00:13:15 DougieBot5000 has quit 00:34:54 nomailing has quit 00:57:15 Emcy_ has joined #bitcoin-wizards 00:57:50 Emcy has quit 01:05:24 go1111111 has joined #bitcoin-wizards 02:04:29 Baz has joined #bitcoin-wizards 02:53:03 jtimon has quit 03:50:09 Been talking about people getting scammed in another channel (geesh, some scammer on the forum just got 200 btc from a single person!) Posted this: https://bitcointalk.org/index.php?topic=398041.0 " 03:50:13 Cryptographically private loan risk management " 05:03:40 justanotheruser has quit 05:19:49 justanotheruser has joined #bitcoin-wizards 05:24:13 justanotheruser has quit 05:30:14 mappum_ has joined #bitcoin-wizards 05:33:15 mappum has quit 05:39:04 justanotheruser has joined #bitcoin-wizards 05:39:07 justanotheruser has quit 05:39:08 justanotheruser has joined #bitcoin-wizards 06:14:26 justanotheruser1 has joined #bitcoin-wizards 06:15:20 justanotheruser has quit 06:18:18 justanotheruser has joined #bitcoin-wizards 06:19:42 justanotheruser1 has quit 06:22:48 justanotheruser has quit 06:23:02 justanotheruser has joined #bitcoin-wizards 06:25:35 gmaxwell: why can't alice just sybil that? 06:25:54 if she wants to borrow more than her lenders want, just restart with a new tree 06:28:30 or better, have a new tree for each lender -- then they all see a proof that their entry was added, and each sees only their own total 06:30:51 justanotheruser has quit 06:30:51 justanotheruser has joined #bitcoin-wizards 06:32:04 andytoshi: note the first line— assumption is that the reputation system is already preventing that. 06:32:23 oh, derp, i read right through that 06:32:54 andytoshi: a common pattern we see on otc and bitcoin talk is that someone starts an account and makes boring breakeven trades for a year, gradually increasing the amounts, and then does tons of large loans all at once. 06:32:56 the line "she publishes the root hash and the proofs in the rep system" 06:33:55 andytoshi: example https://bitcointalk.org/index.php?topic=393593.msg4274997#msg4274997 (thats just one post in a six page thread of people who were ripped off) 06:35:06 suggestions that people publish their loan amounts in OTC in the ratings list have generally been met with unwelcome sounds wrt privacy... though people do it sometimes, esp for smaller amounts with newer traders. 06:35:20 justanotheruser has quit 06:35:36 ok, i see now, this is really cool .. i think it has the highest usefulness/computational hardness ratio of anything you've posted involving zk proofs 06:35:54 yes, also ... implementable outside of bitcoin. 06:36:19 (Any idea where step 1 is change bitcoin ... is just a lot harder to do, regardless of the details) 06:36:43 i'm going to go post this in #coindev and see if anybody wants to implement it.. 06:37:41 also, since it involve loss of currency, the CRS-assumption ZKP systems (where you trust that some key creator has thrown away a master key) aren't so bad. 06:38:08 e.g. you're trusting someone to not have kept data that would allow them to make fake loan accumulators. whoptiedo. 06:38:10 i wonder if there's a stronger/simpler zk proof system for updating merkle trees like this 06:38:21 which maybe doesn't work for general computations 06:38:55 maybe, though as soon as you need proofs for bitcoin thats right out. 06:40:37 I suppose this is why the credit agencies ding you for hard pulls. 06:40:50 in any case, proving a very simple function like this should actually be quite realistic, e.g. cpu time of tens of seconds. 06:41:15 warren: hah you could actually make number of proofs a metric that it tracks and extracts. 06:41:35 (e.g. to do a proof for someone they give you nonce, which you must insert into a pulls counter tree.) 06:42:19 it's not quite so cheap that my trivial NIZK would be useful, I expect. 06:42:35 but I guess I should go count how many AND-gates sha256 has. 07:09:21 <_ingsoc> _ingsoc has joined #bitcoin-wizards 07:24:12 justanotheruser has joined #bitcoin-wizards 07:27:07 fluidjax has joined #bitcoin-wizards 07:35:20 <_ingsoc> _ingsoc has quit 07:40:46 justanotheruser has quit 07:52:28 wumpus has joined #bitcoin-wizards 08:25:26 justanotheruser has joined #bitcoin-wizards 09:12:58 MoALTz has quit 09:12:58 FYF has quit 09:13:00 iddo has quit 09:13:04 tucenaber has quit 09:13:05 forrestv has quit 09:13:05 Sangheil- has quit 09:13:05 deepc0re_ has quit 09:13:06 gmaxwell has quit 09:13:07 jarpiain has quit 09:13:09 adam3us has quit 09:13:10 gribble has quit 09:13:11 Hunger- has quit 09:13:13 kyrio has quit 09:13:16 hno has quit 09:13:17 edulix_ has quit 09:13:19 HM2 has quit 09:13:21 Graet has quit 09:13:21 michagogo|cloud has quit 09:13:23 warren has quit 09:13:24 wumpus has quit 09:13:24 nessence has quit 09:13:26 Alanius has quit 09:13:26 sipa has quit 09:13:26 helo has quit 09:13:27 lianj has quit 09:13:28 Ryan52 has quit 09:13:31 realazthat has quit 09:13:31 Krellan has quit 09:13:31 jrmithdobbs has quit 09:13:32 trn has quit 09:13:32 cfields has quit 09:13:33 justanotheruser has quit 09:13:34 blitzed has quit 09:13:35 K1773R has quit 09:13:35 espes__ has quit 09:13:35 kinlo has quit 09:13:36 amiller has quit 09:13:36 epscy has quit 09:13:38 wangbus has quit 09:13:39 rs0 has quit 09:13:40 fluidjax has quit 09:13:40 go1111111 has quit 09:13:41 harrow has quit 09:13:43 maaku has quit 09:13:43 petertodd has quit 09:13:45 Fistful_of_Coins has quit 09:13:46 typex has quit 09:13:47 pigeons has quit 09:13:47 UukGoblin has quit 09:13:47 nanotube has quit 09:13:47 CodeShark has quit 09:13:48 Muis has quit 09:13:48 OneFixt has quit 09:13:48 azariah4 has quit 09:13:49 EasyAt has quit 09:13:49 mappum_ has quit 09:13:49 hnz has quit 09:13:49 andytoshi has quit 09:13:49 Luke-Jr has quit 09:13:50 Mikalv has quit 09:13:50 ChanServ has quit 09:13:51 Baz has quit 09:13:51 Emcy_ has quit 09:13:51 nsh has quit 09:13:51 nOgAn0o has quit 09:13:51 BlueMatt has quit 09:13:51 Dylan_ has quit 09:13:51 jgarzik has quit 09:13:53 midnightmagic has quit 09:29:15 Mikalv has joined #bitcoin-wizards 09:29:15 andytoshi has joined #bitcoin-wizards 09:29:15 hnz has joined #bitcoin-wizards 09:29:15 mappum_ has joined #bitcoin-wizards 09:29:15 jarpiain has joined #bitcoin-wizards 09:29:15 gmaxwell has joined #bitcoin-wizards 09:29:15 deepc0re_ has joined #bitcoin-wizards 09:29:15 Sangheil- has joined #bitcoin-wizards 09:29:15 forrestv has joined #bitcoin-wizards 09:29:15 tucenaber has joined #bitcoin-wizards 09:29:15 tholenst has joined #bitcoin-wizards 09:29:15 nsh has joined #bitcoin-wizards 09:29:15 midnightmagic has joined #bitcoin-wizards 09:29:15 jgarzik has joined #bitcoin-wizards 09:29:15 Dylan_ has joined #bitcoin-wizards 09:29:15 BlueMatt has joined #bitcoin-wizards 09:29:15 nOgAn0o has joined #bitcoin-wizards 09:29:15 Emcy_ has joined #bitcoin-wizards 09:29:15 Baz has joined #bitcoin-wizards 09:29:15 adam3us has joined #bitcoin-wizards 09:30:06 rs0 has joined #bitcoin-wizards 09:30:06 wangbus has joined #bitcoin-wizards 09:30:06 Hunger- has joined #bitcoin-wizards 09:30:06 wumpus has joined #bitcoin-wizards 09:30:06 nessence has joined #bitcoin-wizards 09:30:06 Graet has joined #bitcoin-wizards 09:30:06 michagogo|cloud has joined #bitcoin-wizards 09:30:06 edulix_ has joined #bitcoin-wizards 09:30:06 realazthat has joined #bitcoin-wizards 09:30:06 Krellan has joined #bitcoin-wizards 09:30:06 jrmithdobbs has joined #bitcoin-wizards 09:30:06 warren has joined #bitcoin-wizards 09:30:06 sipa has joined #bitcoin-wizards 09:30:06 Alanius has joined #bitcoin-wizards 09:30:06 helo has joined #bitcoin-wizards 09:30:06 trn has joined #bitcoin-wizards 09:30:06 lianj has joined #bitcoin-wizards 09:30:06 cfields has joined #bitcoin-wizards 09:30:06 Ryan52 has joined #bitcoin-wizards 09:30:06 HM2 has joined #bitcoin-wizards 09:30:23 luke-jr_ has joined #bitcoin-wizards 09:30:24 MoALTz has joined #bitcoin-wizards 09:30:24 FYF has joined #bitcoin-wizards 09:30:24 iddo has joined #bitcoin-wizards 09:30:26 kyrio has joined #bitcoin-wizards 09:30:26 hno has joined #bitcoin-wizards 09:30:36 CodeShark has joined #bitcoin-wizards 09:30:36 Muis has joined #bitcoin-wizards 09:30:36 azariah4 has joined #bitcoin-wizards 09:30:36 EasyAt has joined #bitcoin-wizards 09:30:43 <_ingsoc> _ingsoc has joined #bitcoin-wizards 09:30:43 fluidjax has joined #bitcoin-wizards 09:30:43 go1111111 has joined #bitcoin-wizards 09:30:43 harrow has joined #bitcoin-wizards 09:30:43 maaku has joined #bitcoin-wizards 09:30:43 petertodd has joined #bitcoin-wizards 09:34:30 luke-jr_ has quit 09:44:13 justanotheruser has joined #bitcoin-wizards 09:44:13 blitzed has joined #bitcoin-wizards 09:44:13 K1773R has joined #bitcoin-wizards 09:44:13 espes__ has joined #bitcoin-wizards 09:44:13 kinlo has joined #bitcoin-wizards 09:44:13 amiller has joined #bitcoin-wizards 09:44:13 epscy has joined #bitcoin-wizards 09:53:35 ChanServ has joined #bitcoin-wizards 09:53:36 Fistful_of_Coins has joined #bitcoin-wizards 09:53:36 typex has joined #bitcoin-wizards 09:53:36 pigeons has joined #bitcoin-wizards 09:53:36 UukGoblin has joined #bitcoin-wizards 09:53:36 nanotube has joined #bitcoin-wizards 09:54:23 UukGoblin has quit 09:54:33 HobGoblin has joined #bitcoin-wizards 09:55:04 <_ingsoc> _ingsoc is now known as Guest26930 09:55:22 HobGoblin is now known as Guest9007 10:02:50 gribble has joined #bitcoin-wizards 10:06:50 luke-jr_ has joined #bitcoin-wizards 10:09:06 MoALTz_ has joined #bitcoin-wizards 10:10:34 nsh has quit 10:11:57 Guest26930 has quit 10:12:14 MoALTz has quit 10:13:19 <_ingsoc> _ingsoc has joined #bitcoin-wizards 10:21:28 justanotheruser has quit 10:30:56 nsh has joined #bitcoin-wizards 10:31:16 nsh has quit 10:31:16 nsh has joined #bitcoin-wizards 10:32:05 <_ingsoc> _ingsoc has quit 10:33:24 <_ingsoc> _ingsoc has joined #bitcoin-wizards 10:36:54 OneFixt has joined #bitcoin-wizards 10:51:26 <_ingsoc> _ingsoc has quit 10:52:37 amiller has quit 10:53:02 <_ingsoc> _ingsoc has joined #bitcoin-wizards 10:55:26 amiller_ has joined #bitcoin-wizards 10:56:36 mappum_ has quit 10:59:10 <_ingsoc> _ingsoc has quit 11:01:45 <_ingsoc> _ingsoc has joined #bitcoin-wizards 11:06:31 <_ingsoc> _ingsoc has quit 11:07:22 <_ingsoc> _ingsoc has joined #bitcoin-wizards 11:07:31 justanotheruser has joined #bitcoin-wizards 11:07:38 <_ingsoc> _ingsoc is now known as Guest57212 11:12:25 Guest57212 has quit 11:18:14 <_ingsoc_> _ingsoc_ has joined #bitcoin-wizards 11:20:38 FYF has quit 11:41:18 brisque has joined #bitcoin-wizards 11:49:39 happy new year, wizards :) 11:49:51 <_ingsoc_> _ingsoc_ has quit 11:49:59 fluidjax has left #bitcoin-wizards 11:51:14 <_ingsoc_> _ingsoc_ has joined #bitcoin-wizards 12:28:14 nomailing has joined #bitcoin-wizards 13:02:52 <_ingsoc_> _ingsoc_ has quit 13:04:33 nomailing has quit 13:11:15 brisque has quit 14:22:38 justanotheruser has quit 14:23:39 grau has joined #bitcoin-wizards 14:27:37 <_ingsoc> _ingsoc has joined #bitcoin-wizards 14:29:15 ChanServ has quit 14:29:42 ChanServ has joined #bitcoin-wizards 14:44:04 nomailing has joined #bitcoin-wizards 14:49:16 <_ingsoc> _ingsoc has quit 14:51:38 adam3us has quit 14:53:58 <_ingsoc> _ingsoc has joined #bitcoin-wizards 14:56:32 jtimon has joined #bitcoin-wizards 14:57:53 https://bitcointalk.org/index.php?topic=396991.0 15:06:56 MoALTz_ has quit 15:07:13 MoALTz has joined #bitcoin-wizards 15:08:38 24 coins built there already... 15:08:49 and that's not even counting the ones which prefer to remain private 15:09:48 Guest9007 has quit 15:09:48 Guest9007 has joined #bitcoin-wizards 15:09:55 Guest9007 is now known as UukGoblin 15:10:26 * nsh considers a "proof of quality" based blockchain 15:10:49 difficult, all involve voting i suppose 15:11:16 e.g. new block whenever someone comes up with a joke that is considered funnier by >75% of people 15:13:45 justanotheruser has joined #bitcoin-wizards 15:16:29 The new scip paper http://eprint.iacr.org/2013/879 seems promising, but they still don't give a download link 15:22:54 spinza has joined #bitcoin-wizards 15:30:47 hmm, ty 15:32:41 How long does verification of a ECSDA signature take? 15:34:03 depends on the library, etc. 15:34:11 (and scheme) 15:34:14 justanotheruser1 has joined #bitcoin-wizards 15:34:21 justanotheruser has quit 15:34:45 justanotheruser1 has quit 15:34:45 justanotheruser1 has joined #bitcoin-wizards 15:35:46 -- 15:35:46 Wow, it's great. 15:35:46 187us versus OpenSSL's 1008us, on my test laptop. 15:36:04 -- sipa's implementation of sepk256k1, last July 15:36:07 https://bitcointalk.org/index.php?topic=236477.0 15:38:34 So they talk of 5ms verification time for a program, but that's not on a lapt, so one would probably have to verify a few hundred signatures -- but they only run their program for 32'000 instructions, so it doens't seem quite useful for signature verification yet 15:39:42 also they talk of a 16 bit machine... 15:48:33 justanotheruser has joined #bitcoin-wizards 15:49:01 justanotheruser1 has quit 15:50:16 justanotheruser1 has joined #bitcoin-wizards 15:50:43 <_ingsoc> _ingsoc has quit 15:51:12 <_ingsoc> _ingsoc has joined #bitcoin-wizards 15:53:19 justanotheruser has quit 15:59:47 Dylan_ has quit 15:59:55 Hunger- has quit 16:03:51 adam3us has joined #bitcoin-wizards 16:36:08 justanotheruser has joined #bitcoin-wizards 16:40:17 justanotheruser1 has quit 16:41:14 justanotheruser has quit 16:41:15 justanotheruser1 has joined #bitcoin-wizards 16:45:25 justanotheruser1 has quit 16:47:51 <_ingsoc> _ingsoc has quit 16:48:21 <_ingsoc> _ingsoc has joined #bitcoin-wizards 16:53:16 spinza_ has joined #bitcoin-wizards 16:53:16 spinza has quit 17:04:09 luke-jr_ is now known as Luke-Jr 17:06:04 oh my god, the comments on BlueMatt's altgen thread.. 17:09:56 always wear appropriate protective eyewear. do not stare directly at derp 17:10:29 andytoshi: on bct? 17:10:58 adam3us: yeah, https://bitcointalk.org/index.php?topic=396991.0 -- jtimon posted it a few hours ago 17:13:19 andytoshi: lol 'bulk discounts' etc 17:13:38 yeah, this was hilariously absurd: https://bitcointalk.org/index.php?topic=398272.0 17:14:25 "We will hard fork you out, then we will have to continue with GPU without you." (imagines set to all your base graphics...) 17:17:05 or 17:17:26 It's awesome. It essentially says: "If you give me money, that'll help me to fraud people!" 17:17:35 there's reductio ad absurdum and then there's straight out building a highway to absurdity. 17:24:03 justanotheruser has joined #bitcoin-wizards 17:28:31 justanotheruser has quit 17:30:33 hehe highway to absurdity... 17:40:30 "Yes, it works fine and you do not end up on the wrong chain as long as you have a different network packet magic - as your node will never peer with another node with a different magic." 17:40:32 hahaha 17:48:03 Hunger- has joined #bitcoin-wizards 18:25:21 justanotheruser has joined #bitcoin-wizards 18:59:12 does anyone know if any of the results have been launched on the alts subforum already? 19:26:01 nsh: can I quote you? [17:17:31] there's reductio ad absurdum and then there's straight out building a highway to absurdity. 19:26:11 (I already did, but I forgot to ask first..) 19:27:04 sure 19:27:05 :) 19:27:42 thx 19:31:27 "hello, is there a way to set a permanent change address?" 19:31:31 why do I get these PMs now? 19:32:44 * Luke-Jr replies "No, because that would be broken and stupid." 19:41:59 tholenst has quit 20:01:10 nomailing has quit 20:11:56 edulix_ has quit 20:12:16 edulix has joined #bitcoin-wizards 20:13:04 edulix is now known as Edulix 20:16:33 ghtdak has joined #bitcoin-wizards 20:44:24 <_ingsoc> Does anyone mess around with Go? 20:45:37 tholenst: their scaling is nearly linear, so you can scale up the cycle count. Also, 32000 instructions is enough to do hash based signing. In any case, the tinyram stuff is always going to be less efficient (by ... 10 to 1000 fold) than direct circuits specialized for the task at hand. 20:58:17 tinyram is just a didactic model though. there's no reason you couldn't adapt it to specialized problems 20:58:25 (that i can think of, at least) 21:00:41 nsh: well kinda, there are ways of using this stuff where you want the circuit under evaluation to be a constant thing. 21:01:02 mmm 21:01:12 and with tinyram you could make it constant (or at least constant up to some execution length) and the hash of the program being run is just a public input. 21:01:41 so it really can be useful to have a fully generic circuit. 21:01:46 * nsh nods 21:03:12 you could, of course, add extra instructions. e.g. for our applications a SHA256 operator would be super useful. 21:03:18 tholenst has joined #bitcoin-wizards 21:03:38 hmm, good point 21:05:13 gmaxwell: yes, i know... i was trying to get a grasp of whether it would be useful for example just to batch all signature verifications... but I found it difficult to assess. Would be nice if there was an implementation available 21:06:07 hnz has quit 21:06:32 tholenst: yea, I don't know why they haven't made it available. They're using the same backend math as pinocchio, so you could look that up. 21:06:51 I could just ask them :) 21:07:12 tholenst: IIRC only a few of the pairing operators are input specific, as I recall. 21:07:22 So I think that if your circut is constant you can precompute a fair bit. 21:08:06 (A few, being like two pairing operations I think) 21:08:12 i don't acutally have a specific application in mind... 21:10:29 hnz has joined #bitcoin-wizards 21:11:08 I was thinking more about extending the scripting language recently anyhow :) 21:12:03 spinza_ has quit 21:12:04 It should be like this: if you have a reserved opcode in the pubkey script, the script should automatically accept no matter what happened before. 21:14:04 tholenst: well it's not. Its easy to build extensions that work like that anyways. 21:14:33 e.g. just different OP_EVALs for new P2SHes that make transactions look hashlocked to the old nodes. 21:16:42 jtimon has quit 21:16:43 do you mean exactly the same as P2SH, but a different op-code instead of OP_HASH? 21:16:54 i don't see right now how you mean that 21:18:20 tempting to revise Script in a P2SH^2 21:21:10 tholenst: effectively. 21:22:28 oh i see -- you can just take one which is effectively a NOP now 21:25:59 spinza has joined #bitcoin-wizards 21:26:47 <_ingsoc> _ingsoc has left #bitcoin-wizards 21:33:47 spinza has quit 21:47:29 btw i was thinking more about what it would need in scripting to implement the idea that you can have deposits for your transactions; i.e., if you double spend you lose money 21:47:39 i think it's reasonable 21:51:24 that implies scriots can access state outside of the chain they operate on 21:51:35 which is extremely jard to get right, i think 21:51:48 scripts, hard 21:51:58 no 21:52:01 i don't need thta 21:52:16 double spends don't exist within one chain 21:52:35 if you're even using that word, it implies you're observing other state 21:53:14 tholenst: double spending is not detectable technically really 21:53:32 two signed transactions spending the same coin, is not necessarily "double spending" 21:53:43 it can occur in legitimate circumstances too 21:53:44 well, the idea is different: I give you a transaction which essentially says: "If you find messages m_1 != m_2, signed with SecretKeyA, then you can have this money here" 21:53:59 ah! 21:54:18 you'd need some higher order construxt in transactions 21:54:35 but indeed, that doean't require access to other data 21:54:49 yes, you need improved scripting, but it suffices to look at the chain 21:54:50 hrmmm 21:54:52 just means you need to embed the two different spending transactions inside your script 21:54:53 interesting idea 21:55:03 no it does not suffice to look at the chain 21:55:16 within the chain double spends are impossible already 21:55:18 Luke; I know that; a bit more work is necessary for that 21:55:38 no you just need to embed the two signatures in the script; I can do that 21:55:57 right, indeed 21:56:07 the chain will get two signatures, from the same secret key, which I assemble from the double spend; thus, the scripting doesn't look outside the chain 21:56:18 yup 21:56:44 but you need some meta construct 21:57:03 where you embed the two previous conflicting signatures as proof that a double spend existed 21:57:09 which is possible and sane 21:57:14 but doesn't exist currently 21:57:31 actually, until here you don't need so much; you only need to be able to call ECDSA_CHECKSIG directly, and then you can do it similar to detecting a SHA256 collision 21:57:34 (i'm also not convinced about the usefulness, but that's another matter) 21:58:56 but -- the problem is that the money which is supposed to back your transaction might be gone once you detect the double spend. For this you need more, and weirder opcodes 21:59:48 well if it's gone, it's gone 22:00:16 going beyond the basic rule of "a coin can only be spent once" is dark magic 22:00:29 i adhere to that basic rule 22:01:17 the basic idea is: if you spend a "backing coin", you can only spend it in such a way that for the next... say 100 blocks, it still remains a backing coin 22:01:45 and only after that it can become a usual coin 22:02:59 mhmm... dark magic :) 22:03:35 i don't think there's anything dark there 22:03:35 (not impossible, and not necessarily a problem, but i think the consequences become horrible to reason about) 22:04:04 no, why? will you be happy if i give a proof of some good properties? 22:04:13 no need to convince me :) 22:04:22 it's just interesting to think about 22:04:45 i seriously think it would be a good idea to have it implemented 22:04:53 as in it means the the spending transaction, as long as the backing coin that can spend from under it, even confirmed, is not actually spendable 22:05:11 or at least, losing fungibility 22:05:24 (those coins would be worth less than other coins) 22:05:32 as they're less certain 22:05:37 no, you can move them back to normal coins, it just takes 100 blocks 22:05:45 so 22:06:07 you pay me, by spending coins C1, and sending me a coin C2 22:06:15 so wait, we get complete anarchy with a BBC broadcast-loop that removes all the vulgarity and orgies? 22:06:16 as long as C2 is buried less than 100 blocks deep 22:06:33 C1 persists in some form 22:06:38 no no, I don't send you coin C2; I send you C1, and if I double spend C1, you get to destroy C2 22:06:55 C1 belongs to you, it's the original coin you had 22:07:06 there's nothing special with it, and it's buried 10000 blocks deep 22:07:09 I own both C1 and C2 22:07:20 wait, what? 22:07:25 i'm not following 22:08:00 the idea is: in order to pay you with C1, i need to back up the payment with C2. C2 has a different PKScript, which makes it a "backing coin" 22:08:26 wait, let's talk about transactions instead 22:08:40 you create a transaction which spends C1, and what else? 22:08:40 ok coin = txout 22:08:43 yeah 22:09:37 I give you a PubKey2-signature of "If you find 2 PK-1 signed messages you may destroy the txout C2" 22:10:09 "PK-1 signed" is supposed to mean "signed with the same key as C1 is" 22:17:59 ok, and C2 needs to be a special invalid-for-100-blocks output? 22:18:23 it'd be neat if you could mark outputs as "cannot be spent with fewer than N confirms" 22:18:24 yes 22:19:05 this is cool, i definitely think it changes coin properties too much to be bolted into bitcoin, but istm that it makes sense 22:20:18 istm? 22:20:20 as sipa says, there are cases when a "double spend" is a legitimate thing to occur, so these would need to be special transactions 22:20:23 it seems to me 22:21:16 yeah one has to be careful with it; note though that if you can wait a bit (100 blocks) with the double spend, you can first move C2 22:22:01 yeah, the receiver of the funds would estimate how long the tx will take to confirm, and require C2 have that many "cannot spent until" ticks left 22:22:31 anyhow, I plan to write a detailed proposal... I think it's worth it even if it doesn't go into bitcoin. it would finally be some real selling point for an altcoin, imo 22:23:06 that'd be great 22:23:20 if you can, explore the consequences re fungibility of locking coins like this 22:23:49 can you elaborate what you mean by that? 22:24:09 well, if some coins can be spent quickly and others can't, the quick-spendable ones are more useful 22:24:10 we need an playpit/sandbox for alt-experimentation 22:24:26 so rather than "a coin is a coin is a coin" different coins might have different values 22:24:43 otoh if they are locked in place, it's hard to claim they have any value, so maybe it's fine 22:24:54 nsh: perhaps BlueMatt's thing will give that to us :} 22:25:52 mm, unfortunately as stands it only changes the (mostly) boring things 22:26:06 well, you just need 100 blocks to get the backing coins back into normal coins; that's not even a day wait. 22:26:21 sure, but given that's apparently popular, i'm sure if you gave BlueMatt a patch he'd inject it into the alts for a few days 22:26:28 it seems people are already fascinated by BlueMatt's thing :) 22:26:29 haha 22:26:49 i suppose there's no shortage of volunteer test subjects 22:27:13 tholenst: ok, another thing to think about is what happens if there is a reorg, and the block at which the coin becomes normal changes 22:27:15 quick, before we end up with ethics panel! 22:27:28 good point 22:27:56 yes, ok 22:28:22 nsh: people releasing cryptographic software without understanding it, and then goading people into putting money into them, are evil, there's no ethical concern in fucking with them 22:28:59 * nsh smiles 22:30:08 grau has quit 22:30:37 andytoshi: evil is evil, even if the victim is guilty of evil things themselves 22:31:31 Luke-Jr: fair enough 22:31:56 tholenst: so, my specific concern is: suppose a coin becomes valid at block 300000, then i spend it in the next block 22:32:08 some reorg happens and now the coin becomes valid at block 300005 22:32:12 what happens to my spend? 22:32:33 if the coin creation is reorganized, the spending of it is certainly reorganized too! 22:32:49 maybe bad things? but for that a 100 block reorg needs to happen, and then bad thing happen anyhow 22:32:55 sipa: that's my thought, yeah, but it makes reorgs more complicated 22:33:08 i doubt it 22:33:13 andytoshi: well, as long as they use the power of argument and not of coercion, I'm not sure "evil" is the right word 22:33:23 let's not go there 22:33:27 +1 22:33:43 andytoshi: if everything is defined within one chain, there should be no problem with reorganizations 22:33:57 but i'm not sufficiently understanding the scheme 22:34:27 well, i spend something at block 300000, but suppose suddenly it is invalid until block 300500 (this is an extreme case) 22:34:50 so suddenly my payment is invalid, and i have a window in which to double-spend 22:34:50 that cannot happen without invalidating the spend as well 22:34:56 as the spend happens after the creation 22:35:05 ah 22:35:41 yeah, so this complicates analysis and i think also has consequences for fungibility of recently-valid coins 22:36:09 I am not sure i understand your problem. Do you agree this only happens if the reorg is something like 100 blocks deep? 22:36:11 but i also suspect this is fixable while still retaining the benefits of tholenst's trickery 22:36:29 tholenst: yeah, it'd have to be deeper than the coin's invalid-until-N-blocks count 22:36:44 so maybe we could require all transactions which do this to have N higher than 100 22:37:12 ok, i didn't think too much about that yet. 22:37:18 or maybe, rather than saying "invalid until 100 confirms" you say "invalid until block 300000" and hardcode the 300000 22:37:30 then you don't care about when the tx is actually mined, so there is no concern about reorgs 22:37:55 you could do that, but then you have to renew the backing txouts periodically; I don't like that 22:38:23 well, you'd have to do this anyway i think 22:39:03 I think it makes sense at this point if I write down the proposal in more detail. 22:39:32 <_ingsoc> _ingsoc has joined #bitcoin-wizards 22:39:37 yeah, it'd be good to have something precise to discuss 22:41:05 the input was useful to me anyhow :) more to think about, ty! 22:41:21 what's the distribution of reorg heights? 22:41:51 any theoretical basis for calculating that, or is it near-enough empirical? 22:42:05 s/heights/depths/ 22:43:52 for a theoretical basis, you need to have some kind of clue how fast the block distributes among the miners 22:43:56 nsh: (a) hard to make precise, as generally only part of the network perceives a reorg as a reorg, while the rest of them saw the winning chain first, (b) the big ones occur by implementation bugs, which are hard to predict, (c) the small ones probably are also due to network flukes which are also hard to predict, thought they might have a nice distribution since they're frequent 22:44:30 * nsh nods 22:44:45 but it should be possible to put a 100-block reorg into an improbability bracket 22:46:25 agreed, using only mild assumptions that should be possible 22:58:29 <_ingsoc> _ingsoc has quit 23:13:22 tholenst has quit 23:21:33 MoALTz has quit 23:27:20 nessence has quit 23:28:30 spinza has joined #bitcoin-wizards 23:34:57 nsh, tholenst: my expectation is that if you can get any number assuming no horrific forking bitcoind bugs, it'd be like 1/googol or something 23:35:07 way way way lower than the chance of a serious dev mistake 23:35:19 so that's the probability you need to estimate, and good luck with that :) 23:35:53 pft, i crunch graham's number for breakfast 23:36:09 it's higher than 1/graham's number ;) 23:36:21 maybe late lunch then :) 23:41:12 justanotheruser has quit 23:44:23 grau has joined #bitcoin-wizards 23:49:19 grau has quit