I don't understand why, but presumably you are saying that blocks with more transitions should have (or have now) greater weight when choosing between two branches of the orthodox chain.

 If that were (or is) the case, then wouldn't miners pad their blocks with transactions that move a few bits between their pockets, in order to win the block race by weight rather than by work? 

If that were (or is) the case, the cratel could fill the blocks of chain (2) with such transactions, instead of leaving them empty. 

Does this make sense?


Please check again the script that I outlined above.  The miners that will form the cartel have 54% (say) of the hashpower, so they consume about half of the total electricity; and that consumption will not change, whether they attempt the protocol change or not. 

Their expected payoff, if they succeed, is 54% of 3600 BTC/day, instead of 54% of 1800 BTC/day, for the next two years.  Even if they had to forfeit their revenue during the transition period, that would still be a huge gain.  (And all miners, cartel or not, will enjoy the same benefit.)

However, I believe that the cartel would not lose any revenue during the transition period.  Through that time, they will collect more than half of 3600 BTC/day from the reformed chain (1), and, if they succced, they will keep those BTC.  (They will also collect all the 1800 BTC/day from the empty orthodox chain (2); but those coins will not be usable outside of chains (2)+(3), so they will be discarded at the end of the transition.)

Even if they were to fail in the attempt (how, I cannot see), they would lose the coins from chain (1), but would retain those of chain (2); which are twice as much as they would have earned if they mined fairly.

(In fact, a cartel with 51% of the hashpower can just starve the other miners and collect 100% of the block rewards, without doing any other evil.  But that is a well-known evil.  What I am trying to show is that a 51% cartel can force a change in the protocol.)

I don't bet money if I can avoid it.  (That is one of the reasons why I do not own bitcoins.)

No, the question is not whether we need a P2P payment system that is not centralized.   

The question is whether bitcoin is such a system.

To me, it is already clear that it isn't, because it requires us to trust the 4-5 largest miners; in the same way that the banking system requires us to trust the few large banks that dominate it.  I bet that you will see that too, eventually.


It is you who keeps ignoring what I pointed out several times already: that a cartel of miners can take permanent control of the network in the open, with advance warning, and with the cooperation, approval, or indifference of most of the community.  Just as a few large banks took permanent control of the banking system.  If such a thing is possible, it will almost certainly happen, because of common human greed.

(By the way, have you checked the business career of Brock Pierce?  I would not have imagined that "mining" and selling video game points could be a profitable business, much less that a single bilion-dollar company could monopolize that business all over the world.  Some similarities to bitcoin are intriguing, e.g. the "game point mining farms" that were set up in China by Pierce's associates.  I cannot stop wondering why he decided to buy his way into the Bitcoin Foundation's board...)

I understand "success" as "the bitcoin protocol provides a P2P payment system that does not require trust in a third-party authority".

We now know that the bitcon protocol does not provide that.  The protocol requires users to trust the miners; which is OK, as long as mining power is sufficiently well distributed over thousands of independent entities, benign or short-term greedy.   However, the protocol cannot prevent concentration of mining, and in fact forsters it.  Once mining is concentrated in a small number of companies, having to trust them is no longer OK.

It does not matter whether those companies ever did something bad, the problem is that users must trust that they will not do it.  That is supposed to be the bad feature of banks and credit cards that bitcoin was designed to avoid.  (Personally, I would more easily trust my money to a a bank cartel than to those 4 top mining companies.)

You seem to be saying that FooBank's saferoom is secure because in the past 2 years no one has tried to force it open; and gets more secure at each month that passes without anyone trying to force it.  Sorry...

You seem to define "success" as "the current bitcoin network will keep working and people will keep using it".

Bitcoin may still be successful in that sense; but what would be the point, if it is no longer "trustless"?



The distribution of power does not have to be stable for Satoshi's goal to be frustrated.

The protocol asks us to trust that, at any time during the life of the network, no subset of miners that comprises 51% of the total power will agree to do something that violates the protocol, and will maintain that agreement long enough to make the damage permanent.

Again, one can take for granted that the members of that susbet will not agree to do that, if the subset has thousands of independent miners.  But if the subset has only a few members, one cannot make that assumption.  There is significant probability that they will agree and maintain their agreement for the time needed, especially if the violation of the protocol is profitable for that subset.  The smaller that subset, the more liikely it is that they will cooperate in such "attack".  But the, it is highly probable that such thing will happen at some point during the life of the network.

We had already a situation when GHash.io controlled by itself more than 51% of the network's total hashpower, IIRC for several days.  During that time, everybody had to trust that they would not use their power to violate the protocol; in particular, that they would not decide to change the protocol by threatening users with DoS.   

Right now, users have to trust that Discus, GHash, AntPool and BTCChina will not join forces to violate the protocol.  They have to trust that Discus, GHash, AntPool and KnCMiner will not do it either.  And that Slush, pool34, BTCMiner, KnCMiner, BTCChina, GHash, and Discus will not do it either.  And ...

You see, if power was distributed over many thousands of independent miners, all such lists would have thousads names, and users would not have to worry about the chance of all the members in one list agreing to play foul.  But right now there are two sets of 4 companies that would have the power to do that, and several sets of 8 companies or less.  The chances that all members of one of these list will form a cartel and violate the protocol is not longer negligible.   Users will have to trust that none of those potential cartels will exploit that opportunity.

The risk of protocol violation by a 51% cartel is even greater if two or more of those big companies are owned by the same people.  It is quite possible that GHash still controls more than 51%, but made an arrangement with other pools for them to nominally "host" part of GHash's power.

Even if the pie chart changes completely by next month, it is a safe bet that power will remain quite concentrated (as it has been for many months).  Again, the economics and nature of PoW mining fosters concentration, overt or disguised.

You still have not read my reddit posts, did you?

Summarizing them:  Say the cartel has hashpower 0.54 * Z where Z is the total.  The cartel first warns users that starting from block N, there will be a change in the protocol.   The only substantive change will be the block reward, that will continue to be 25 BTC, for another 2 years, instead of dropping to 12.5 as originally planed. This change is actually necessary and good for bitcoin because the network is in grave danger bla bla bla.  The cartel warns that users and miners who upgrade to the new version of the software, anytime before block N, will see no change at all.  Users who do not upgrade will see no change until block N, but after that their transactions will not go through, or will be confirmed an then unconfirmed -- until they upgrade too.  Starting from block N, miners who have not upgraded will not earn any rewards, until they upgrade too.

Starting with block N, the cartel redirects 0.52*Z hashpower to mine the original chain, and 0.02*Z to mine the new reformed chain, that forks from it after block N-1.

The miners working on the reformed chain (those 0.02*Z from the cartel, plus any other miners who have upgraded) use the new protocol, earn 25 BTC rewards, and accept all transactions from all clients that have upgraded.  The difficulty is lowered temporarily in that fork so that those miners can sustain a reasonable block rate.

The other cartel miners, with power 0.52*Z, keeps mining according to the original protocol; except that, starting with block N, they ignore any blocks generated by miners with the old protocol, and mine only empty blocks, always using their last (empty) block as parent. 

Thus, during that transition phase, there will be usually three chains: (1) the new main chain, gnerated according to the modified protocol; (2) the empty orthodox chain generated by the cartel; and, occasionally, (3) a short orthodox chain hanging from chain (2), generated by the orthodox miners.  Note that the original protocol says that the orthodox clients and the orthodox miners must view (2) and (3) as equally valid, and always select the longest of the two.  Since chain (2) has more hashpower working on it,  chain (3) will eventually be discarded by those clients and miners, and even orhodox miners will use the last block of chain (2) as the parent of the new chain (3).

As the non-cartel miners upgrade to the cartel version, the cartel would repartition dynamically its power so that it always retains majority power in fork (1) (to foil any counter-attacks by rebels)  and in the two forks (2)+(3), i.e. more power on (2) than the rebels have on (3).  Eventually, most of the users and miners will be happily using fork (1).  Then forks (2) and (3) can be abandoned by the cartel, since the rest of the ecosystem will not accept their bitcoins or recognize their transitions.  The cartel will forfeit all the 12.5 BTC rewards that it collected in chain (2), but it would still have half of the 25 BTC rewards from chain (1) generated in that interval.  Anyway, from then on the network and ecosystem would be just as before; but every miner would still be collecting the same revenue as before, instead having his revenue cut in half.

Since clients and miners will know this plan in advance, most of them should want to upgrade, out of self interest.  There is a bit of prisoner's dilemma there; but for greedy users and miners, who will assume that most of the other players are greedy too, the decision to upgrade is almost a no-brainer.   Only users and miners with an overpowering ideological motivation may try to stick to the original protocol, but they will only succeed if the cartel plus the defecting miners loses its majority position during the battle. 


Yes, and that shows that the protocol can be changed -- even retroactively! -- if the miners agree to do that.  Note that if only the users or only the miners had agreed to the rollback, the transactions would no longer go through; but while that would be disastrous for the users, it would make almost no difference for the miners, since they would still collect rewards from their empty blocks.  And, in either case, the blockchain would use the version of the protocol that was chosen by the miners, not by the users.


You (and most "51% deniers") are still fixated on one particular type of attack, and are arguing that it would not work because users and miners would disapprove of it and would even violate completely the protocol (by manually bypassing the longest-chain rule) in order to "save" bitcoin.  Again, please read my scenario above.  An "attack" that changes the protocol so as to benefit miners and is not too harmful to users will probably succeed because it will be in the self-interest all parties.  Who knows, by then Gavin may be working for the cartel and urging everybody to upgrade.


Well, we obvioulsy disagree about who is detached from reality here.

The size of the user base and the price are not important for the experiment. But the distribution of mining power is.

You are entitled to you opinion, but in my view the experiment has already shown that the protocol does not work.  It does not achieve its stated goal: all users of the system now have to trust that those 4 companies (which may actually be only 3, or 1, or may become 1 next year) will not be more evil or insane than the bank cartel. 
[/quote]

Obviously the attacker will not do that.  It will ignore all blocks that the orthodox miners put out, and continue mining empty blocks using his last mined  block as the parent.  Since the attacker has more power than the orthodox miners, his empty chain will eventually outpace every orthodox side branch, and all the orthodox blocks in the latter will then be orphaned and discarded by all the orthodox clients.

Thus, every transaction request that the orthodox clients issue will either stay unconfirmed forever, or become unconfirmed even after having been confirmed several times.  Whereas the clients who upgrade to the cartel's version will not notice any difference.

This argument is superficial and flawed.  The users can reject unorthodox blocks, but cannot create orthodox ones; whereas the mining cartel can block the orthodox chain while keeping their unorthodox chain open and functional.  So the users cannot oppose the miners, nor interfere with their operation.   Each user has only three options: (1) stop using the bitcoin system and lose all his coins, (2) upgrade to the cartel's revised protocol and continue use the full network, or (3) upgrade to some 'rebel' protocol which is run by a tiny CPU/GPU network.  (He can opt for both (2) and (3) at the same time, or switch between them any time; but then he will risk committing or be victim of double-spending.)

Please do read the detailed "script" that I posted to reddit:

http://www.reddit.com/r/Bitcoin/comments/2qdfat/without_downvoting_me_to_hell_can_someone_explain/cn5s41z
http://www.reddit.com/r/Bitcoin/comments/2qmfgw/so_warren_buffet_says_bitcoin_is_bs/cn82t3q
http://www.reddit.com/r/Bitcoin/comments/2qmfgw/so_warren_buffet_says_bitcoin_is_bs/cn7rxz1


 

There is no fixed number, of course. Rather, as the number of independent entities in a majority set of miners increases, their interest will be more aligned with the interest of the users.  (This is true of democracy too, by the way.)

In the case of bitcoin, one additional problem is that bitcoin ownership is highly concentrated too, and the largest holders are not miners.  So, even if the protocol were somehow fixed to require consensus of all miners (instead of just a set with 51% power), the miners would still be largely disjoint from the users, whether one counts people or bitcoins held.  So the miners might still change the protocol to increase their revenue at the expense of the users.  (Would PoS be a partial solution to this problem?)

The likelyhood of getting N mining entities to cooperate with a protocol change attempt depends also on the benefit that the miners will get from it.  For example, I would guess that nearly all of them would approve a postponement of the next reward halving.

The 4 largest named slices already add to more than 51%.  That is why I used "4" in my posts.

Indeed, my mistake.


That is a good question.  OKCoin and Huobi too received similar VC investment.  They have a much larger staff (Huobi claimed to have ~50 people just on customer support), but being in china all their costs should be even smaller than in Slovenia.

A company that moves that much money will need several people in finance and accounting.  They will need people to take care of AML/KYC, or (more likely) sub-contract a specialized company (which are said to be quite expensive).  

I would weakly defend my estimate of 5 M$ for expansion of operations and 1 year of expenses.  I cannot find fault with the lower estimates that people have posted (around 1 M$/year), but do not feel them compelling either.

What were their costs in 2013?

One thing to note is that most of the VC investments that were announced through 2014 were actually negotiated in late 2013 or early 2014.  (For example, OKCoin said that their 10 M$ investment, announced in Mar/2014, had been closed in Dec/2013). At that time, expectations for the growth of the bitcoin economy and price were still in outer space   (By May 2014, most bitcoin gurus and angels were still predicting 3'000 USD/BTC or much more by the end of the year.)  That may explain why the investments were so big compared to the current profits.

And you made me fork the chain, are you happy?

Why didn't you answer with a question?

I fully agree that the banking sector is an oligopoly.  And the same is true of the economy in general.  And centraliaztion of the economy invariably results in centralization of political power and collapse of the democracy.

But I do not agree that bitcoin is somehow different from banks. Because:

* The same economic process that created the banking oligopoly has already created a mining oligopoly; namely, the big fish grows faster than the smal fish, and may even eat it.

* The mechanisms that are supposed to protect the bitcoin users and the protocol from abuse by the dominating cartel do not work:

** Acting in its self-interest, the cartel will be careful not to destroy its market, but will try to maximize its gain in the long term;

** The cartel will charge monopoly-level prices and provide monopoly-quality service;

** Users who object to the cartel have no alternative except to do without the service, or to use a much inferior one;

** For that reason, most users just accept the cartel as a fact of nature, and even try to be friends with it;

** For that reason, the cartel can define and change its terms of service, and not even a supermajority of the users can stop them;

** New providers (banks or miners) who want to enter the market and survive must submit to the cartel;

** Therefore, unhappy users may take their money to another bank or miner, but cannot break free of the cartel's power;

And so on.

By the way, a majority cartel could, by following the same script outlined in my reddit post, also undo the Bitstamp heist.  All it needs to do is block withdrawals from that address (which it can do immediately and unilaterally, by its veto power), and then force the users to upgrade to a version of the software that includes a built-in table of exceptions: transactions that violate the normal rules, but should be considered valid anyway.  For the time being, that table would have only one transaction, moving those 18'000 coins from the thief's address to the new Bitstamp's address.  The input would have 'FuckAllThieves' as the signature; which of course is not valid for that address, but the exception table will override that. 

This change to the protocol will surely cause more revolt among the fundamentalist users than the mere extension of the reward schedule.  On the other hand, it would be much easier to justify to the general users, since it would undo what is universally viewed as a crime, redress the loss of the victims, and create a powerful deterrent of future bitcoin thefts.  In fact, this hack will probably make bitcoins more valuable, increase adoption, appease hostile governments, etc. etc..  And the non-ideological users are already used to the banks doing that sort of thing.

And you can see how this will end.

The fact is, you do not really own your bitcoins, even if you are the only person who knows their private keys. Since bitcoins cannot exist outside the blockchain, they are actually owned by the miners.  Your bitcoins will stay or move only if and where the miners are willing to keep or move them.  At present, the miners will only move coins  if they get a transaction request with the proper signature.  However, if a majoritary subset of the miners agrees to do something else, they will have the power to force the users to accept it -- as long as it is less harmful to the general user than being cut off from the service.

Just like them banks.

A man, a plan... a canal -- Panama!

Of course! That must be where the thief is hiding!

Actually it is not that much. Considering office space, furniture, equipment, marketing, energy, internet access and other bills, etc, I would guess that it may support a 20-person company for 6 months, maybe a year.  Probably they have already spent half or more of that amount. (Investors do not give money to a company for it to keep unused in its bank account.)


I believe that is called "sending good money to chase after the bad" in finance.  

Pantera would have to choose between writing off 10 M$, or investing 20 M$ that will take 10 years to be paid back, before it can start yielding 1 M$/year profit (maybe).  Will Bitstamp survive 10 years?


The loans would be repaid from the revenue, and that extra expense would decrease their profit by the same amount.  So yes: effectively, the loan would be paid from the profits.   In that scenario the other investors may not receive any profits for the next 5 years.

IIRC, they were owned by Tony Gallippi and a couple of other investors, who just a couple weeks ago sold to Josh Garza of GAWminers (what is the problem with them Joshes?).  IIRC, they also stopped issuing the paper version, and became online-only.

(Josh Garza also bought "btc.com" and made it point to his altcoin, Paycoin.)

Sorry, you are right.  Indeed I see many bitcoiners who are aware of and worried by the centralization issue.

Well, I see now why you keep claiming that millions of users would revolt.

But the easiest and safest way to retain access to one's bitcoins and keep issuing transactions, secured by 99% of the current network power, will be to upgrade to the cartel's version, not to the rebel version.


Recall that the change made by the rebels is such that the cartel cannot mine their fork.  That means that no off-the-shelf mining equipment will be able to mine it either.  The rebel network would have to rely on CPU and GPU mining for months, until manufacturers start selling equipment for it.

The value of the BTC money base will be divided into two currencies, cartelBTC and rebelBTC.  Every bitcoin owner will start off with equal amounts of both, and can choose to issue transactions in either network, or even in both of them.   So their self-interest will not automatically push them to side with the rebels and boycott the cartel.

The cartel will have nearly 100% of the existing mining equipment working for them.  It is the rebels who will have to convince investors to build an EH/s network from scratch.

In that scenario that I described, the "protective improvement"  to the protocol would be proposed by the cartel sometime before the next halving.  By that time, the network will still be supported by money from the new adopters who buy the coins produced by the miners.  Which coins would those new users rather buy: cartelBTCs, that live on the largest network built by man, using (almost) the same protocol designed by Satoshi, wich has been tested for more than 6 years; or rebelBTCs, that live on a small CPU/GPU network, using a radically different protocol that was patched together in three days and has been in used for less than a month?

I am already tenured, actually, so I could badmouth the government at will (which in fact I do) with no risk. 

But of course I can't expect someone who is invested in bitcoin to admit that its future is in danger.