6 ms·

I'm not talking about a discreet modification of the blockchain. When you bootstrap a bitcoin client, you need to be use that the blockchain is the real one wit

I'm not talking about a discreet modification of the blockchain. When you bootstrap a bitcoin client, you need to be use that the blockchain is the real one without having to trust another party, otherwise someone could give you a completely different version. By incorporating proof of work, you can prove that the copy of the blockchain you have needed X amount of energy to create. This is what I sort of agree with you that immutability is not the right technical word for this property, but that is what I was getting at.

p4bl0 4y ago
Bootstrapping a client requires the same trust in the source from which you're getting the blockchain history, with or without PoW. PoW doesn't play a role here. But you're right that immutability does. What can give you confidence is that the version of the blockchain that you got is consistent with what others have and can show you (i.e., that you will be able to be a part of the network). This is the "distributed" part of what make immutability. The amount of energy spent until then plays no role here.
- datadata 4y ago
  No, you do not have to trust the source when bootstrapping a client. The proof of energy needed to construct the blockchain is what ensures that the copy you receive is likely to be a held as the consensus, since it would be prohibitively expensive to have multiple versions. Without an energy expenditure, the source could fabricate the entire blockchain just to attack you.
  - p4bl0 4y ago
    I never said you had to trust the source, I said that the necessary level of trust is the same (and it is indeed zero). So yes, PoW can give you confidence, but it is unnecessary in practice. Well, let's say it's an additional security measure where something else more trivial is already enough. When you get a copy of the blockchain, verifying if all the Merkle tree structure (without even checking for the PoW) and comparing the last hash (or the few last hashes) with what you see on the network from other sources is enough to be sure that your copy is valid. Because providing you with a fake chain which still has the same last hash would require to have at some point (for the block the attacker –i.e., the source of your copy of the blockchain– wants to modify) found a full collision, which is much more difficult than computing alternative valid PoW. So yeah, here PoW can give you confidence in the copy of the blockchain you get without having to even minimally interact (just looking at a blockchain explorer not controlled by your source for example) with others. But the whole point of the tech is to interact otherwise you don't need to bootstrap a client. So this refinement makes little to no sense.
    - datadata 4y ago
      I think you are just not getting it. In my scenario (downloading the blockchain from nothing and bitcoin not having any proof of work scheme), you would not need to find a full collision as you don't have any hash that you trust to check against anyway. The blockchain you downloaded could have been entirely made up by one person-- e.g. all of the addresses are opened and signed by them, etc. The entire thing is fake. This would be possible to construct with almost no energy, because we have removed proof of work. There would be no way to determine if the blockchain data is real You keep referring to other consensus mechanisms that are not really trustable without the PoW foundation (looking at other copies on the network, blockchain explorer). The beauty of PoW is that it speaks for itself-- you could download the data over an untrusted network with just one peer, and still be confident you got the real thing, because you can prove energy was sacrificed for its construction. PoW has other benefits beyond this quite silly scenario, I am just explaining it again as you don't seem to get it.
      - p4bl0 4y ago
        I'm an associate professor of computer science, and my PhD was in cryptology. I think I know a bit about what I'm talking about here. Please stop assuming people you are talking to are just "not getting it" and try to make an actual effort to think about the answers you get. I'm not talking about other consensus mechanisms. We were first discussing what makes a blockchains immutable, I already explained why PoW is not necessary for that. Then you reframed the discussion to how can you trust that a copy of the blockchain you were just given by someone you don't trust is valid, and you are right that PoW is a solution to this specific problem. My point, again, is that it is an unnecessarily costly solution for this specific problem, because the properties that makes a blockchain immutable (Merkle structure + distribution) are already enough to ensure that in practice, because a fake blockchain copy, even without PoW, will have a different last hash from the real one, and it will be easy to see that by simply comparing it with others sources (if you trust no one, which is one of the requirements for blockchains to be useful, you just need to do that with multiple sources to gain enough confidence, typically ones that are very public and would be easily denounced if they lied). And anyway by participating in the blockchain protocol it will be obvious very soon that your copy doesn't match with everyone else's. The only way this strategy won't work is if the last hash of the Merkle structure is valid while the blockchain copy is not, and the only way for this to happen is if a full collision has been found on the modified block. Which is way more costly than building a PoW valid hash. Let me take an example with another technology that has the same immutability properties as blockchains do but don't use PoW: Git. If you want to get a copy of the git repository of a project and you clone it from my version of the repository, either it is the real repository and everything is fine, or it is not —for example I could have introduced a backdoor somewhere in my version of the project— and then there is two possibilities: 1- Using the copy you downloaded from me you won't be able to participate (push or pull) in the project with anyone else than me because the commit log of the copy you got is incompatible with everyone else's version of the repository. You'll quickly understand that something's wrong with mine, and it will even be easy to see at which point the commit history diverges from the other copies of the repository that you attempt to collaborate with. 2- I've added my backdoor in a past existing commit, and found a collision in its hash to make it have the exact same hash as the original version of the commit (the one without my backdoor), and I have rebuild the exact same commit history from there. But here it requires me to have computed a full collision, which is actually impossible (at least much more so than computing a valid PoW hashes for a few commits after adding my backdoor), as long as there is no vulnerabilities discovered in the hashing algorithm. Now, if you never interact with anyone else than me, I don't have to find a collision because my commits hashes won't be compared to any others, and then you are right to say that you won't be able to know about the backdoor and that using PoW would make this scenario less plausible (not impossible, but way less plausible) in terms of cost for me. But, even more in the case of bootstrapping a blockchain client, it is the very idea of only interacting with the person you got a copy of the blockchain from that makes no sense.

p4bl0 4y ago

Bootstrapping a client requires the same trust in the source from which you're getting the blockchain history, with or without PoW. PoW doesn't play a role here. But you're right that immutability does. What can give you confidence is that the version of the blockchain that you got is consistent with what others have and can show you (i.e., that you will be able to be a part of the network). This is the "distributed" part of what make immutability. The amount of energy spent until then plays no role here.

datadata 4y ago
No, you do not have to trust the source when bootstrapping a client. The proof of energy needed to construct the blockchain is what ensures that the copy you receive is likely to be a held as the consensus, since it would be prohibitively expensive to have multiple versions. Without an energy expenditure, the source could fabricate the entire blockchain just to attack you.
- p4bl0 4y ago
  I never said you had to trust the source, I said that the necessary level of trust is the same (and it is indeed zero). So yes, PoW can give you confidence, but it is unnecessary in practice. Well, let's say it's an additional security measure where something else more trivial is already enough. When you get a copy of the blockchain, verifying if all the Merkle tree structure (without even checking for the PoW) and comparing the last hash (or the few last hashes) with what you see on the network from other sources is enough to be sure that your copy is valid. Because providing you with a fake chain which still has the same last hash would require to have at some point (for the block the attacker –i.e., the source of your copy of the blockchain– wants to modify) found a full collision, which is much more difficult than computing alternative valid PoW. So yeah, here PoW can give you confidence in the copy of the blockchain you get without having to even minimally interact (just looking at a blockchain explorer not controlled by your source for example) with others. But the whole point of the tech is to interact otherwise you don't need to bootstrap a client. So this refinement makes little to no sense.
  - datadata 4y ago
    I think you are just not getting it. In my scenario (downloading the blockchain from nothing and bitcoin not having any proof of work scheme), you would not need to find a full collision as you don't have any hash that you trust to check against anyway. The blockchain you downloaded could have been entirely made up by one person-- e.g. all of the addresses are opened and signed by them, etc. The entire thing is fake. This would be possible to construct with almost no energy, because we have removed proof of work. There would be no way to determine if the blockchain data is real You keep referring to other consensus mechanisms that are not really trustable without the PoW foundation (looking at other copies on the network, blockchain explorer). The beauty of PoW is that it speaks for itself-- you could download the data over an untrusted network with just one peer, and still be confident you got the real thing, because you can prove energy was sacrificed for its construction. PoW has other benefits beyond this quite silly scenario, I am just explaining it again as you don't seem to get it.
    - p4bl0 4y ago
      I'm an associate professor of computer science, and my PhD was in cryptology. I think I know a bit about what I'm talking about here. Please stop assuming people you are talking to are just "not getting it" and try to make an actual effort to think about the answers you get. I'm not talking about other consensus mechanisms. We were first discussing what makes a blockchains immutable, I already explained why PoW is not necessary for that. Then you reframed the discussion to how can you trust that a copy of the blockchain you were just given by someone you don't trust is valid, and you are right that PoW is a solution to this specific problem. My point, again, is that it is an unnecessarily costly solution for this specific problem, because the properties that makes a blockchain immutable (Merkle structure + distribution) are already enough to ensure that in practice, because a fake blockchain copy, even without PoW, will have a different last hash from the real one, and it will be easy to see that by simply comparing it with others sources (if you trust no one, which is one of the requirements for blockchains to be useful, you just need to do that with multiple sources to gain enough confidence, typically ones that are very public and would be easily denounced if they lied). And anyway by participating in the blockchain protocol it will be obvious very soon that your copy doesn't match with everyone else's. The only way this strategy won't work is if the last hash of the Merkle structure is valid while the blockchain copy is not, and the only way for this to happen is if a full collision has been found on the modified block. Which is way more costly than building a PoW valid hash. Let me take an example with another technology that has the same immutability properties as blockchains do but don't use PoW: Git. If you want to get a copy of the git repository of a project and you clone it from my version of the repository, either it is the real repository and everything is fine, or it is not —for example I could have introduced a backdoor somewhere in my version of the project— and then there is two possibilities: 1- Using the copy you downloaded from me you won't be able to participate (push or pull) in the project with anyone else than me because the commit log of the copy you got is incompatible with everyone else's version of the repository. You'll quickly understand that something's wrong with mine, and it will even be easy to see at which point the commit history diverges from the other copies of the repository that you attempt to collaborate with. 2- I've added my backdoor in a past existing commit, and found a collision in its hash to make it have the exact same hash as the original version of the commit (the one without my backdoor), and I have rebuild the exact same commit history from there. But here it requires me to have computed a full collision, which is actually impossible (at least much more so than computing a valid PoW hashes for a few commits after adding my backdoor), as long as there is no vulnerabilities discovered in the hashing algorithm. Now, if you never interact with anyone else than me, I don't have to find a collision because my commits hashes won't be compared to any others, and then you are right to say that you won't be able to know about the backdoor and that using PoW would make this scenario less plausible (not impossible, but way less plausible) in terms of cost for me. But, even more in the case of bootstrapping a blockchain client, it is the very idea of only interacting with the person you got a copy of the blockchain from that makes no sense.