sipa changed the topic of #bitcoin-wizards to: This channel is for discussing theoretical ideas with regard to cryptocurrencies, not about short-term Bitcoin development | http://bitcoin.ninja/ | This channel is logged. | For logs and more information, visit http://bitcoin.ninja
Aaronvan_ has joined #bitcoin-wizards
AaronvanW has quit [Ping timeout: 240 seconds]
MaxSan has joined #bitcoin-wizards
Noldorin has joined #bitcoin-wizards
Aaronvan_ has quit [Remote host closed the connection]
AaronvanW has joined #bitcoin-wizards
MaxSan has quit [Ping timeout: 240 seconds]
AaronvanW has quit [Ping timeout: 248 seconds]
Noldorin has quit [Ping timeout: 255 seconds]
d_t has quit [Ping timeout: 260 seconds]
rusty has joined #bitcoin-wizards
d_t has joined #bitcoin-wizards
dabura667_ has joined #bitcoin-wizards
dabura667_ has quit [Read error: Connection reset by peer]
danrobinson has quit [Quit: danrobinson]
Belkaar has quit [Ping timeout: 276 seconds]
Belkaar has joined #bitcoin-wizards
Belkaar has joined #bitcoin-wizards
Belkaar has quit [Changing host]
neha has quit [Ping timeout: 276 seconds]
neha has joined #bitcoin-wizards
pro has quit [Quit: Leaving]
danrobinson has joined #bitcoin-wizards
d_t has quit [Ping timeout: 240 seconds]
chjj has quit [Ping timeout: 248 seconds]
Noldorin has joined #bitcoin-wizards
airbreather has quit [Read error: Connection reset by peer]
airbreather has joined #bitcoin-wizards
rusty has left #bitcoin-wizards [#bitcoin-wizards]
legogris has quit [Remote host closed the connection]
legogris has joined #bitcoin-wizards
dabura667 has quit [Quit: Connection closed for inactivity]
TheSeven has quit [Ping timeout: 276 seconds]
TheSeven has joined #bitcoin-wizards
Cory has quit [Ping timeout: 240 seconds]
dnaleor has quit [Quit: Leaving]
Cory has joined #bitcoin-wizards
TheSeven has quit [Ping timeout: 255 seconds]
[7] has joined #bitcoin-wizards
danrobinson has quit [Quit: danrobinson]
chjj has joined #bitcoin-wizards
BashCo has quit [Remote host closed the connection]
BashCo has joined #bitcoin-wizards
d_t has joined #bitcoin-wizards
MaxSan has joined #bitcoin-wizards
dnaleor has joined #bitcoin-wizards
d_t has quit [Ping timeout: 260 seconds]
BashCo_ has joined #bitcoin-wizards
daszorz has joined #bitcoin-wizards
BashCo has quit [Ping timeout: 240 seconds]
BashCo_ has quit [Ping timeout: 260 seconds]
CheckDavid has joined #bitcoin-wizards
pro has joined #bitcoin-wizards
g0d355__ has joined #bitcoin-wizards
Guyver2 has joined #bitcoin-wizards
BashCo has joined #bitcoin-wizards
MaxSan has quit [Ping timeout: 260 seconds]
JackH has joined #bitcoin-wizards
AaronvanW has joined #bitcoin-wizards
_whitelogger has joined #bitcoin-wizards
Noldorin has quit [Ping timeout: 255 seconds]
MaxSan has joined #bitcoin-wizards
CheckDavid has quit [Quit: Connection closed for inactivity]
<yoleaux>
@VitalikButerin Erasure coding has been known for ages as an attempted solution to the fraud proof problem; gmaxwell suggested it years ago. (@petertoddbtc, in reply to tw:895555712096419841)
<yoleaux>
@VitalikButerin It's also been known for ages that it doesn't work, as large-scale financial fraud can be hidden in arbitrarily small amounts of data. (@petertoddbtc, in reply to tw:895557678017110016)
<kanzure>
petertodd: don't you only need to protect against certain forms of fraud (such as: double spending, but not against bad scripts since client-side validation can handle that)?
Chris_Stewart_5 has joined #bitcoin-wizards
rgrant has joined #bitcoin-wizards
<instagibbs>
kanzure, pretty sure the discussion is on withheld data in a treechain like setting
<kanzure>
you still need replay protection in treechainland
<kanzure>
er i mean, anti-replay
deusexbeer has quit [Ping timeout: 260 seconds]
deusexbeer has joined #bitcoin-wizards
MaxSan has joined #bitcoin-wizards
rockhouse has joined #bitcoin-wizards
Guyver2 has quit [Quit: Going offline, see ya! (www.adiirc.com)]
Aaronva__ has joined #bitcoin-wizards
AaronvanW has quit [Ping timeout: 255 seconds]
Murch has joined #bitcoin-wizards
dgenr8 has joined #bitcoin-wizards
dnaleor has quit [Quit: Leaving]
daszorz has quit [Read error: Connection reset by peer]
Aaronva__ is now known as AaronvanW
MaxSan has quit [Ping timeout: 260 seconds]
Guest51547 has quit [Read error: Connection reset by peer]
prime_ has joined #bitcoin-wizards
pro has quit [Quit: Leaving]
_rht has joined #bitcoin-wizards
BashCo has quit [Remote host closed the connection]
_rht has quit [Quit: Connection closed for inactivity]
daszorz has joined #bitcoin-wizards
laurentmt has joined #bitcoin-wizards
laurentmt has quit [Client Quit]
arowser has joined #bitcoin-wizards
brutefruit has quit [Ping timeout: 255 seconds]
brutefruit has joined #bitcoin-wizards
arowser has quit [Quit: No Ping reply in 180 seconds.]
arowser has joined #bitcoin-wizards
harrymm has quit [Ping timeout: 240 seconds]
c0rw1n has joined #bitcoin-wizards
arowser has quit [Quit: No Ping reply in 180 seconds.]
prime__ has joined #bitcoin-wizards
arowser has joined #bitcoin-wizards
prime_ has quit [Ping timeout: 248 seconds]
c0rw1n has quit [Ping timeout: 255 seconds]
gribble has quit [Read error: Connection reset by peer]
c0rw1n has joined #bitcoin-wizards
JackH has quit [Ping timeout: 255 seconds]
gribble has joined #bitcoin-wizards
tromp has quit [Remote host closed the connection]
Cory has quit [Ping timeout: 255 seconds]
Pasha has joined #bitcoin-wizards
chjj has quit [Ping timeout: 240 seconds]
prime_ has joined #bitcoin-wizards
Pasha is now known as Cory
chjj has joined #bitcoin-wizards
prime__ has quit [Ping timeout: 260 seconds]
MaxSan has quit [Ping timeout: 255 seconds]
chjj has quit [Quit: WeeChat 1.9]
chjj has joined #bitcoin-wizards
tiagotrs has joined #bitcoin-wizards
tromp has joined #bitcoin-wizards
c0rw1n has quit [Ping timeout: 260 seconds]
tromp has quit [Ping timeout: 240 seconds]
chjj has quit [Ping timeout: 240 seconds]
<petertodd>
kanzure: client side validating scripts is the *easy* part; preventing double-spends is where all the difficulty is
chjj has joined #bitcoin-wizards
<petertodd>
kanzure: hmm... actually, maybe that's the wrong way to say it: mechanisms that succesfully prevent double spends all seem to require the same data necessary to validate scripts, so solving double-spends ends up solving script validity; equally they're essentially the same problem, as the definition of a double-spend depends on script validity
<petertodd>
instagibbs: it's not, vitalik appears to be talking about a very different type of system than client-side validated treechains
<petertodd>
instagibbs: notably, the description of treechains in that paper is weird and misses the point
tromp has joined #bitcoin-wizards
prime_ has quit [Ping timeout: 240 seconds]
<betawaffle>
petertodd: can you share the point? (for my education)
<kanzure>
you don't need the scripts if you are just making sure there's no double spends
c0rw1n has joined #bitcoin-wizards
<kanzure>
anyway, double spends can't be hidden in arbitarily small amounts of data. there's a minimum size to have a spend at all.
<petertodd>
kanzure: yes you do: if you can't validate the scripts I can burn your coins with a *fake* unauthorized doublespend
<kanzure>
fine, use a spending authorization. but it doesn't have to be the whole script.
prime_ has joined #bitcoin-wizards
<petertodd>
kanzure: my phrasing "arbitrarily small" is in relation to the whole of transaction history - as in the fraud where inflation happens can be a single txout
<petertodd>
kanzure: now, there *are* potential systems that change that property, like the limited volume schemes I've discussed on this channel a few years ago, but ethereum isn't one of those schemes
<kanzure>
i think there is value on focusing on the anti-replay problem with this redundant encoding scheme stuff
<petertodd>
kanzure: indeed it doesn't - I've proposed using the revealing of a hash committed nonce as a "trigger" for proof-of-publication-based single-use-seals, but the whole script *still* needs to be revealed even in that case (albeit, it can be encrypted so that only participants can understand it)
<kanzure>
you need an encoding scheme where fraud can be proven such that if there's not a single sig authorizing the inclusion of the transaction in the block, then the error code should be able to flag this
airbreather has quit [Read error: Connection reset by peer]
<petertodd>
kanzure: explain? what do you mean by "single sig"?
<kanzure>
well you need a list of inputs, if it's not signed by the owner then its inclusion in the block is irrelevant, right?
blackwraith has joined #bitcoin-wizards
<petertodd>
kanzure: wait, so you're assuming the transaction itself will be in a block? what exact type of system are you talking about here?
<kanzure>
btw, what are we talking about? is there a pdf?
airbreather has joined #bitcoin-wizards
<petertodd>
kanzure: a pdf for what part? :)
<kanzure>
i thought there was an error correction code used over the whole block, and the goal is a system where you can prove fraud merely by showing that there were inconsistent query results when different peers tried certain queries over the data
priidu has quit [Ping timeout: 258 seconds]
<petertodd>
kanzure: nope, that's not enough: the query wouldn't be inconsistent - that's easy - the query would be denied
<kanzure>
well that's the same as the current situation in bitcoin: you don't choose a chaintip unless you have the data or good crypto reason to accept
<petertodd>
kanzure: ah, but the whole point of this stuff is to achieve a scaling improvement
daszorz has quit [Read error: Connection reset by peer]
<petertodd>
kanzure: see, note how the plasma admits it has a honest minority assumption - an assumption that *other people* are doing certain validation tasks properly.
<kanzure>
oh is plasma what we're tlaking about?
<petertodd>
kanzure: ignoring erasure encoding, I obviously could have a system where I assume that collectively I and others have validated a sufficient amount of a chain to detect fraud
<kanzure>
(didn't know. reading is hard.)
<petertodd>
kanzure: heh :)
<kanzure>
hm wait why do you need to assume hte other validation results are correct, they are not proofs ?
<kanzure>
you need to precommit with your peers as to which ones of you are doing what queries
<kanzure>
and then if any of them abort, you need to take on that extra load
<petertodd>
kanzure: basically, because to fully validate even an erasure encoded system, you need just as much data as without the erasure encoding
<betawaffle>
erasure-coding != compression
<petertodd>
betawaffle: exactly
<kanzure>
sec, you are saying erasure coding validaion of individual proofs is ottal more work than.. er.
<petertodd>
kanzure: because if those other peers aren't actually validating, they haven't helped you in any way - consider the case where fraud has been hidden in a part of the chain that you don't have, and you're assuming someone else validated it - erasure encoding or not, you still have that problem
daszorz has joined #bitcoin-wizards
<kanzure>
their validation effort should result in a proof of some kind
<kanzure>
it should not be trust the peer results -_-
<betawaffle>
kanzure: that's the dream ;)
<petertodd>
kanzure: but see, currently other than moon math we don't know how to create a proof of validation for doublespends
<petertodd>
kanzure: incidentally, I was talking to one of the zksnarks team about this - specifically treechains - and we came to the conclusion that if they do crack the recursive zksnark problem - and they think they're close - treechains will be easy to implement
<kanzure>
what are the bounds on the proof sizes from the peers here?
<petertodd>
kanzure: no erasure encoding needed :)
<kanzure>
i am not convinced it must always be larger than just downloading the full block data or w/e
<kanzure>
(or more cost than bandwidth+validate of the original data)
<petertodd>
kanzure: an anti-doublespend proof is exceptionally hard, because a single double-spend that isn't caught breaks the whole system - I have a scheme to reduce the size of that by a linear factor, but no better than that
<petertodd>
kanzure: I'm not saying it must be *larger*, I'm just saying it's no *smaller*
<kanzure>
and what is the strength of the proof that it is no smaller? where is that coming from.
Dyaheon has quit [Ping timeout: 246 seconds]
<petertodd>
kanzure: what do you mean "proof"? erasure encoding simply takes a message k long, and transforms it into a message n long where n>k, such that the original message can be recovered by any k symbols out of n - that's obviously not smaller than not usin erasure encoding in the first place
<betawaffle>
petertodd: i don't think he's asking about erasure coding
Dyaheon has joined #bitcoin-wizards
<kanzure>
beween peers you transfer some proofs that you did some validation work over a part of the erasure encoded block
<kanzure>
you have mmade the claim that the total transfer or work for each of these peers will be strictly no smaller than just validating the erasure-encoded block in the first place (in totality)
<betawaffle>
how do you prove validation?
<betawaffle>
well, even that would be an improvement on reality
<kanzure>
you could probably do lots of two-way trusted snarks between your trusted peers
rjak2 has joined #bitcoin-wizards
rjak has quit [Disconnected by services]
<kanzure>
s/two-way/one-way
rjak2 is now known as rjak
<betawaffle>
wait, trusted peers?
<kanzure>
you are trusting them to do the work they promised. then you check their results.
<kanzure>
try to keep up! :-)
<petertodd>
kanzure: by "validation work", what exactly do you mean by "validation"?
<betawaffle>
:D
<kanzure>
petertodd: checking the chunf of erasure encoded block maybe? i'm not sure. this is underspecified.
<kanzure>
hah chunfs
<petertodd>
kanzure: like, can we nail this down to, say, a proof-of-publication index to shorten proofs-of-non-doublespend?
<petertodd>
kanzure: remember that erasure encoding just lets us recover a data structure - you still need to validate that data structure
<kanzure>
right, but it's sharded validation of some kind (i don't know if this is the right term)
<betawaffle>
sharded sounds implausible
<petertodd>
kanzure: you'd have to say what exactly is being validated there still :)
<betawaffle>
with a subset of data, you can't prove lack of doublespends
<petertodd>
kanzure: note that plasma is proposing a system that as far as I can tell assumes *multiple* currencies, that aren't actually fungible for each other
<kanzure>
betawaffle: ordered data can help
<betawaffle>
fair
<kanzure>
petertodd: i really haven't read the paper.
<petertodd>
kanzure: heh, I'm not sure I can say I've "read" the paper either, as it appears to be intentionally written to be obtuse enough that I'd need to spend quite a few more hours on it :)
<waxwing>
heh sergio was just complaining how long it is :)
<betawaffle>
"just make it long enough for the serious people to get bored"
<petertodd>
kanzure: what *I'd* call sharded validation, is the idea that we have a commitment to a data structure - not unlike a merkle sum tree - such that the data structure is validated in parts for self-consistency, with the assumption that the total set of validators achieved complete coverage of it. Again, a merkle-sum-tree is a perfect example
<petertodd>
betawaffle: it also includes nonsense like talking in terms of "computation"...
<kanzure>
why that assumption about total set of validators. is this different from the trust yo peers thing?
<petertodd>
kanzure: actually, "assumption" is the wrong word to use, I mean "somehow" we have to ensure that the validators have achieved complete coverage of it - or in some schemes, *sufficient* coverage
<kanzure>
yes but it shouldn't be based on a trusted set of validators that you join....
<petertodd>
kanzure: for example, in my prior volume-limited ideas, sufficient coverage could be less than 100% as fraud - IE inflation - could be bounded
<petertodd>
kanzure: exactly, equally, in a fintech environment, the fact that you *can* define a trusted set of validators makes scaling up quite easy - the basis of my proofchains work
<petertodd>
kanzure: corda for example is apaprently going as far as to rely on SGX, which will be trivially scalable at the expense of giving Intel the ability to commit serious financial fraud
<betawaffle>
oh, intel would never...
<kanzure>
"oops one of our server management opcodes interfered"
<petertodd>
betawaffle: I have a sneaking suspicion that at least some engineers in Intel are horrified by Corda's plans :)
<betawaffle>
i bet
<betawaffle>
petertodd: you don't know such engineers!?
* betawaffle
is surprised
<petertodd>
betawaffle: not to say that corda is necessarily *insecure* - in the context of fintech there are ways to mitigate SGX vulnerabilities w/ volume-related auditing, but it's definitely not trivial to get right
<kanzure>
no doxxing
<petertodd>
betawaffle: I don't actually know anyone on the SGX team
<petertodd>
betawaffle: (at least, on a personal level)
<waxwing>
a trust point is a security hole; the risk is never *only* fraud committed by the trust point itself.
<petertodd>
kanzure: ugh, there's far better tech than that :(
<betawaffle>
petertodd: like?
<petertodd>
betawaffle: well, admittedly, it's not packaged software, but the proofchains model that keeps all that data off the chain
<petertodd>
betawaffle: though, I probably should get off IRC and do some more work on making that happen :P
<betawaffle>
:P
alferz has joined #bitcoin-wizards
alferz has joined #bitcoin-wizards
alferz has quit [Changing host]
rgrant has left #bitcoin-wizards [#bitcoin-wizards]
arubi has quit [Ping timeout: 248 seconds]
Chris_Stewart_5 has quit [Ping timeout: 260 seconds]
pro has joined #bitcoin-wizards
<gmaxwell>
ugh thats yuck
<gmaxwell>
Nitcoin is not an arbitary database for other assets and the security assumptions do not clearly apply (e.g. if you start trading around a hundred million in foo-tokens that don't become worthless if bitcoin is attacked, attacking bitcoin to break foo tokens is not discouraged by the system incentives.
<gmaxwell>
Bitcoin*
<betawaffle>
oh yeah! nitcoin!
chjj has quit [Ping timeout: 246 seconds]
<gmaxwell>
and the registration requires additional unprunable data.
chjj has joined #bitcoin-wizards
<gmaxwell>
(and it burns nsequence bits :-/)
<gmaxwell>
So effectively it proposes making bitcoin perpetually worse in several respects, for the benefit of trading competing assets which may undermine the security assumptions of the system.
dnaleor has joined #bitcoin-wizards
chjj has quit [Client Quit]
chjj has joined #bitcoin-wizards
c0rw1n has quit [Ping timeout: 260 seconds]
c0rw1n has joined #bitcoin-wizards
c0rw1n has quit [Read error: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number]
daszorz has quit [Read error: Connection reset by peer]
echonaut has quit [Remote host closed the connection]
<bsm117532>
Well, we're going to see it for reals as ERC20 assets compete with ETH
<gmaxwell>
bsm117532: ethereum is far too centeralized to conduct that expirement.
<gmaxwell>
If someone starts saying that miners should accept ERC20 assets instead of eth for fees, then the users of that token have a non-trivial risk that the eth foundation issues another ledger update to confiscate them to protect the value of their ether holdings, or other lesser insanities-- like just announcing that any miner that does is attacking the network and should be avoided.
<gmaxwell>
(as they did when some miners started accepting free txn)
<bsm117532>
This is why multi-asset chains are fundamentally a bad idea. You have a database with IOU's or you have a single asset on your chain.
<gmaxwell>
Yes, that was part of my point.
<bsm117532>
Just reinforcing it...
<sipa>
i think IOU's on a chain are totally fine, but not wion a system that uses PoW
<gmaxwell>
IOUs on a chain sounds like snakes on a plane.
<sipa>
as the security of a PoW based system derives from its ability to pay miners in its native currency
<bsm117532>
sipa well then your "chain" is just a database. PoW is an asset.
<gmaxwell>
Databases are nice.
<sipa>
bsm117532: i disagree, but let's ignore semantivs
<bsm117532>
Databases are nice, and useful.
<sipa>
you could argue it is a distributed database system
<sipa>
but bitcoin's chainstate is also already a database
<bsm117532>
Sure fine, but it has no inherent value proposition, it's just record keeping, not an asset in itself.
<sipa>
the chain never replaces the chain part - but it could replace another consistency mechanism
<sipa>
sure, no need for a native asset in a federated distributed database
<bsm117532>
*sigh* I'm going to have to read this plasma paper... :-/
<kanzure>
just do the vulcan mind meld thing: reading is only necessary if you do not already know the answers.
<bsm117532>
Well. I respect at least one of the authors. And people are poking me asking me for my opinion. So at least I should give it a fair shot at not knowing the answers in advance. :-P
c0rw1n has quit [Ping timeout: 255 seconds]
<kanzure>
i think there's likely to be a fraud proof censoring problem in this one.
<kanzure>
if you assume non-censorship then i think you can get away with much simpler systems
<kanzure>
(i'm just guessing that it's one of their operative assumptions here.)
LeMiner has quit [Ping timeout: 260 seconds]
LeMiner has joined #bitcoin-wizards
c0rw1n has joined #bitcoin-wizards
Aaronvan_ has joined #bitcoin-wizards
Aaronvan_ has quit [Remote host closed the connection]
AaronvanW has quit [Ping timeout: 240 seconds]
Chris_Stewart_5 has joined #bitcoin-wizards
Dizzle has joined #bitcoin-wizards
blackwraith has quit [Read error: Connection reset by peer]
blackwraith has joined #bitcoin-wizards
Chris_Stewart_5 has quit [Ping timeout: 276 seconds]