07:08 <maaku> bsm117532: that's a flawed argument. you're saying "if all the other miners do X, the incentive for a given miner is also to do X"

07:08 <maaku> but that's presupposing that all the other miners are acting that way

07:09 <maaku> the very question is whether the incentives are such that the other miners should in fact be doing something else en masse

07:10 <maaku> selfish minig works because of a difference in information availablility which is just as true in a DAG model as otherwise, and there's no reason to think that witholding blocks won't work for the exact same reasons

07:14 <maaku> depending on the proposal in question you may have to mine a long chain, purposefully double spend, etc.

07:14 <maaku> it's kinda hard to say though because there aren't actually any proposals to analyze

07:15 <maaku> which makes it very unintersting to talk about at all /topic (for me at least)

10:21 <arubi> o/ , I've been thinking about an atomic coinswap scheme that uses a signature and a public point's discrete log as the secret in the script (instead of a hash). if it works, it could allow for unlinkability between two coinswap transactions. I wrote how it could be used as a drop-in replacement for CoinSwapCS style swaps here (PDF) : https://github.com/fivepiece/coinswap-blind-secret/blob/master/coinswap_blind_secret.pdf . I'd

10:21 <arubi> appreciate the input

10:25 <arubi> *the drop-in replacement is for the HTLCs (in case a swap fails)

10:52 <nickler> I haven't worked through the protocol but it looks useful in a non-Schnorr world. If we have Schnorr/taproot then adaptor signatures seem to be better at hiding the contract. Are you aware of https://github.com/apoelstra/scriptless-scripts/pull/1 ?

11:03 <arubi> nickler, yea, actually waxwing linked this to me a couple of days ago but haven't worked through everything yet. I agree wrt usefulness in non-schnorr, where we have much better schemes. this one I linked can be used today (if secure :) )

11:47 <bsm117532> maaku: If a DAG is used as a pool instead of a coin, you're beholden to the selfish mining properties in the parent chain.

11:47 <bsm117532> If it was a coin, you'd solve the selfish mining problem. If ALL miners are using the DAG-pool, you'd also solve the selfish mining problem.

11:48 <bsm117532> In between is messy.

11:53 <bsm117532> One idea we've bounced around is to have the braidpool actually execute the selfish mining algorithm against other pools, once it passes 34% of the total. This would force other miners to join the distributed pool, but is easy to subvert by "spy mining". And for that reason we probably won't do it.

11:57 <bsm117532> Throw an idea for an attack at me and I'll simulate it.