Received-SPF: pass (sog-mx-2.v43.ch3.sourceforge.com: domain of petertodd.org
	designates 62.13.149.101 as permitted sender)
	client-ip=62.13.149.101; envelope-from=pete@petertodd.org;
	helo=outmail149101.authsmtp.com; 
Date: Tue, 16 Dec 2014 07:36:42 -0500
From: Peter Todd <pete@petertodd.org>
To: Alex Mizrahi <alex.mizrahi@gmail.com>
Message-ID: <20141216123642.GA19943@savin.petertodd.org>
References: <54876653.4020403@certimix.com> <548769FA.5040406@bluematt.me>
	<CA+s+GJAe9MeO+Sr0+2BRwu3q-Be5JQt_s_xdnBBEcquXqOyxcA@mail.gmail.com>
	<417518B4-1E4D-4467-BC87-95C9EAF0C599@bitsofproof.com>
	<54880492.9060300@intersango.com>
	<CAE28kUQ1tzCXp=90-1ZQG67f2Vh3uCrApJTbx+Lf1r-1byV4Lw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="0OAP2g/MAC+5xKAE"
Content-Disposition: inline
In-Reply-To: <CAE28kUQ1tzCXp=90-1ZQG67f2Vh3uCrApJTbx+Lf1r-1byV4Lw@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Cc: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] Merged mining a side chain with proof of
 burn on parent chain
Precedence: list


--0OAP2g/MAC+5xKAE
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Dec 16, 2014 at 11:55:50AM +0200, Alex Mizrahi wrote:
> Usually at this point people say "we assume that miners aren't going to
> collude, otherwise even Bitcoin is not secure".
> Well, this is BS. The fact that a pool can acquire more than 50% of total
> hashpower was successfully demonstrated by ghash.io.
> But the thing is, Bitcoin doesn't offer one a good way to attack the whol=
e,
> as there are powerful factors which will work against the attacker.
> But this is not the case with sidechains (or any merged-mined chains, for
> that matter).
> And once you have a clear incentive, collusion is much more likely.

+1

It's notable that blockstream hasn't published much if anything concrete
on what exactly you'd use merge-mined sidechains for; they're even worse
than Ethereum in that regard.

> > Proof of Burn is a real cost for following the rules.
> >
>=20
>  So what? As long as cost is less than revenue, it is OK.

It's even better than that: if an attack does happen, the participants
in the consensus system have an incentive to defend against it to
maintain the value of their tokens. Proof-of-burn allows that defense to
be in response to a threat, and essentially unlimited in size.

So now any attacker knows that if they launch an attack in theory the
response could be as strong as the value of the system itself.

This can be improved upon with systems that allow the tokens to be
burned, "internal" proof-of-burn. This suffers from "nothing-at-stake"
vulnerabilities to an extent, OTOH within the context of the system it
is a true sacrifice of value; probably not a big deal in a zookeyv-style
block-DAG where multiple lines of history can be combined. Here the
incentives of the defenders are even more strongly tipped towards
burning their value to preserve the system, not unlike
replace-by-fee-scorched-earth thinking.

--=20
'peter'[:-1]@petertodd.org
00000000000000000e0c078667795abe21bfdebb913eba60cc7a625c732f0a89

--0OAP2g/MAC+5xKAE
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----

iQGrBAEBCACVBQJUkCdWXhSAAAAAABUAQGJsb2NraGFzaEBiaXRjb2luLm9yZzAw
MDAwMDAwMDAwMDAwMDAxMjRjOTFiMGIxYTE1ZWU2Njc0OTlmNzkzMTNhODQ5YzIx
MmIyMWYyYzMwYjQ1NDgvFIAAAAAAFQARcGthLWFkZHJlc3NAZ251cGcub3JncGV0
ZUBwZXRlcnRvZC5vcmcACgkQJIFAPaXwkfsOcAgAjaNgy0PyWqR2yeXXqjuD5i+U
syiGdJ3fw473PgTQRijBtmOPsBGy5/Z1/338GzxVcf0u6Yr9s5002pD09xcNfVJa
kTYCDLEwulOHYnmsdUyN51SM+dQohCgzhtPISfyJiMTuzn/N+MSP/7AseSiquegh
Y/I0vLaJboKmZZ+10xZyF0EfQQ5Ks3HpJwru5gwGxPL0NODGyTw/V9blpb06UqVt
c0mHLJe9X0947N3CyOBX3ftXBfXIKeew3KOcLOsdGmCrinUEiQejiF024VwZtDys
RXVP9qrZ+wJtYF/QJAOAgNQijNlynCHCqAjrO4Je0X5TXYRbzqjWAJvZQz5qZA==
=Ka3f
-----END PGP SIGNATURE-----

--0OAP2g/MAC+5xKAE--