So POS is a sham? it's as clear cut as that?
...
... and do, make subtle changes to their systems when presented with flaws, or order to "fix" the flaws. In formal and security analysis, any change, however subtle, means the analysis needs to be completely redone. Obviously you can see how this might make it infeasible to keep up with every new variation and show how each and every one of them are broken in specific detail.
Nevertheless it is possible to analyze these systems in broad terms and reach conclusions in terms of general principles, such as needing to consume some external resource (i.e. proof of "work", broadly) in order to reach a decentralized consensusmaintain unbounded entropy...
But anyway, what of Paul Stzorc's response to Vitalik? Riskless counter-contracts. In general with PoS it seems to me that Vitalik and the other PoS people are falling into the "make the security model confusing enough that even really smart people can't understand it = good security" error. Sure, PoS doesn't seem confusing, but with things like stake-grinding plus an endless parade of more unfamiliar-to-security-researchers workarounds it optimizes for a security model that's difficult to poke holes in during debate, but that a motivated attacker could eventually figure out how to attack precisely because it's too opaque to know that what the attack vectors are so that they can be defended against.
I maintained since 2013 that PoS can't pull from a large enough pool of entropy. The randomization of order can be gamed. Note a natural source of external entropy can't be employed (as this would require centralization).
The excessive use of resources in PoW can be easily solved by lowering the debasement rate (and transaction fees), but before you do this you have to remove the 50+% attack...
Proof-of-Work vs. Proof-of-StakeExtending from my prior post, the bolded portion is an unnecessary assumption (i.e. a weaker assumption is also valid):
https://download.wpsoftware.net/bitcoin/pos.pdf#page=76In that same blog post, Buterin says “if you are tired of opponents of proof of stake pointing you to this article[Poe14b]
by Andrew Poelstra, feel free to link them here in response”. It is not clear what he means by this; he did not, there or
anywhere, refute that paper’s claim that you cannot produce consensus except by consuming an external resource.
What part of "subjective condition" did Andrew (and Maxwell) not understand? Vitalik demonstrated an example whereby PoW suffers an analogous requirement for assumptions of mutual incentive for optimization of the public good as PoS does. Andrew is trying to argue that PoS is self-referential thus can never be absolute proof. But Vitalik shows by example that PoW is conditioned on subjectivity also.
The subjectivity claim against PoW may be weaker than against some variants of PoS (e.g. one-time spend addresses with check points), but the devil is in the details. PoW requires checkpoints to guard against 50+% attacks too. Checkpoints are a form of social trust (aka "assumptions of mutual incentive for optimization of the public good"), subjective (SPV-like) trust model which
Maxwell alluded to.
Objective: a new node coming onto the network with no knowledge except (i) the protocol definition and (ii) the set of all blocks and other “important” messages that have been published can independently come to the exact same conclusion as the rest of the network on the current state.
Weakly subjective: a new node coming onto the network with no knowledge except (i) the protocol definition, (ii) the set of all blocks and other “important” messages that have been published and (iii) a state from less than N blocks ago that is known to be valid can independently come to the exact same conclusion as the rest of the network on the current state, unless there is an attacker that permanently has more than X percent control over the consensus set.
The main argument I had against Proof-of-Stake since my 2013 debates with Etlase2 was the entropy of the randomization function. I still have to look at how that is done in variants and see if my former criticism still applies.
P.S. Andrew's paper and Vitalik's blog are both excellent for raising clarity on the issue and much appreciated.
Edit: Ah I see my long-standing reservation against PoS has remained true thus far:
https://blog.ethereum.org/2014/11/25/proof-stake-learned-love-weak-subjectivity/#comment-1730404390Random contract execution and random hash functions every x nonces both proved flawed after some research. The plan is to use a variant of Hashimoto for v1.