I want to explore if Sybil attacking the signups is viable.
Who sets the minimum and how is it computed? Will it decline from 3?
Sybil attacking depends on the measures used by whoever it is who is paying for the account with their Steem. If you are getting your account from the steemit web site, they have various rules about social media accounts, IP addresses, etc. I'm sure they can all be bypassed, but that may or may not be worth it for $10 of value that has further restrictions on liquidating it (and these rules can all be changed if it becomes a problem; nothing at all is promised when it comes to free accounts). The minimum to power down is not the primary obstacle to milking the free accounts, but it does reduce the incentive somewhat, so other barriers can be a bit lower, inconveniencing legitimate users less.
The minimum is set by witness vote. Might decline, might increase. There is no set rule. It is possible the minimum might at some point not be sufficient to actually use the network much if at all, since bandwidth scarcity could increase the amount of SP needed. That depends on a number of things including usage, technology, etc.
My point is that it has to be difficult to reach the power down level, else it can pay to Sybil attack. So while 10 free with 30 power down threshold might be borderline for the attacker, it must also not be too easy for average users to hit that level unless they stay on the site for a while, else the Sybil attack may become viable by arbitraging the labor costs in the Africa. I don't yet know what the attrition rate is even though I've asked for that data numerous times. Surely with your resources, you would want to know. I assume Dan and Ned know, but they aren't telling us apparently.
If the witnesses vote to fork the protocol to block the accounts, that would be equivalent to Ethereum hard forking to stop the DAO attacker. It would mean it is not a blockchain that can be trusted to honor its own rules.
One strategy might be to signup as many free 10 SP accounts as you can using harvested Facebook accounts, then set up bots to earn curation rewards and/or hire cheap blogging labor to raise them up to 30 SP, you can power them down. I've seen phone verified Facebook accounts for as low as 80 cents, but I think you could create them much cheaper than that. For example, here in the Philippines you could probably buy mobile phone numbers for as low as 20 cents each (maybe half that in bulk, especially stolen ones). At 30 SP threshold it appears borderline, but at 20 SP, I think it would become very viable. I bet you can find decent bloggers in Africa who can emulate the popular posts, for perhaps a few bucks per successful blog. They could invent interesting life stories, use photos of others on the Internet, doctor them with Photoshop to paint Steemit on their Tshirt, etc..
Bandwidth costs less than $10 per terabyte. It is costing more on Graphene because Graphene is not the best design we can do (for example on Graphene then all delegate miners have to validate all transactions so O(N
2) bandwidth cost where N is number mining nodes). So if a competitor comes along to challenge Steem with a better cost model for transactions, then game over because users don't like to pay to use social networks and if they can't earn fast enough to cover their bandwidth allocation, then they leave for the technology that can.
I haven't done analysis yet to determine if paying for comments is worthwhile.
In practice the main effect is to sprinkle a little rewards around to a
lot of people. I doubt anyone will make a living as a professional commenter, but who knows.
Those who have a financial or "SP as karma level" incentive to comment, are those who aren't successful at earning from blogging.
So that might true if we end up with more professional bloggers and their flock or followers earning some karma from commenting and post curating.
What if they earn less from commenting than their bandwidth allowance cost.