A digital currency with no judging authorities

[WarDaft]

Before I actually start what will probably end up a monster post on an idea that (rather infuriatingly) kept me up literally all night, I wanted to first ask if anyone knows any examples of a secure digital currency with no trust placed in anyone at all, and thus no compromisable authority figures? Because I feel like I'm literally this |-| close to devising a model for one. I just have to ensure that there are no hidden pathological capabilities, all the obvious stuff is taken care of quite neatly. As in, it's secure enough that I could never hope to wring any sort of personal profit from being the one to implement the idea (no built in taxing, no printing free money, nothing!) so there's no reason not to just share the concept in its base form.

If there already is one, then this is kind-of redundant.

Okay, the details.

Like the real world economy, the functionality of this currency will be based on the exchange of debt. Specifically, proof of work debts. These debts will be orchestrated so that the system works equivalent to everyone having a non-negative amount of currency. As a bit of background, I started thinking along these lines when I read a post somewhere on these forums about bitcoins, and this system borrows a term and a concept from that system (though the concept is not unique to them, I thought of it myself before bitcoin existed, but did not apply it to currency.)

So, the nitty gritty:

Each person maintains a personal transaction history. Every entry in someones transaction history must contain an accurate hash of the previous entry in that persons history, this is assumed for all following statements, even when it seems redundant. This hashing process must be as secure as possible. It will not be a bottleneck, so the hashes do not need to be concerned much with speed - within reason of course. Your history must also contain - at its beginning - a secure public key from an encryption system capable of signing documents.

To pay someone, you place yourself a certain amount in debt to that person. To do this, you construct an entry for their transaction history stating:
-How much you will owe them.
-Contact information that will allow anyone reading their history to ask you for your history.
Then, you must construct another entry for them signing that entry with your private key. You will give them both of these entries, and they will include it in their history (they want to do this, you've just signed that you owe them money.)
Lastly, you construct an entry for your own history, making note of how much is owed, and pointing to the entry in their history containing your signature of their entry stating that you owe them. They will want to verify this before providing you with whatever they agreed to for the exchange.

Key part number 1: Making debts stick.
This is all well and good so far, but information theory says its impossible for you to force a debt to stick, they can just roll back their history and pretend it never happened. How do we avoid this? We make it undesirable! We who are being paid with a debt demand that the other party record their debt to us, and then cash in on their proof of work debts until we are satisfied that they will not roll back their history thus erasing their received payments to erase their debt to us. Those who pay to them will have record of that, and certainly won't pay again! Furthermore, any who chose to deal with someone who rolled back can see the contact information for those who owe them, and check to see if they have confirmation of the rollerbacker being paid the proofs of work.

Key part number 2: Paying Proofs of Work
When paying a proof of work, the string being hashed must contain certain information. Specifically, there must be only one possible position in someone's transaction hierarchy for the payment to be received. This will allow others to force the person being paid the proofs of work to make their debts public by requiring them to take payments immediately after creating a debt. In order to collect from multiple people (otherwise, transactions will take prohibitively long), multiple proofs of work may be paid into the same position on someone's history, and considered a single entry for the next item. Once the individual collecting the proofs has all they called out for, they place them as a single entry in to their history and sign it. The proof payers then create an entry in their own history duplicating the aggregate proof entry and signature, and sign it. This allows them to show that the collector received the proof. The proof collector then collects the signatures, and signs that. This allows the proof collector to show to the individual they just created a debt too that the proof payers can show the collector received the proofs of work - and thus, cannot roll back the debt. The individual the debt was created to should accept nothing less than this.

Market Fluidity
It may be necessary (for larger transactions) to pass the obligation to actually calculate the proof of work downstream to someone who owes you. It should not come as a surprise that we can construct proofs of work that can only go in one position in each of several people's transaction histories, and they can simply pass them along, covering multiple debts with a single round of work. This would need careful adjustment and hands on experimentation to get right. Futhermore, it will be necessary to actually get debt in the first place. The easiest way of course, is for two people to simply exchange it. By simultaneously assigning each other debt, and through a recursive signature scheme (vaguely similar to the mess involved paying proofs of work) it should be relatively clear that this is a straightforward activity - your incentive to preserve your debt to the other individual is dually preserving your record of their debt to you, and not risking your histories investigable reputation over something silly like a zero net change in your wealth. Your selfish acts also force the other individual to take take the same precautions, and the situation is symmetric, thus you both do fine and there is enough debt around for the economy to function.

But wait a minute... what's stopping someone from simply vanishing once they owe more than they're owed? Then we're out of luck aren't we? Right?


To fight these minions of evil, we require what I call The Law of the Excluded Middleman.

Suppose A owes B, and B owes C. As far as C is concerned, if B doesn't play along, then they're just a nuisance, A can pay C and simultaneously resolve their debt to B, and B's debt to C. In short, you can simply go around anyone who owes you, to collect from the people who owe them. We will record this in a way such that everyone investigated can see that this was done, and if B later comes to their senses/gets back from vacation, can notate the application of this law to their predicament in order to update their own books as if they had been there all along, but acknowledging that other people have other records. After all the signature dancing above, I'm not going to go into the specifics of this, but you should find that it is perfectly acceptable...

As long as B is owed more than they owe.

What do we do if B is owed less than they owe? Then they might not have enough to pay us! Hmm. Maybe we shouldn't take a deal with B unless after that deal, B is still owed more than they owe. In fact, this is pretty good advice for... well... everyone ever. So we can really simplify the representation... A can only pay B an amount such that the amount they owe plus the new amount they owe B is less than the amount they are owed. Hmm, owed, minus owing, minus new debt... must be positive.Totally invert everything, and this acts exactly like a positive economy with no debt at all! By the above conventions, we can inspect anyone's debt who wants to do business with us, and we can inspect as much as we want of who they do business with (because all debts include contact information for the debtor) until we are either satisfied that they are a good customer, or unsatisfied to the point where we decide that they are too big a risk. With proper client software, the user could literally only have to interact with paying positive amounts of currency and never being negative, with the software keeping track of everything underneath in a maximally selfish way.

With this inverted perspective, the people who are actually crunching out the proofs of work are now essentially mining coinage just like in bitcoin, because they're getting the proofs to pay off debts without taking out new debts, increase via decreasing the magnitude of the negative being subtracted from.

The only remaining problem is inflation of computer hardware. This is easy. We require that all entries be dated. Unless someone goes for a very very long time without doing any transactions, any proofs of work will be sandwiched into a very narrow time frame that they could have been computed during. And there is no reason to have a hard coded difficulty for a proof of work - it can be a self defined challenge whose value is evaluated when it is completed. Also note, that proofs of work are never offered, just requested. You can't just throw more processing power at the situation and expect to get more digital profit.


Fin.


Poking holes is welcome, and encouraged, not that I really have to say that, just a little extra emphasis. It's also possible I was a little overzealous in a few areas, but better safe than sorry.

[undecim]

Bitcoin? http://www.bitcoin.org/

[WarDaft]

That has a central authority - the block chain. Everyone must have an up-to-date copy of that for it to work. It the inspiration for this though.

This system won't require the person being paid to contact any central authority. There will be no set boundaries to a network. Unless there are some subtle pathelogical potentials I have not yet uncovered, it will hopefully <overly optimistic voice> work just fine walking into a virtual den of thieves who will each act as selfishly as possible, after you have had no Internet connection for a month. </overly optimistic voice>

[Yakk]

So, modern currencies are all backed by "promises to pay back".

Ie, banks create a pair of debt and cash, own the debt and hand the cash to the person who owes the debt. The debt is a promise to pay back the debt (plus interest).

They then take the money and find a way to convince others to give them even more money, so they can pay back the debt (and interest). The bankers end up making the interest in profit.

So each dollar you own in a given currency is backed by the debt of everyone who has borrowed money in that currency. If they fail to pay back their debt, they lose both tangible and intangible resources (things are repossessed, they lose access to credit, etc). That provides a demand for your dollar, and gives it a somewhat fundamental value.

You could imagine a system whereby each dollar of currency was a legally binding promise by someone in particular to pay it back, on pain of some other punishment. Ie, someone might issue currency backed by their house -- and those house-dollars are good for some share of that actual house. Interest becomes sort of insane, because that person in question needs to get those particular dollars to pay the interest in, which "shortens" the size of the economic loops that work. And if you aren't anywhere close to that house (economically), you'd have to arrange for some kind of clearing house to swap that house-dollar for debt that someone "closer" to you actually wants (or, such a clearing house could exist, which allows you to look up prices and value the house-dollar, and virtually swap it).

However, liquidity problems abound. Properly pricing a given house-dollar is extremely difficult, as you need to know the creditworthiness of the particular person, the quality of the house (how well up kept is it), the degree to which the mortgage holder is going to forgive late payments (if the mortgage holder is an ass, this means that the house-owner is going to be more desperate for those dollars), the financial means of the house-holder (how much can the house-holder afford to trade for those house-dollars), etc. On top of that, what if the house-holder issues multiple currencies all backed by the same house, uses it to buy yet more resources elsewhere, then defaults on all of the debt, leading to multiple people all in possession of the same house? So now in order to value a house-dollar, you need a relatively deep understanding of the ownership structure of the house (or insurance on your house-dollar in case it is no good, which is what banks do today).

We abstract that problem away with a national debt-backed currency. Banks are allowed to effectively issue currency for debt, but they have rules about how careful they have to be (because their solvency/accounting rules is a proxy of the solvency of the entire economy).

In short, I could issue "currency" right now, but without a massive infrastructure nobody would want it.

[WarDaft]

There, all edited in. It's a pretty resilient system, but I have not proven it correct, only been driven batty by not being able to stop thinking about the challenges inherent in it and thus unable to get any sleep. Hopefully now that I've got it out of my system I will be able to.


Edit: Okay, now having had a proper amount of sleep, there is something I didn't cover, but it's a minor hiccough - the system acts as zero sum as described above. We want currency held to be defined by (Paid + owed - owing) in order to allow currency to actually flow into the system from work done. This way, when someone produces a proof of work, their amount of currency increases, while the individual who requested it remains neutral. This allows the people who generated the currency to perform the debt transference equivalent of buying things from other people, who will then have positive differences, who can then pass those on, and so on and so forth. This does mean that we will be dealing with individuals who have debts out greater than debts in, but this will be because these individuals have managed to be paid by others - this is a bad thing and means they are actually more reliable than simply if they had the debts in, because they managed to collect as well. The system will not run out of debt in, because it can be created out of thin air in parity with debt out in unbounded quantities, and this does not affect anyone's net worth. Also I was wrong about not simply throwing computing power at the problem to become rich, as it's actually necessary possible to do so to get currency flowing into the system. A reputable 'minting operation' would be two computer farms calling proofs of work from each other - they don't really care who they are crunching proofs of work for, so there is no reason to suspect that their debt to you is any way different from their debts to each other. In fact, they want to pump out works for a myriad of others in order to improve the appearance of their transaction history.

The only remaining problem I can see is what if some idiot agrees to a large amount of debt out with no debt in. The only solution I can see to this is to take advantage of your ability to request to inspect the histories of individuals who have done business with the person you are dealing with until you are comfortable with the sale, and then it's just a matter of seller beware.


Also note, that in such a system the net worth of a given amount of debt difference is would proportional to how much debt has already been crunched, but how much can be crunched right now. Every transaction involves the seller demanding fresh proofs of work, so the time any transaction will take time depend on the systems overall ability to produce proofs of work divided by the rate people are spending. As such, past work done should not cause inflation, because the 'cost' of a transaction to the buyer is the amount of effort for them to obtain new proofs of work to present to the seller.

[themandotcom]

I'm a little confused, maybe you can explain the premise behind this whole thing to the uninitiated? So the idea is that you get paid in a currency, and have the ability to lend out and borrow money from anyone, without the use of a bank? If that's the case, how do I grow my money? In the current market, I would but my money in a bank account/savings account/CD to get interest on my money. Do I get to charge interest to people I am owed by?

[Yakk]

You don't want unbacked currency in your system as a general rule.

What is this money denominated in (what units?) If you use something like "US dollars", you might as well just use US dollars? (the trusted party in US dollar denominated currency is the Federal reserve, and those that the Federal reserve trusts enough to make more money for).

and then cash in on their proof of work debts until we are satisfied that they will not roll back their history thus erasing their received payments to erase their debt to us.

So, in effect, you have to hold hostage at least as much money as the remainder of the debt.

So instead of having a debt of 10,000$, what you do is get a debt of 20,000$, then demand that they immediately transfer 10,000$ from some "trusted" third party (oh oh, trust) or at least disinterested.

For them to get 10,000$ from the "trusted" third party, they first have had to paid the third party 10,000$, who then turns around and pays them 10,000$. Or something like that.

In fact, you borrow 10,000$ from the trusted 3rd party, loan your counterparty 20,000$, who takes a payment of 10,000$ from a bank to pay you back half of your debt, and you then take that 10,000$ and pay back your trusted third party.

However, for this to work, you need credit with your trusted third parties, and in effect those third parties "validated" your transaction (but had to risk 10,000$ to do it, an amount equal to the loan ... if only for a short time...).

[WarDaft]

It's backed by proofs of work - a computationally hard problem has a certain kind of integrity that mere government banks lack.

A proof of work is when you search for a string which hashes with a particular prefix - the hash is essentially random, so demanding a prefix of 0xaaaaaaaa for example will require on average 4.3 billion hash attempts. Paying a unit of currency would scale up the size of this prefix over time so that a piece of hardware costing $n can compute a proof of work worth V in the digital currency in a roughly constant amount of time as new technologies are released. A simple exponential growth curve would also suffice, and if we accidentally make it harsher than technology can keep up with? Great, a counter inflationary force! Likewise, we can easily tune the size of the proof of work such that it takes on a practically continuous divisibility. You want to price your stock in base Pi to 15 digits? Okay. There are already digital currencies backed by this concept, but they have a centralized system which you must connect to to ensure that you are dealing with people who actually have the resources. We on the other hand, wring the payers hand so that they don't want to just forget that they've paid us.

As such, we do not need to trust the third parties at all, and we can verify that they have done thier work quite trivially.

For them to get 10,000$ from the "trusted" third party, they first have had to paid the third party 10,000$, who then turns around and pays them 10,000$. Or something like that.

They can simply do a debt exchange. Two people say to each other "Okay, I owe you X." This does not change either of their net wealths, but gives them an opportunity to either be called upon to provide proofs of work (giving them a positive difference between owed and owing - good thing), or call upon someone to provide proofs of work (to validate a purchase they have made - good thing.) People with hashing farms for example quite want to do debt exchanges and have these swaps called on, this lets them build up a significant difference between their owing and owed that they can treat like a currency. You want to do business with people who have more Paid + Owing than they do Owed - as much more as possible in fact - as this means they are more reliable (they have backers they can get proofs of work from [which can trivially be forwarded to you when needed] and they aren't "spending" more than they are being paid.) Thus, you yourself want to be in a similar situation so that other people want to do business with you. It would not be impossible to see Server farm A build up a difference of Owed/Owing, then indebt themselves to B, who indebts themselves to C... to D... ... ... who indebts themselves to BZ, and then BZ calls on BY, who calls on BX, who... ... who calls on A to build a proof of work for the chain A->B->C->...->BZ, just not likely.

However, for this to work, you need credit with your trusted third parties, and in effect those third parties "validated" your transaction (but had to risk 10,000$ to do it, an amount equal to the loan ... if only for a short time...).

To the contrary, those third parties (who can be absolutely purely selfish scoundrels) paid off their debts while maintaining what they were owed, this is good for them, they want to do it. It's literally the printing money stage of the equation, and lets them build a good reputation to boot. That's why we use the proof of work in this part of the system, it provides a fundamental limit that costs real world money to increase. As proofs of work increase in difficulty roughly exponentially, any amount of real world money spend on purchasing additional processing units can only have a finite return in units of currency - the result of a decreasing geometric sum. This provides a lower bound on the value of the currency that inflation simply cannot penetrate.

As the system matures it might be possible for people to accept debts with a self-tax on them to cover payments, that however is less reliable and would require actually building such a system to find out it it ever became reliable enough.

I'm a little confused, maybe you can explain the premise behind this whole thing to the uninitiated? So the idea is that you get paid in a currency, and have the ability to lend out and borrow money from anyone, without the use of a bank? If that's the case, how do I grow my money? In the current market, I would but my money in a bank account/savings account/CD to get interest on my money. Do I get to charge interest to people I am owed by?

No, you don't get to charge interest. You produce currency by leaving your computer on overnight and letting it compute proofs of work when other people call for them from you (in an active economy, this will happen a lot.) The excessive lending back and forth can be viewed in a way such that no one is actually loaning anyone anything, and people running server farms are slowly minting more currency. What's happening behind the scenes is that people are trading debt, which produces differences between their income and their expenses which, if everyone refuse to do business with those who have a poor history, works just like having an actual hard currency and no loaning at all.

Its even possible for wealthy individuals to set up large banks to compute more money.

[Yakk]

It's backed by proofs of work - a computationally hard problem has a certain kind of integrity that mere government banks lack.

Ok, why do I want proofs of work?

On the other hand, I want tokens for your debt. Because if you are in debt, if you don't pay it back, your stuff gets taken away. So long as you have stuff that can be taken away this way, you being in debt makes my money worth something. You, personally, will do things for money (dance monkey dance) in order to pay off your interest.

So my money is backed by the value of a few million people in debt and wanting to pay it back or lose their stuff.

Sure, the money is also issued by the central bank/government -- but they aren't what is backing the debt. The central bank/government won't give me the things I want based off of money -- they'll just give me money in different forms.

A proof of work system looks like a fancy "mining gold for currency" -- it is a method to prevent the currency that we agree to from growing in amount without bound. It isn't tied to the actual size of the economy of doing things for people denominated by the currency, so it has random inflationary/deflationary effects (ie, the value of the currency is very unstable).

Mining money looks like it has most of the problems of gold-backed currencies (basing the amount of money off some relatively useless activity, creating too many people who do that activity) without the advantage (gold is at least pretty, your proofs of work aren't).

Ah -- you are talking about your currency being "denominated" in proofs of work. So at no time will the currency be worth more than the the cost of doing such a proof of work. This is a cap on the value of the currency. This cap is implemented by diverting resources to the utterly useless task of "mining" more currency whenever the value of the currency passes a certain point, thus contracting the part of the economy we care about (doing things for other people that are useful). That sort of sucks.

In addition, such proofs of work are pretty worthless -- what provides a floor on the value of the currency? I suppose if the value of the currency plummets, people stop mining the currency. Then in the long term, assuming that the economy denominated by the currency continues to grow, the money supply won't (until computational power gets faster/better techniques are developed), the currency value could recover. However, in the long term we are all dead, so this doesn't look like a strong defence against currency collapse?

For them to get 10,000$ from the "trusted" third party, they first have had to paid the third party 10,000$, who then turns around and pays them 10,000$. Or something like that.

They can simply do a debt exchange. Two people say to each other "Okay, I owe you X."

Does this act of making debt generate more money? Ie, do I need money in order to lend some to someone?

Or is this all just juggling around these "mined" coins, signing who has them?

This provides a lower bound on the value of the currency that inflation simply cannot penetrate.

No, this is an upper bound on the value of the currency. You are assuming that the value of the currency is "how much it costs to replace the currency", when that is a upper bound on how much the currency can be worth.

I mean, you do know that this looks a lot like pre-Adam Smith economics, where governments horded silver to back your currency, right?

[WarDaft]

Ok, why do I want proofs of work?

On the other hand, I want tokens for your debt. Because if you are in debt, if you don't pay it back, your stuff gets taken away. So long as you have stuff that can be taken away this way, you being in debt makes my money worth something. You, personally, will do things for money (dance monkey dance) in order to pay off your interest.

So my money is backed by the value of a few million people in debt and wanting to pay it back or lose their stuff.

You want them, because a central government can't decide to print itself up a million times what you can earn in your lifetime. The bank can't decide to freeze your assets. The bank can't go broke and leave you with nothing. Because there is no bank. Yes, the market can crash, but that can happen anyway. This particular virtual currency has a stronger counter inflationary measure than others I've seen.

With a mature system, there's no reason that we couldn't see a form of meta-debt come into being, which works like real world loans do - interest and foreclosure and all that. It doesn't all have to be doubly anonymous cloak and dagger style hushed exchanges over the internet, it could also be face to face, as a part of a legally binding contract. Unlike in real life however, you can never distance the money you loaned from the loan itself, there will always be a chain that can be followed back. But we have to build the currency first, just trying to jump to that state and the system has a very strong chance of just self-destructing before becoming useful.

Sure, the money is also issued by the central bank/government -- but they aren't what is backing the debt. The central bank/government won't give me the things I want based off of money -- they'll just give me money in different forms.

A proof of work system looks like a fancy "mining gold for currency" -- it is a method to prevent the currency that we agree to from growing in amount without bound. It isn't tied to the actual size of the economy of doing things for people denominated by the currency, so it has random inflationary/deflationary effects (ie, the value of the currency is very unstable).

Mining money looks like it has most of the problems of gold-backed currencies (basing the amount of money off some relatively useless activity, creating too many people who do that activity) without the advantage (gold is at least pretty, your proofs of work aren't).

It's also possible that our "hash" function could be finding folding patterns for proteins that satisfy a certain fitness, so long as such a process is never found to be too easy. Now we're curing cancer, or something. Anything we can define a fitness for and is sufficiently consistently hard so that we know how much work almost certainly went into an attempt at solving it is fair game. If we could find such a function for attempts at solving outstanding mathematical problems, we'd really be set.

So what can debt do?

Ah -- you are talking about your currency being "denominated" in proofs of work. So at no time will the currency be worth more than the the cost of doing such a proof of work. This is a cap on the value of the currency. This cap is implemented by diverting resources to the utterly useless task of "mining" more currency whenever the value of the currency passes a certain point, thus contracting the part of the economy we care about (doing things for other people that are useful). That sort of sucks.

In addition, such proofs of work are pretty worthless -- what provides a floor on the value of the currency? I suppose if the value of the currency plummets, people stop mining the currency. Then in the long term, assuming that the economy denominated by the currency continues to grow, the money supply won't (until computational power gets faster/better techniques are developed), the currency value could recover. However, in the long term we are all dead, so this doesn't look like a strong defence against currency collapse?

Does this act of making debt generate more money? Ie, do I need money in order to lend some to someone?

Or is this all just juggling around these "mined" coins, signing who has them?

No, the act of a debt exchange itself leaves everything balanced. Otherwise the currency literally would be worthless. However, this creates some debt that someone can pay off to you, or you can pay off to someone, with a proof of work. This second act is what you want to do, and requires the first.

The currency will never grow above the cost of obtaining a proof of work right away. The proofs themselves will become exponentially more difficult over time, to keep pace with technological advances. This rate can even be set to exceed them if we want.

No, this is an upper bound on the value of the currency. You are assuming that the value of the currency is "how much it costs to replace the currency", when that is a upper bound on how much the currency can be worth.

Actually, the fact that people literally cannot spend at a rate greater than the system can process new works of proof will almost certainly cause the system to value above this. That is, there is only a certain amount of profit that can be made across the whole system in a given interval of time. You want as much of that to be your profit as possible. If the total processing power starts folding because it becomes undesirable, there are direct counter-inflationary forces. You can't just charge more much for something, because the throughput on paying just got cut, and for everyone.


All in all, your concerns are all completely and totally tangential to what was really worried about. Either virtual currencies will work, or they won't, they weren't my idea. There's already several, and one (Bitcoin) has an economy 4.5 million USD strong (yes, that's based on what people actually pay for them, and also roughly as many as there are coins circulating.) My goal was creating a secure decentralized version.

[Yakk]

So, it is based on goldbug 2.0 pre-Adam Smith's "wealth of nations" economics?

So what can debt do?

Under the current system, lots? Every single dollar is backed by a dollar of debt. Someone out there is looking for your dollar (in particular) to pay off their debt (or at least service it), and if they don't get it they lose real assets (or, they go bankrupt, and the bank now has on their books the need for your dollar instead).

That seems like a real value, while gold/cryptographic hashes/etc is a single-dimensional value whose quantity does not fundamentally scale with the size of the economy it denominates.

Actually, the fact that people literally cannot spend at a rate greater than the system can process new works of proof will almost certainly cause the system to value above this. That is, there is only a certain amount of profit that can be made across the whole system in a given interval of time. You want as much of that to be your profit as possible. If the total processing power starts folding because it becomes undesirable, there are direct counter-inflationary forces. You can't just charge more much for something, because the throughput on paying just got cut, and for everyone.

Wait, what? No really, what? Are you somehow binding the velocity of money?

...

Virtual currencies don't need any kind of goldbug-type "mining". Heck "Virtual currencies" exist -- the vast majority of US dollars are not pieces of paper, but rather numbers in an account somewhere.

A virtual currency that wasn't some kind of goldbug based system might involve trading on debts (effectively IOUs), which are created not by mining some random cryptographic system but rather by someone making and being held to a promise.

/shrug.

---

So, how does the rate of currency in your system scale with the amount of economic activity/the currency growth with the economic growth? Or do you just hope they are similar?

What exactly happens in the inevitable event where the purchasing value of your currency drops by 50%? How is the money supply contracted in response to bring the value back up?

Why do you trust someone who has engaged in pointless, probably automated, sham transactions with another bot they control more than someone who has a new, blank, account?

What happens if someone finds a new way to solve the problem you denominate your currency in that is 10x to 1000x faster?

[Zamfir]

Apart from possible practical problems (which might indeed be solvable), I'd say the central objection to your system is the same as with bitcoins, or really most other goldbug schemes: how do you prevent an unstable downward spiral? Liek Yakk says, what if the value starts dropping a lot?

At any moment, some people might stop accepting and holding your kind of currency. That causes a bit of a drop of its market value, and other people might start worrying whether the currency will keep its value, and decide to sell their holdings just to be sure, lowering the value more, etcetera. At some point bubbles collapse, and there is no mechanism to stop this from happening in your system.

Your proofs of work have no value in themselves, and they are not legal claims on something else of value. They only represent value as long as other people accept them as paymnt, and those other people are under no binding obligation to accept them.

That makes them susceptible to such spirals, just like all currencies. For a currency to work, you need something stabilizing to counteract that instability. At the moment, bitcoins are stabilized by the hope of a some people to see a rise in value, and perhaps by some ideological dreams. That's how bubbles can stay inflated for quite a while, but it is hardly something you want to base your currency on.

Most currencies are simply stabilized by the promise of governments to stabilize them. A government is so large, and so creditworthy, that it can reliably stop a spiral by promising to buy all currency offered at a fixed floor price (where "buying" means giving you other things in return, or other currencies, or simply accept them as tax payment). But to do that, it has to have the creditworthiness to quickly borrow a shitload of those other things or currencies. Governments can do that because they can tax their people to repay that borrrowing, if needed. No other entities have a reliable cash flow anywhere near that size, which limits the amount of currency they could back.

If you can think of other stabilizing principles, that would be great. That's how you could create a currency that is independent of a powerful central authority. There are definitely possibilities, but they usually have their own weaknesses.

All in all, your concerns are all completely and totally tangential to what was really worried about. Either virtual currencies will work, or they won't, they weren't my idea. There's already several, and one (Bitcoin) has an economy 4.5 million USD strong (yes, that's based on what people actually pay for them, and also roughly as many as there are coins circulating.) My goal was creating a secure decentralized version.

.
You can't just wish away the difficulties of currencies, the difficulties that lead to the curent large, centralized and complicated system to secure and organize them. You're basically saying "let's solve global warming by assuming CO2-neutral cars. It's not my problem how to do that. Would it be better to paint them green, or should we paint them blue?"

[WarDaft]

Under the current system, lots? Every single dollar is backed by a dollar of debt. Someone out there is looking for your dollar (in particular) to pay off their debt (or at least service it), and if they don't get it they lose real assets (or, they go bankrupt, and the bank now has on their books the need for your dollar instead).

That seems like a real value, while gold/cryptographic hashes/etc is a single-dimensional value whose quantity does not fundamentally scale with the size of the economy it denominates.

What exactly happens in the inevitable event where the purchasing value of your currency drops by 50%? How is the money supply contracted in response to bring the value back up?

If it drops 50% overnight, it probably dies. If it drops 3%, and there was anyone riding the value of it being just barely worth their costs to produce coins (until the day everyone is using the exact same level of hardware and living where the costs of maintaining a computer are the exact same, this will necessarily happen gradually) they will stop producing coins. This will make it harder overall on the buyer to get proofs of work in a timely manner, and thus act as a force to reduce what they are willing to pay. Granted, it is possible that sellers as a whole will simply ignore this and the market will die, or they can start reducing their prices to maximize their gains with a more hesitant crowd of buyers.

And like I said, there's nothing in the system preventing contractual debt exactly like it exists with real currencies. In fact, it may support it more, as the individual who was loaned the money can have it as a permanent record in their history that the money they are paying you was in fact literally borrowed and they must pay it back with interest.

Virtual currencies don't need any kind of goldbug-type "mining". Heck "Virtual currencies" exist -- the vast majority of US dollars are not pieces of paper, but rather numbers in an account somewhere.

A virtual currency that wasn't some kind of goldbug based system might involve trading on debts (effectively IOUs), which are created not by mining some random cryptographic system but rather by someone making and being held to a promise.

/shrug.

Theoretically, yes. The problem, however, is that without a powerful central authority acting to do so, you can't be held to your promises. And, when building a new currency, you as a currency user do not want there to be a central authority with this freedom to act - there is entirely the possibility that this central authority just set up the whole thing as a money grab and that once it becomes profitable to do so in some currency they do value, to completely abandon the system to the ruin of everyone who trusted in it.

Why do you trust someone who has engaged in pointless, probably automated, sham transactions with another bot they control more than someone who has a new, blank, account?

Proofs of work can't be just whipped up. If the would be scammers were paid, then they should have demanded proofs of work to cover those payments, and you (more likely your client software) can backtrack through transaction histories to make sure the purchases were covered with proofs of work. If they were able to get those proofs of work, then it literally means nothing more to them to have those proofs of work stop at themselves, than to pass them on to you in the future, and the second gives them legitimacy. Most importantly, you can employ the law of the excluded middleman to follow the trail back to whoever is producing the proofs of work, and they really can't value participating in a scam more than actual commerce, because they're expending actual resources to do so and it will be no easier for them to do so than anyone else participating in real transactions. But this is the sort of thing I am worried about being possible in some way right now.

What happens if someone finds a new way to solve the problem you denominate your currency in that is 10x to 1000x faster?

This is one reason we want a flexible proof of work system. Indeed, the buyer could demand the proofs of work be any of a number of hashes, and the crunchers decide whether or not they are acceptable by how much the seller values them against how fast they can compute them. Or the seller could just demand proofs that are 10 to 1000 times harder. If a way is found that fundamentally reduces the complexity of the problem, that particular hash may become worthless.

You can't just wish away the difficulties of currencies, the difficulties that lead to the curent large, centralized and complicated system to secure and organize them. You're basically saying "let's solve global warming by assuming CO2-neutral cars. It's not my problem how to do that. Would it be better to paint them green, or should we paint them blue?"

Sorry, that was actually rather flippant of me. My concerns, right now, are ensuring that the system cannot be cheated. Ensuring market stability in a system that can be cheated is a waste of effort. First ensure it is secure, then ensure that it will not crash. I'm not sure of the first yet so it is not sensible for me to already be focusing on the second.

That said, I have a partial system in place... it's obviously not enough on its own of course, but it might be more effective than a piece of paper - and that's really what I'm working on defining first, the equivalent of the pieces of paper that cash is printed on, hopefully in such a way that no one can just print as much as they want.

At any moment, some people might stop accepting and holding your kind of currency. That causes a bit of a drop of its market value, and other people might start worrying whether the currency will keep its value, and decide to sell their holdings just to be sure, lowering the value more, etcetera. At some point bubbles collapse, and there is no mechanism to stop this from happening in your system.

The more people are exchanging the currency at a given time, the more valuable proofs of work become, as they are being demanded at greater rates. The value of the currency is founded in the value of proofs of work, thus (hopefully) acts to drive the currency's value back up.

No seller actually has to personally value receiving a proof of work. They just demand the buyer obtain them to ensure paying the seller was difficult for the buyer and not something the buyer will just forget. The buyer values them because it allows them to convince the seller that they are serious about their agreement.

There is a chance we can even arrange the system so that the virtual debt (which we would otherwise treat as the exchange of actually possessed currency in terms of transferring difference in owed/owing) recorded is instead an actual debt recorded, such that the buyer has recorded in their history that they ow someone some other form of reparation, even a real world currency, rather than owing virtual currency units. I do not believe this to be a simple extension (or I'd have built it into the base system) but it could be workable. So long as the effort the buyer expended to prove their commitment to the seller is at least as great as the effort for them to repay the debt, the debt will stay in their transaction history.

But like I said, cheat proof first, long term stability second. That is, what I'm worried about is not global warming, or the colour of the car, but making sure that the cars won't randomly explode killing all the occupants. That comes before being environmentally friendly.


---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

An effective way occurs to me to get real value out of the proofs of work. Devise a translation from random data into solutions to any problem that approximate solutions are useful for and hard to obtain. We might even be able to train ANNs this way. Then, instead of requiring a prefix for the hash, require that the fitness of the solution translated from the essentially random data of the hash result is above some threshold value. The seller can now obtain actual value out of proofs of work if they so choose, and the work required remains governed by a cryptographically secure hash. Note that this is value the seller has obtained from the buyer being paid. The seller was still paid by the transfer of debt difference from the seller to the buyer. Any value at all obtained from this is strictly sugar on top, it doesn't have to be equal to the purchase value.

[Zamfir]

@WarDaft, there is something that I don't get about people who are so worried about the power the government has over currency. Perhaps you can help explain.

Basically this: the government obviously already has the power to tax you. In all advanced economies, governments routinely collect 30 to 50% of GDP, without any need for currency manipulation to achieve that. That's far more than they can get from debasing the currency, especially in the long run. You can do unexpected inflation once in while, but not every year.

The same is true as a more general principle. Pretty much anything a government can do through its control of a central bank, it could roughly copy through fiscal measures. The power of central banks is mostly a manifestation of government power, not a source of it.

So what do you hope to gain, in return for the risks and pains of an unbacked currency? Money you lose through direct taxation is just as gone as value you lose from the printing press.

[WarDaft]

Oh, I don't hope to gain anything, I just find the concept interesting. Like I said, I'm fairly sure the system is secure enough that it's basic form can't possibly profit me in any way by being the one to implement it.

Other people might value such things though. But it doesn't matter to me either way except as an intellectual challenge.

Edit: I wasn't thinking about what I was typing and manage to directly contradict myself with two successive sentences.


Double edit: Thinking about it more, it technically doesn't even have to be a hash function. The proof of work just needs to satisfy these conditions:

1) A reliable estimate of how long the task will take to complete in the average case.
2) A way to prove that the task was completed for this particular request, and verify it correct, in less time (ideally much less) than to actually do the work.

Any operation which satisfies these is a reasonable request for proof of work format for a seller. Hey, we could even use image rendering as a task! To verify, render a small subset of the points in the image at random. Likewise, a small random subset of the picture can be used to estimate the time to completion.

You have to admit, that actually would be useful to many people.

This is all while we don't actually need the proofs to be useful, because the seller isn't being paid in proofs, they're being paid with a debt difference. The buyer is being paid proofs, so that they won't erase their debt difference exchange to the seller by simply not recording it in their history.

[Yakk]

So clearly I'm not understanding this proof of work system.

Are the proofs units of currency?

Do you prevent proofs of work from being reused? What prevents a proof from being reused? Do you say "prove this hard problem"?

If the proofs of work are hard, doesn't this eat up any economic surplus? Currencies need to be cheap on a per-transaction basis, or they are a massive amount of economic friction that causes your system to seize up.

[WarDaft]

The proofs are units of currency. But there's also debt (of the proofs, or perhaps, other things) which is what you transfer when you're paying for something. To convince the seller that the buyer will not erase their debt to the seller from the buyers history (which the buyer maintains the primary copy of), the buyer calls for proof of work payments from people who owe the buyer. Whether the buyer wants those or not, it takes effort to produce them, and they must obtain them to appease the seller.

The seller values this because the buyer has negated an amount of debt to themselves sufficiently large to convince the seller that the buyer will retain note of their debt to the seller. The negated debt is all signed with the buyer's transaction of debt to the seller so to 'forget' the debt to the seller, the buyer must also forget all the subsequent payments to themselves. The proof of work system allows the seller to be sure that the buyer obtained something that was not easy to obtain (whether or not they wanted it) and do not want to 'accidentally forget' having obtained. It does not necessarily have to be such proofs of work exchanged, they are merely a default debt that no one can easily obtain. Over time, there may be other transactions that buyers come to trust to ensure that debts to them remain a matter of permanent record in the buyer's history.

[ryanelm]

fun, I've been playing a mental exercise with this concept for years,
the fundamental truth as I see it is that "bad money replaces good"
which is a paraphrase of an old aphorism
it means that whenever someone is in control of the stuff, that is, the value of a currency
they tend to make decisions that weaken the currency, such is the conflict-of-interest that is power
leading in the end back to an individual trust based system, I think
money seems like a game taht works as long as the players follow the ruls

[moriarity_enabled]

@WarDaft: I do not understand how you get around the problem you tried to address with Key part number 1: Making debts stick. Suppose I "agree" to be indebted to you. I with great flourish make my entry and you include it in your history. Then I roll back. You say something about making sure that they do something subsequently, for example, make history entries that were "on top of" the one including the debt to you. But they can even satisfy this requirement (though honestly, I can think of no practical mechanism for *you*, the person taking part in the transaction, to do ensure this -- this is the foundation of bitcoin's block scheme -- more on this below). Suppose, for example, that they simply keep two books, the one you like, and the rolled-back one, in parallel for however long you think should "cement" the deal. Now, what happens just after the requirement period? Presumably, they now begin making transactions against their rolled-back copy. Eventually, someone waaaay down the chain will uncover the conflict. But I can see no way for *that* person, or anyone else for that matter, to have any way to distinguish which person, you or I, was lying. If there is some kind of implicit "whoever has the most consistent entries" kind of criterion, then all the liar has to do is be more transactionally active than you -- that is, the liar must outweigh you -- and I can see no reason to think this would be particularly challenging. You also allude to something else when you write: "Furthermore, any who chose to deal with someone who rolled back can see the contact information for those who owe them, and check to see if they have confirmation of the rollerbacker being paid the proofs of work." This part I just didn't understand, and so I can't tell if it is relevant to my concerns. Note that all of my concerns are addressed by the block scheme of bitcoin -- it is in fact the entire raison d'etre of the block scheme. I do not really understand why you consider it to be a "central authority." The block scheme is maintained as a distributed database by every participant in the block generation task. It is in fact a democracy of CPU cycles -- so long as anyone can play, and so long as tons of people do, the system is practically difficult to compromise. But in the normal sense of "central authority," there is none -- no one can assess the facts of the matter about the currency except for the compute cluster at large. Perhaps you meant something like, you were after a "completely unsubvertible currency," i.e. one upon which the possibility of subversion by commanding completely dominant compute power was not available. I don't understand how your system is unsubvertible, given my stated concerns, so that would be the most interesting thing to talk more about.

@Zamfir: I found your comments very illuminating. I had always wondered what smelled funny about bitcoin, but couldn't put my finger on it. I was thinking it had something to do with the fact that it was a "companion currency" where ever it was used -- that is, it was global but always being used in any given municipality as an exchange currency in and out of local coin. But now that you've pointed out that the fact that it isn't itself backed by something like a governmental promise to be honored (forget the fiat vs not fiat distinction -- no government would currently accept this currency as a tax payment), I "see the light." However, I do think there is a partial response. There is in fact a feature of e.g. bitcoin that supports its having a value and this support does tend to lend *some* stability to the currency. This is the feature that like cash, it is (relatively) anonymous, but like digital payments, can be made to and from anywhere. As long as there are things that people want to be able to do untracked by whatever element of the watching system they find most disagreeable, there will be a pragmatic value to having digital anonymous transactions. Bitcoin is an example of a home for such transactions, and as such, it gains some stability from this. For example, suppose there were a downward spiral of value due to more and more people and businesses no longer accepting bitcoins. There would be a crash. Subsequently, if people and businesses came about that *still thought there was a need for a cash-substitute online*, then once again, the value would begin being built. This would be true even though no government came and officially put a floor on bitcoin (although that could happen, too -- no reason why a big enough entity, could be a govt., could be amazon.com, might not also by fiat say, we sell X -- books, cds, tax vouchers -- for Y bitcoins, period; what's necessary is that the stabilizing party have an internal economy that is big relative to the bitcoin transaction market). The stabilizing ability for this feature of e.g. bitcoins then is relative to the *size of the anonymous market* -- that is, to the size of the market in which people require features of digital cash. If that market approaches 0, bitcoins will be valueless. If it came to pass that online, *everyone* demanded the closest proxy for anonymity for their financial transactions that they could possibly have, then bitcoins or some other similar system would be *comparatively* stable.

I would be totally psyched to read your replies, and thank you for such an interesting thread.

-m

[WarDaft]

My apologies, I was on vacation and so did not see the replies when they happened, then the thread was pushed back down the page.

The goal there is to ensure that whatever other histories the buyer is keeping track of, the one with their debt to you is the more favourable one for them to keep due to entries on it that they have paid for by calling in debts (and those they call the debts in from will not keep paying more than they owe.) Whether they record it or not, they can only get so much out of the people in debt to them. Furthermore if the debt repayments to them are close to or evenly split amongst their debtors, then it will be very apparent if they do not record some of it - thus the sellers will tell the buyer to distribute the debt covering evenly amongst their debtors.

And the reason I say that even BitCoin has a central authority, is because it does. The peer to peer network is not infallible, and if you do not have the latest accurate copy of the chain (the authority) you can be deceived. Furthermore, there is a known vulnerability - it has been calculated that a purchase of as little as 10 million dollars worth of the most cost efficient graphics cards hardware would be enough to fully compromise the network and render it useless. This cost will not likely increase much, as there is only so much value present in actually doing the calculations, there is a threshold with regards to cost of electricity and wear and tear on equipment which will eventually force the calculations to be a money losing activity if more than a certain amount of processing power is in the system. They are nearing that point, if not outright there, from which point the cost to compromise the system will not rise.

Under my system, throwing vast amounts of computation at the system can only make the person throwing it more wealthy, indeed, those are the people who would likely end up founding the first banks.