[emin-gun-sirer]

Nice ad hominems you've got there.

>In fact, the paper just formalized some concerns discussed in the mining community for years.

This is false. Discussed here: http://hackingdistributed.com/2013/11/09/no-you-dint/

>the "Bitcoin lunatic fringe" this author mocks has been right about the pool(s) having such power refraining from destructive (and self-bankrupting) next steps.

No. The Bitcoin lunatic fringe was adamant that no pool would willingly cross the 50% boundary.

That just happened. Models and reasoning based on "no rational miner would do X" are clearly flawed, partly because the miners may not be rational, or partly because they are rational within a time-frame not modeled. In any case, people who reasoned like you have now been shown conclusively to have the model wrong.

This is an opportunity to fix the protocol, not shill for the price, and certainly not to engage in ad hominems.

Cheers.

[gojomo]

I think your track record of alarmism and disrespect to non-academics is relevant, but even if you classify it 'ad hominem', you've earned it with your own prolific slurs of critics.

I've addressed your continued "no-you-dint" willful-blindness about earlier analysis elsewhere... including on your own blog at (http://hackingdistributed.com/2013/11/14/response-to-feedbac...). You failed to discover (and thus footnote) prior community work, from years earlier, that did everything except for your more-rigorous boundary formalizations. So again, nice write-up, but exaggerated novelty. The interested can follow the links and decide for themselves.

I'm sure someone said no pool would ever even try to get 51%. Others simply said a pool in such a position wouldn't self-destruct the entire ecosystem, against their own interests. (Instead, they behave like the 'stationary bandit' of Mancur Olson's political-economy. Not ideal, and not what Bitcoin intended, and worthy of attempted-fixes... but also not an instant and unsurvivable crisis.) It's this latter prediction, of stability even in the presence of explicit (or secret) 51% cartels, that is still, so far, outperforming your own. For now they have the same claim to "I told you so!" as you do.

[waterlesscloud]

"I'm sure someone said no pool would ever even try to get 51%."

Yeah, the 'lunatic fringe' like Sam Altman.

https://twitter.com/sama/statuses/477510946080845826

[emin-gun-sirer]

To the contrary, we've been far more respectful and accommodating to the Bitcoin fringe than merited, and certainly far more than the other way around. After all, we took a fair amount of abuse for simply pointing out an objective weakness that is part of the protocol. This, despite the fact that we proposed a fix for it.

Perhaps you've not read our final paper. It doesn't just footnote, but actually cites the prior discussion.

And anyone who reads the previous discussion can see that our paper:

* shows a more extensive attack than the one described there, one that works,

* performs a full analysis of the revenue to be obtained from that attack, and characterizes that revenue as a function of attacking pool size and attacking pool's ability to control information flow in the network,

* shows that Bitcoin is not incentive-compatible,

* shows that, even under the best of circumstances (i.e. the attacker has terrible network connectivity, no Sybils, no control over information propagation and loses to the honest miners every single time), defending against the attacker requires at least 2/3rds of the network to be honest.

Perhaps the biggest giveaway that we did something differently is that THE BITCOIN TALK FORUMS CONCLUDED THAT THEIR ATTACK WOULD NOT WORK, WHEREAS WE SHOWED THAT OURS WOULD.

You're making things up when you imply that we're claiming that 51% is an "unsurvivable crisis." To the contrary, the article very clearly says that the Bitcoin economy remains unaffected, and that the Bitcoin price is also unaffected.

We have been trying to improve the Bitcoin system since day 1. I realize that you're part of the original brigade, and that also explains your ad hominems here. I urge you to elevate the discussion.

[gojomo]

It's nice to hear that in your final paper you acknowledge the earlier discussions. You should link that final version from your author homepages. (The latest versions linked from you and your coauthors' pages, at arXiv [1] and Cornell [2], still have no mention of the earlier discussion.) If the FC14 version [3] is final, it's better, but I still think you're unfairly summarizing the key thread [4].

Every key aspect of selfish strategy is described there, from manipulating 'gamma' via network-tricks, to releasing the minimum number of 'secret' blocks, after each external-block, to maximize the cartel's expected return. ByteCoin's simulations show advantages, and breakeven thresholds with regard to 'override success' ('gamma'), very similar to your paper's calculations. That's why I credit your paper for rigorously describing the situation, under your specific assumptions, but not with the discovery of a previously-unknown less-than-51% attack.

Also, your final paper is simply lying when it says the thread "does not suggest a solution to the problem". It's almost as if your disdain of these 'fringe' Bitcoin fanatics has blinded you to the actual words of the thread.

Two commenters in the December 2010 thread (btchris and RHorning) suggest that preferencing accurate-seeming timestamps can disadvantage cartel-delayed blocks. That countermeasure is likely stronger than your paper's proposed random-choice-between-ties. (Randomization, by pushing gamma to 1/2, could make things worse if, on the real network, the effective gamma for late-releasers was already closer to 0. Preferring realistic timestamps, meanwhile, almost always helps 'honest' blocks, which don't have to guess a future time when they'll be released.)

Note that the last bullet of supposed novelty in your paper – "defending against the attacker requires at least 2/3rds of the network to be honest" – is the exact same best-case threshold as reported by ByteCoin in thread message #36, 2010-12-14. He states: "a cartel with no preferential network access can be profitable with 33% of the generating power"[5]. Same result, 3 years earlier. How can you allege ByteCoin was simulating some other strategy? Wouldn't the slightest difference in block-release-rules result in a different best-case threshold?

Finally, the Bitcoin Talk forums hadn't "CONCLUDED" anything. They're not a deliberative body. Some people were convinced, others weren't. The relevant actors – mining insiders – knew what they needed to know, to either try the attack, or detect it in orphan rates and weird timestamps... and to try countermeasures based on disadvantaging cartel blocks if ever necessary. Meni Rosenfeld also referred back to the matter as a known concern, in an answer on the Bitcoin StackExchange, in October 2011 [6]. So he knew it was an issue, and lots of people trust him about mining matters.

There's no "brigade" out to trash you led by some "failed academic" "Singaporean" "ringleader". Your critics are not the heads of some unified hydra, that you can disregard altogether as the "Bitcoin lunatic fringe" based on a few quotes from particular yahoos. You've made specific claims of novelty, or doom, that were either never true, or disproven by later events. These will be pointed out when you claim to enjoy a "we told you so" record of authoritative insights.

[1] http://arxiv.org/pdf/1311.0243v5.pdf

[2] http://www.cs.cornell.edu/~ie53/publications/btcProcArXiv.pd...

[3] http://fc14.ifca.ai/papers/fc14_submission_82.pdf

[4] https://bitcointalk.org/index.php?topic=2227.0;all

[5] https://bitcointalk.org/index.php?topic=2227.msg30138#msg301...

[6] http://bitcoin.stackexchange.com/questions/1475/can-someone-...

[gwern]

> Nice ad hominems you've got there.

That's seriously rich coming from the dude who just wrote

> The main ringleader of this brigade was a failed academic from Singapore, someone who had a superficial knowledge of game theory and sufficient familiarity with Latex to create the look & feel of research papers, but someone whose own academic work never went beyond repackaging well-known results in game theory.

[Smudge]

I don't disagree with you, but just FYI, 'ad hominem' has a pretty specific meaning and I don't think it applies in this case.

Simply calling someone 'panic-prone' isn't in itself ad hominem. If the argument were that because the author is panic-prone he cannot possibly be right, then it would be ad hominem. But if there isn't an explicit causality implied (i.e. being panic-prone makes you wrong), it's more just name-calling. (name-calling != ad hominem)

There may be other fallacies that apply here, but there is actually an argument backing up the commenter's claim that the author is being too panicky, and that this is less of an issue than it is being made out to be.

[gojomo]

In particular, if emin-gun-sirer had gotten his 2013-Nov-03 prediction right, and that was a good time to sell your Bitcoins, don't you think he'd be shouting it from the rooftops, ever since?

He took a gamble: that the bold tweeted prediction would increase attention for his paper (which it did), and then come true, improving his credibility about such matters (which it didn't).

He's now saying "I told you so", literally, in a gambit for more credibility – but eliding mention of his prior bad predictions. (In addition to the "good time to sell" prediction, I would point out that (a) orphan rates since his paper was published have not shown the predicted wide self-interested adoption of "selfish mining"; (b) the pool that's achieved 51% does not appear to have used "selfish mining" to get there - just the same economies-of-scale and small-miner-superstitions that have been known threats since the beginning of pooled-mining. In other words, even if this is a disaster, it's not the same one, by the same path, as he predicted – but an older potential doom, prophesied by others long before his work.)

When facing such a claim of earned authority, it's entirely appropriate, and not at all ad hominem, to highlight the full record. To "shout from the rooftops" exactly the same early calls he himself would be bragging about – if he'd been right.