EB76 – Emin Gün Sirer & Ittay Eyal: From Selfish Miners To The Miner's Dilemma

Transcript

this episode of epicenter Bitcoin is brought to you by shapeshift.io with no account sign up required it's the easiest way to buy and sell Litecoin Dogecoin darkcoin and other leading cryptocurrencies go to shapeshift.io to instantly convert all coins and to discover the future of cryptocurrency [Music] exchanges hello welcome to epicenter Bitcoin the show which talks about the Technologies projects and startups driving decentralization and the global cryptocurrency Revolution my name is Sebastian and my name is Brian faan crine today we're going to revisit a topic that we've talked about often in the show which is the issue of Mining centralization and we're joined today by

Amin G and it a the both at kenell University in computer science uh well computer science professor and postto and they've done a lot of uh important work in this field so I'm super excited to have to join us for this discussion today so than thanks guys for coming on thank you for having us thanks for having us so to get started can you give a brief introduction about how you got involved in Bitcoin and what made you guys curious about this in the first place so for my part um my interest in cryptocurrency started a long time ago actually it predates uh Bitcoin uh back in the 2000s my research topic was

self-organizing networks I was looking at peer-to-peer networks and uh one of the problems in peer-to-peer networks especially like networks like bitor where people are expected to donate resources is keeping track of who has donated how much uh how much resources to the good of the network and uh keeping track of that and also incentivizing them to actually provide more resources as opposed to freeloading So to that end I developed a cryptocurrency called karma and it was one of the first implemented in fact I believe it's the first implemented cryptocurrency that had distributed mining in it this was 2004 and U so that was my initial sort of foray into the space uh that thing get cited a lot in academic

circles so when Bitcoin came by uh I read the white paper I was very excited I was a little myth to be honest that it didn't site Karma um and I was like oh okay well let's find out if if these guys got it right or if Satoshi got it right and uh that that was the beginning of my interest in uh in uh cryptocurrencies yeah that's interesting because bit torent of course is is uh there's a big problem there about who's freeloading on the system and and uh traditionally people have I mean sites have uh used registration and kicking people off uh when they're freeloading or not providing uh enough enough resources to to support the wealth of

the network so right they do that um but typically they rely those sites rely on the actual uh value reported by your client and it's almost trivial to hack that so you can always say like hey I download I uploaded 15 petabytes if you want and get on the good side good part of the good good side of the of the website so um you need something more well we needed something more robust and that's what brought Karma along but most uh most bitcoiners don't actually know about history before Satoshi world begins with the white paper but there's absolutely there has been a lot of research in cryptocurrencies going back maybe two decades um Ron revest of course is uh is the is the one of the people who played a big role in this um

and uh sha David sha played a big role in this so there's a there's a lot of research going back maybe all the way to U you know I would say uh early 80s maybe even late 70s wow and itai what about yourself uh so uh like many others I heard about Bitcoin first from a friend uh he said yeah I'll I'll send you a couple of Bitcoins they were worth since then and I told him no I'm I'm not going to install yet another app on my phone uh and uh nevertheless I I went ahead and and look at looked at the the white paper satoshi's white paper and I read through it and I said nah this is not going to work and I basically forgot about it and after a while I don't know

why I I came back to it and I started reading more thoroughly uh to understand uh the depth behind it and first of all I was was convinced that it is kind of going to work maybe uh and second of all I started to think about ways where it might not exactly work uh and this is what led to the to the selfish uh mining uh research project that uh we did good and myself so how did you guys come together to work on this project uh I uh completed my my PhD uh two years ago and I came to work on uh the uted the systems here in Cornell and I had this Bitcoin idea and I asked

around and people told me go speak to this guy uh about Bitcoin and uh the rest of his history well so uh it Tai is leaving out the part about why he came to Cornell he came to Cornell to work on sort of old school distributed systems which was his main effort at the time and uh well he started doing this Bitcoin thing and the um name of the the the the tech file that contained the paper that became the selfish mining paper was called BTC Pro for procrastination so that that was his side project sort of uh that kind of blossomed into a line of research so how much of your time you to today spend on

bitcoin or cryptocurrency related research uh maybe most of it this is the the center of my research the uh security of cyber curreny IES and uh their their scalability and the novel properties that they Exposed on on distributed systems so for me I spend most of my time actually working on databases and data stores and Bitcoin is uh uh is a is not my main thing at the moment um but nevertheless I find that there are lots of exciting examples that I can take from the Bitcoin world and then apply to uh to data stores to to data management data visualization and so forth and the thing you brought up before this idea of karma embedded in in

born I mean that I I've definitely heard this idea before right of having uh cryptocurrency embedded uh did you ever think of uh revisiting that idea and sort of relaunching it with uh cryptocurrency or has someone else done something like that um I haven't actually looked I I've heard it many times um you know mention many times myself um so we ended end up actually doing a startup for some time around 2007 that did use something like a currency tokens uh unforgeable tokens actually to keep track of people's uh people's uh sort of resource contributions and then to award them uh

resources proportionately to their contributions but it was it's been a tough space the whole peer-to-peer file sharing space is a very very tough space most of the the companies that were operating in that world have gone bankrupt at least uh at the time I was looking into it um video bandwidth is so cheap now that uh maybe there aren't that many use cases also in the US at least um residential internet speeds have stalled so we don't really see that many opportunities to to to win big by taking advantage of peer resources now meanwhile it has proven to be very efficient in my opinion and often the fastest way to get have access to files absolutely I was I did a startup in this

space I was convinced it was going to take off um but but timing is everything you know 2007 and 200 you know whenever it is the three years that we did that startup um there was a stall and uh and when we watched all of our competitors mostly go go bankrupt one of them got acquired by aami aamai uses peer-to-peer uh for uh Distributing game updates for example it's a very scalable way of getting to your users technically it's it's a very very solid idea Market wise I don't know it wasn't it wasn't the right time for us back then it might once again be the right time well we just recorded a podcast with Paul Brody who was doing the internet of things for IBM and you know they did this Internet

of Things prototype and there one of the components is bitorrent right so they they propose using bitorrent for devices in the future to send data around so maybe it will have its comeback oh undoubtedly undoubtedly these Technologies never go away and and the core technical base is pretty is super exciting and you have access to a set of functionality that's otherwise very expensive to deploy so um so yeah no it's it's not going anywhere so um talk about the selfish mining paper is is that your has that been sort of the main uh the main part of your work or maybe the the main result of your work or so it was the start of our work I would say so uh um the we've gone

Beyond selfish mining to look at a bunch of other issues so I think maybe to give give this some historical context we started by looking at what made the blockchain secure and whether those protocols were indeed uh as good as claimed whether the sort of the folk theorems around Bitcoin really held and they mostly hold except you know some of the most fundamental ones were we found with selfish mining were not right that that the protocol as devised by Satoshi could be gained that was the big sort of surprising result with selfish mining following that we started looking into other issues related to mining especially centralization so Two-Face proofs of work for example to avoid centralization to uh uh to to make sure

that people don't grow too big then itai looked at um at mining pools and Mining pool strategies uh what what their best options are and what when they can attack each other and under what circumstances they would do so uh which is its own fascinating line of work and these days we're looking at how to address uh two issues that I think are the burning big issues with Bitcoin at the moment which are scalability of the network and uh security of the network I think security affects adoption quite a bit and uh and so those are are the two things that sort of drive us and so with the work and research that you've done in distributed database systems I suppose that you have quite a I mean you have a different view perhaps on

scalability than someone who's solely um involved with in Bitcoin right um perhaps I think the goals are the same everybody wants the network to to scale out and uh and to scale up right so uh bitcoin's very good at scaling out in incorporating new players that's wonderful um in scaling up there may well be some limitations and uh at the moment the block size Etc limit the network to uh a number of transactions that serves the network well but will likely not allow it to compete with visa and like and so we want to to make sure that the network is competitive well let's revisit the the topic of

scalability later um for selfish mining can you give a a summary of what your finding was in that area uh yeah yeah of course so uh the the the main results perhaps to start with the bottom line is uh that uh you need at least 2third of the network uh to be honest miners so we're talking about the miners that generate the blocks H it was commonly believed that as long as a majority more than half of them are honestly working then the network is fine and what we found out is that you actually need at least uh 2third of the minors to be honest uh and

actually this is uh an optimistic bound uh if you don't make any assumptions then the bound may be even worse so you'll need more than 2/3 for the network to be safe um the attack is is uh is not terribly complicated the analysis is not trivial but the attack is is uh pretty elegant and straight forward ER you know that blocks are generated one after the other and when a minor generates a block is supposed to publish it to the network and then everybody work and try to create a block that will follow this original block and with selfish mining the attacker keeps the block to itself and mines on

top of it uh without exposing it to the network and it only exposes this secret chain the local secret chain when it has to uh in order to maximize its Revenue so uh it turns out that by doing that a minor can actually increase its revenue and earn more than he should more than his fair share of the mining power and this this is the the essence of the attack so I mean I presume if if a minor holds back the block right so you you of course run a risk then that someone else finds a block and and sort of the valid block you found now you know the block rewards lost and you lose the money what what in what

situation is it still better for the minor to hold back and not publish it it's uh it's it's kind of like a winning strategy at Blackjack so you're not going to always win it's uh uh it's not there are cases where you take a risk by holding the block and you know the one that you identified as the first block that you have uh discovered and you're keeping it secret if the network finds a block at the same time well then now you're at a bit of a risk and you might indeed lose that one block um but as I said it's just like a strategy in blackjack on on average you are expected to win because sometimes you will end up winning in the network and you get you

will end up uh progressing more than the the network itself the honest people who came up with the competing block sometimes you'll end up building two blocks on your own that you're keeping secret so when the network comes up with one block well you then plunk down your two blocks and uh kill off and orphan off that other one so there are a number of scenarios where you win and uh uh I did the analysis on this and uh and it's h very clear that on average you're expected to win and in some cases you're expected to win with selfish so so is is the basic idea of this that uh a minor in this scenario can kind of waste work for other miners so that then his work is sort of a larger proportion of the

total work of the network and and thus you can yeah yeah you got it that is the core idea you can't with the hashing power you have um that's the hashing power you've got right so so now the trick here is uh getting other people to to work on solving what are essentially stale puzzles and therefore wasting their effort and uh thus allowing whatever percentage of the hashing power you've got to actually reap more rewards than than it's fair share okay so let just rephrase this the way I understood uh let's see if I understand this right so you have one pool that is conducting the attack and the rest of the miners the miners that are not participating in

the attack will mine blocks and then your attacking pool so for example the rest of the network May mine two blocks and then your attacking pool may have three and at that point you've held on to those three and then you publish them um essentially being one block ahead of the rest of the network yeah okay and then so if then the Bitcoins the subsidy um has been issued to those other to the rest of the network for those two blocks that they mind um what happens to to those Bitcoins have they been issued already or so the subsidy the way the subsidy works is that uh you only get your uh your cash if your block ends up in the

main chain uh I mean how subsidy implemented really it's just a transaction uh coinbase transaction at the head of the block so if you mind a block and you ended up ended up outside the main chain then okay right so indeed um you cannot exercise the the uh the block subsidy for 100 blocks after it has been mined so uh the selfish Miner will end up uh being able to if the selfish Miner is able to orphin your blocks off your blocks don't appear in the record they disappear and the selfish guy will collect those RS okay of course but yeah so so the basic idea right is that a minor basically tries to make other miners waste their hashing

power right so cuz cuz let's say you're ahead of everyone else and like two blocks now if you keep mining on that everybody else is mining on chain that's two blocks behind you're basically sure that all these other miners are wasting all that energy and as soon as you publish it's it's just all wasted work notice of course that you also waste some work like you you noted before so some of the blocks you generate are going to be pruned as well because uh someone else is generating the blocks and your block is pruned so you also o lose some of your own uh mining power and the point is that the others lose more than you do and because the um the mining rate is adaptive then over time

you will earn more than they do and I guess one of the consequences now as an attacker you really would care a lot about being con really well connected with the network no I mean I guess if you if you found the block know and if you have nodes all over all over the world and then maybe you could send the block already that was found to all those noes so that if another block comes in you can propagate it extremely fast no that's that's that's a very good point because the network uh is er is not prepared for that kind of attack so Bitcoin is incredibly robust uh to partitioning and uh denal of service

type of attacks uh it's it's uh in practice it has been proven that it's it has been demonstrated that it's impossible to to deny deny service or partition the network but uh Bitcoin doesn't try uh to propagate blocks very fast and so if you as the attacker uh build up the infrastructure to block to propagate blocks very fast then you're ahead and and Bri Brian you outlined exactly what a good attacker would do so uh I a little afraid of you right now but uh so indeed you'd end up building a network of sensors and uh you'd pre- place your block next to other people and uh that way as soon as you find out

that there's a competing block you can push your own block out and notice that full nodes uh they have a bit of a delay between uh accepting a block and forwarding it on so uh uh so that you can take advantage of that and your nodes don't have to have that delay especially if you've pre-placed your block across the globe uh you can really push yours out faster than other people right yeah this is solely for the one case like you don't have to um to necessarily win these battles every single time to win overall so if you're an attacker with more than 33% of the network then it doesn't matter if you lose these head-to-head battles inside the network you have so much hashing

power if you're above 33% that nobody can stop you because you'll be able to build on your own block with enough frequency that you'll be able to get more than your fair share that's why it's really dangerous to have people uh to have mining pools above a third of the network those lots more to talk about but before we do that let's take a short break to talk about shape shift shape shift is the fast and easy way to buy and sell altcoins if you've ever tried to uh buy and sell altcoins you know how complicated that can be you have to find a reputable exchange create an account there place an order wait for the order to be fulfilled that can take a long time not with shape shift shapeshift allows you to convert about 25 different alt coins and uh they're adding new coins all the time so you

just go to their website shapeshift.io and use their uh currency conversion tool which looks a lot like Google Translate for cryptocurrencies you choose the currency you want to convert so for instance Dogecoin and also the currency you want to receive so Bitcoin for instance and hit start once you do that you'll be presented with uh a uh do coin addressing QR code which you would send Dogecoin to and those would be converted and sent to the Bitcoin address with no confirmations needed so it's really fast takes anywhere between 30 seconds to a minute to uh for that transaction to go through and you don't need need to create account they don't even want your email address so your

privacy stays protected and uh that I mention it was fast cuz it is fast it takes uh no time at all so shape shift is the fast and easy way to buy and sell all coins and we'd like to thank them for the support go to shape shave. to give it a try and so can you explain then how so how would this play out if if if someone had an the idea to play out this attack and and and implement it um what would he do so that's a great question so there are bunch of interesting Dynamics so um here we would start or an attacker would start um by creating a selfish mining pool

controller that pool controller like as I explained before would not uh immediately publish the blocks he finds uh and instead would sit on them and would would get its uh miners to uh to build up on uh on its secret secret block now um so let me just stop you that does the does the pool does only the pool controller have to be aware of this attack or do the miners also need to be aware uh the miners are working for the pool controller and they will they will know what hash or on which hash they're uh they are um Mining and if they correlate that with the publicly known

uh tail of the blockchain then they will be able to tell that they are indeed currently being used to mine selfishly so that's one way to detect if your pool controller is a selfish Miner okay um which is I think where your question right so then so then the the pool controller you were saying ah so the pool controller then um has a has its own private chain so the thing that I was pointing out before is if the pool has more than 33% of the hash power it doesn't have to engage in any of these head-to-head battles it just doesn't care if it wins them it's nice uh but even if it doesn't win them it will still on average come out ahead because uh he'll be able to build chains of you know he'll be able to get ahead

by two blocks blocks on occasion and with enough frequency that you'll be able to kill off of the competing blocks and that alone will give him uh enough of a boost to get more than 33% of the revenue and after 33% he gets more and more and more um and a funny Dynamic develops this is this was part of the selfish mining work that was kind of interesting is um if if a selfish minor emerges and he's making money then uh suppose a new person comes long now you might imagine okay well what's what's this person going to do well he has two strategies available to him at the moment he could follow the honest protocol and then you'll make less money than he should because the selfish Miner

is operating in the network he could selfishly mine for himself and that's fine too um except you know he's not going to make all that much money with that because he's small or he could join forces with the existing selfish minor and that's where we found a very interesting Dynamic where by combining forces they actually make more money than they would individually so the network has a has an incentive mechanism for selfish miners to coales together and get bigger and bigger and bigger which is really dangerous for the network because that would tend the network or tend the selfish minor towards 50% so yeah so where would this end up right because obviously uh I mean at the

extreme when the selfish minor controls the whole network then there's no point of selfish mining anymore that's exactly right so uh the the analysis we use is actually only relevant while the selfish Miner the selfish mining pool uh is a strict minority uh once it gets close to 50% you don't need selfish mining to to earn more than you should you can do a much more devastating attacks um and there are the analysis here is is uh different you have to ask yourself uh how far would uh would an attacker want to go but I think the

point here is that we we don't want to test that uh we don't want the network to get there ER you don't want to trust on people's good intentions or make assumptions on their uh game theoretical uh incentives you want the N the network to be uh strongly robust against this uh kind of attack specifically you don't want to guess what the threshold exactly is so how large an attacker has to be we we show that it's somewhere between a very small minor and 33% but we don't really know what the minimum size of an attacker is and some of the pools even today are are

dangerously large to the extent that if if two or three pools decide to go malicious and join forces uh they can uh they can U uh start a selfish mining attack uh this is something that uh that the network should be able to uh provably prevent so so the 50 I was going to point out that the 50 50 the 50% threshold is like the apocalypse we should never never get there and the reasoning about the Ever After what happens after the apocalypse when you know the network has is under the control of a single single entity U for a decentralized currency it's it's very

hard to reason about what's going to happen at that point and as a Tai pointed out then you have to figure out well what were the motivations of the miners are they trying to for example maliciously take down the network in which case they're really they're just super happy when they reach that state or are they rational actors that want to make money well in that case maybe they'll back off slightly from 50% but hover at that boundary or maybe they have a bound there are a bunch of miners whose Machinery is getting out of date and they don't care if they eek out the last scent from the network within six months or whatever it is that their Machinery is timing out so there are a bunch of different considerations it's really hard to know what happens and so uh these sort of counterarguments about

oh a selfish Miner would never do that because he wouldn't want to hurt the network they don't really make sense um they all rely on assuming a whole lot of things about what the selfish minor wants in the long term um and and post-apocalypse so as a Tai pointed out um what we want to do is make sure the network is robust against such attacks and then in fact we developed a fix for selfish mining so that was the positive side of this whole line of research not only did we identify the attack but also identify a very simple fix that if a selfish minor were to emerge we could just deploy it so what kind of fix is that so the fix adds some randomization into the network that current people

took for granted that the selfish minor takes advantage of um so essentially what what we do is we make sure that whenever there are certain battles inside the network or sort of block blocks race inside the network we randomize who wins that is somebody who pre-aces his blocks somebody who gets rid of the delay from his uh node loops and so forth he doesn't have an advantage over the regular honest nose and so that ures that a selfish Miner has to be at least 25% uh big before he can succeed at the moment as it I pointed out we don't know maybe a 5center could actually end up mining selfishly and making 7% of the of

the of the money or a 10center could end up making a few other few extra percent uh we just don't know but with this fix we know that if you're below 25% selfish mining is not a sane strategy for you it's a net money losing strategy that's what the fix in shorts so but you know there is an impossibility on the other side of this so if somebody's bigger than 33% nothing absolutely nothing in the protocol can actually do anything about that uh that uh that selfish minor so we have to diligently so we have to have a threshold with our fix is 25% and we have to sort of put social pressures on people to uh to make sure they don't exceed the pressure now this F you

mentioned that the the if we get to this point we would implement the fix uh is this something that needs to be deployed when there is a selfish money tap occurring or can we implement this uh before that would happen that's a good question we it can be Implement in fact we've implemented it it t got the the code um and the the core developers know about the fix and but there have been other issues that are more pressing on the Bitcoin Horizon so uh it could be predeployment um it's it's ready to go everybody knows about the problem and the so but this is still only I mean as you mentioned right it only it only would protect from an

attacker that's you know not too big so sort of I guess they also means if we assume that an attacker would grow during the attack because others would join the pool to make more money then there would be a very narrow time window perhaps only during which one could uh deploy such a fix plus I guess there's always the situation right I mean if I'm if I were doing the selfish mining attack as an attacker you know even if that fix is deployed and now I'm not profiting anymore from the attack I might be willing to pay more to people to just come along until I'm above that

33% threshold th those are fascinating concerns and that's what actually led itai to his next batch of work which is what keeps the pools from growing without bound and we started out um just essentially being very worried that these pools once they get big there really is no Force opposing them and with selfish mining they they tend to get bigger and bigger and it's actually very dangerous for everyone so uh it tied some work on uh the uh the miners dilemma and he looked at uh sort of modeling what happens to big pools and he has a very surprising result and I'll let him explain it but it completely

blew at least my mind way that uh that pools that there is a force that keeps pools from growing without bound that pools could actually attack each other and in doing so uh make more money than they should that is they use some of their hash power to attack another minor a competitor and uh and end up wasting effort or seemingly waste effort but actually make more Revenue with why don't you explain the sort of the the forces at play that keep the miners in check yeah thanks good that was a perfect intro really ER I I'll start with some background maybe so the the basis for this analysis uh is something called block

withholding ER this this is an old attack uh from uh perhaps even from Adam Beck's uh hash cash work in 200 too and uh more recently it was mentioned by many Rosenfeld in 2011 uh so block with holding is a different kind of attack than selfish mining it an attack it's an attack that a minor with which a minor attacks the pool he's working for and the way it works is very simple uh The Miner works for the pool it rep reports partial proofs of work so it demonstrates to the pool that it is actually working for it but when the miner finds a full solution

so a full block that the pool can use it just deletes this block and does not contribute to the pool uh now because of the way Bitcoin works this block cannot be used for anything it's not like selfish mining the block is discarded so the miner harms the pool because it denies it from profit but it also harms itself because it gets less revenue from the pool that it works with uh and this was for a long time considered uh an attack that can only harm the pool and it costs you something it's a sabotage attack uh you decide that you want to harm some pool due to whatever uh personal or non-personal

reasons and you harm it and you pay something for the harm you cause but ER ju just uh recently last year um er Gavin and Reon asked the small question on Twitter he asked do we know whether uh block withholding is actually a better strategy in some cases and uh following this uh the following this tweet it turned out that there were at least uh three three Works in progress uh mine included uh that were actually investigating what happened when when someone wanted to use uh block withholding to increase the

revenue ER and uh the simple fact is that you can do that just as goon explains so one pool could uh decide to do block withholding against another Pool as if it was a minor and so reduce the other pool revenue and increase the first pool Revenue uh and so selfish so sorry so block withholding is sometimes not just uh not just a sabotage attack but it can only increase the attackers revenue and uh what was interesting for me what I started investigating is what happens when the two pools attack one another so pool a attacks pool B and the revenue of pool B decreases and the

revenue of pool a increases but then pool B decides to attack back and so it turns out that pool B can increase its Revenue a little bit so it won't earn as much but it would own more more than it was just being attacked and then uh the surprise came it turns out that when both pools attack each other both of their revenue uh becomes lower than what it would have been if they just honestly uh mined so what happens each pool has a motivation to attack the other pool whether or not it is being attacked it should attack the other pool so both of them attack each other and then the revenues of both pools

decreases this is the prisoners dilemma or in this case called it the minor dilemma uh both of them should attack and then both of them make less money we once had a talk about this actually at the the bill in Meetup here um and one one thing that sort of came up was the idea that a pool could maybe pay a bonus uh if for a minor who submits a full proof of work so who actually um actually finds a block of course this would of course a downside of this right would be that then the variant would increase for small miners right so so you you're compromising some of the actual benefit of a pool but

would this prevent this attack uh well you have to run the numbers with exactly uh what kind of bonus you're going to give in the most extreme case you just give the entire block to the minor and you're actually not uh not doing pulled mining ER but the answer is what you just said uh there are some Solutions like seniority and and bonus for for miners that find full proofs of work they all reduce uh the attractiveness of a pool and they could push miners to go to pools that do not have this limitation ER My Hope Is that uh this

discovery will lead miners to join forces in smaller pools where they really trust one another uh not to cheat and this could be very a very good step for the for the Bitcoin ecosystem where uh miners work in smaller pools they are still pulled enough for them to have a steady Revenue but uh the risk of decentralization oh sorry of centralization will be reduced so how would you get the miners in these smaller pools to trust one another because you you would still have the same incentives right I mean if you if you you can do this sort of uh withholding attack you you still would

right in even in a private pool yeah yeah that's exactly right so really only with outof band mechanisms they have to know each other know their identities or anything that would uh disincentivize a a minor from attacking but Brian this is a good development right so it's much better to have lots and lots of small pools uh than to have a few just a couple of really really large Anonymous entities that nobody knows who's behind how it's being operated and so forth so we would like Bitcoin to actually be really decentralized we would like the pools to be as small as possible yeah yeah absolutely right but the the question would be maybe if if it's if

it's actually really difficult to get those kind of agreements in the small pools then maybe that would mean for small Miner I'm not going to mine at all and then what's left could be you know larger miners who just mine on their own and not with a pool yeah that's a valid concern I think uh but people underestimate the um uh the benefits of even small pools right so if I have just a 1% of the hashing power of Bitcoin that's already uh low enough variance that is it doesn't really if you go from 5% to 45% you know all you're doing is hurting the network really the the reduction in variance is really not that big of of a of a game so I would much

rather see you know 50 1% 100 1%ers than than just a couple of uh you know as we saw with gash for example 155% that was terrible so so is there anything we can do to sort of you know hasten our progress to this world except for buying a lot of mining hardware and starting uh to you know mine on pools and withold blocks so to frustrate into downsizing that's a good question I think I think the nice thing is uh is that the the larger pools that are professionally operated um might actually attack each other and keep each other in check that is I was really

relieved to really hear of of of of itti's Discovery there it was uh it was essentially just like oh my God thank God there is something that's going to actually keep these guys in check because without this all we had was angry posts on on for forums and people put trying to put just social pressure and making noise whereas now we have a technical measure so if somebody gets really big then uh you might start eyeing them you know as as a potential attack Target and take them down a notch has somebody not I correct me if I'm wrong is it not Manny Rosenfeld who had proposed a system by which uh miners would be disincentivized from joining large pools

many has a very very nice paper on uh on different ways of paying out mining pools uh that I happen to like a lot I I think that in in rosenfeld's uh paper on on reward system he suggested the mechanism uh to to defend so for a pool to defend against uh against block withholding ER but by making a change to the way the proof of work works so not something that's directly able for Bitcoin but rather a different currency or a different method to solve it in a different currency um but as as as we said we we do not believe that this is

uh this is contributing to the health of the of the system uh we actually want uh pools to have this threat uh so they do not become too [Music] large today's magic word is is selfish s e l f i h go to Leto bitcoin.com to sign in enter the magic word and claim your part of the listener [Music] reward do you guys think this is sufficient because there are probably other ways right that the larger pools can benefit there but do you think this will be um sufficient

to sort of you know keep Bitcoin at least reasonably decentralized and does you know prevent some of these um apocalyptic scenarios from happening that's a good question it's hard to tell I think uh so far so good and Bitcoin has probably benefited immensely from having many of its participants be basically honest in fact in many cases alteristic participants right people run full nodes just to run full nodes um people do not engage in these kinds of attacks uh in selfish mining attacks for example um we've seen miners attack each other there have been cases of that which is a good

development because it breaks apart the really large open pools so so it seems like this is sort of keeping the the the community going at the moment um we might need additional mechanisms and U you know we we need a community of researchers to sort of think up what the different attack scenarios might be and what the defenses might be so Tai and I are to do our part there are many others like us actually looking into into Bitcoin now that it's it's gain so much traction and and has become such an interesting sort of fertile ground for ideas um actually this is a a great maybe segue to bring up one of my concerns so I I I've brought up with a few people and and once I we did an episode on this as well uh but it's just

a sort of and then I think this is maybe a little bit of a larger bigger picture and more longer term concern about security of proof of work but right so if we if we assume that an attacker actually you know has to go out and then purchase the majority of the hashing power to you know do all these evil things right then uh you know maybe today would cost I don't know $100 million or who knows how much maybe less but um so you know does this make sense to do that uh well depends right depends on on how much you can benefit from an attack so one of the things that wor me a little bit right is that with decreasing transaction fees uh well

transaction fees we'll see I guess but decreasing block reward uh you know that sort of as a proportion if Bitcoin gains in value um you know the the mining reward total man reward will be fairly small and thus the total value of the hardware will be fairly small so it will be actually uh quite cheap and become even cheaper in the future to attack Bitcoin so this is something that worries me quite a lot and I guess the most pressing point for that will be at the Block halfing right when a lot of mining Hardware becomes sort of worthless yeah I've seen a bunch of people actually worry quite a bit about the the block having and you're right it's going to have an effect um but I I

don't know that it's going to be a you know a devastating thing it's a uh as it is mining Hardware becomes stale or becomes sort of outdated fairly fast fast anyway so the miners are continually Ching their hardware and they don't have an infinite time Horizon they actually have typically a six Monon time Horizon so um so I think a lot of a lot of the worry there with the having is uh is probably a little misplaced sure we're going to have a drop in in uh in hash rate maybe um but I don't think it's going to make it um it's just you know there have been a bunch of alternative currencies that went through the having and they they did okay so I

don't see next July not this one the next July as being a big potential problem Point um but you know that's just my opinion on this I would like I'd like to add that I I don't think that the that the Hing is is a singular Point uh when when people buy their equipment and they when people exchange Bitcoin uh they know when having is going to happen and uh this is Incorporated in the exchange rate in the price of mining equipment in in everything uh it's not going to come as a surprise uh for the really long range uh when er when the subsid is is going to drop to zero that's a bigger question and really hard

to tell yeah I mean I mean actually when I started starting be concerned about that I actually talked about this with ch 11 at one point and I didn't even I was concerned about this thing before the block cing and he was like oh the block cing is when this is going to be most dangerous and I think this true perhaps but I I think actually what makes me more concerned is the possibility of shorting Bitcoin right let's say there's a Bitcoin ETF or like coin bases and maybe you can get derivatives from Wall Street Banks and stuff you know if you can take a a big short position on bitcoin uh well you know then uh it may you know let's say we can take a a very large short position so

that if you gain you can make $5 billion or something well would you lose a 100 million or 200 million on an attack well perhaps right uh and then an attack could even be you know it doesn't have to destroy Bitcoin it just has to disrupt it enough to the price to collapse right no that's a that's a real concern um you know it's uh it's yeah being able to benefit from the short side o opens us up to a larger number of players who could actually launch attacks um but uh but I have faith in the sort of the I have faith in two things one is the technology the core technology itself it really resists sort

of the um the a large classes class of attacks civil attacks um and uh uh and and dos attacks the N of service attacks really really well it's designed to do so um and the second thing I have faith in um which was borne out by what happened when the unintentional forast happened which was the community came together and managed to patch its way through what would would have been a devastating event and the fact that it was able to to assemble itself and react to it in such a fast manner is actually a very very good sign that should we Face some unanticipated thing uh we could potentially come together and develop a patch for it and uh and then

build from there so moving on to our next topic uh which is a topic of SC scalability which we is also one of those topics we keep coming back to and uh is quite discussing the ecosystem and in fact uh uh we had Talon a few months ago I believe uh and he just published a paper on scalability which I personally have not read yet but um getting the courage to do so soon um can you perhaps address some of uh some of the challenges that you think are most pressing to bitcoin with regards to scalability and some solutions that uh might um remedy those problems so the the the thing that prohibits

immediate and simple scalability is that it takes time for blocks to propagate uh throughout the network uh and if you make blocks larger or if you try to uh reduce the interval between blocks then uh you're going to get more forks and uh Forks are uh terrible uh for Bitcoin uh not in a catastrophic sense but uh if you have a lot of forks then it means that uh users have to wait for a longer time until they're sure that their transaction was in place so you're trading off bandwidth uh for latency you

on the other on the one hand you want to see transactions go out very fast uh and on the other hand you want a lot of transactions per second and uh this trade-off is is the big challenge for uh for Bitcoin scalability so on one hand you're uh so what you're talking about is increasing the block size to say 20 megabytes so on one hand uh you're including more transactions in those blocks but those blocks are taking potentially more time to get validated I don't think that we'll see that for 20 megabytes but uh if you if you reduce the I mean if you eliminate the limit completely and allow for for a 100 uh half a gig uh transactions then

suddenly you will have problems so I think it's illustrative to sort of think in uh just just as thought experiments to think about what would happen in the in the way extremes imagine that's what ital was mentioning imagine that your blocks are a terabyte big obviously it's going to take so long to transmit that block that by the time it it reaches you know propagates throughout the network other people will have come up with their own block and there'll be forks and so forth um also imagine that you shorten the time between blocks to um to let's say a minute and or maybe even less say to a few seconds uh and instead of um instead of waiting for six confirmations now you

wait for 6,000 confirmations same amount of time same amount of hashing power um it seems like it's an equivalent transformation to what we have now but it actually isn't it actually creates again lots of the opportunity for lots and lots of forks to arise so so you can see that these two solution strategies at least in the limit uh are not very good so um now there's a different debate being had among the core developers about expanding the block size from its current limit to its next up you know to going up one notch that's a separate issue um I think think that's essentially parameter selection and uh Itali and I have been thinking sort of more broadly about what fundamental things are at stake here and what are

the sort of the the bigger mechanisms that we could sort of play with uh to improve scalability um so we are in a preliminary stage at the moment and um the uh the scalability issue will play itself Out Among the core developers they're going to pick a set of block siiz parameters that make sense for the current Network as it is and current Network Bandits as they are um and uh we'll see um and our work will hopefully come in at a point that's not it's not suitable for immediate deployment right now but uh but will perhaps come in uh when those kinds of changes the parameter selection is no longer sufficient to really scale the network up so is there anything you can cuz

right I mean if you if you do those kind of yeah changes you go the 20 megabytes or whatever or 50 megabytes or something I mean uh that of course can work well as long as Bitcoin stays as like small Niche thing but then if you talk about the sort of aspirations when you have in the space then that completely insufficient right then you need to go up by much much more and uh you know we we did the internet Things episode you know if you imagine like now machine to machine payments with Bitcoin and stuff then you know maybe you actually you need to go orders of magnitudes above something that even Visa does today so do you think that will ever be

possible with Bitcoin I hope so I hope so we we are banking on making it so um so we're working very much on changing or adding things to the protocol not changing the base idea but adding things to the protocol that allows us to to reach out to maybe four or five orders of magnitude Improvement to the scalability rate cool that's great that someone's working on this when you say four five orders of magnitude Improvement uh on the current uh like basically on on what is currently possible now in terms of volume right uh yes yes exactly okay but you know with regards to what Brian just just mentioned if we want to get to some orders of magnitude like Visa or potentially uh handling the transactions

of several billion Internet connected devices well five five orders of magnet would be that would be uh so what is today maybe the limit maybe like five transactions per second or something no yeah three 3 to seven somewhere between 3 to 7 so if we go up to if we go up to 30,000 transactions per second we're already better than Visa territory which is 20,000 to 40,000 or maybe about Visa territory I think we can take a breather there and think about the next next thing after that yeah that's true maybe we should be um yeah we won't complain if we're there but yeah but can you say anything about like how cuz it seems like would that

still have one Central blockchain that holds all the transactions or would you have some sort of uh separate blockchains maybe or or do you think side chains are a part of that solution side chain so the ER like said we're we're keeping the uh the essence of of of of the blockchain technology uh still there it's not a completely different algorithm uh but uh perhaps it's a it's a bit too early to to talk about the exact details um side chains I think are are a different kind of kind of story

because um they're offering a different level of of security yeah uh in some sense each side chain uh takes care of its own security and it can go different ways okay well perhaps we'll have to come back and uh have you guys back on at some point when uh we can talk more about the scalability when the issue comes how we now can uh make all the the Visa people very angry that Bitcoin is now has more capacity so when we talking about the future of Bitcoin where do you guys see this going I mean I I guess we sort of alluded to it now uh by bringing up this Visa comparison is do you see

this becoming the sort of um currency or payment system universally used of the future or what's what's your vision for Bitcoin I would love to see that happen I'm not sure if it will um so it's uh as a scientist uh first and foremost we have to be open-minded there have been many other Payment Systems in the past and uh they succeed based on a whole bunch of reasons and now all of the stars have to line up for success I think um and then they fail and they get replaced by something else but I think the technology that Bitcoin brought to the table is so new and so so revolutionizing that that that core

technology uh the the idea of a global Ledger for example the idea of a self-organizing network that propagates these uh unfor transactions these core ideas I think are are here to stay with us for a while and um and there will be probably uh successors to bitcoin or perhaps uh Bitcoin will be its own successor if it's if it's good enough to evolve if the community around it is uh doesn't get stagnant doesn't get mired in uh technical sort of impasses and so forth uh so if it can actually evolve and change then uh then yes it's a lot of these the future is is wide open right I really don't see the value of of holding and exchanging shiny Metals um

and I I can imagine that uh that uh that the digital world needs a a digital store of value uh but it takes a lot to really be a a trustworthy store of value um so on that topic I think there are real challenges so scalability was one big challenge I think we talked about it a little bit uh the second thing that makes me uneasy at night is related to security it's in in particular related to security of clients and security of servers that is the sort of the exchanges and so forth that Implement Bitcoin Based Services or value added things on top of the blockchain so um the the client security story is as you know uh not so great it's okay for a

technos Savvy person to navigate you know there are these 37 step uh sort of uh writeups about what you're supposed to do to secure your Bitcoins and at some point they involve actually building a pyramid hiding your your paper wallet killing everybody involved in its construction and so forth you know these are yeah that's that's what it takes these days and it's just not really acceptable to go mainstream right you know your your uh non-computer Savvy relatives will find it difficult to actually keep their stuff safe and uh the we've had some some attempts to improve the situation I love multisig uh work but I find them hard to use myself so I can't imagine that that's actually

good so there has to be something better there and sadly I think we are dependent on our Computing infrastructure on on the security of cell phones on the security of laptops and so forth so we need better technology just fundamental infrastructure that's better more secure more trustworthy for client security I I I think so my view on security is that it it's gotten a a a lot better in last year and and we are getting there um I I personally think that there's a lot of technology that can allow for security so you mentioned multisig uh we could we could also mention uh some Hardware Solutions like uh like Ledger for instance um then it's just a matter of

figuring out what the right user experien is uh for that technology to be for for that technology to be used by you know uh just about you know anyone um but I do think that in terms of Technology uh I mean we're pretty much there it's just developing the right uh the right UI actually that's absolutely true uh in a very funny way for example uh the treasur and so forth the hardware wallets are fantastic right um except we can't expect to outfit the whole world with treasures it it turns out though that um that many laptops actually have Hardware in them called The Trusted platform module um it's just a few dollars worth of Hardware it's a secure

co-processor and it can serve the function of of a Traer that's right so so that's it's but it is a matter of changing our infrastructure right it's it's hard to tap into it uh if you use you know whatever it is like your typical Windows installation is going to have bit Locker in it but it's not going to be able to use um the uh the the the secure Hardware Cod processor for storing your bit your bit Bitcoins yeah and similarly like mobile phones are now I think in in two or 3 years now we're expecting to see mobile phones now all have a secret environment on which we can expect you know uh I'll come back to Ledger uh but you know they're also developing a um a secure OS to uh to be able to so people could actually have

these on their mobile phone so I mean I think we'll get there AB I think the the the client side security I I have sort of faith in that I within maybe two years years will be at a point where it's significantly much better and definitely usable for a large majority of people I mean just in one year we've made Leaps and Bounds uh it's a server side security that I I think we need to be more worried about and I think there there needs to be some real improvements in terms of Standards uh I dare I say legislation but no I don't um but definitely in terms of Industry standards um there's lots of there's lots of room to grow so I I agree so with my resarch your hat on

you're absolutely right so we know what it takes for example to create secure execution environments we we know what it takes to attest to properties of an operating system so uh we know how to take advantage of trusted platform modules for example so I I am also more hopeful on the client side than I am on the server side on the server side the the problem really stems from the way people construct these services so if you're in the valley uh you're hearing this sort of narrative about how to create create web services and you know that narrative is always Illustrated with personal blogs uh or low value services that you know I want to put up a little Dynamic web page here and there oh sure you know deploy mongodb uh you

know use this cache or that or whatever and voila you've got a web page uh that sort of does something cutesy uh but when you're dealing with actual things of high value like Bitcoins that kind of technique is no longer good enough in particular people end up using these nosql databases to store their data and uh the first generation nol databases that people go to like typically have incredibly weak guarantees they do not guarantee consistency they do not guarantee fault tolerance and people have been building websites based on these Technologies so if you do do that well then you'll find yourself in a terrible terrible situation where uh you're using some database to to store something really valuable and that

database doesn't guarantee anything that what's good for a Blog isn't good for a bank so that's really the main concern on the service side I think well I I think that's where standards needs to uh need to uh come into play right I mean absolutely either standards or better education perhaps yes yes also better education um but as as the client side security becomes better and better I don't think we'll need to rely so much on these server sight Solutions um um no I disagree with you on that one I I disagree with you on that one I think we'll always need centralized Brokers to find each other imagine local Bitcoins for example um it's it's yeah you can do it in a peer-to-peer fashion but it's

hard imagine any kind of an exchange yes you can have a decentralized exchange but it's actually not going to perform as well it's going to be hard to audit it's going to be open to all sorts of attacks uh so there are a bunch of uh bunch of unsolved problems on the decentralization side when it comes to these Services I I don't think they're going away for the next 5 to 10 years yeah I I I was specifically talking more about uh uh holding of coins so rather than everyone flocking to coinbase or some other coinbase competitor as security client side security gets better then I I would assume people would have um and also with education people would hold their coins uh but I may be wrong on that no no I agree I

agree on the on the uh wallet Services PL absolutely so uh indeed people should be holding their own coins on their local security devices as opposed to uh uh to trust in something that Co savy I I I would like to agree with that but also to note that there is an inherent problem here uh another tradeoff uh so on one side you want uh you want Security on on the other side you want robustness so how much are you going to trust your your phone uh to hold your your coins I mean it can just be I don't know fall into the river or something and then you lost your coins so uh you need replication and when you have replication the attacker has uh more surface to to to get your uh your

secrets away and this is a problem that uh starts with uh with client side and goes on all the way up to the largest uh uh Services out there that need to to replicate their their um er their cold wallets uh in a way that's uh both robust and secure and it's it's a challenge there is I don't think there there are many similar scenarios anywhere for for any kind of data yeah I mean I think one of the one of the key things too is I mean I think Sebastian you toally right right like

the I'm sure the it will become much much easier to hold uh coins securely with harder Etc but that being said of course things will still go wrong right sometimes people won't do it proper L probably very often they won't do it properly and they will lose their coin and and I think that is a very difficult thing right because when people just like random people who like now get excited about this Bitcoin thing and then they lose their coin and there's no one to turn to like there's no one they can call and say and they get it back or something I think that's a that's a big challenge to somehow deal with that and uh yeah I think that's cuz that's just not what people are used to right people

are used to something goes wrong they can call the credit card company say like hey it was stolen like something happened um and and I think that's also one of the reasons I guess why people will like hosted wallets right they will regardless of the security regardless of what you know someone says all insurance on that and stuff I think that that that's very attractive no no I agree that there I think there's still some some space for some centralized service but uh I I mean I would like to uh to see it moving into a Direction Where We don't we don't have Reliance on that so much anymore no absolutely of course and and I think it's fantastic that yeah with Hardware multis Etc you know it gets much better but yeah I think yeah I mean the server side I I agree I agree

with that concern I think that's a big challenge so then I shouldn't use mongod DB to for my uh exchange startup idea but what you not yeah no not if you care for your Bitcoins cool well uh thanks so much for coming on today guys it was it was really great talking with you super interesting and uh thanks it was a pleasure and I think maybe maybe we can do another episode at some point when it comes to the topic of scaling to 30,000 transactions we're working towards it thank you very much for having us yes okay well thanks so much and um yeah thanks for listening for listening if you want to you can follow us on Twitter at enter BTC and you know we will be

back next week with another episode [Music]