Do we want oblivious mining pool shares? - page 2.

grue

legendary

Activity: 2058

Merit: 1431

Quote

Lie in wait - When miner finds a winning share, he doesn't submit it right away. Instead he pulls all his mining capacity (assuming he has extra capacity used elsewhere, perhaps specifically in preparation for this cheat) into this pool, using his "inside knowledge" that a winning share is imminent to increase his expected payout.

what do you mean by that?
here's my interpretation:
1. you find winning share, you don't report it
2. you take all of your miners off of the pool, and onto another pool

am i getting this correctly?

JorgePasada

member

Activity: 61

Merit: 10

Quote from: MoonShadow on April 27, 2011, 02:21:50 PM

Quote from: Meni Rosenfeld on April 27, 2011, 02:17:22 PM

Small pools will be fairly useless. Variance for small miners will be huge,

What do you base this statement on?

The Maths.

Meni Rosenfeld

donator

Activity: 2058

Merit: 1054

Quote from: MoonShadow on April 27, 2011, 02:21:50 PM

Quote from: Meni Rosenfeld on April 27, 2011, 02:17:22 PM

Small pools will be fairly useless. Variance for small miners will be huge,

What do you base this statement on?

Expected payout for mining = hashes * block reward / difficulty
Variance of payout = hashes * block reward^2 / difficulty
Standard deviation of payout = sqrt(hashes/difficulty) * block reward
Ratio between SD and expectation = sqrt(difficulty/hashes)

(In this notation I integrate the 2^32 factor into difficulty)

As Bitcoin grows, the total hashing capacity of the network will be much higher than that of an at-home miner (difficulty >> hashes), so his relative variance will be correspondingly high. Same goes for pools which are too small.

Or, more simply, when there are lots of miners, one with little capacity has a snowball's chance in hell to ever find a block.

MoonShadow

legendary

Activity: 1708

Merit: 1010

Quote from: Meni Rosenfeld on April 27, 2011, 02:17:22 PM

Small pools will be fairly useless. Variance for small miners will be huge,

What do you base this statement on?

Meni Rosenfeld

donator

Activity: 2058

Merit: 1054

Quote from: FooDSt4mP on April 26, 2011, 04:33:47 PM

Pooled mining is important... but I think it will mostly be smaller, private pools where trust is less of an issue. Or one miner using pool software to track all his mining rigs.

Small pools will be fairly useless. Variance for small miners will be huge, and you need a large pool to get a remotely steady payout.

FooDSt4mP

full member

Activity: 182

Merit: 100

Quote from: Meni Rosenfeld on April 26, 2011, 04:06:12 PM

Quote from: grue on April 26, 2011, 03:45:28 PM

the second one won't work, because shares expire every 10 minutes (approximately)

So you hold out for 2 minutes. With a pool which is 25% of the total network that's all you need to be effective. It also depends on the scoring method used.

Quote from: MoonShadow on April 26, 2011, 04:04:06 PM

Quote from: Meni Rosenfeld on April 26, 2011, 02:31:00 PM

but I think the only way to be truly immune to them is to change the Bitcoin protocol to make pooled miners oblivious to whether their shares are winning.

Ah, no.
The Bitcoin protocol does not exist to make things easier on pool miners. If this is really a concern, perhaps you shouldn't be pool mining.

I disagree, pooled mining is an important aspect of Bitcoin and the limitations of the protocol that hinder it should be fixed.

Pooled mining is important... but I think it will mostly be smaller, private pools where trust is less of an issue. Or one miner using pool software to track all his mining rigs.

Meni Rosenfeld

donator

Activity: 2058

Merit: 1054

Quote from: grue on April 26, 2011, 03:45:28 PM

the second one won't work, because shares expire every 10 minutes (approximately)

So you hold out for 2 minutes. With a pool which is 25% of the total network that's all you need to be effective. It also depends on the scoring method used.

Quote from: MoonShadow on April 26, 2011, 04:04:06 PM

Quote from: Meni Rosenfeld on April 26, 2011, 02:31:00 PM

but I think the only way to be truly immune to them is to change the Bitcoin protocol to make pooled miners oblivious to whether their shares are winning.

Ah, no.
The Bitcoin protocol does not exist to make things easier on pool miners. If this is really a concern, perhaps you shouldn't be pool mining.

I disagree, pooled mining is an important aspect of Bitcoin and the limitations of the protocol that hinder it should be fixed.

MoonShadow

legendary

Activity: 1708

Merit: 1010

Quote from: Meni Rosenfeld on April 26, 2011, 02:31:00 PM

but I think the only way to be truly immune to them is to change the Bitcoin protocol to make pooled miners oblivious to whether their shares are winning.

Ah, no.

The Bitcoin protocol does not exist to make things easier on pool miners. If this is really a concern, perhaps you shouldn't be pool mining.

grue

legendary

Activity: 2058

Merit: 1431

the second one won't work, because shares expire every 10 minutes (approximately)

Meni Rosenfeld

donator

Activity: 2058

Merit: 1054

Currently, when a participant in a mining pool finds a share, he knows whether this share is winning for the true difficulty. This knowledge can be used for at least two kinds of attack:

Sabotage - Miner never submits winning shares. This doesn't increase the miner's own profits, but it decreases the total rewards of the pool and thus the payouts of participants. For Pay per Share, this can do heavy damage to the operator.
Lie in wait - When miner finds a winning share, he doesn't submit it right away. Instead he pulls all his mining capacity (assuming he has extra capacity used elsewhere, perhaps specifically in preparation for this cheat) into this pool, using his "inside knowledge" that a winning share is imminent to increase his expected payout.

I suppose there are ways to mitigate these problems, but I think the only way to be truly immune to them is to change the Bitcoin protocol to make pooled miners oblivious to whether their shares are winning. I have an idea what this change would be and I may suggest it in a different thread (and argue for its cost/effectiveness), but first I would like to inquire - do we want shares to be oblivious? It could be argued that oblivious shares make it easier for the operator to cheat, but I'm not sure that's true.

Topic: Do we want oblivious mining pool shares? - page 2. (Read 7794 times)