[3pt14159]

What I do not understand is why we couldn't build this onto a web of trust + proof of stake. It may require some more state during resolution, and might even require falling back to automatic service denial if there is a severe network interruption (say in the event of nuclear war), but I can't figure out why we couldn't have miners just sign a growing dag of transactions and once a subset of the dag is accepted by 51% of the stake that network can prune the excess data (all the signatures). Work timestamps into the signature process and pin the keys used to sign the dag as only those belonging outside the current resolution. If a key is used to sign a transaction that conflicts with it's own "Verified & Locked" signature then it's coins are burned, including for it's own transaction. So in your example, if Alice signs both transactions and she doesn't have the funds to fulfil both of them the transaction causes Alice to lose 100% of her money.

I'm sure there is a reason, and I vaguely recall some people talking about proof of stake a couple years ago, but I'm surprised we're still melting icecaps running ASICs out of China for new coins.

[bmcusick]

> I can't figure out why we couldn't have miners just sign a growing dag of transactions and once a subset of the dag is accepted by 51% of the stake that network can prune the excess data (all the signatures)

Because of Sybil attacks.

> So in your example, if Alice signs both transactions and she doesn't have the funds to fulfil both of them the transaction causes Alice to lose 100% of her money.

Remember, the goal isn't to punish Alice. She's losing 100% of the bitcoin no matter what happens. The goal is to assure Bob (or Charles) that the transaction they receive will be recognized as valid by the rest of the world.

If you're Bob, and you know that Alice can invalidate the transaction (e.g., burn the bitcoin you just received) by signing a second transaction in the future, why would you ever accept Bitcoin?

Don't punish Alice. Assure Bob.

[3pt14159]

Short of an adversary having greater than 50% of the coins I don’t really see how a sylbi attack is relevant.

As for Bob isn’t he assured once he sees inclusion of his transaction into the 51% signed dag? Also Alice’s punishment is only for double spending before inclusion into the dag. On second thought it should go to the miners, not just get zapped into the void.

[runeks]

> What I do not understand is why we couldn't build this onto a web of trust + proof of stake.

Because the incentives of nodes in a web of trust is not to tell the truth about how much money they have; their incentive is to prefer whichever chain says they have the most money.

With proof-of-stake, an arbitrary number of valid chains can be created from scratch in no time. How do we decide which is the right one? All nodes will prefer the chain that says they’re the richest, and the nodes that most efficiently can coordinate their lying will end up with all the money.

Proof-of-stake solves the wrong problem: the problem isn’t to decide who gets to extend the chain, the problem is deciding which chain to extend in the first place (there can be millions of valid PoS-chains).