[mappum]

I am long Zcash:

* The founder is Zooko Wilcox-O'Hearn, creator of Zooko's triangle, the BLAKE2 hash function, Tahoe-LAFS, and former employee at MojoNation (an early attempt at cryptocurrency/P2P filesharing where another employee, Beam Cohen, went on to create Bittorrent). He knows a thing or two about decentralization/P2P.

* This project is NOT a trivial Bitcoin clone with only a new proof-of-work swapped in. The Zero Knowledge Proofs they use to keep transactions private is state of the art crypto. Also their PoW is actually memory-hard (many currencies have used PoW functions which they thought would be memory-hard and ASIC-proof, such as Litecoin with Scrypt, but it turned out not to be the case).

* Their "Founders Reward" is less like a premine and more like startup vested equity (it pays out to them gradually over 4 years to incentive themselves not to pump and dump).

* The team is extremely helpful in the Zcash Slack and are a relief after dealing with the pedantic, difficult Bitcoin developers.

[rspeer]

I can't stand the proliferation of proof-of-work cryptocurrencies in a world where people don't have to pay for the externalities of the energy they use.

Let me know when there's a cryptocurrency based on proof-of-carbon-sequestration or something.

[DennisP]

I'm working a coin minted for proof of carbon sequestration. It'd be implemented as a ledger on Ethereum (which is currently PoW but moving to proof of stake). Pay ether to a smart contract, it forwards the ether to approved organizations doing sequestration, and you get new minted coins.

A couple weeks ago I presented the idea at MIT's Solve conference, and I've got a writeup at MIT's ClimateColab that made finalist this year.

http://climatecolab.org/contests/2016/shifting-behavior-for-...

http://solvecolab.mit.edu/challenges/2016/fuel-carbon-price

(The Solve writeup is pretty old, the Colab is recent but I've done more thinking about the minting schedule since then and made some changes.)

[rspeer]

Neat.

Aside from the fact that it's built on a bug-prone foundation (Ethereum), the idea at least gives me some hope that cryptocurrencies don't have to have a negative impact.

[DennisP]

Cool :)

As for Ethereum, so far the bugs in the underlying platform have been minor; right now they're dealing with DoS attacks resulting from mispriced opcodes but that's getting fixed. Most issues have been due to poorly-written smart contracts rather than the platform. That's not entirely the fault of the contract authors; it's taking some time to figure out the attacks and best practices.

I'm not planning to launch in the near future anyway, because Ethereum is going through some major changes next year for scalability, and contracts will need to be coded differently to take advantage of that. In the meantime I've gotten a job doing Ethereum app work, so I should be reasonably well-prepared to get the technical side of things right.

I think the bigger challenge is making sure the climate action is actually effective. Something I learned from people at the MIT conference is that while carbon offsets are readily available in the voluntary market, even the certified offsets are often very poor quality, or even outright scams.

Also I'd like to figure out a governance system that doesn't rely on central administration, but that may not be workable; a more democratic system could end up funding charismatic projects that don't actually do much good. I've got some ideas though.

[DINKDINK]

>I can't stand the proliferation of proof-of-work cryptocurrencies in a world where people don't have to pay for the externalities of the energy they use.

Not a fare comparison; all of visa/mc's servers have externalities, all of the money trucks driving around physically collecting cash have carbon externalities, building ATMs and printing plastic credit cards have carbon externalities, building banks and running them have carbon externalities.

You have to compare the relative carbon impact. Cryptocurrency miners obviate all of those things.

[rspeer]

Have you compared the relative carbon impact? You're making it sound like the things you're "obviating" are on at all the same scale.

Visa et al. are incredibly efficient compared to Bitcoin. I heard a Bitcoin advocate point out that all it would take to make Bitcoin have enough throughput that everyone could use it is 1% of the power in the entire world.

[nickik]

That is the case for Bitcoin but not for all blockchains, particularly prove of stake systems. BitShares for example has an extremely efficient system.

The tradeoff is that the 'peer' need to be relatively high performance servers (just normal commodity servers, nothing special).

Its impossible to achieve with the concept of everybody running their own nodes on a laptop.

In BitShares the Shareholders (people who own BitShares) can vote on either improving the performance and decreasing the distribution or the other way around.

So you are still gone be somewhat less efficient compared to Mastercard but you can achieve the same the scalability with a reasonable amount of extra power usage.

[wyager]

Good luck getting anything like that into a cryptosystem.

Do you actually understand the utility of proof-of-work? Whenever someone proposes something silly like "proof of recycling" or "proof of solar power" I can't imagine they do.

[rspeer]

I understand the negative utility of proof-of-work. It takes useful resources and turns them into nothing.

I didn't claim it would be straightforward to make a cryptosystem whose mining process causes a benefit instead of a harm. I didn't claim I had such an idea. But let's rank some options in order of goodness:

1. Figure out a cryptocurrency with a real-world benefit

2. Don't use cryptocurrencies

3. Use cryptocurrencies

You may have chosen the worst option. I'm content with option #2.

[wyager]

> I didn't claim I had such an idea

Hint: it's impossible.

But regardless, I seriously doubt that Bitcoin mining actually has negative utility even after taking into account any negative externalities introduced by the relatively small electricity use from mining. My suspicion is it's more or less negligible compared to manufacturing or transportation.

[cloudjacker]

What do you think about Cryptonote projects? Such as Monero, Boolberry, a variety of other similar networks

Some advantages Cryptonote has that come to mind:

- They are private by default. Zcash requires two states, a state analogous to bitcoin, and the anonymous zcash state which has to be explicitely opted into. Shadowcash also has this, but opted for ring signatures for the anonymous state (like cryptonote coins use by default) instead of the zkSNARKs. The market hasn't focused much attention on Shadowcash.

- Cryptonote projects have proof of work algorithms that are durable and so far ASIC-proof. Cryptonite, Wild Keccak still are CPU and GPU friendly. But I'd have to read their respective papers before I say "ASIC Proof because memory hard"

- Cryptonote are also auditable if a user wants to reveal information about a transaction. But even then the information is limited, it will show that payments came in and out of specific amounts, but it won't show the sending/receiving address along with those transaction IDs.

- Cryptonote projects have nonthreatening names. Many privacy centric projects have names like Dark- Shadow- Anon- whereas noteworthy cryptonote projects have names that at worst simply wouldn't be taken seriously by a "powerful establishment" until so much capital and infrastructure is already built. I think ZCash or "Zerocash" isn't going to get smiles and congratulations from FinCEN. Hyperbole, but I don't think it is an advantage for the project.

Its one thing to be optimistic about the founders and their company, but for you to say "long" something that doesn't seem like a better investment, makes me wonder what you see in comparison to some other existing technologies.

Looking forward to your thoughts

[ewillbefull]

> Zcash requires two states, a state analogous to bitcoin, and the anonymous zcash state which has to be explicitely opted into.

It does not require two states, this is a misconception that originates from the paper which refers to "basecoins" and other obsolete terminology. The protocol was anticipated to be a sidechain of some kind, but due to technical limitations that never panned out. Our system does use two states, but I personally advocate for removing the "transparent" system in the future when we have things like private multi-sig.

> Cryptonote are also auditable if a user wants to reveal information about a transaction. But even then the information is limited, it will show that payments came in and out of specific amounts, but it won't show the sending/receiving address along with those transaction IDs.

You can do all of this with our system as well, it was one of our design goals!

[cloudjacker]

I get that the protocol in theory doesn't need two states, Zcash the product will have two states. The harder second state likely won't be used that much. There are several cryptocurrencies that had multiple states to promote privacy. Darkcoin's darksend was an option in an otherwise bitcoin clone. Shadowcash has two states where the default state is an otherwise bitcoin clone. Zcash doesn't differentiate there.

As regard to your second point, I know, thats why I said "also".

Aside from the marketing budget and evangelists, Zcash isn't really standing out to me. What do you see? Your idea and possibility of removing the transparent system? From my understanding this means every transaction will have the high system requirements, it still seems like a worse execution of this technology than other existing cryptocurrencies who will be even further ahead by the time these growing pains are even considered on the Zcash network.

[Ar-Curunir]

CryptoNote doesn't look very scalable; if you want a large anonymity set, your transaction size grows linearly with the size of the set.

[cloudjacker]

Scaling is a valid criticism of cryptonote

Have you talked with the monero team on how they plan to address it?

They might not have a good answer (cheaper storage, computers faster in the future), maybe they do have some solutions in mind

This seems to be an issue with zcash too? Can you explain why it isn't?

Given current information if seems like these problems won't become apparent till the year 2021

[Ar-Curunir]

In ZCash each transaction is the same size, regardless of how large your anonymity set is.

[cloudjacker]

Okay, that is an interesting perk, where could I read about that and come to the same conclusion? For some reason I don't recall the white paper explicitly saying that but it wasn't comparing itself to cryptonote to begin with.

[Ar-Curunir]

It's a property of the zero knowledge proofs in question; they're called Succint Non-interactive Arguments of Knowledge because their size grows sublinearly with the size of the statement being proved. In the case of ZCash, the statement consists of proving things about the blockchain, and things are set up in such a way that the size of the proof used is 288 bytes, ALWAYS.

[vegabook]

As you are zealously talking your zcash book, maybe you would be willing to let me short this worthless charlatanry and transparent crytopportunism to you for actual dollars? Via a personal CFD?