1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
|
Return-Path: <ajwest@gmail.com>
Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org
[172.17.192.35])
by mail.linuxfoundation.org (Postfix) with ESMTPS id 63512927
for <bitcoin-dev@lists.linuxfoundation.org>;
Tue, 5 Dec 2017 18:21:12 +0000 (UTC)
X-Greylist: whitelisted by SQLgrey-1.7.6
Received: from mail-ot0-f181.google.com (mail-ot0-f181.google.com
[74.125.82.181])
by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 4D24544D
for <bitcoin-dev@lists.linuxfoundation.org>;
Tue, 5 Dec 2017 18:21:11 +0000 (UTC)
Received: by mail-ot0-f181.google.com with SMTP id d27so1065495ote.11
for <bitcoin-dev@lists.linuxfoundation.org>;
Tue, 05 Dec 2017 10:21:11 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;
h=mime-version:in-reply-to:references:from:date:message-id:subject:to;
bh=2mW700/lH9Sni04TvR3EqojqfBGIHUWpofFUJdSOAes=;
b=mK4Put+74vLeeayVw0VAquqQokmJ9sfWKbLztLLfgKen0DctSq1dBxyNDZVT35hGaD
EbIubIw5nTofx8uXgbxnx/JBIsIbNRTa8lu3kI+lVYxW1h1FazGP1t7JZKWTHgkFTiF+
2ZSNMJIH1wt966EFsF44wwQN0nSSXSp5WwC0RkWM8FCp1udBeMhbHBpagFLrNuQCzt+P
3zr5TGbInDx2Pgnl/9f7Spful/tGrFZ1kVtnrxHXd7jY1di8rfZAVly2ezNLUDl3rMGs
8+iuBRSyqUUZ4oHlPGx2BLF3Av8wPeK4SazfoBa39fT72/ibvsDl27o4xQ1Q+2X/O5hG
cqkA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:in-reply-to:references:from:date
:message-id:subject:to;
bh=2mW700/lH9Sni04TvR3EqojqfBGIHUWpofFUJdSOAes=;
b=ZdRhZ2w1r25v6upSUNXtBIQSL5crAlUCUYGuF1WWWcwk2dJtobC8hVSj8HmG28cWEf
HdB2DH5EQgApOuEi2HfhQ+GleRRNdJ1HTynJW0gWrdaEqmN9Qzp+cMoFms1q8Q86LXZW
eaW0aqsv62Ak9pCp7xaBO89Cr7yaRpyQXsOAXbFHogHC5itKfLmObtGYjqY3RBq4cQmw
q4ri0y1DyhEVWq5YFEOI8EsBj5u9vC6mfTfgxmH5vOB/izBnwpDbIhO81DjMI5v6bXJv
jPzw7B33PsROr/9mXVOcFlSMA7Pl9/0jw0HAfFdMKDgqktpJ4edTMJfVYG2gNDmXO2ZT
0hjA==
X-Gm-Message-State: AJaThX7a6utSmZugpGZcD4Ak8+JKMqfFYuKmYMgD9KA7TNh1k1wqjVt2
4iILrNfrxHpRsflRGcT/j2N1liOOZyD9j5JS6yY=
X-Google-Smtp-Source: AGs4zMaZlLg8WjddcHxglu3LWp6BuuC/sTETFOfbmzvdinDWjO/fPqZ7+eqIykfTzZ9PlRxfjIkfKostjAqW//P+4SQ=
X-Received: by 10.157.0.239 with SMTP id 44mr20397847otk.327.1512498070494;
Tue, 05 Dec 2017 10:21:10 -0800 (PST)
MIME-Version: 1.0
Received: by 10.157.94.9 with HTTP; Tue, 5 Dec 2017 10:20:49 -0800 (PST)
In-Reply-To: <c898cc1c-d71c-de5c-aede-a2a4235656e0@gmail.com>
References: <d3497397-33c3-90c1-1be8-a733736eac0b@gmail.com>
<1bb6cccd-3f6d-d62a-2825-4e6f46a4b525@mattcorallo.com>
<dd2781a6-3e10-9f0c-6ee0-a2c070b7cf67@gmail.com>
<CAB+qUq4wNv=-ZSibUvVCwYSE7Qw8xe8EH91KG6znUp1d7X=mdA@mail.gmail.com>
<c898cc1c-d71c-de5c-aede-a2a4235656e0@gmail.com>
From: AJ West <ajwest@gmail.com>
Date: Tue, 5 Dec 2017 13:20:49 -0500
Message-ID: <CABXVU6asm_N94CUVm0_88zVOEr_m6Zm1_sR8i1r+UoKRji9X_Q@mail.gmail.com>
To: Paul Sztorc <truthcoin@gmail.com>,
Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="94eb2c1c074a372422055f9be684"
X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED,
DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, HTML_MESSAGE,
RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
smtp1.linux-foundation.org
X-Mailman-Approved-At: Tue, 05 Dec 2017 19:34:47 +0000
Subject: Re: [bitcoin-dev] Two Drivechain BIPs
X-BeenThere: bitcoin-dev@lists.linuxfoundation.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Bitcoin Protocol Discussion <bitcoin-dev.lists.linuxfoundation.org>
List-Unsubscribe: <https://lists.linuxfoundation.org/mailman/options/bitcoin-dev>,
<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=unsubscribe>
List-Archive: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/>
List-Post: <mailto:bitcoin-dev@lists.linuxfoundation.org>
List-Help: <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=help>
List-Subscribe: <https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev>,
<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=subscribe>
X-List-Received-Date: Tue, 05 Dec 2017 18:21:12 -0000
--94eb2c1c074a372422055f9be684
Content-Type: text/plain; charset="UTF-8"
Hello,
I would like to refer to these BIPs in other contexts and conversations.
Regardless of the pitfalls or benefits, the discussion and technical review
happening in this thread (and the ones before) are well-formed ideas with
an active champion. The point of BIP numbers/conventions are so we're all
on the same page about what we're talking about.
Please assign these BIP numbers so discussion may continue in a controlled,
tagged, linear manner, instead of "the first BIP" and "the second BIP."
Thank you
AJ West
On Tue, Dec 5, 2017 at 1:05 PM, Paul Sztorc via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> wrote:
> Hello Chris,
>
> 1. Marginal Cost
>
> There actually is a very small cost to casting a malicious vote, relative
> to an honest vote. This is because the software (when run as-is), will
> automatically vote correctly. But to vote fraudulently you must decide on
> what to do instead, and configure that! This might not be as easy as it
> seems (see collective action part, below).
>
> It is true that there is no *marginal* cost to creating a bad vote, in the
> fraudulent withdrawal case. But then again there is no marginal cost to
> creating a good vote either -- in fact there is no cost at all. In fact,
> there is no marginal cost to creating a bad block either, in the 51%
> hashrate reorganization case. Epistemologically, the protocol has no way of
> differentiating a "bad" block/vote from a good one. So one cannot "cost"
> more than the other, in a narrow sense.
>
> I suppose in the reorganization case there is the risk of lost mining
> effort on a chain that actually does *not* have 51% and therefore won't
> catch up. But this only encourages conformity to the longest chain,
> including fraudulent chains. For example, imagine that the reorganization
> is done via secretly mining a longer chain -- once that chain is published,
> it will be the longest. Then, according to your framework, there will be a
> "marginal cost" to doing the *right* thing (trying to preserve the honest,
> transparent chain). So I'm afraid I don't understand what you mean.
>
> 2. Repercussions
>
> As for there being no repercussions, that is incorrect. The miner's choice
> to engage in a fraudulent withdraw is one that has several negative
> consequences. They take a variety of forms and likelihoods, but they
> definitely exist and are very relevant.
>
> The first repercussion is the loss of victim-sidechain future tx-fees. A
> second is the loss of all future tx fees on all sidechains. A third is that
> the Bitcoin super-network is changed from being a "sidechain enabled"
> network to a "sidechain disabled" network.
>
> The impact of these repercussions is still unclear and open to
> interpretation. On one hand, the impact may be small and therefore not very
> persuasive (as in the case where a sidechain has few tx-fees, few
> sidechains are used, few are expected to be created/used, and so little is
> lost by attacking). On the other hand, a single fraudulent withdrawal might
> motivate the creation of a new spinoff network that is exactly the same as
> the old network, but with merely two changes: the fraudulent withdrawal
> surgically removed (as if it were never attempted) AND a new proof of work
> algorithm. Since the withdrawals are so slow, there would be plenty of time
> to organize such an option (and people who already want a pow-change would
> jump at this glaring opportunity). Will the repercussions be small or
> large? Even if there is only a *risk* of large repercussions, it can be
> very persuasive. (Just as the IRS is very persuasive to tax-paying
> Americans, even though only a tiny proportion of tax returns are audited.)
>
> 0. Useless Sidechain Fallacy
>
> Finally, you are joining the long list of people who are committing the
> "useless sidechain fallacy". You are saying that because you believe the
> sidechain is useless, therefore everyone must believe as you do, and
> therefore the option to use a sidechain must be one that has zero value.
> However, in the real world people are heterogeneous. They may decide that
> your interpretation contains errors, or else their circumstances might
> incline them towards a different risk-reward tradeoff. Finally, this
> fallacy obfuscates the main benefit of sidechains, which is that they are
> optional -- the sidechain-designer must convince users to deposit funds
> there.
>
> 3. Collective Action Problem
>
> There actually is a collective action problem inherent to fraudulent
> withdrawals.
>
> If miners wish to fraudulently withdraw from the sidechain, they need to
> choose the destination addresses (on mainchain Bitcoin Core) months in
> advance. Then they need to upvote/downvote this destination, despite that
> fact that --during this time-- new hashpower might be coming
> online/offline, and/or hashers might be joining/leaving specific pools. I
> bring this up to demonstrate that even the most straightforward attack (of
> "a 51% hashrate group attacks a sidechain and distributes the proceeds to
> the group proportional to hashpower") is actually one that contains a
> difficult (and potentially interminable) negotiation. The effort required
> to initiate the negotiation is the source of the collective action problem
> here.
>
> I think that this collective action problem is actually more burdensome
> than Bitcoin's -- for mainchain Bitcoin miners merely need to decide which
> block height they intend to reorganize from.
>
> You may wish to read Drivechain's security model to learn more:
> http://www.truthcoin.info/blog/drivechain/#drivechains-security
>
> In this case, I don't see a way to measure "security" cardinally or
> ordinally. Instead, I am only able to see it as either "secure enough" or
> "not secure enough". But perhaps someone can enlighten me as to the math
> they are using to produce these cardinal/ordinal rankings.
>
> --Paul
>
>
> On 12/4/2017 2:36 PM, Chris Pacia wrote:
>
>
> I think you are missing a few things.
>
> First of all, I think the security model for sidechains is the same as
> that of every blockchain
>
> People will say things, like "but with sidechains 51% hashrate can steal
> your coins!", but as I have repeated many times, this is also true of
> mainchain btc-tx. is something else?
>
>
> There are substantial opportunity costs as well as a collective action
> problem when it comes to re-writing the mainchain.
>
> Is there anything similar for drivechains? As far as I can tell there is
> no opportunity cost to casting a malicious vote, no repercussions, and no
> collective action barrier that needs to be overcome.
>
> Unless I'm missing something I wouldn't liken the security of a drivechain
> to that of the mainchain.
>
>
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>
>
--94eb2c1c074a372422055f9be684
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><div>Hello,</div><div><br></div><div>I would like to refer=
to these BIPs in other contexts and conversations. Regardless of the pitfa=
lls or benefits, the discussion and technical review happening in this thre=
ad (and the ones before) are well-formed ideas with an active champion. The=
point of BIP numbers/conventions are so we're all on the same page abo=
ut what we're talking about.<br></div><div><br></div><div dir=3D"auto">=
Please assign these BIP numbers so discussion may continue in a controlled,=
tagged, linear manner, instead of "the first BIP" and "the =
second BIP."</div><div dir=3D"auto"><br></div><div dir=3D"auto">Thank =
you<br></div><div>AJ West</div><div class=3D"gmail_extra"><br><div class=3D=
"gmail_quote">On Tue, Dec 5, 2017 at 1:05 PM, Paul Sztorc via bitcoin-dev <=
span dir=3D"ltr"><<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.or=
g" target=3D"_blank">bitcoin-dev@lists.linuxfoundation.org</a>></span> w=
rote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;borde=
r-left:1px #ccc solid;padding-left:1ex">
=20
=20
=20
<div text=3D"#000000" bgcolor=3D"#FFFFFF">
<div class=3D"m_5648554002538150650moz-cite-prefix">Hello Chris,<br>
<br>
1. Marginal Cost<br>
<br>
There actually is a very small cost to casting a malicious vote,
relative to an honest vote. This is because the software (when run
as-is), will automatically vote correctly. But to vote
fraudulently you must decide on what to do instead, and configure
that! This might not be as easy as it seems (see collective action
part, below).<br>
<br>
It is true that there is no *marginal* cost to creating a bad
vote, in the fraudulent withdrawal case. But then again there is
no marginal cost to creating a good vote either -- in fact there
is no cost at all. In fact, there is no marginal cost to creating
a bad block either, in the 51% hashrate reorganization case.
Epistemologically, the protocol has no way of differentiating a
"bad" block/vote from a good one. So one cannot "cost&=
quot; more than
the other, in a narrow sense.<br>
<br>
I suppose in the reorganization case there is the risk of lost
mining effort on a chain that actually does *not* have 51% and
therefore won't catch up. But this only encourages conformity to
the longest chain, including fraudulent chains. For example,
imagine that the reorganization is done via secretly mining a
longer chain -- once that chain is published, it will be the
longest. Then, according to your framework, there will be a
"marginal cost" to doing the *right* thing (trying to prese=
rve the
honest, transparent chain). So I'm afraid I don't understand =
what
you mean.<br>
<br>
2. Repercussions<br>
<br>
As for there being no repercussions, that is incorrect. The
miner's choice to engage in a fraudulent withdraw is one that has
several negative consequences. They take a variety of forms and
likelihoods, but they definitely exist and are very relevant.<br>
<br>
The first repercussion is the loss of victim-sidechain future
tx-fees. A second is the loss of all future tx fees on all
sidechains. A third is that the Bitcoin super-network is changed
from being a "sidechain enabled" network to a "sidecha=
in disabled"
network.<br>
<br>
The impact of these repercussions is still unclear and open to
interpretation. On one hand, the impact may be small and therefore
not very persuasive (as in the case where a sidechain has few
tx-fees, few sidechains are used, few are expected to be
created/used, and so little is lost by attacking). On the other
hand, a single fraudulent withdrawal might motivate the creation
of a new spinoff network that is exactly the same as the old
network, but with merely two changes: the fraudulent withdrawal
surgically removed (as if it were never attempted) AND a new proof
of work algorithm. Since the withdrawals are so slow, there would
be plenty of time to organize such an option (and people who
already want a pow-change would jump at this glaring opportunity).
Will the repercussions be small or large? Even if there is only a
*risk* of large repercussions, it can be very persuasive. (Just as
the IRS is very persuasive to tax-paying Americans, even though
only a tiny proportion of tax returns are audited.)<br>
<br>
0. Useless Sidechain Fallacy<br>
<br>
Finally, you are joining the long list of people who are
committing the "useless sidechain fallacy". You are saying =
that
because you believe the sidechain is useless, therefore everyone
must believe as you do, and therefore the option to use a
sidechain must be one that has zero value. However, in the real
world people are heterogeneous. They may decide that your
interpretation contains errors, or else their circumstances might
incline them towards a different risk-reward tradeoff. Finally,
this fallacy obfuscates the main benefit of sidechains, which is
that they are optional -- the sidechain-designer must convince
users to deposit funds there.<br>
<br>
3. Collective Action Problem<br>
<br>
There actually is a collective action problem inherent to
fraudulent withdrawals.<br>
<br>
If miners wish to fraudulently withdraw from the sidechain, they
need to choose the destination addresses (on mainchain Bitcoin
Core) months in advance. Then they need to upvote/downvote this
destination, despite that fact that --during this time-- new
hashpower might be coming online/offline, and/or hashers might be
joining/leaving specific pools. I bring this up to demonstrate
that even the most straightforward attack (of "a 51% hashrate
group attacks a sidechain and distributes the proceeds to the
group proportional to hashpower") is actually one that contains =
a
difficult (and potentially interminable) negotiation. The effort
required to initiate the negotiation is the source of the
collective action problem here.<br>
<br>
I think that this collective action problem is actually more
burdensome than Bitcoin's -- for mainchain Bitcoin miners merely
need to decide which block height they intend to reorganize from.<br>
<br>
You may wish to read Drivechain's security model to learn more:
<a class=3D"m_5648554002538150650moz-txt-link-freetext" href=3D"http:=
//www.truthcoin.info/blog/drivechain/#drivechains-security" target=3D"_blan=
k">http://www.truthcoin.info/<wbr>blog/drivechain/#drivechains-<wbr>securit=
y</a><br>
<br>
In this case, I don't see a way to measure "security" c=
ardinally
or ordinally. Instead, I am only able to see it as either "secur=
e
enough" or "not secure enough". But perhaps someone ca=
n enlighten
me as to the math they are using to produce these cardinal/ordinal
rankings.<span class=3D"HOEnZb"><font color=3D"#888888"><br>
<br>
--Paul</font></span><div><div class=3D"h5"><br>
<br>
On 12/4/2017 2:36 PM, Chris Pacia wrote:<br>
</div></div></div><div><div class=3D"h5">
<blockquote type=3D"cite">
<div dir=3D"auto">
<div><br>
<div class=3D"gmail_extra">
<div class=3D"gmail_quote">
<blockquote class=3D"m_5648554002538150650quote" style=3D"mar=
gin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class=3D"m_5648554002538150650quoted-text">I think you=
are missing a few
things.<br>
</div>
<br>
First of all, I think the security model for sidechains
is the same as<br>
that of every blockchain<br>
<br>
People will say things, like "but with sidechains 51%
hashrate can steal<br>
your coins!", but as I have repeated many times, this =
is
also true of<br>
mainchain btc-tx. =C2=A0is something else?<br>
</blockquote>
</div>
</div>
</div>
<div dir=3D"auto"><br>
</div>
<div dir=3D"auto">There are substantial opportunity costs as well
as a collective action problem when it comes to re-writing the
mainchain.=C2=A0</div>
<div dir=3D"auto"><br>
</div>
<div dir=3D"auto">Is there anything similar for drivechains? As
far as I can tell there is no opportunity cost to casting a
malicious vote, no repercussions, and no collective action
barrier that needs to be overcome.=C2=A0</div>
<div dir=3D"auto"><br>
</div>
<div dir=3D"auto">Unless I'm missing something I wouldn't l=
iken
the security of a drivechain to that of the mainchain.</div>
</div>
</blockquote>
<p><br>
</p>
</div></div></div>
<br>______________________________<wbr>_________________<br>
bitcoin-dev mailing list<br>
<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org">bitcoin-dev@lists.=
<wbr>linuxfoundation.org</a><br>
<a href=3D"https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev" =
rel=3D"noreferrer" target=3D"_blank">https://lists.linuxfoundation.<wbr>org=
/mailman/listinfo/bitcoin-<wbr>dev</a><br>
<br></blockquote></div><br></div></div>
--94eb2c1c074a372422055f9be684--
|