined.

[2] Of course you could have a centralized entity approving accounts which has some way to audit Sibyl's 1000 machines and make sure they in fact represent 1000 different real people and broadcast a digitally signed statement that it's okay to give those 1000 machines the favorable diminishing returns for individual miners which is automatically checked by all honest nodes, but a system with such centralization is more like Paypal than Bitcoin.

Outside of 3D video games, the bulk power of most computers is already idle pretty much the entire time they are turned on.

There was this response by one of the devs:

http://www.reddit.com/r/ethereum/comments/1vh94e/dagger_upda...

They seem to be moving away from Dagger:

"We will switch our PoW from Dagger to a hybrid PoW/PoS system to be developed via a bountied competition conducted by our university partners and open to the general community for participation." https://bitcointalk.org/index.php?topic=428589.0;all

Whether this instills confidence that they are agile and not ideologues or shows inexperience is your call.

> Although we have great talent as far as theoretical computer science is concerned, we have not yet acquired any experts in computer hardware on our team

Note to readers: the exact wrong time to use an appeal to authority is this, the moment after your authority been disproven by facts.

i think it's better to approach this from the other side - there are already many distributed computing projects like folding@home, etc that are trying to solve "problems that are cpu and memory hard" - and will realistically have no ending (unless one day there is no disease, or we attain world peace, find aliens, etc). How about we assign value and proof of work to something tangible? Like if your computer folds a correct protein that solves a problem re cancer or aids, you get 1 "humanity coin" ?

That is ideal but not especially easy.

Hashing as they are doing it requires several factors: what you need to compute is not handed out by a central authority, it is hard to compute, and is easily provable once computed.

folding@home and others do not usually fit 1 and 3. However, there have been some attempts, see Curecoin and Primecoin to a lesser extent.

While protein folding calculations are useful, they can't be used as a foundation of PoW systems because there is no easy way to verify a solution.

Yes there is. It's the most easy way to verify - see if the protein matches with the problem receptor. It's pretty much black or white if something binds to a receptor.

I think the perspective just needs to change. Maybe a little handheld "protein receptor match" kit that you plug your numbers into, and it will "make" your particle to try to match in a small lab kit that is portable.

First you have to verify that the conformation of the protein is correct. What use is an improperly or incompletely folded protein with regard to ligand binding?

So, a machine that can print prions?

For something to work as a proof of work, it needs to have a couple of properties that most @home projects don't have:

There needs to be a quick way to verify a correct solution.

There needs to be a way to pre-estimate the difficulty of the problem.

There should be a way to adjust said difficulty.

Ideally, there shouldn't be a time/memory tradeoff.

>Like if your computer folds a correct protein that solves a problem re cancer or aids, you get 1 "humanity coin" ?

There have been a couple of attempts. GridCoin comes to mind. It works like a regular coin but you get a huge speedup in mining from Boinc credits. Probably easy to abuse and depends on a centralized server though so I'm not sure it could actually work.

Proof of Work and proof of stake hybrid. Mining to create useful computations as much as possible. Make produced resources available using the currency only. Proof of computing resources provided.

Why is Scrypt not a suitable solution?

Scrypt requires as much memory to verify a POW as to create one.

The author doesn't seem to think that's a problem.

the problem of finding proof of work is inherently parallel - embarrassingly parallel, in fact - and cannot possibly be anything else.

so calling dagger flawed for being parallelizable is.. well, ridiculous.

Reply on news.ycombinator.com