plasticmachine

That's incorrect, Monero does not leak amounts since they created and added RingCT (currently compulsory on testnet, and compulsory on mainnet from a hard fork next year September) - https://lab.getmonero.org/pubs/MRL-0005.pdf

Not only does Monero already do what ZCash is trying to do, but it has two main advantages:

1. EVERY transaction is private, which means that the entropy of the anonymityset is continuously growing. Instead, ZCash restricts privacy to an opt-in mechanism (mostly due to private transactions being horrible - requiring north of 8gb of RAM and several minutes on a modern computer) which means that there is a trivial amount of entropy, and deanonymization is pretty trivial.

2. Monero is focusing on further improvements that ZCash is just dreaming about, such as their C++ i2p router, Kovri. They can do this because they've been in production, tested, and hammered for several years.

The real question is: what does ZCash provide that Monero doesn't, except some sort of ridiculous "star cred"?

No, it is. Those already exist in the form of Monero. Using some new-fangled, likely broken cryptography, is very hipster.

Thanks for confirming that you rushed unproven, untested cryptography into a production system meant to defend user's privacy and their money.

Speaking of - why did you rush it out? Because your investors wanted to make profit? Absolutely despicable.

It uses completely unproven cryptography that may quite possibly be horribly broken. If you have a better definition of "hipster" than "use something for the sake of it, regardless of practicality" I'd love to hear it.

Can you give me that price in buckets of tempura shrimp?

No, Google removed the beta label some time ago: https://gmail.googleblog.com/2009/07/gmail-leaves-beta-launc...

Also if Gmail lost all your email it would be bad, but you'd probably be ok. If ZCash causes you to lose a significant portion of your life saving, on the other hand...

*stark

If the aim was for it to be experimental, why create a "live" monetary system? Why not keep it testnet-only, untradeable?

You had a single thing with ZCash that you had to get right, and you couldn't get it working in your initial release? What an utter embarrassment.

Sure, and I agree with you in principle. Doesn't change the fact that what you've highlighted as some indication of Monero's inferiority lives in start contrast with the ZCash amateurs.

I think it's relevant, as I've heard a LOT of people claim that ZCash is amazing "because of the dream team behind it". The dream team clearly misunderstand cryptocurrencies, see for eg https://github.com/zcash/zcash/issues/713

Exactly. The coinbase could've been time-locked and only spendable after a block height.

The amount of perverse incentives it creates is insane. Instead of investors being forced to slowly accumulate ZEC, they are given it almost in bulk, and are in a perfect position to manipulate and short the market.

Sorry but I can't agree with you here. When Monero still allowed mixin 0 transactions almost nobody used the privacy-enhancing transaction type. The same goes for Dash and it's DarkSend, or Shadow's ring-signature side-currency - all virtually unused.

Thus X grows at a rate that is useless for its intended purpose: getting lost in the dust of millions of others.

But to make matters worse, ZCash is grossly irresponsible by not making private transactions mandatory, as people will use t-address transactions and think they're safe. Pools pay out to t-addresses, exchanges only accept t-address deposits, and lightweight clients will all end up being t-address only as it's the quick win.

Claiming that it's "just an experiment" is not acceptable when people's money is on the line, at best, and where their lives might hang in the balance, at worst. The disgusting and dangerous approach taken by the for-profit US company behind ZCash, that of fast-tracking the launch of massively immature technology due to investor pressure, is something that should lead to grave consequences for them because of the nature of this technology.

I greatly respect the work of Ben-Sasson, Green, Garman, Miers, et. al., but even they have been complicit in the rush hack-job that is ZCash. We would do well to consider what advantage a nation state attacker would have in encouraging adoption of this immature and likely broken system, over alternatives that are FOSS and have prolific contributor communities.

What you're talking about has already been covered in research by the Monero Research Lab: https://lab.getmonero.org/pubs/MRL-0001.pdf and https://lab.getmonero.org/pubs/MRL-0004.pdf

Basically, unless you own 80% of the outputs on the blockchain you don't have enough to identify subsequent transactions, so any foothold you gain in owning outputs becomes rapidly weaker. Given the cost of owning 80% of the blockchain outputs, it's not an attack that is particularly effective even at Monero's current state of usage.

Individuals who publish their input history won't make any significant difference.

Then rushing the launch in the absence of a superior MPC protocol is just a bad idea.

Except that they had to rush the launch because they're a for-profit, centralised company, with investors that are demanding return on their investment. Thus they went with a shoddy, half-baked attempt at a trusted setup, with a whole lot of hand-waving to make it seem like it was done securely.

Linking to that GitHub issue is pretty embarrassing for you. Not only can it not be practically exploited, per the author of that issue, but it looks like it's just using Keccak as a stream cipher of sorts (but seeding it from /dev/urandom). That's pretty ok, and if we don't trust stream ciphers to produce pseudorandom numbers we have much bigger issues.

But more importantly, the contributors acknowledged the issue, and are fixing it. Do you honestly expect bug free open-source development? No, and the entire benefit of it being a welcoming open-source development community (instead of ZCash's centralised development team) is that it is made better by many eyes. Hopefully the OP that opened that issue spends some more time reviewing the code along with the 160+ Monero contributors.

Also, if we're going to view lapses like these as representative of a major failure, you'd best review some of ZCash's greatest hits, maybe starting with the fact that wallet encryption is ENTIRELY DISABLED in ZCash, and your wallets are stored in the clear and ready for malware to steal: https://github.com/zcash/zcash/issues/1552

- https://github.com/zcash/zcash/issues/713 <- this one is particularly stupid, and shows a gross misunderstanding of how Bitcoin works

- https://github.com/zcash/zcash/issues/1304

- https://github.com/zcash/zcash/issues/1522

- https://github.com/zcash/zcash/issues/1779 <- literally, they had ONE JOB for the release, how did they fail at that?

- https://github.com/zcash/zcash/commit/f8ada2435bd3f6b7a1165e... <- oh that's right, they failed at the one thing they had to do because they were focused on other...uhhh...important stuff

And let's not forget the massive attack surface that ZCash has, which leads to fun things like this:

- https://github.com/zcash/zcash/issues/98

- https://github.com/zcash/zcash/issues/178

How will they pump the ZCash scam if they do?

You're almost there, but not quite.

Since Monero outputs go to dual-key stealth addresses, outputs are effectively paid to a random 256-bit "address". So if you use a mixin of 50, in a transaction with 1 input, an external observer can say "this illicit transaction spends funds from 1 of 50 possible transactions", but then you need to go to those 50 and work your way back till eventually you find a needle, in a very large haystack, that you can actually identify.

Because of this, the anonymityset grows exponentially the further up the tx chain from an identifiable transaction (eg. a withdrawal from a KYC / AML exchange) you are.

The major advantage here is that every Monero transaction adds to this anonymityset, since privacy is compulsory.

On the other hand, ZCash's privacy is nearly unusable. Using it requires 8gb+ of RAM, and takes over a minute on a Xeon processor. Because of its unusability you end up being "1 of X people", where X is very tiny - it's limited to the people moving from traceable addresses to z-addresses who haven't identifiably moved ~the same amount out.

ZCash is useless at best, dangerous privacy theatre at worst.

You can do that with Monero right now (within a cryptographically negligible, but plausibly deniable, risk) and it doesn't require crazy unreliable cryptography, a (badly done) trusted setup, or 8gb+ of RAM and 60 seconds on a Xeon.

Sergio's a great guy, but he does NOT understand the mechanics behind SNARKS "very well". You're overestimating his grasp of the moon-math in SNARKS.

Values can't be known, after the RingCT hard fork. See: https://lab.getmonero.org/pubs/MRL-0005.pdf

As I recall, it's been mining Monero for over 2 years. Reports of it in malware go back to 2014!

I wonder if they could be sued for that:-P

Just chiming in here: Kovri is still a work in progress, and there is still some work to be done before it can be used more broadly or as a replacement for the Java router: https://github.com/monero-project/kovri

Surely this is better suited to ZMTP than 0MQ?

Some of the Monero Kovri developers are known, public people, there's no problem with that at all if you choose to be public. There's really no longer as much of a stigma for people who are working on privacy projects:)

Monero has got an I2P router in C++ as one of their projects: https://github.com/monero-project/kovri

If you want some general information on Monero then this is a good talk on Bitcoin privacy and on what Monero is and does: https://www.youtube.com/watch?v=YVlQE-ObEXk

Unsurprisingly, there exists research by the Monero Research Lab highlighting temporal association attacks and other possibilities.

https://lab.getmonero.org/pubs/MRL-0001.pdf https://lab.getmonero.org/pubs/MRL-0004.pdf

As to your last statement: even if the supposition is that the true signer is the most recent output on the blockchain, that is nothing but an unprovable supposition, which means that Monero enables plausible deniability at the very least.

Since transactions are both unlinkable (for any two outgoing transactions it is impossible to prove they were sent to the same person) and untraceable (for each incoming transaction all possible senders are equiprobable) the anonymityset continues to grow, which makes the privacy risk cryptographically negligible.

Fair enough, I retract my name-calling.