Feedback-ID: i525146e8:Fastmail
Date: Thu, 20 Oct 2022 18:28:16 -0400
From: Peter Todd <pete@petertodd.org>
To: Jeremy Rubin <jeremy.l.rubin@gmail.com>,
 Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Message-ID: <Y1HLgLkCmVJQtqT+@petertodd.org>
References: <CAD5xwhjXh33AdK96eToHtDP3t_Zx5JbxCqJFbAQRRRKy6rFC2Q@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="mxy5USJ1Q2UT37G3"
Content-Disposition: inline
In-Reply-To: <CAD5xwhjXh33AdK96eToHtDP3t_Zx5JbxCqJFbAQRRRKy6rFC2Q@mail.gmail.com>
Subject: Re: [bitcoin-dev] Does Bitcoin require or have an honest majority
 or a rational one? (re rbf)
Precedence: list


--mxy5USJ1Q2UT37G3
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, Oct 16, 2022 at 01:35:54PM -0400, Jeremy Rubin via bitcoin-dev wrot=
e:
> The Bitcoin white paper says:
>=20
> The proof-of-work also solves the problem of determining representation in
> majority decision
> making. If the majority were based on one-IP-address-one-vote, it could be
> subverted by anyone
> able to allocate many IPs. Proof-of-work is essentially one-CPU-one-vote.
> The majority
> decision is represented by the longest chain, which has the greatest
> proof-of-work effort invested
> in it. If a majority of CPU power is controlled by honest nodes, the hone=
st
> chain will grow the
> fastest and outpace any competing chains. To modify a past block, an
> attacker would have to
> redo the proof-of-work of the block and all blocks after it and then catch
> up with and surpass the
> work of the honest nodes. We will show later that the probability of a
> slower attacker catching up
> diminishes exponentially as subsequent blocks are added.
>=20
>=20
> This, Satoshi (who doesn't really matter anyways I guess?) claimed that f=
or
> Bitcoin to function properly you need a majority honest nodes.

Satoshi also made a very fundamental mistake: the whitepaper and initial
Bitcoin release chooses the *longest* chain, rather than the most work chai=
n.
Longest chain is totally broken.

What Satoshi said in the whitepaper is completely irrelevant and quoting it=
 in
circumstances like this is IMO misleading.


Anyway, obviously we should always try to make systems that work properly w=
ith
an economically rational majority, rather than the much more risky honest
majority. Economically rational is a better security guarantee. And whenever
possible we should go even further, using the standard computationally
infeasible guarantees (as seen in our EC signature schems), or even,
mathematically impossible (1+1=3D2).

It's notable how in ethereum land, their smart contract schemes have lead to
significant effort in economically rational MEV optimization, at a signific=
ant
cost to decentralization (eg majority of blocks are now OFAC compliant).
There's no reason why Bitcoin should be fundamentally any different in the =
long
run.

--=20
https://petertodd.org 'peter'[:-1]@petertodd.org

--mxy5USJ1Q2UT37G3
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEEFcyURjhyM68BBPYTJIFAPaXwkfsFAmNRy3wACgkQJIFAPaXw
kfvXGQf/dM6X36GoLtiFL2TxGiQnD0IalDDnae751icxwBIt0xU67w/aKH2jkMDs
MpL7iPRWmIbl7gjB2OPmRGU28uLryuP89heaJeD6FqaHRUxEHKA/CQ4/RKAbSJYa
wyfCc1Js9s6XVjjGLj47p/scd/IwIyL26wRvjW2MIsSkAnCvNEqGTkR60M6UUfYi
7jmmrnZnzBcb4mYvn3Ul3kgLiIzw2mUjjbr9pZHd7DDMjf+jUgZzfhP3oQf+Elu0
QAqULH2UQA+WH/FhoBsHeocjVjcEDCDLCXzEBqjqg2x0P6c3+z42DLFQ2eI9ZrcW
uSk4+4SRh4ZdTnDDgYSt8Bg5Kk1ikQ==
=F6Xn
-----END PGP SIGNATURE-----

--mxy5USJ1Q2UT37G3--