(cache) theymosがPetition to Protect Satoshi's Coinsについて記入したコメント

Petition to Protect Satoshi's Coins (self.Bitcoin)

Anenome5 が 12時間前投稿

あなたは単独のコメントのスレッドを見ています。

[–]theymos -36ポイント-35ポイント-34ポイント 11時間前* (58子コメント)

Edit: To be absolutely clear: I am not proposing (and would never propose) a policy that would have the goal of depriving anyone of his bitcoins. Satoshi's bitcoins (which number far below 1M, I think) rightfully belong to him, and he can do whatever he wants with them. Even if I wanted to destroy Satoshi's bitcoins in particular, it's not possible to identify which bitcoins are Satoshi's. I am talking about destroying presumably-lost coins that are going to be stolen, ideally just moments before the theft would occur.

This issue has been discussed for several years. I think that the very-rough consensus is that old coins should be destroyed before they are stolen to prevent disastrous monetary inflation. People joined Bitcoin with the understanding that coins would be permanently lost at some low rate, leading to long-term monetary deflation. Allowing lost coins to be recovered violates this assumption, and is a systemic security issue.

So if we somehow learn that people will be able to start breaking ECDSA-protected addresses in 5 years (for example), two softforks should be rolled out now:

One softfork, which would activate ASAP, would assign an OP_NOP to OP_LAMPORT (or whatever QC-resistant crypto will be used). Everyone would be urged to send all of their bitcoins to new OP_LAMPORT-protected addresses.
One softfork set to trigger in 5 years would convert OP_CHECKSIG to OP_RETURN, destroying all coins protected by OP_CHECKSIG. People would have until then to move their BTC to secure addresses. Anyone who fails to do so would almost certainly have lost their money due to the ECDSA failure anyway -- the number of people who lose additional BTC would be very low. (There might be a whitelist of UTXOs protected by one-time-use addresses, which would remain secure for a long time.)

[–]Dude-Lebowski 44ポイント45ポイント46ポイント 8時間前* (2子コメント)

[–]DSNakamoto [スコア非表示] 43分前 (0子コメント)

[–]Anduckk [スコア非表示] 13分前 (0子コメント)

[–]chuckymcgee 29ポイント30ポイント31ポイント 11時間前 (9子コメント)

I think it sets a dangerous precedent to go about forking Bitcoin so that those who omit to do something lose their coins. The ability of the majority to strip a minority of stored value is contrary to one of Bitcoin's core appeals.

What if we learned ECDSA-protected addresses would start being broken in 1 year? 6 months? 3 weeks? How soon would be too soon to permit a softfork?

And why is it up to us to say that it's wrong that old-coins be suddenly recirculated? People never joined Bitcoin that coins would be lost at any particular rate, or that they'd actually know what that rate would be. Surely people have assumed some coins thought lost would be recovered and recirculated, how can this be said to be too much? And, importantly, if we know ECDSA-protected addresses are going to be broken in X years, why shouldn't bitcoin participants be able to price this possibility in before what we've deemed inevitable occurs?

[–]Dude-Lebowski 26ポイント27ポイント28ポイント 8時間前 (2子コメント)

[–]saibog38 [スコア非表示] 7時間前* (1子コメント)

Then the reality is that if and when quantum computing becomes a reality, there will be a massive gold rush for people to steal those unsecured coins instead. Is that honestly better? Anyone who wants to secure their coins will need to ensure they're secured by a quantum safe signature, that's true regardless of any proposal being discussed here.

I can see arguing for the quantum theft gold rush due to certain moral objections to the alternative, but I'm skeptical that's actually the best outcome. That would likely mean whatever entity (or entities) has first access to a legitimate quantum computer gets to steal millions of bitcoins, probably a government intelligence agency or some big corp.

It'd be great if the original owners could just keep control of the coins, but under the scenario being considered that's not really an option unless they themselves move them to safe addresses, so you have to consider what you think the lesser evil would be.

[–]ScarfacePro3 [スコア非表示] 3時間前 (0子コメント)

[+]theymos スコアが基準値未満のコメント-9ポイント-8ポイント-7ポイント 10時間前 (5子コメント)

go about forking Bitcoin

It's a softfork, so there wouldn't be any actual fork unless some part of the Bitcoin economy explicitly refused to accept the new rules. People who did nothing would automatically accept the new rules.

The ability of the majority to strip a minority of stored value is contrary to one of Bitcoin's core appeals.

For many, another one of Bitcoin's core appeals is that it's expected to eventually become deflationary due to the fixed monetary inflation schedule and the effect of lost coins. If periodic weakening of the crypto allows lost coins to be recovered, then unpredictable periods of what is essentially monetary inflation will occur.

There's no majority rule in Bitcoin. A hardfork requires a large supermajority of the economy (ie. "consensus"). A softfork requires only the majority of mining power, though a large supermajority of the economy can undo a softfork. It is a big problem that a majority of miners can today start blacklisting coins which belong to "criminals" or whatever, but to a large extent the real fix for this is the widespread usage of low-cost anonymity techniques such as CoinSwap which would make it extremely difficult to identify which coins belong to which person.

What if we learned ECDSA-protected addresses would start being broken in 1 year? 6 months? 3 weeks? How soon would be too soon to permit a softfork?

It'd be a weighting of harm vs benefit. It'd depend in large part on how quickly the attacker could break keys.

[–]chuckymcgee 10ポイント11ポイント12ポイント 10時間前 (3子コメント)

The tyranny of the majority exists whether it's a simple majority or a supermajority- a large enough group of people can compel individuals to do something or lose control of their wealth.

There's are always unpredictable periods of what is essentially monetary inflation in bitcoin, by your definition. Coins are constantly being taken in and out of cold storage and being lost and recovered. We have nothing but speculative insight as to what that supply might be, and yet we're fine. Satoshi could re-emerge tomorrow and decide to sell a million coins for all we know. Why is that acceptable, but knowledge that some coins will almost certainly re-enter the market in 5 years is not?

If we're really concerned about the unexpected movement of coins, why stop at ECDSA-protected addresses then? Why not require individuals to move their coins every year to prove ownership or see destruction?

[–]Dude-Lebowski 4ポイント5ポイント6ポイント 8時間前 (0子コメント)

[–]theymos -5ポイント-4ポイント-3ポイント 10時間前 (1子コメント)

Why is that acceptable, but knowledge that some coins will almost certainly re-enter the market in 5 years is not?

Because one is due to a failure of the system's cryptographic security and the subsequent theft of bitcoins, and the other is due to the intentional action of individuals on their rightful property.

If Satoshi has 1M bitcoins (which I doubt) and wanted to dump them all today, then that'd be his right. I would vehemently oppose any proposal to stop this from within the Bitcoin system.

Why not require individuals to move their coins every year to prove ownership or see destruction?

I've proposed this in the past as a way to reduce the size of the UTXO set which all nodes must store, but there have been technological advancements since then which make it seem unlikely to ever be necessary.

[–]Dude-Lebowski 10ポイント11ポイント12ポイント 8時間前 (0子コメント)

[–]zoinks10 3ポイント4ポイント5ポイント 10時間前 (0子コメント)

For many, another one of Bitcoin's core appeals is that it's expected to eventually become deflationary due to the fixed monetary inflation schedule and the effect of lost coins. If periodic weakening of the crypto allows lost coins to be recovered, then unpredictable periods of what is essentially monetary inflation will occur.

Correct me if I'm wrong, but my understanding is that the coins will only become recoverable from the old addresses. Assume someone hacks and steals 1 million BTC from Satoshi, moves them to a newer (uncrackable) address, then loses the private keys to the new address - this then loses the bitcoins for good.

I guess what I'm saying is that the currency remains deflationary in the long term, only that known insecure coins may be brought out of "dormancy" and into the spendable Bitcoin population (from where they can be lost) - as opposed to them sitting there waiting for Satoshi to potentially spend them.

What am I missing?

[–]011010110 [スコア非表示] 6時間前 (2子コメント)

[–]theymos [スコア非表示] 5時間前 (1子コメント)

That's probably the strongest argument against it, but I don't really see much of a slippery slope. IMO there's a very wide gap between applying a uniform policy meant to address a specific technical/security issue, and doing targeted deletions. (The majority of miners could already do targeted deletions, BTW, which is a huge concern which should be addressed by widespread usage of CoinSwap, etc. and efforts to decentralize mining.)

Maybe I find this idea less surprising because this general idea of expiring old UTXOs has long been discussed in the context of scaling. If you expire UTXOs after a year or whatever, it limits the size of the UTXO set and also allows for several other nice optimizations. I (and others) were talking about this as early as 2011, and some altcoins have implemented versions of the idea. Later on, far better scaling technologies were developed which put this concept (often called "demurrage" in the Bitcoin universe, though it's very different from this word's usual meaning outside of Bitcoin) out of fashion. But I've always thought that it's an acceptable technique, if Bitcoin's survival requires it.

I don't think this will actually be a problem for 10-20 years, so we'll have plenty of time to debate it...

[–]svarog [スコア非表示] 55分前 (0子コメント)

[–]iamnotmagritte [スコア非表示] 2時間前 (1子コメント)

[–]Gargoyle88 [スコア非表示] 1時間前 (0子コメント)

[–]umbawumpa [スコア非表示] 6時間前 (1子コメント)

[–]theymos [スコア非表示] 5時間前 (0子コメント)

[–]goodbtc [スコア非表示] 5時間前 (0子コメント)

[–]segregatedwitness [スコア非表示] 3時間前 (0子コメント)

[–]OnNom [スコア非表示] 2時間前 (0子コメント)

[–]darkice [スコア非表示] 2時間前 (0子コメント)

[–]princekolt [スコア非表示] 2時間前 (0子コメント)

[–]deadalnix [スコア非表示] 7時間前 (4子コメント)

[–]theymos [スコア非表示] 6時間前* (3子コメント)

[–]deadalnix [スコア非表示] 6時間前 (0子コメント)

[–]todu [スコア非表示] 1時間前 (0子コメント)

[–]sQtWLgK [スコア非表示] 6時間前 (1子コメント)

[–]theymos [スコア非表示] 5時間前 (0子コメント)

[–]-Hegemon- [スコア非表示] 4時間前 (1子コメント)

[–]todu [スコア非表示] 1時間前 (0子コメント)

[–]Mark0Sky [スコア非表示] 2時間前 (0子コメント)

[–]BitcoinXio [スコア非表示] 30分前 (0子コメント)

This is a terrible precedent to set. I take issue with this statement in particular:

People joined Bitcoin with the understanding that coins would be permanently lost at some low rate, leading to long-term monetary deflation. Allowing lost coins to be recovered violates this assumption, and is a systemic security issue.

This is not true. One of bitcoin's selling points has never been the guarantee of lost coins thus making other coins more valuable. It's always been something said to happen but not on the basis on why people use bitcoin as a store of value. In addition, what is more concerning is that many people have purchased bitcoin in the early days with the sole intent to hodl them, and not use them until much later when they are worth more. The proposition to essentially steal these people's coins because of the fear that someone else could steal them before you is not what anyone wants and should never happen in my opinion.

[–]redlightsaber [スコア非表示] 5時間前 (2子コメント)

Ah, more central economic interventionism. It's clear on what side of the debate you're on regarding this issue.

Your economic concerns are false. Satoshi using his old coins is always a possibility, and I don't think anyone should assume otherwise (or that the current market is doing so).

Setting a precedent that developers could just choose to "destroy" any group of coins, or worse still, to impose an expiry date on all of them, is a far more dangerous proposition than any imagined dangers that a one-time 5% inflation event could produce, and that's assuming a suddenly perfect quantum computer engineered out of the blue... In reality the addresses would be "hacked" in such a scenario at a slow and steady rate, very possibly not even being able to reverse the continuous deflation.

Please stop. Most of us are into bitcoin trying to get away from centralised interventionism.

[–]Ant-n [スコア非表示] 4時間前 (1子コメント)

[–]redlightsaber [スコア非表示] 2時間前 (0子コメント)

[–]AceSevenFive [スコア非表示] 4時間前 (1子コメント)

[–]aaaaaaaarrrrrgh [スコア非表示] 2時間前 (0子コメント)

[–]Guy_Tell [スコア非表示] 3時間前 (0子コメント)

[–]xhiggy [スコア非表示] 1時間前 (0子コメント)

[–]liquidify [スコア非表示] 6分前 (0子コメント)

[–]pokertravis -1ポイント0ポイント1ポイント 8時間前 (0子コメント)

[–]Anenome5[S] -3ポイント-2ポイント-1ポイント 11時間前 (10子コメント)

[–]theymos 1ポイント2ポイント3ポイント 10時間前* (9子コメント)

Yeah, getting the timing right will be difficult. On the one hand, you want to give people as much time as possible to move their bitcoins, but on the other hand it'd be very harmful if you're late by too much.

One helpful thing is that quantum computers will start out extremely slow and extremely expensive. So if the deadline is a few months too late, it's likely that only a small fraction of QC-breakable bitcoins could be stolen in that time, and maybe none of the parties with access to such a powerful quantum computer would be hidden enough to actually steal BTC and get away with it.

One interesting suggestion I heard was that you could do the UTXO deletions gradually over a year-long interval (or whatever), with the highest-value UTXOs getting deleted before the lower-value ones. That way, the UTXOs with the highest reward-to-cost ratio for attackers and the highest risk to Bitcoin would be deleted right away, buying extra time for the vast majority of people who have far-lower-value UTXOs.

(BTW, although you often hear about minuscule quantum computers being built in labs, most experts think that a quantum computer large enough to attack Bitcoin keys won't exist for at least 10-20 years.)

[–]Anenome5[S] 0ポイント1ポイント2ポイント 10時間前 (1子コメント)

One helpful thing is that quantum computers will start out extremely slow and extremely expensive. So if the deadline is a few months too late, it's likely that only a small fraction of QC-breakable bitcoins could be stolen in that time, and maybe none of the parties with access to such a powerful quantum computer would be hidden enough to actually steal BTC and get away with it.

That's a good point; Satoshi made a new wallet for each block mined, IIRC.

So, anyone with the actual QC power to steal coins is faced with a dilemma, take wallet by wallet, or crack wallets one by one and delay the sweep, risking the chance that someone else may sweep them in the meantime.

Which means they'll likely start sweeping immediately and, as you say, it should still take some time to sweep even one address.

One interesting suggestion I heard was that you could do the UTXO deletions gradually over a year-long interval (or whatever), with the highest-value UTXOs getting deleted before the lower-value ones. That way, the UTXOs with the highest reward-to-cost ratio for attackers and the highest risk to Bitcoin would be deleted right away, buying extra time for the vast majority of people who have far-lower-value UTXOs.

Hmm, yeah, that might be a good idea.

(BTW, although you often hear about minuscule quantum computers being built in labs, most experts think that a quantum computer large enough to attack Bitcoin keys won't exist for at least 10-20 years.)

Sure, but when there's a billion dollars on the line or w/e, no one thought a bitcoin ASIC miner would be the world's first 20nm consumer product either (ala KNC).

[–]Dude-Lebowski 2ポイント3ポイント4ポイント 8時間前 (0子コメント)

[+]--__--____--__-- スコアが基準値未満のコメント-6ポイント-5ポイント-4ポイント 10時間前 (6子コメント)

[–]Dude-Lebowski 6ポイント7ポイント8ポイント 8時間前 (1子コメント)

[–]manginahunter [スコア非表示] 3時間前* (0子コメント)

[–]theymos 0ポイント1ポイント2ポイント 10時間前 (2子コメント)

[–]--__--____--__-- 0ポイント1ポイント2ポイント 10時間前* (1子コメント)

[–]Dude-Lebowski 2ポイント3ポイント4ポイント 8時間前 (0子コメント)

[–]Anenome5[S] -1ポイント0ポイント1ポイント 10時間前 (0子コメント)

π Rendered by PID 23966 on app-159 at 2016-05-11 15:09:04.472205+00:00 running 4fb957d country code: JP.

Bitcoin

Community guidelines

Related communities

Non-Bitcoin communities

Join us on IRC

Other Bitcoin sites

Download Bitcoin Core

調停者