Author [EN] [ZH] [ES] [PT] [IT] [DE] [FR] [NL] [TR] [SR] [AR] [RU] [EN] [ZH] [ES] [PT] [IT] [DE] [FR] [NL] [TR] [SR] [AR] [RU] [EN] [ZH] [ES] [PT] [IT] [DE] [FR] [NL] [TR] [SR] [AR] [RU] Topic: Blog Post arguments against DPOS  (Read 520 times)

0 Members and 1 Guest are viewing this topic.

Offline bytemaster

For the latest updates checkout my blog: http://bytemaster.bitshares.org
Anything said on these forums does not constitute an intent to create a legal obligation or contract between myself and anyone else.   These are merely my opinions and I reserve the right to change them at any time.

Offline bytemaster

Re: Blog Post arguments against DPOS
« Reply #1 on: August 16, 2014, 01:21:09 AM »
Response by Ryan Higgins:
Quote
This post is a response to a well thought out blog post by Piotr Piasecki titled Thoughts on Delegated Proof of Stake and Bitshares.
Delegated Proof of Stake is consensus algorithm first presented by Dan Larimar in a white paper of the same name published April 3 2014.
Although not explicitly stated I suspect Piotr acknowledges the numerous benefits that a Delegated Proof of Stake system offers. The primary purpose of his article however is to further the discussion pertaining to the security of the DPOS system.
Does the DPOS protocol sacrifice security to achieve its numerous benefits?
That is the million-dollar question. Piotr raises a number of security concerns over the Delegated Proof of Stake algorithm and in this article I hope to address them.
Thank you Piotr in advance to for the time and considerable intellect you have thrown into this assessment.
Preface.
It is important to note that this author is not claiming that DPOS is perfect. Likewise it is acknowledged that Proof of Work as used in the Bitcoin protocol and Proof of Stake are not perfect. No system is.
Through out this post we shall assess the threat levels as a direct comparison to the afore mentioned consensus algorithms.
In addition there are a number of attack vectors that Proof of work systems are more vulnerable to than DPOS systems. This post will not draw attention to these and simply address the concerns raised by Piotr.
Security threat #1 Coin Distribution
It is worth noting that the first implementation of DPOS is BitSharesX and it has not positioned it self as a currency or payment system like Bitcoin. It is the world’s first profit producing Decentralized Autonomous Company (DAC). Given this is its primary use it is perfectly fair that the creator be the 100% share holder. He need not give any of his company away and simply collect the profits himself.
But lets assume that in time, the creator does choose to sell or give away a small portion of his company. The market would have to factor into its price the centralization of power that stems from this. In this instance while still being a fair distribution of coins I think we can all agree that the market would be unwise to choose this DPOS chain as a general form of money because of its centralized nature.
If however a coin distribution method was used, that in the markets opinion created a high degree of decentralization, then it perhaps may be wise for the market to adopt this coin as a general everyday currency.  This would be similar to using your Apple stock to buy your groceries. If the technology allowed that to be frictionless, inexpensive and anonymous, then why not?
Security threat #2 Paying for Mining
Not so much a security threat as it is a discussion of potential capital gain. In the short term it is true that a Miner/Laborer may hoard their wares waiting for a price to come up to where it is profitable for them to sell. However there is a finite amount of resources the Miner/Laborer will be willing to spend. Eventually the profitable Miner/Laborer will win out.
To paint a more dramatic picture; this is the equivalent of saying the poorly run business will continue to operate at a loss waiting for the market to pay more for their services, just because costs are high. In a competitive environment customers will just move toward the well-run business.
Security threat #3 DDOS on Delegates.
Lets take a look at how a DDOS attack might look at POW and DPOS and compare.
With regard to DPOS while delegates are known their IP addresses are not known publically. But lets assume that through some detective work their IP addresses were discovered.
If any number of 1 to 100 of the 101 delegates are simultaneously DDOS’d and they fail to mine blocks then they are quickly voted out and other delegates are voted in. With block times of 10 seconds a small interruption to the network is made as some confirmations take up to 1000 seconds (17 minutes) instead of 10 seconds. A disruption to be certain. But not fatal.
It is important to note that delegates can campaign on their ability to defend against DDOS attacks and thus are incentivized to defend against that. If this was a concern to the users (stakeholders)  then that would certainly be an important selling point for a delegate.
But now lets suppose all delegates are DDOS’d. Now we have a problem that votes cannot be changed because the votes are cast in every transaction and transactions must be mined to acknowledge a change of vote.
This is a serious problem. In this instance all transactions would be unconfirmed for the duration of the successful attack. i.e.: Either the attacker runs out of resources or any one of the miners defends against the attack.
The stakeholders do have another choice. As a fail safe to defend against all manner of attacks users have the ability to hardfork with a single click in their wallets. Granted this is undesirable, but the philosophy here is through removing the barriers to hardforks you reduce the value of attacks because hardforks are so easy.
And the final consideration is that 101 delegates is just an arbitrary number. Stakeholders can choose to increase the number of delegates at any time. As the network grows this may prove prudent.
Before we get to how a DDOS attack might work on Bitcoin I would like to introduce an important concept.
A network is as secure as it is decentralized.
The more miners securing the network the less dependant on each miner the network is and therefore more robust.
As Bitcoin scales there is a clear trend toward centralization. In the very near future most people agree that giant purpose built water-cooled ASIC farms will be the norm.
Already Bitcoin is centralized to the point that with just 2 mining pools you can control 51% of the network. With just 4 ASIC chip manufacturers you can control 90%+ of production. And as we rapidly approach giant purpose built mining centers it is certainly conceivable that by controlling just 10 or so of these mining centers one could control 51% of the network.
DPOS proponents believe that the trend toward centralization is unavoidable and thus it is best to plan for it in advance rather than ignore it and hope it won’t happen
With this in mind DPOS proponents believe that at scale their system is inherently more decentralized and therefore more secure because 101 delegates is more than 2 mining pools, 4 chip manufacturers, and 10 mining centers. And if it were not, the DPOS DAC could simply add more delegates.
With that said lets return to how Bitcoin is affected by a DDOS.
Bitcoin is similar to DPOS systems in that the IP address of mining pools is not known. And as a result we have not seen a DDOS attack on the miners to date. All though not a likely event it is still worth discussing what would happen just in case.
One such attack could be against the mining pools. A sustained attack on the top 10 mining pools would at present knock out 80% of the mining power. In time miners could mine directly and avoid using a pool at all and the system would recover relatively quickly (hours or days), but during that time confirmations could take an hour each.
A big disruption. But not fatal.
Identifying and DDOS’ing 10 mining pools would however be an easier task than doing the same with 101 (or more) delegates in the DPOS system. Again a system is as secure as it is decentralized.
Another point of attack could be to DDOS the top 10 mining centers. Again the same challenges arise in identifying them. I think a similar outcome would be achieved as the DDOS attack on the mining pools. About 80% of the hashing power would be knocked out and block times could blow out to be an hour or more. However with this attack the miners may not be able to recover as quickly.
Again 10 mining centers is far more centralized that 101 delegates.
I think in both DPOS and POW systems delegates/miners/pools are heavily incentivized to defend against an unlikely DDOS attacks.
Security threat #4 Margin delegate coercion
This is a possible outcome, and because voters can vote for many delegates at once it is possible that large stake holders could “sell” their votes multiple times. Again we go back to the principle that a system is as secure as it is decentralized.
At this point we have to rely on the fact that a large stakeholder stands to lose far more by voting for an inadequate delegate that could ever be paid to him in bribes.
Where as a delegate position may profit say, $20,000 per year, a 5% stake holder could see their net position move in value by that much with a price increase of less than 0.1%.
While small amounts of corruption may move into the system, the incentives are still in place to eject poorly performing delegates quickly.
Making up numbers to illustrate the point; perhaps the 105th best delegate for the job does “bribe” a large stakeholder to displace the 101st, but it is unlikely that a large stakeholder would jeopardize their investment by voting in the 1000th best delegate (even if it was himself).
Also it is important to re-iterate that DPOS is positioned not as a currency but as a DAC. In the real world when shareholders vote for a board of directors the same corruption exists to the same extent.
Security threat #5 Some people just want to watch the fees burn
I think this argument appeals to the shortsightedness of the stakeholder.  Would you rather own 100% of the dry-cleaners down the road or would you rather own 10% of Apple Inc? Both stake holders and delegates are motivated to grow the value of the tokens. Doing this means attracting more customers. Customers are always your boss in the free market. Great products at low prices are the key to everyone’s success. Jacking up the fees in a competitive market would be counter productive to all parties primary goals.
Security threat #6 Malicious wallets and services
Should one of these DAC’s become so successful that the market chooses to use their tokens as a currency then I agree that in time the Coinbase’s of the world will appear and it is true that they will be in control of the voting power of the tokens that they are in custodianship of.
The owners of the private keys retain the voting power however. So the Blockchain.info’s of the world do not represent a centralization of power in this case. However a Coinbase like company does.
This move toward centralization is a detraction for sure, but one that poses little threat. Minimal gains are available to a nefarious actor who seeks to take over a majority of delegates for the sake of double spends.  Not to mention they are extremely transparent to the community, and would be devastating to not only the value of their double-spend gains but also to their business. Imagine a company like Coinbase throwing away their business and out casting themselves from the community for a silly short term gain.
The only way to be truly devastating to the DAC is for them to hold 51% of all tokens in existence. As with all proof of stake systems this is generally considered a very unlikely scenario.
Security threat #7 BitShares and lack of Gateway incentives
This is not a security threat and in this case not even specific to DPOS. This actually refers to the concept of BitAssets that are a feature of BitSharesX but not a feature of all DAC’s who choose to run on DPOS.
This is an interesting discussion point but for the sake of keeping this post limited to potential security threats of DPOS we will leave this for another day.
Conclusion
That is for you.  ☺ Does DPOS provide an increase or a decrease in security vulnerabilities compared to Proof of Work systems like Bitcoin?  Let us know in the comments below.
For the latest updates checkout my blog: http://bytemaster.bitshares.org
Anything said on these forums does not constitute an intent to create a legal obligation or contract between myself and anyone else.   These are merely my opinions and I reserve the right to change them at any time.

Offline fuzzy

Re: Blog Post arguments against DPOS
« Reply #2 on: August 16, 2014, 01:39:09 AM »
The issue with delegates is precisely why we need a central location where people can earn reputation and payment from providing information, content and propagation of both.  The key is to make it pay for active users to learn about and support delegate selection/switching over the broad range of DACs that will someday be employed.

beyondbitcoinx.net is actually considering the possibility of promoting the Delegates that want to support BeyondBitcoinx and eventually its internal currencyfor providing an open and diverse playing field. 

Feel free to message if you are interesred in being part of the BBx delegate team. 

As for the rest, keeping my ears to the ground on this thread.
WhaleShares==DKP; BitShares is our Community! 
ShareBits and WhaleShares = Love :D

Offline toast

Re: Blog Post arguments against DPOS
« Reply #3 on: August 16, 2014, 06:21:28 AM »
Relieving to see proper critical analysis for once instead of strawman bs

Sent from my SCH-I535 using Tapatalk

Do not use this post as information for making any important decisions. The only agreements I ever make are informal and non-binding. Take the same precautions as when dealing with a compromised account, scammer, sockpuppet, etc.

Offline santaclause102

  • Hero Member
  • *****
  • Posts: 2487
    • View Profile
Re: Blog Post arguments against DPOS
« Reply #4 on: August 16, 2014, 08:40:37 AM »
http://tpbit.blogspot.ca/2014/08/thoughts-on-delegated-proof-of-stake.html
It is in no obvious way biased which is great. On the content:

The only thing which determines coin distribution is the degree of public attention. POW vs. POS doesnt play a role here. You can also have inflation in POS and create additional coins over time.

"labour theory of value" is only true if there is enough demand which makes it not pure labour theory anymore. In this case the ratio of supply and demand (if nothing else effects the demand) is effected over time - the supply grows and the demand stays the same (cet. par.) which lowers the price over time.

Pay back delegates can be a problem but not really in the way described in the blog post: The 102nd delegate would also have the support of many other shareholders and the 5% shareholder wouldn't have much of an influence on the approval of the 102nd delegate if he votes only for that ONE delegate (reason: approval voting).

Quote
If delegates would be incentivised to appeal to the users of the system, they would keep the fees low and the burn rates high. However, since they are appealing to the hoarders, they would want to keep the fees high while keeping the burn rates high as well.
This could be somewhat a problem if shareholders and therefore delegates do not take into account the dependence of the value of their shares on mainstream adaption / market share and therefore low tx fees. So shareholder education / a quality discourse matters.

Quote
Malicious wallets and services
This is very much worth thinking about. A trusted exchange might promise their users to vote like the rest of the network votes?
« Last Edit: August 16, 2014, 08:44:48 AM by delulo »

Offline luckybit

Re: Blog Post arguments against DPOS
« Reply #5 on: August 16, 2014, 03:35:08 PM »
http://tpbit.blogspot.ca/2014/08/thoughts-on-delegated-proof-of-stake.html

Quote
This leaves a lot of room for attack on a small number of nodes. Since most delegates probably won't have a state of the art computing centre to protect themselves, they will be vulnerable to DDOS attacks, among other things. If someone was determined to disrupt the confidence in the network, they would only need to go after the delegates once by one and take their machines out of the network. Of course the delegate pool would reshuffle each time with new delegates, but if good agents are taken out on a regular basis and bad agents have a chance to replace them, it would be possible to have a disproportionate amount of bad agents disrupting the network.

I don't think this attack is realistic. The blogger is underestimating the technical expertise of the delegates or the fact that knowledge/best practices will propagate over time. I think technical attacks is the one area where delegates will be the least vulnerable.

A valid attack against delegates that he mentioned is coercion. That is a viable attack but coercion likely will not work as most expect. Coercion would make make the delegate pool adapt to become coercion resistant over time. The coercion attack if it did happen is more likely to be extortion than to try to hijack the delegates because extortion would get the money from the delegates in the form of a hidden tax over an indefinite period of time.

In that case the extortionists would actually prefer their coerced delegates stay as delegates and that the Bitshares network remain stable. It wouldn't make economic sense for them to try to destroy a cash cow.

Selling votes and other forms of corruption/collusion may exist in Bitshares at some point and may already could exist in Bitcoin. I don't see any way to avoid that kind of corruption to be honest. But I don't think it's something to worry about right now when a delegate can't really make a fortune as a delegate and a lot of jobs pay much more than a delegate. I do think we could have a problem once the market cap and volume are high enough that delegates are living rich but I don't see how it will be more severe than the kind of problems anyone else with a high paying job would have.

The blog has some valid arguments many of which are known but haven't been discussed. I see a delegate like being on a board of directors at first but depending on the growth of the company then it can become a risk to be a delegate. At that point though the delegates could develop strategies to deal with those risks and being somewhat known may actually make some sense.

The gateway problem is actually the most pressing issue. We need IOU's at least for the digital assets. For physical assets it might present some legal difficulty but for bitBTC to become real would be very helpful especially if we could enter our BTC address in the Bitshares client and lock it to our account.




https://metaexchange.info | Bitcoin<->Altcoin exchange | Instant | Safe | Low spreads

Offline luckybit

Re: Blog Post arguments against DPOS
« Reply #6 on: August 16, 2014, 03:41:45 PM »
The issue with delegates is precisely why we need a central location where people can earn reputation and payment from providing information, content and propagation of both.  The key is to make it pay for active users to learn about and support delegate selection/switching over the broad range of DACs that will someday be employed.

beyondbitcoinx.net is actually considering the possibility of promoting the Delegates that want to support BeyondBitcoinx and eventually its internal currencyfor providing an open and diverse playing field. 

Feel free to message if you are interesred in being part of the BBx delegate team. 

As for the rest, keeping my ears to the ground on this thread.

I pretty much agree with this. I think we do need a central location for that and that it should be built into the Bitshares client. It should start there but yes it is necessary.

I think not enough thought has been given for how to deal with the risk of coercion/extortion. I think because today Bitcoin is only 6 billion, and Bitshares hasn't reached even 1 billion, most of us just don't see the money as being a lot of money and neither does the rest of the world.

But what happens if the market cap of Bitshares is 10-100 billion and Bitcoin is 1 trillion? How much money would delegates be making by then? Since all the delegates would be known then there is a different risk equation entirely. Not so much out of the ordinary because there are a lot of rich people in Silicon Valley but it all depends on how the rest of the crypto community plays out.

In any case delegates will likely be fired or choose to burn 100% of fees if it does become a problem, then the network could adapt by decentralizing to 1000 delegates, delegates could form legal corporations as well and get paid salary through that.

Let's build a risk analysis chart for Bitshares X (DPoS)

https://docs.google.com/spreadsheet/ccc?key=0AoMhHK4BehGedHNCem8tMEVHSGJLN3BfTDBadzVfcGc#gid=0

After we fill this in with every risk we know then we can compare it to Bitcoin (PoW). Anyone is free to fill it in. Usually I keep this stuff internal but it's in the best interest that we all contribute to this and that all the information be in one place.


« Last Edit: August 16, 2014, 04:06:01 PM by luckybit »
https://metaexchange.info | Bitcoin<->Altcoin exchange | Instant | Safe | Low spreads


 

Google+