plasticmachine

That's fair enough, but consider that SakiWatanabe's comment is equally uncivil and insulting to an open-source project and the contributors that have built it. Why is that allowed, but when I call that person out I get SJW safe-space thrown at me? Don't you think that is hypocritical as a moderation strategy?

I don't understand your terminology. What do you mean "mix 1000 coins together", and what is the use-case there?

You can't be serious. It's using libsodium in one part of the code, so therefore ALL cryptography uses libsodium? You do know that Bitcoin has already switched most of the secp256k1 stuff away from OpenSSL and to libsecp256k1, and ZCash will follow suit?

But more importantly than that it uses libsnark for the actual clever bits, which has already been critically broken[1] precisely because it is so new and poorly tested.

Even the cryptography in ZeroCash/ZeroCoin is too new to be trusted with a financial system. That is not alarmist, that is practical. Relying on old, established cryptography is precisely why Bitcoin hasn't been trivially broken, and the zk-snarks cryptography will need to go through the same peer-review and refinement process over the next decade or two.

[1] https://leastauthority.com/blog/a_bug_in_libsnark.html

This is an utterly stupid comment. If you read an article that slammed MongoDB's eventual consistency and encouraged people to use mysql instead would you call it a "mysql pump?

This is also not the first time someone has smacked down ZCash for being ill-conceived and dangerous: https://blog.okturtles.com/2016/03/the-zcash-catch/

Stealth addresses aren't nearly enough. It needs to be mandatory stealth addresses + some sort of mandatory passive mixing that can't be Sybil attacked + Confidential Transactions. At a minimum.

On further consideration I agree with you. Knowledge of the accumulator would merely allow for the arbitrary creation of forged spends that appear valid, but the rest of the system would still remain opaque (much to its detriment in this instance).

Also there is nothing so suggest that a clever MPC will solve the collusion problem. Of course the participants will make claims about their honesty, but if ZeroCoin is worth massive amounts of money the temptation to seek collusion will be there.

Of course, whilst it's true that some participants might stick to their proverbial guns, what is going to prevent a motivated state-level attacker from monitoring as many participants as they can during the computation? Then they only need to compromise the handful that they couldn't monitor, and for that they have rubberhose cryptanalysis.

The point you're actually trying to make is "every privacy scheme has trade-offs".

Zerocoin's trade-offs are massive: untested / unreviewed cryptography, a trusted initial accumulator that can ruin the anonymity for everyone forever, a significantly larger transaction size, and a blockchain so opaque that double-spends and false coin creation cannot be seen.

Those are the issues that matter, and Monero suffers from none of those problems.