points by nullc 5 years ago

Proof of Stake offers precisely zero security in the context of decentralized systems unless you already have a consensus system: https://download.wpsoftware.net/bitcoin/pos.pdf

Advocates of it have responded to fact of PoS's tautological security by applying seemingly unending amounts of complexity, essentially obfuscating their design until people give up reviewing it. Cryptographic security against review is not cryptographic security, it is the opposite of it.

At best these schemes have security that reduces to the underlying consensus mechanism that they're running on top of (which usually ends up being some not-at-all-decenteralized system like the Ripple UNL, where all participants must accept a consistent set of authorities or it will eventually fail to converge), but they can do worse than that-- and often do, as a result of vulnerabilities that come out of the obfuscation.

Vitalik Buterin isn't a stranger to making deceptive claims: Before he created this technobabble laden massively pre-mined altcoin, and dumped it on an unsophisticated public while misleading them about its properties, he was primarily known to me as some kid that got banned from the Bitcoin chat channels by driving people nuts trying to solicit people to invest in his sham "Quantum Miner" project.

If by chance these systems act in a secure manner in practice -- e.g. they successfully operate as a centralized consensus and the central authorities remain benign -- their economics lock in massive ongoing revenue streams for their prior participants. Especially in the context of a system which pre-mined some 72 million coins most of which are illiquid held by a small number of parties-- as selling them would completely collapse the market-- the result is a tremendous rent-seeking windfall.

In fact, when Vitalik made the decision to edit the ethereum ledger to claw-back funds taken from himself and others as the result of the technically-correct (but surprising) execution of "DAO" smart contract, part of the justification given was that if the funds were not taken back the system couldn't make its impending transition to POS (now delayed for years) because POS would benefit the "hacker". So it isn't surprising to see continued efforts towards that model from the persons who most stand to gain from it, even after years of delays and failure. Nor is it surprising that this article extols greater ease at editing the ledger ("recover from attacks") through processes external to the rules of the system as a purported _benefit_ of the proposed insecure mechanism. It's not that unusual to see a security weaknesses spun as advantages, but it is unusually audacious and self-serving in this case.

There are plenty of systems in the world which are perfectly happy with a distributed-but-centralized security model as they can have robust and clear security properties within the scope of their limitations. People should be happy to use them where they fit their needs. I don't think the world benefits from having more systems with security models obfuscated by pretending to be strongly decentralized when they are not, no matter how many benefits can be derived from not being decentralized.

miloignis 5 years ago

I read the criticism in the paper you linked, the article itself, and the FAQ (https://eth.wiki/concepts/proof-of-stake-faqs) linked in the article.

In my opinion, it seems like the criticism in the paper is valid, but the conclusion is too dire. Proof of Stake is a different and weaker model of consensus than Proof of Work, but one that seems practical enough for the real world. To address the two main criticisms in the paper, the FAQ seems to state that there are decent schemes to inject enough randomness to prevent stake grinding, and that Proof of Stake does have a "weak subjectivity" as a con, but that in the real world coordination on which block is real to get started on out of band isn't too onerous. Asking a trusted friend or just looking at major forums or whatever would work to get started, and then after that you don't need to keep trusting a third party. Trust on first use, kinda, which a lot of us use every day, SSHing into things, but this case is even better because your first trust can be to a friend or trusted party.

This seems like a very reasonable concession in order to not burn wild amounts of electricity and make the system much more sustainable.

  • chytrik 5 years ago

    > Asking a trusted friend or just looking at major forums or whatever would work to get started, and then after that you don't need to keep trusting a third party. Trust on first use...

    The 'weak subjectivity' issue doesn't just arise at the first use, it becomes a very important consideration in the event of a network fork (ie, a bad actor attacks the chain, and users attempt to defeat the attack by following a different chain that ignores the attacker). This is a much larger issue, it is easy to find consensus on a 'genesis block', but finding consensus in the moment of an uncertain/contentious chain-split is very different. At best it falls back to trusting some centralized party to make the correct choice, and then having a large enough portion of the users follow them.