Consensus on the list of delegates

[Troglodactyl]

Can't you guys just change the rules slightly and get rid of the issue?

If there is an issue...

What exactly are you suggesting?  You're welcome to pull request a fix yourself, or even campaign for a delegate position and try to either work for our blockchain long term or try to sabotage it.

[Come-from-Beyond]

Can't you guys just change the rules slightly and get rid of the issue?

[Troglodactyl]

If an honest delegate signs a block that elects one or more new delegates, the newly elected delegates will clearly prefer that fork over the one in which the votes that elected them were ignored.

I suspect this will lead to fragmentation of the network which is very bad because it makes possible to do double-spending almost for free.

Also, this is most possible in a 51 vs 50 scenario. If the attackers had a sizable majority, say 81 vs 20, then it would be very difficult for the 20 to add enough ignored votes to their blocks to elect 31 more delegates and remake a longest chain.

Clearly if you somehow managed to get a strong majority of delegates hostile to the network elected, they could seriously disrupt service until they were voted out.   I don't think anyone here is disputing that. What I am disputing is the idea that they couldn't be evicted without a hard fork.

The hostile delegates have no way to maintain their power as long as honest delegates are also active, and the hostile delegates can't get rid of the honest ones. The more they disrupt the network, the faster the voters would respond and vote new honest delegates in on an honest block.

[Chronos]

If an honest delegate signs a block that elects one or more new delegates, the newly elected delegates will clearly prefer that fork over the one in which the votes that elected them were ignored.

I suspect this will lead to fragmentation of the network which is very bad because it makes possible to do double-spending almost for free.

Also, this is most possible in a 51 vs 50 scenario. If the attackers had a sizable majority, say 81 vs 20, then it would be very difficult for the 20 to add enough ignored votes to their blocks to elect 31 more delegates and remake a longest chain.

EDIT: It should come as no surprise that 81 delegates can control the chain. What is notable is that 81 delegates can (maybe) control the chain and never be voted out without a hard fork, and that bribery methods can (maybe) turn a delegate majority into a Nash equilibrium outcome.

[Come-from-Beyond]

If an honest delegate signs a block that elects one or more new delegates, the newly elected delegates will clearly prefer that fork over the one in which the votes that elected them were ignored.

I suspect this will lead to fragmentation of the network which is very bad because it makes possible to do double-spending almost for free.

[Come-from-Beyond]

Really? How is this true in the United States?

The USA has weird laws, I'm talking about the rest of the world.

[Troglodactyl]

Come-From-Beyond has been explaining for 6 pages, haha. I'll summarize:

• 51 of 101 delegates decide they never want to be fired (via bribery, for example).
• These delegates ignore all blocks from the other 50 delegates. Their chain is longest, so it is accepted. The 50 are powerless.
• The 51 delegates ignore all transactions that vote them out, but they still produce blocks without these transactions.
• In the end, the accepted longest chain never votes them out. They can sell all BTS and maintain control of the chain.

Do I understand correctly?

Yes.

No.

The hostile delegates can't prevent the honest delegates from creating blocks. All they can do is ignore those honest blocks.  If an honest delegate signs a block that elects one or more new delegates, the newly elected delegates will clearly prefer that fork over the one in which the votes that elected them were ignored.

[svk]

...and then just start a new fork.

What will happen to DACs in this case?

It depends how the shareholders view it I guess, the idea would be to freeze "malicious" funds in the new fork but otherwise just pick up where the other left off. Depending on your interpretation it could be seen as a successful attack in which case you'll lose confidence in the DAC and move on, or you could see it as a failed attack that was successfully fended off. One of those glass half-full/half-empty kind of things..

[donkeypong]

Basically, it's possible for any election on the planet earth to be "bought" in one way or another. So you're saying that elections are always suspect? That BitShares delegates will care more about a potential small bribe than about their longer term financial interest and fiduciary duty to act in the best interests of BitShares? I certainly don't see this as a solid possibility.

Modern election systems are more secure because the branch of the state that supervises election process is not controlled by another branch which is being elected.

Really? How is this true in the United States?

[Come-from-Beyond]

...and then just start a new fork.

What will happen to DACs in this case?

[svk]

Come-From-Beyond has been explaining for 6 pages, haha. I'll summarize:

• 51 of 101 delegates decide they never want to be fired (via bribery, for example).
• These delegates ignore all blocks from the other 50 delegates. Their chain is longest, so it is accepted. The 50 are powerless.
• The 51 delegates ignore all transactions that vote them out, but they still produce blocks without these transactions.
• In the end, the accepted longest chain never votes them out. They can sell all BTS and maintain control of the chain.

Do I understand correctly?

If all they wanted was to sell their BTS they'd be better off doing that before attempting an attack though, as the attack will be detected very quickly and promptly cause a big drop in the price of BTS. Being a delegate doesn't give you magical powers to spend BTS you don't have, so I still don't see the economic incentive for anyone to do such a thing, although of course a theoretical malicious entity (read government or bank) might be more plausible.

Even so, like BM has said many times: we'll take their money that they need to spend to gain control of the network, say thank you very much and then just start a new fork.

[Come-from-Beyond]

Basically, it's possible for any election on the planet earth to be "bought" in one way or another. So you're saying that elections are always suspect? That BitShares delegates will care more about a potential small bribe than about their longer term financial interest and fiduciary duty to act in the best interests of BitShares? I certainly don't see this as a solid possibility.

Modern election systems are more secure because the branch of the state that supervises election process is not controlled by another branch which is being elected.

[donkeypong]

So then what would be the point of doing all this?

The point is just to show that power that controls election will stay on the top forever. This is what we observe in a lot of dictatorship countries where elections are faked.

Basically, it's possible for any election on the planet earth to be "bought" in one way or another. So you're saying that elections are always suspect? That BitShares delegates will care more about a potential small bribe than about their longer term financial interest and fiduciary duty to act in the best interests of BitShares? I certainly don't see this as a solid possibility.

[jsidhu]

Its a moot point to try to do this because:

1) The attack will render the value of the underlying asset useless, just like a bitcoin 51% attack. The top mining pools have financial incentive to keep going honestly, just as delegates do.
2) If it does happen we can hard fork and start again, ofcourse it would hurt value unless people believe its a bargain and we end up higher because we survived a hard fork attack
3) If they don't do it fast enough they will get fired as they try to collude, if people find out... all it takes is one leak. Its too hard to keep a secret like this when there are so many parties involved.

With points 1/2 and 3 it is less likely we see the scenario play out as CfB wants it to. Is the block signing system more robust than bitcoin's? I think so, does it improve upon the efficiency of consensus protocol? Yes for sure.

If the system withstands itself from this attack (which is probably the #1 on the list of types of attacks on bitshares) then we have a self re-enforcing system that will end up stronger than it was before.

In what case would the system not be able to withstand itself from this attack? The only case I would see is if people end up shying away from the project because it got hacked and wasnt' recovered in a timely manor. Even though their keys would still be intact they may lose confidence... however I find this very unlikely to be the case.

[Come-from-Beyond]

Come-From-Beyond has been explaining for 6 pages, haha. I'll summarize:

• 51 of 101 delegates decide they never want to be fired (via bribery, for example).
• These delegates ignore all blocks from the other 50 delegates. Their chain is longest, so it is accepted. The 50 are powerless.
• The 51 delegates ignore all transactions that vote them out, but they still produce blocks without these transactions.
• In the end, the accepted longest chain never votes them out. They can sell all BTS and maintain control of the chain.

Do I understand correctly?

Yes.