8 ms·

Bitcoin is "Worse is Better"

41 points by r11t 15y ago

tptacek 15y ago
The logic in this post appears to be: 1. "Notice how Bitcoin has a minimal-to-nonexistent cryptographic pedigree". 2. "Here are many criticisms of the system ranging from 'it is difficult to scale' to 'it is completely meaningless as a currency', many of them from cryptographers who have studied cryptocurrencies for over a decade". 3. "Notice how Bitcoin is currently popular". 4. "Therefore, Bitcoin is worse-is-better". It helps at this point to understand that "worse-is-better" --- a casual essay by Richard Gabriel --- describes how Unix took over the world not based on merit but on its viral characteristics. By implication, this article suggests that Bitcoin is also poised to take over the world virally. The issue here is that Unix was also a functioning operating system. Nobody criticizes Unix as "completely unworkable"; they just think it's inelegant. Gwen recognizes this, and uses "elegance" as a straw-man argument to bucket Bitcoin critiques into and to make it fit the pattern of "worse-is-better". But the most damning criticisms of Bitcoin --- criticisms he himself cites in this very article --- aren't that it's inelegant. Instead, the most damning critiques of Bitcoin are instead that it almost totally fails to achieve its security objectives, that it exploits a misperception about anonymity to handwave away the fact that for most users it is not anonymous, that it is reliant on centralized infrastructure ("Bitcoin is peer to peer in the sense of the British Peerage System"), and (most importantly) that it is meaningless as a currency: "I have taken $100 and set it on fire; I will sell you a certificate representing the smoke for $101". These aren't elegance critiques. This isn't "worse-is-better"; to make a similar argument fly, you have to come up with "worthless-is-better". Unfortunately, the greater fool theory floats that argument too, at least until Esquire writes the postmortem on Bitcoin and all the fools who lost money to it.
- gwern 15y ago
  Thanks for reading; your summary is pretty decent. But obviously I differ about the elegance and following. Elegance is not optional; elegance is useful; elegance has important practical consequences. Go back to rpg's original paper and one of his examples - the difference between ITS and Unix in system calls was not one of mere aesthetic elegance, but a case where Unix programs were incorrect and could, and did, fail! Like freeing memory in memory management, it's easy to omit the check whether the system call failed. This applies to each of your points: - the anonymous vs pseudonymous distinction - you can build anonymity on top of the pseudonymity (I spent a couple links and cites establishing this with the mix material!) but you can easily not succeed in getting the anonymity you wanted. Just like you can easily not check system call success on Unix. - the centralized infrastructure: anyone who wants to be a full miner peer can... they just have to buy the GPU power. Like writing a secure & bug-free Unix C program, it'll cost you. (One in money, the other in time & skill.) - meaningless as currency: I am actually not sure how elegance plays into that at all, so I have no cute analogy to rpg's Unix/ITS system calls. The wasted computing power is inherent to the system of avoiding double-spending (I also spent some time discussing this), but that's not related to Bitcoin being worthless or not as a currency. Any damn thing can be currency, after all; currencies are as currencies do.
  - kiba 15y ago
    - meaningless as currency: I am actually not sure how elegance plays into that at all, so I have no cute analogy to rpg's Unix/ITS system calls. The wasted computing power is inherent to the system of avoiding double-spending (I also spent some time discussing this), but that's not related to Bitcoin being worthless or not as a currency. Any damn thing can be currency, after all; currencies are as currencies do. It would be great if tptacek actually explained what he means. It seems to be a muddled economic argument. I do not understand "meaningless as currencies goes".
    - tptacek 15y ago
      In this comment I would like to propose "Flitcoin". Flitcoin is nearly identical to bitcoin, with exactly one difference. In Flitcoin, instead of brute forcing a nonce through SHA-256(x) to find hashes with a suitable prefix of 0's, Flitcoin brute forces a nonce through HMAC-SHA256("bananas", x) to find hashes with a suitable suffix of 1's. Please explain to me why my Flitcoin is inferior to your Bitcoin. As you do so, note that all the world's Bitcoin software is trivially upgradable to Flitcoin; in fact, it requires less than 10 lines of code to do so.
      - icebraining 15y ago
        Bitcoin already has users and Flitcoin doesn't?
        tptacek 15y ago
        So, marketing? Ok! I'll just run a 2-for-1 sale on Flitcoin. Less snarkily: why are people using Bitcoin? What's the intrinsic value they see in Bitcoin? Based on what evidence can they predict that Bitcoins purchased today will be convertible to gold, dollars, or even toenails at any valuation? You've begged the question.
        icebraining 15y ago
        >You've begged the question. No, you just asked a different question. >What's the intrinsic value they see in Bitcoin? Well, free transfers, for one, and not being subject to having your money frozen by online payment companies (e.g. Paypal).
- bdr 15y ago
  As long as we're talking about Bitcoin, mind clarifying your criticisms? it almost totally fails to achieve its security objectives, that it exploits a misperception about anonymity to handwave away the fact that for most users it is not anonymous Are these the same -- both referring to the mere pseudonymity of addresses? it is reliant on centralized infrastructure How so? My understanding is that anyone can generate a new block, it's just (linearly) more likely to be you the more CPU you have. and (most importantly) that it is meaningless as a currency This seems like the weakest criticism. There are many conventions that work simply because they are conventions. In other words, they are self-supporting. Bitcoin has bootstrapped to the point where such a convention exists, and people are productively using it as a currency. This may not be the level of rigor you're used to in your work, but it seems plausible that a convention like Bitcoin could last for a significant period of time before collapsing.
  - tptacek 15y ago
    The dollar isn't a currency simply by convention. Neither is gold. It only seems that way in the frictionless vacuum of message board arguments.
    - bdr 15y ago
      Agreed, and I didn't say they were.
stygianguest 15y ago
Worse is better does not apply to bitcoin as a cryptographic system, only as a monetary system. As a cryptographic system it makes a clear choice for more features over simplicity. Make no mistake, bitcoin is a very complicated system. Not for a piece of software, but for a cryptographic system. One that aims to replace the fundaments of our economic system. With such ambition, "it seems to work," is not good enough. As someone who has spend some time hacking the bitcoin code, I have little confidence. Although I have not found any outright errors, the quality of the code shocked me. The code does nothing to provide structure and/or insight to the already complicated protocol. Basic protocol is mixed with parsing of messages and parallelism of the code. I for one, fully expect major and near fatal errors to be found in bitcoin.
- gwern 15y ago
  > As someone who has spend some time hacking the bitcoin code, I would say I have little confidence. There are a lot of differing opinions on this. I quoted Kaminsky at length as someone with major security credentials who is saying the opposite of you.
  - tptacek 15y ago
    You are citing as an authority on code quality someone who says Bitcoin should use Bcrypt instead of SHA-256 because Bcrypt is less amenable to hardware optimization. I hope to make the starburst of applicable points that follow from this by implication instead of explicit argument.
    - gwern 15y ago
      I'm afraid you're going to have to be explicit, because the idea of using Bcrypt for that reason makes perfect sense to me - the logic that makes Bcrypt better than SHA-256 for passwords seems to apply nicely to Bitcoin. Hardware optimization privileges the few who can invest in the hardware over the many who are able to run more commodity hardware, and is exactly contrary to the P2P Bitcoin ethos. (A similar point applies to time-lock puzzles: http://www.gwern.net/Self-decrypting%20files http://www.gwern.net/Self-decrypting%20files Why were Rivest/Shamir/Wagner unhappy with brute-force decrypting? Because it's so amenable to hardware optimization. Why were subsequent researchers unhappy with successive squaring and looked for memory-bound hashes? Because squaring is still implementable in hardware.)

41 points by r11t 15y ago

The logic in this post appears to be: 1. "Notice how Bitcoin has a minimal-to-nonexistent cryptographic pedigree". 2. "Here are many criticisms of the system ranging from 'it is difficult to scale' to 'it is completely meaningless as a currency', many of them from cryptographers who have studied cryptocurrencies for over a decade". 3. "Notice how Bitcoin is currently popular". 4. "Therefore, Bitcoin is worse-is-better". It helps at this point to understand that "worse-is-better" --- a casual essay by Richard Gabriel --- describes how Unix took over the world not based on merit but on its viral characteristics. By implication, this article suggests that Bitcoin is also poised to take over the world virally. The issue here is that Unix was also a functioning operating system. Nobody criticizes Unix as "completely unworkable"; they just think it's inelegant. Gwen recognizes this, and uses "elegance" as a straw-man argument to bucket Bitcoin critiques into and to make it fit the pattern of "worse-is-better". But the most damning criticisms of Bitcoin --- criticisms he himself cites in this very article --- aren't that it's inelegant. Instead, the most damning critiques of Bitcoin are instead that it almost totally fails to achieve its security objectives, that it exploits a misperception about anonymity to handwave away the fact that for most users it is not anonymous, that it is reliant on centralized infrastructure ("Bitcoin is peer to peer in the sense of the British Peerage System"), and (most importantly) that it is meaningless as a currency: "I have taken $100 and set it on fire; I will sell you a certificate representing the smoke for $101". These aren't elegance critiques. This isn't "worse-is-better"; to make a similar argument fly, you have to come up with "worthless-is-better". Unfortunately, the greater fool theory floats that argument too, at least until Esquire writes the postmortem on Bitcoin and all the fools who lost money to it.

gwern 15y ago
Thanks for reading; your summary is pretty decent. But obviously I differ about the elegance and following. Elegance is not optional; elegance is useful; elegance has important practical consequences. Go back to rpg's original paper and one of his examples - the difference between ITS and Unix in system calls was not one of mere aesthetic elegance, but a case where Unix programs were incorrect and could, and did, fail! Like freeing memory in memory management, it's easy to omit the check whether the system call failed. This applies to each of your points: - the anonymous vs pseudonymous distinction - you can build anonymity on top of the pseudonymity (I spent a couple links and cites establishing this with the mix material!) but you can easily not succeed in getting the anonymity you wanted. Just like you can easily not check system call success on Unix. - the centralized infrastructure: anyone who wants to be a full miner peer can... they just have to buy the GPU power. Like writing a secure & bug-free Unix C program, it'll cost you. (One in money, the other in time & skill.) - meaningless as currency: I am actually not sure how elegance plays into that at all, so I have no cute analogy to rpg's Unix/ITS system calls. The wasted computing power is inherent to the system of avoiding double-spending (I also spent some time discussing this), but that's not related to Bitcoin being worthless or not as a currency. Any damn thing can be currency, after all; currencies are as currencies do.
- kiba 15y ago
  - meaningless as currency: I am actually not sure how elegance plays into that at all, so I have no cute analogy to rpg's Unix/ITS system calls. The wasted computing power is inherent to the system of avoiding double-spending (I also spent some time discussing this), but that's not related to Bitcoin being worthless or not as a currency. Any damn thing can be currency, after all; currencies are as currencies do. It would be great if tptacek actually explained what he means. It seems to be a muddled economic argument. I do not understand "meaningless as currencies goes".
  - tptacek 15y ago
    In this comment I would like to propose "Flitcoin". Flitcoin is nearly identical to bitcoin, with exactly one difference. In Flitcoin, instead of brute forcing a nonce through SHA-256(x) to find hashes with a suitable prefix of 0's, Flitcoin brute forces a nonce through HMAC-SHA256("bananas", x) to find hashes with a suitable suffix of 1's. Please explain to me why my Flitcoin is inferior to your Bitcoin. As you do so, note that all the world's Bitcoin software is trivially upgradable to Flitcoin; in fact, it requires less than 10 lines of code to do so.
    - icebraining 15y ago
      Bitcoin already has users and Flitcoin doesn't?
      - tptacek 15y ago
        So, marketing? Ok! I'll just run a 2-for-1 sale on Flitcoin. Less snarkily: why are people using Bitcoin? What's the intrinsic value they see in Bitcoin? Based on what evidence can they predict that Bitcoins purchased today will be convertible to gold, dollars, or even toenails at any valuation? You've begged the question.
        icebraining 15y ago
        >You've begged the question. No, you just asked a different question. >What's the intrinsic value they see in Bitcoin? Well, free transfers, for one, and not being subject to having your money frozen by online payment companies (e.g. Paypal).
bdr 15y ago
As long as we're talking about Bitcoin, mind clarifying your criticisms? it almost totally fails to achieve its security objectives, that it exploits a misperception about anonymity to handwave away the fact that for most users it is not anonymous Are these the same -- both referring to the mere pseudonymity of addresses? it is reliant on centralized infrastructure How so? My understanding is that anyone can generate a new block, it's just (linearly) more likely to be you the more CPU you have. and (most importantly) that it is meaningless as a currency This seems like the weakest criticism. There are many conventions that work simply because they are conventions. In other words, they are self-supporting. Bitcoin has bootstrapped to the point where such a convention exists, and people are productively using it as a currency. This may not be the level of rigor you're used to in your work, but it seems plausible that a convention like Bitcoin could last for a significant period of time before collapsing.
- tptacek 15y ago
  The dollar isn't a currency simply by convention. Neither is gold. It only seems that way in the frictionless vacuum of message board arguments.
  - bdr 15y ago
    Agreed, and I didn't say they were.

stygianguest 15y ago

Worse is better does not apply to bitcoin as a cryptographic system, only as a monetary system. As a cryptographic system it makes a clear choice for more features over simplicity. Make no mistake, bitcoin is a very complicated system. Not for a piece of software, but for a cryptographic system. One that aims to replace the fundaments of our economic system. With such ambition, "it seems to work," is not good enough. As someone who has spend some time hacking the bitcoin code, I have little confidence. Although I have not found any outright errors, the quality of the code shocked me. The code does nothing to provide structure and/or insight to the already complicated protocol. Basic protocol is mixed with parsing of messages and parallelism of the code. I for one, fully expect major and near fatal errors to be found in bitcoin.

gwern 15y ago
> As someone who has spend some time hacking the bitcoin code, I would say I have little confidence. There are a lot of differing opinions on this. I quoted Kaminsky at length as someone with major security credentials who is saying the opposite of you.
- tptacek 15y ago
  You are citing as an authority on code quality someone who says Bitcoin should use Bcrypt instead of SHA-256 because Bcrypt is less amenable to hardware optimization. I hope to make the starburst of applicable points that follow from this by implication instead of explicit argument.
  - gwern 15y ago
    I'm afraid you're going to have to be explicit, because the idea of using Bcrypt for that reason makes perfect sense to me - the logic that makes Bcrypt better than SHA-256 for passwords seems to apply nicely to Bitcoin. Hardware optimization privileges the few who can invest in the hardware over the many who are able to run more commodity hardware, and is exactly contrary to the P2P Bitcoin ethos. (A similar point applies to time-lock puzzles: http://www.gwern.net/Self-decrypting%20files http://www.gwern.net/Self-decrypting%20files Why were Rivest/Shamir/Wagner unhappy with brute-force decrypting? Because it's so amenable to hardware optimization. Why were subsequent researchers unhappy with successive squaring and looked for memory-bound hashes? Because squaring is still implementable in hardware.)