[ricardolopes]

ETH2 was years in the making, with multiple delays and not fully migrated yet precisely because of how unsafe standard PoS is. Vitalik and co spent years researching the best mitigations.

Right now, it seems to be one of the best protected PoS chains. It's still fairly new, with novel mitigations, so it still doesn't stand the test of time against all possible attack vectors.

In that sense, it still can't be considered as secure as a PoW chain with high hashrate, which is protected by thermodynamics (you can't produce more hashes than the physical energy you have access to allows).

[dathinab]

> unsafe standard PoS

Not "unsafe standard" but

"dangers/unsafe to bootstrap".

But there are ways to mitigate the bootstrapping issue to some degree.

And PoW chains tend to have a low cost at the beginning making them similar not easy to bootstrap safely (through more easy then PoS).

In the end I don't think what theoretically is better matters, what only really matters is what practically matters for big crypto currencies (and smaller ones can during bootstrap (and potentially later one) interlink with the large chains).

[DennisP]

PoS is more quantum-resistant though. If someone were to build a quantum computer capable of running Grover's algorithm on bitcoin hashes, they would get a quadratic speedup over classical miners. That's a threat that doesn't exist on PoS.

(Both would be vulnerable to Shor's but post-quantum signatures would fix that.)

[yanmaani]

PoS is not more quantum-resistant, because of the situation with Shor's algorithm, and that a key compromise would be much more damaging.

It might be, in the future, if you replaced the keys, but it isn't now. Words mean things, and it really is important to use them correctly.

(Also, wouldn't the network respond by just raising the difficulty, miners respond by buying quantum computers, and the world to spin as usual?)

[DennisP]

PoS is a class of consensus protocol, not any particular blockchain. It's orthogonal to signature algorithms. A blockchain can incorporate any combination of consensus algorithm and signature algorithm. So yes, please use your terms correctly.

If sufficiently powerful quantum computers become readily available to anyone, sure, everybody will upgrade. Given the exotic hardware they typically require, it seems likely that for a while only a few large organizations will have them.

[yanmaani]

If you're fine with changing algorithms, wouldn't PoW also be able to change to something more quantum-resistant?

[DennisP]

Grover's algorithm is pretty general, I don't think there is anything we know about that we could switch to.

Shor's is faster but more specific. It works on factoring and elliptic curves, but not on hashes. The advantage of Shor's is that if you have enough qubits, you can get the answer immediately. Grover's only offers quadratic speedup, effectively halving the number of bits in the hash function.

So for signatures we just need to switch to something like a hash-based signature algorithm, with keys having twice as many bits as we'd want against classical attackers. But we don't have hash functions that keep Grover's from working, so a quantum miner be way faster than classical miners.

[snak]

Is there a known limit for the energy to hash ratio ?