N.B. This document was originally published in 2023 as https://inquisitivists.s3.us-west-2.amazonaws.com/Blockchain_For_Everyone.pdf. The world being what it is these days I no longer wished to host files online in a pay-per-request fashion. If for some reason you are seeking the citation from Money Has No Value by Samuel Chambers, this is the original article.
This article attempts to cover some of the many, many (many many many) things I’ve long wanted to say about Blockchain. I’ve had, for several years, a lot to say on the subject and I’ve found it pretty difficult because that subject is complicated and language is, you know, hard. And also…it’s kinda not that complicated? A lot of what seems complicated about blockchain is just basic truths about the world obfuscated by a little bit of computer science. And even the computer science isn’t that complicated. As CS topics come up, I’ll talk a little bit about them without, I hope, getting too technical. You can go look them up in other sources if you want, but you don’t need to understand how they work in order to understand blockchain.
While I was working on this article, the Bloomberg finance columnist Matt Levine published a 40,000 word essay on Blockchain. It says 93.4% of what I wanted to say on the subject, as well as a lot more that I didn’t say, and as an added bonus Matt Levine writes with pretty much the same voice that I do except he’s smarter, clearer, and knows more stuff about finance. So you could skip this article, read his, and miss very little.
Oh my god, you’re still reading. Okay. Well then, the first part of this article will be a general overview of what a blockchain is. Then I will talk about two very different ways in which a blockchain is implemented: Proof of Work, and Proof of Stake. Proof of Work will get some words, and Proof of Stake will get some words. Then I’ll write some final thoughts.
To begin, all I’m going to assume is that you live in the world and haven’t read anything more about blockchain than regular reporting on the subject. In which case, what you probably know about blockchain is this:
A blockchain is a decentralized ledger, whatever that means.
It has coins – cryptocurrency – that you can buy and speculate on, and lots of people are doing this.
Apart from the cryptocurrencies, the decentralized ledger is a technology that has lots of potential future uses.
Nobody is quite sure what those potential future uses are.
So let’s talk about those things.
Ledgers
Normally a ledger is a book that’s held privately, the access to which is really tightly controlled. For instance, a bank is going to hold a private ledger that has a record of everyone’s deposits and all the money they’ve loaned out. When you deposit some money with the bank, they write a line in the ledger that says who you are and how much money you left with them (actually, they write two lines – everyone for at least the last 800 years has done double entry bookkeeping). When you make a withdrawal at the ATM, they write that transaction down in their ledger and subtract the amount from whatever you have on deposit.
Now, a couple of things should be obvious. First, it’s the 21st century, so the bank ledger isn’t actually a book, it’s a computer program. Second, there’s all kinds of security around who can write things in that ledger. Both you and the bank don’t want anybody tampering with how much money you have on deposit. And the bank certainly doesn’t want anybody to tamper with how much money somebody with a loan might owe them. That would be, like, super bad for the bank if that happened.
The Blockchain
A blockchain is also a ledger. But it’s a ledger that anybody can keep a copy of, and that anybody can write in, provided they follow the rules of that blockchain. Here is how it works: There’s a network of computers that participate in the blockchain, and each of them keeps a copy of the entire blockchain. The blockchain is, like, literally a chain of blocks (or it would be, except that “block” and “chain” are themselves metaphors). A “block” is like a page of the ledger – it’s got a certain number of lines in it, and each line will be a transaction of some kind. So for instance, say Bob wants to give Sally a Bitcoin. Here’s what will happen.
Bob will write a transaction. It will say, “I give Sally one Bitcoin. Signed, Bob.”
Bob will broadcast the transaction to all of the computers that participate in the blockchain.
Each computer in the network will do the following:
it will verify Bob’s signature,
it will verify that Sally is somebody they’ve heard of who can receive a Bitcoin,
it will verify that Bob has a Bitcoin to give Sally. It will do this by looking at its own copy of the blockchain to see if, in the past, Bob got a Bitcoin that he hasn’t given to anybody else.
If all of these conditions are met, each computer writes the transaction into the current block of its blockchain.
In the future, all the computers will agree that Sally has the Bitcoin and that Bob doesn’t have it. Bob can’t give it to anyone else because in a previous transaction he gave it to Sally. Sally can give it to someone else because Bob gave it to her.
Again, every computer on the blockchain is doing this. They all have copies of the blockchain ledger, and they all write into it every transaction they hear about. They write transactions into the “current block” of the blockchain until all the lines in that block are filled up with transactions. Then they do the following thing:
All the computers check in with each other to make sure they have the same set of transactions in the current block.
They all collectively “validate” that block. Block validation is an important and painstaking process. We will talk a lot about how it works in the coming pages. Like, a lot.
Each computer puts the validated block onto their copy of the chain.
Each computer starts a new block by writing the “result” of the block validation into the first line of that new block. This validation result is also incredibly important and we will talk a lot about it.
Each computer on the chain goes back to recording transactions on that new block. They will record transactions until that block is full, and then they will go through this same process again.
How the computers validate a block depends on what kind of blockchain it is. For now, think of it like condensing the entire block down into a single word that perfectly represents the entire block of transactions. It’s such a clever and perfect word, in fact, that if you change a single character in the block, the word no longer validates it. And if you change the word by even a single character, it also no longer validates the block. For the moment, let’s call this thing the “Validation Word” of a block.
The fact that there’s a Validation Word at the top of every block creates the “chain” of blockchain. It makes it so it’s easy to verify that the chain hasn’t been changed or tampered with. Go back to the first block and compare it to the Validation Word that’s on the top of the second block. Check and see if that Word correctly validates the previous block. Does it? Now you know that the first block hasn’t been changed or tampered with…so long as the second block hasn’t been tampered with. How do you know if the second block was changed? Turn to the third block and compare the second block with the Validation Word at the top. Do they match each other? If so, the second block hasn’t changed since it was validated, so long as nothing about the third block has changed. How do you know if the third block has changed? Check it against the validation word that’s at the top of the fourth block. And so on.
This chain of blocks and Validation Words leads to a very important property of the blockchain: if your computer’s chain has the same current block as another computer’s current block, you know that your entire chain is exactly the same as their entire chain. And it’s worth stopping for a moment to think about why this must be true:
If you have exactly the same current block as someone else, it means that the Validation Word at the top of your current block is the same as the Validation Word at the top of their block.
If the Validation Words are the same, that means their previous block in the chain is exactly the same as your previous block in the chain.
If that’s true, then the Validation Words on those previous blocks must also match.
If that’s true, then you must have the same block before that as the other computer does.
…and so on, all the way back to the beginning of the chain.
This means that every time the computers that make up the blockchain get together to validate the current block, they are also verifying that everybody has the exact same copy of the entire blockchain. This is a pretty handy property of a database – which is really kind of what a blockchain is.
The obvious question is, what happens when the current block fills up but the computers disagree about what should be on it? What if somebody broadcast a transaction but an edge router was down somewhere on the internet and half of the computers on the network never heard about it, and that half filled the last line of their current blocks with a transaction that the other computers think should go on the next block? Or maybe somebody has a different block because they are nefarious evil-doers who sold their Bitcoins to somebody else for Dollars and now want to drop that transaction off of the blockchain entirely so that they get to keep both the Bitcoins and the Dollars?
This is where we need a second thing: some kind of consensus mechanism. A blockchain needs some reason or incentive that all the computers on the network agree to a common version of the current block. So the specific answer to the question of “what happens when the computers disagree?” is the same as for the answer for the Validation Word: “it depends on what kind of blockchain it is.” So for now, just know that a blockchain needs to have two important things: a way to generate Validation Words, and a Consensus Mechanism.
The one other important thing we need to cover is: why would you want this technology? What is it good for? I assumed at the beginning that you knew, if only vaguely, that blockchains all have their own cryptocurrency and when you trade them with other people, those transactions are recorded on that blockchain. But the general promise of a blockchain lies in the fact that you could write any kind of transaction you wanted on there – not just trading the cryptocurrency that’s native to that blockchain. So there is a thing called a Smart Contract that can live in a blockchain. It works like this:
First, you have to have some kind of asset, the ownership of which is encoded on the blockchain. Let’s say, for example, the deed to Sally’s house, instead of being written in the County Hall of Records, is written into a blockchain and that she’s part of a society where everyone agrees that this blockchain is where ownership of houses is recorded.
If you want to know who owns the house, you ask a computer on the Blockchain. It will say, “Sally owns the house.”
Sally wants to sell her house to Bob. They’ve agreed on a price – let’s say it’s 100 Bitcoins. Since the deed to Sally’s house is written in the blockchain, they’re going to write a smart contract that says, “When Bob pays Sally 100 Bitcoins, the deed to Sally’s house belongs to Bob.” They both sign it and broadcast it onto the blockchain.
The smart contract by itself doesn’t affect the ownership of the house. If you ask a computer on the Blockchain who owns the house, it will see the smart contract, but it will see that the conditions of the smart contract haven’t yet been fulfilled, and so it will still say, “Sally owns the house.”
Some time later, Bob sends Sally 100 Bitcoins by broadcasting a message to the blockchain that says, “I pay Sally 100 Bitcoins for her house, signed Bob.” The blockchain will then “execute” the smart contract because its conditions were fulfilled. Now if you ask a computer on the blockchain who owns the house, it will say, “Bob owns the house.” Since Bob and Sally live in a society where everyone agrees that ownership of houses is determined by asking the blockchain, Bob now owns the house.
If you’ve ever bought and/or sold a house, you recognize that this process has a lot fewer intermediaries than the process you went through. There was no escrow company, no title insurance, no thousands upon thousands of papers to sign and initial. And the transaction was fair – Sally couldn’t take Bob’s money and not give him the deed to the house, and Bob couldn’t take the deed but not give Sally the money. When people talk about the promise of blockchain, this is what they are talking about – the ability to deal fairly with each other without needing a business or government or other kind of intermediary between them.
I will talk much more about this as we go along. For now, I would just like to point out that the promise of the internet was the same: that we wouldn’t need gatekeepers to access information or find the things we wanted. And in some spaces, and in some ways, it did do that. And it also brought forth the biggest, most powerful intermediaries in the history of mankind.
It’s also worth taking a moment to ponder the idea of a society where there’s this document – the blockchain – and we all generally agree to abide by what’s written in it. So Sally sells her house to Bob and the smart contract is executed and the blockchain says that Bob now owns the house. But what if Bob shows up with his stuff the next day and Sally won’t leave? The blockchain can’t force Sally out of the house, it’s just a network of computers. If Sally won’t budge, some kind of force will be needed to dislodge her. I suppose it’s possible that when enforcement is required in a blockchain-based society, a citizen militia spontaneously takes up arms to do that enforcement and then immediately stands down again when it is no longer required, but also…no? That doesn’t jibe with my experience of humanity or my reading of its history. So it seems like you still need a government built around, and to enforce the words of, the blockchain. I don’t think the fact of blockchain existing has magically solved that.
Proof of Work
I don’t own any Bitcoin (or indeed any crypto asset of any kind). I never have, and I never intend to. As you’ll see, I don’t think it can ever accomplish its inventor’s goals. At last check the Bitcoin blockchain uses as much energy as the entire nation of Thailand. And despite all of this I think Bitcoin – the original cryptocurrency – is one of the most beautiful things I have seen invented or even conceived of by humans in my lifetime. It is DaVincian.
The story of Bitcoin starts in 2008 when a person or persons using the pseudonym Satoshi Nakamoto published a whitepaper describing a thing called Proof of Work. He then released and deployed the code that implemented it, and in so doing, created the world’s first blockchain, and the world’s first “cryptocurrency,” Bitcoin. In the whitepaper, Satoshi described Bitcoin as money that people could use that would be free from any government or corporate interference, and depicted blockchain as an immutable public ledger on which Bitcoin transactions would be recorded. Here was an invention we could use to do business with each other without a bank or a government between us. If Sally had something that Bob wanted, and they both agreed to use Bitcoin as a medium of exchange, Bob could transfer some Bitcoin to Sally in exchange for the thing. He wouldn’t need a bank, or a credit card, or the US Government minting dollars to do it.
I have, obviously, a lot to say about all of this. But first we should talk about how Bitcoin implements a blockchain, because it’s extraordinary. Proof of Work is often described as a network of computers that are all trying to solve hard math problems. This is…kinda wrong? They’re actually doing something that’s much more like trying to open a combination lock by trying every possible combination and seeing if it opens the lock. Here’s how it works:
Cast your mind back to our previous explanation of how a blockchain works. All the computers on the network have been recording transactions, and now they’ve all filled up the current block on the blockchain and they need to validate it – to find a Validation Word that perfectly represents the block.
It happens that there is an unsolved mathematical conjecture in the world that will help them do this! There is a class of problems in Computer Science that are called “N-P Complete” problems. They are problems that we don’t have fast algorithms to solve (the unsolved conjecture is whether that means the algorithms don’t exist, or that we just haven’t found them yet – like, maybe they’re solvable with quantum computers or something).
The particular version of this that Proof of Work uses is called a Hash Function. A hash function is a function that garbles text. Here’s a handy online one you can try out. Note that it garbles text really fast, and that it garbles the same text exactly the same way every time. And also note that if you change even one character of your original text, it garbles it totally differently.
For instance, go hash the following string, with the quote marks and everything:
“Sic transit gloria. Glory fades. My name’s Max Fischer.”
You will get the same result that I did:
670aaa5256b5cf0d458eacfdde1df472346f92a7ba29b59817336dc2cd4edf30
Now go change it by exactly one character:
“Sic transit gloria. Glory fades. My name’s Max Fisher.”
You will get a completely different result when you hash it:
89aa49e530bf1cde6a0d11f4a23ba43b7a23fedb51aabc5456f733cb784507ae
What it doesn’t do – what it can’t do – is un-garble the text back to what you started with. If you have a garbled string that is the output of hashing a block of text – if I just give you one of the hashes above with no other information – there is no algorithm that anyone anywhere in the world knows that can get back to the text that I hashed to produce it.
SInce there’s no algorithm, the only thing you can do if you need to ungarble the text is to try some random text, hash it, and see if it matches. On the one hand, hashing is very fast so it’s easy to check if you got it right. On the other…there’s a lot of possible text in the universe. Like, a lot a lot.
This is actually how most websites store your password – as a hashed string. When you enter your password on their website, they hash it, and then look up the stored hash and see if the two things match. If the hashes match, they let you in. And if someday their password database gets compromised, they won’t have revealed your password to anyone.
Back to our blockchain: the rules of Bitcoin say this: “The Validation Word for a block is a word you can add to that block so that when you hash the text of the block and the word together and then look at the result in binary, it starts with 17 zeros.”
How will our computers find such a word? There’s no reverse function for hashing. The only way to do it is to choose a word, add it to the block, hash it, and see if you get a hash that, in binary, starts with 17 zeros. After the 17 zeros it can be whatever (it’s got 256 digits so that’s 239 left that can be zero or one), so I don’t have to find a specific hash, which would take literally forever. I just have to find a hash in that specific class of hashes.
A computer in the network working on this problem might first try the letter “a.” It probably won’t be right, but they have to start somewhere: the computer takes the text of the current block, puts an “a” on the end of it, and sends it through the hash function, and checks the result in binary, hoping that it starts with 17 zeros.
All of the computers in the network do this. They start adding different words to the current block, hashing the result, and checking if the binary result looks right. It is incredibly inefficient and takes an extraordinary amount of computing power, all of which is essentially wasted. BUT since there are a lot of powerful computers in the network, eventually – it usually takes about ten minutes or so – a computer finds a solution.
Let’s say it was Sally’s computer that found a solution – her computer randomly discovered that if it added “3.1415helpimtrappedinauniversefactory96535” to the current block, it hashes to something that, in binary, starts with 17 zeros.
Sally’s computer broadcasts that solution to the rest of the computers in the network. They can immediately verify that it works by adding “3.1415helpimtrappedinauniversefactory96535” to their own current blocks, hashing that text, and looking at it in binary. They’ll all agree that yes, that is the Validation Word.
They’ll stash the current block onto their chains, and at the top of the new current block, write “3.1415helpimtrappedinauniversefactory96535”.
Then, and this is perhaps the most important thing, they will write a ledger entry right under it. It will say, “Sally’s computer found this solution, so Sally gets one Bitcoin.”
That’s a lot to take in, especially if you aren’t used to…I don’t know, what even is this? It’s computer science, yes. But it’s also probability, formal logic, game theory, and the clever leveraging of a mathematical conjecture that we’re not even certain is true. And if you imagine the computer as a miner, digging up raw material for its owner to sell for a profit, it’s also a weird metaphor for the exploitation of labor under capitalism. It’s worth looking at and thinking about. Every time I look at this ruleset I feel like its ramifications run even deeper than I previously thought.
I’ll explain some things that may or may not be clear. This process – all of the computers trying all sorts of words to find one that hashes the right way – is what’s being referred to when we talk about “Bitcoin mining.” The metaphor is pretty apt – a whole bunch of computers are trying to virtually dig up a Bitcoin. They will use an extraordinary amount of energy in the process of doing so. One of them will find it and be rewarded. The rest didn’t and won’t, and will have to wait until the next block needs to be validated so that they can try again.
In the previous part I said a blockchain also needed a Consensus Mechanism: some reason that all the computers agree to what’s on the current block of the blockchain. Bitcoin mining doubles as the consensus mechanism that I said we needed. Before they start mining, all the computers need to make sure that they agree with each other about what’s in the current block. Otherwise, they might find a solution for their own block, but their block won’t match the current block of all the other computers and those other computers are going to reject that solution. They’ll add it to the ends of their own blocks and hash it, but it won’t give them 17 binary zeros (I mean, technically it might? But the odds are it wouldn’t ever happen even once if we ran blockchains until the end of the universe). So they’ll reject it. A Bitcoin miner doesn’t want their effort to be wasted – they want a chance of digging up the Bitcoin – so they’ll want to agree with everybody else before they start mining.
This is also where two other rules of Bitcoin become important. The first one is: longest chain wins. If somebody in your network has a valid chain with more blocks than yours, you throw yours away and replace it with theirs – you don’t even bother to compare the chains. Somewhere along the line more compute time was used to generate that chain than was used to generate yours, and that literally – according to the rules of Bitcoin – makes it more valid. If you’re asking the blockchain questions about who owns a particular Bitcoin, you want to make sure that you’re asking the longest valid chain that anybody holds.
What can (and sometimes does) happen in the Bitcoin blockchain is that the chain forks because one set of computers is working on a different current block than the others – maybe there was a network outage that cut off some of the computers from the others and it lasted longer than ten minutes. At that fork, there will be two different versions of the chain. And as long as the two sets of computers are cut off from each other and don’t know they’ve diverged, they’ll keep building chains that differ at the point of the fork. So then what do you do?
This leads into the second important rule, one that is derived rather than written down: majority rules. If the chain forks, and two groups of computers are working on different versions of the chain, you don’t want to be in the group that has less compute power. More computing power is going to be able to make a longer chain in the same amount of time. When the network is back up again, that longer chain is going to be the valid one, by definition. Everyone with the shorter chain will throw theirs away. So if the chain forked, and your computer worked really hard and unearthed a Bitcoin but you were working on the chain that had less compute time behind it, that Bitcoin will vanish once the network heals and the smaller group of computers realizes it has forked and has a shorter chain. Everyone will just discard the block that had your Bitcoin on it, along with the rest of the fork. That would suck for you – you thought you’d found a Bitcoin, but then it just vanished. You definitely want to avoid that. So you’re always incentivized to agree with whatever the majority of compute time in your network says.
In the space between these two rules there are some shenanigans you can pull: you can fork the chain on purpose. When the blockchain gets really big, it gets broken up into sub-networks, each of which is responsible for a different part of the chain, and it’s possible to take control of the chain if you control the majority of the compute time in one of these sub-networks (called “shards”). In what’s called a 51% Attack, Sally controls a majority of the compute time in a shard. She’ll give Bob a Bitcoin in a transaction and lets everybody else solve the block that contains it so it goes onto the end of the chain. Now Bob thinks he has the Bitcoin, so he’ll give Sally whatever it was she was buying with that Bitcoin. Meanwhile, Sally has secretly made her own block that didn’t have that transaction on it, and as soon as she has Bob’s money, she forks the chain at that block and has all of her computers working on a version of the chain with her fake block instead of the real one. She’s got the majority of the compute time, so her chain is going to get longer faster and become the valid fork. Everybody else was technically working on the “correct” chain, but Sally’s is now longer so according to the rule of “longest chain wins,” they all have to discard their shorter chains. Once that happens, Sally has Bob’s money, but she also still has her Bitcoin. Bob doesn’t have it because the transaction where Bob got it from Sally has been dropped from the blockchain.
It’s really hard and expensive to do this, and once a transaction sits a few blocks deep in the chain, it’s essentially impossible to remove – the deeper in the chain it gets, the more compute power you’d need in order to fork the chain at that point and eventually catch up and overtake everyone else working on the main chain. But with enough money and/or power you can mess with things that are on the very end of the chain.
A blockchain is, kind of literally, a record of all the compute time it took to make it. Every time the current block gets added to the end of the chain, it means that a whole bunch of computers in the world did a whole bunch of hashing in order to find a solution for that page. So you can’t just forge a new chain. It really only works if a majority works together and agrees about what they’re working on. And once the majority does, everybody else needs to get in line with it. I find it to be a hell of a metaphor, I’m just not quite clear on what the metaphor points at.
I want to talk a little about Satoshi and his stated intentions for Bitcoin. Satoshi is absolutely a genius. His invention is, like, real and it works (well, sort of). And he has, in all of this, remained pseudonymous. This is pretty crazy given that he owns the first million Bitcoins ever mined, which even now are worth tens of billions of dollars, and which he has never touched. That combination of raw genius and wisdom – he’s smart enough to invent this thing and wise enough not to touch the money it created in order to protect privacy that he apparently values even more – is just really, really rare outside of fiction. I can’t think of anybody else in the history of the world that fits that profile – Nicola Tesla is as close as I can get. There are other possibilities – Satoshi is dead, or is wanted for some other crime and has to remain hidden, for instance – but if I had to take a guess, I’d guess Satoshi is an alias for a government that was seeking to undermine the global dominance of the US Dollar. I’m just guessing, obviously, and either way my hat is off to you, whoever you are. You built a hell of a thing.
Satoshi, according to his whitepaper, was only ever trying to create a peer-to-peer payments system. He never said anything about writing other stuff into the blockchain or using it as a general decentralized ledger. And this seems to be a distinction that’s escaped more or less everyone who touts blockchain as a promising future technology: you can trade things that only exist on the blockchain entirely within the confines of the blockchain and indeed you will not need governments or power structures. But if you decide that you want the blockchain to hold a representation of a thing that exists in the real world, you still need a power structure to enforce that representation. That’s true if it’s a deed to a house or a license to practice medicine or anything else. A blockchain cannot be an authority for anything other than the text that’s written in a blockchain. There’s no society in the world where every person will abide by something just because it is written; there never has been and I wouldn’t take the odds going forward. It has always required force.
But again, that’s not true of Bitcoin itself. Bitcoin only exists on the blockchain, so the blockchain is the only authority that can say who holds one. If people decide that Bitcoin has value, and will exchange things of value for it, then it does work as a way to pay for things and it doesn’t require a government or a bank in between them. It’s this curious loophole – a virtual version of the Ron Swanson-esque Libertarian dream where we all have gold and exchange it for goods and services. There are a lot of people who find this story really compelling and want to live in this world. I guess because they think in this world that because the government no longer controls money that the government just goes away?
Or sometimes it seems to me that hardcore blockchain enthusiasts are trying to, like, will Capitalism out of existence. It’s like they’ve observed that Capitalism needs money that can expand and contract – Capitalism is investment and speculation, so you need credit based on the hope of future profits for it to work – and so they think that if everyone starts using this other, rigid, commodity-like thing as money then Capitalism will wither and die? I’m all for Capitalism withering and dying – it’s become profoundly untimely at this point – but…I mean, Capitalism doesn’t work like that. Or rather, it does work like that, and it would take but a single Capitalist in a world of people trying to use a commodity money to come in and fuck up their shit (and also this, like, totally already happened? I’ll mention this again at the end).
I’m not one of those people, obviously. I guess it’s not quite clear what I am in all of this: I am a big admirer, obviously, of the construction of the thing. And at the same time I am a profound skeptic of every interpretation that’s so far been offered for what the Proof of Work blockchain actually is. I think that Proof of Work is something. But what that something is, I don’t know if I know. At least not yet.
Proof of Stake
By 2012, two things about Bitcoin were apparent: it was really interesting, and it took an absolute truckload of energy to run it. The idea of a decentralized ledger was starting to take hold, but Proof of Work was not a viable platform for anything on the scale of, say, the internet. Today the Bitcoin blockchain trades nothing but Bitcoins (which is all it was designed to do, and all it is capable of doing) at a rate that’s roughly 1000 times smaller than the global system of electronic payments (i.e. Visa, Mastercard, and the like) and it requires the energy of Sweden to do so. Again, though, that is by design: it is hard – for a mathematically well-defined meaning of the word “hard” – to add blocks to the Bitcoin blockchain, and that property is what makes it immutable and decentralized. This concept – this “hardness” – is an important concept to keep in mind as we go forward and talk about Proof of Stake.
2012 was also the year that Sunny King and Scott Nadal (like Satoshi, pseudonymous individuals. Unlike Satoshi, they’ve shown their faces many times since: still pseudonymous, but as founders of specific Proof of Stake projects) published a new whitepaper describing a new kind of blockchain: Proof of Stake. Proof of Stake quickly became the de facto blockchain implementation due to the promise that it could serve as a decentralized, public ledger without the enormous energy requirements of Proof of Work. Instead of validating each page of the public ledger by requiring massive amounts of compute time, Proof of Stake validates each page of the public ledger by requiring…wealth.
I should step aside and point out the obvious: it’s not that Proof of Work doesn’t also require wealth. Compute time costs money, and if you have more money, you can have more power over the validation of the network, mine more currency, or maybe even take over the network. Blockchains are mathematical constructions, but outside of that mathematics they have to exist in the actual world, and the actual world is, you know, Capitalist. To me, where Proof of Work is problematic but aesthetically beautiful, Proof of Stake is insidious and kind of ugly. I’ll try and explain what I mean by that as we go along.
There are scores of different ways that Proof of Stake is implemented, and for the most part I will ignore all of them except at the highest levels of abstraction. There is a good reason for this that will become apparent. Instead, I want to take you through a little thought experiment based on the things we should now understand from previous sections.
I’m going to invent a kind of Blockchain called “Proof of Signature.” I’ve talked a lot about people “signing” things as we’ve gone along. In fact, in CS, there is a way you can sign something that’s a lot like the hash function we talked about in previous sections. For instance, there was this when we first talked about how a blockchain works:
Bob will write a transaction. It will say, “I give Sally one Bitcoin. Signed, Bob.”
Bob will broadcast the transaction to all of the computers that participate in the blockchain.
Each computer in the network will do the following:
it will verify Bob’s signature…
In general, if Bob wants to sign something, he does the following:
He generates a public/private key pair. Both keys in the pair are just very long strings of characters. A public key looks like this:
ssh-rsa ABSAB3NzaC1yc2EAAAADAQABAAABAQDLJq23iaitmNsiby1Th+iI9P5exNHFeW0h5Y7Z5qNt8zWD1xPh2GMC4+w/FSa474AkFkQa03MjKmwjpqbTmhBIAUiEjFenHH4D8Grqm0FdiNr5YLxaRVTNdx95NZ2dqqbSleS08A9HRxmA88n3k3GVy9qxEuEImZJ6cBs9cI+AECWDjACiqPvv6KohayXKHEXVufZ4GoNVzEaz5/Zti9apy8sgNy3jLM0dDSesM/OIANfKcU8dviNlnLyZLFN+2/uOSz8XzRFttTJ7QDuE9AOd0L5ngtjmsJlmDvczfbg75C90Mq7cVqRo8+eQSOUdYQwvpC5AEg3Th5g/CzlEn8JT bob@bob.com
(A private key looks similar, but longer and with different header and footer text).
Bob will keep his private key private and never show it to anyone. He will publish his public key far and wide. He will put it on his website at the URL, “bob.com/mypublickey/hereitis/righthere/everybodylook”. Or, you know, whatever.
When Bob wants to sign Something, he will take a hash of Something plus his private key. This will produce a string of characters that’s very much like a SHA256 hash from the previous section.
Neither Sally nor anyone else knows what Bob added to Something in order to hash it, because Bob keeps his secret key very secret. Nobody else can sign things as Bob. Bob will send his signature along with Something to Sally.
Sally (or anyone else) can verify the signature using Bob’s public key. She will take Something, Bob’s signature, and Bob’s public key and (using miraculous computer science) verify that Something was signed using Bob’s private key – that all three pieces of the puzzle fit together – even though she doesn’t know what Bob’s private key is.
This also means that anybody can tell if Something changes after it’s signed by Bob, or if Bob’s signature changes, even by one character. If that happens, the three pieces of the puzzle won’t fit together any more.
(Here I have elided how the public key allows anybody to verify a signature. It’s not the same as un-hashing a hash – which you can’t do – it’s sort of like being able to ask, “does this hash work out mathematically if I give you one half of the solution?” The mathematics behind this are dark and arcane. You can read about them elsewhere if you want. There was a time that I myself understood them, but that time has long since passed).
So what if we adopt Proof of Signature as our method of chaining together blocks on the blockchain? It would work like this: when we get to the end of a block, all the nodes would get together and choose somebody to sign the block (or maybe multiple somebodies). Whomever we choose takes the text of the block – let’s say it’s Sally this time – hashes it together with her private key, and publishes that signature to everybody. Everybody can immediately verify that Sally’s signature is valid because Sally has published her public key, and so they all write that signature (along with something that will let everyone know that it was Sally who signed it so that anyone else can also verify her signature). Now that signature becomes the Validation Word for that block.
Does this work? It seems like it does, because a signature works the same as a hash – if you change even one character of either it or the block that was signed, the signature will no longer be valid. Nobody can change that signature except for Sally. If Sally was always the signer, she could change all the pages and re-sign them and everything would be valid, but we could get around that by electing lots of different people to sign the various blocks. So the only problem we need to solve is how we elect Sally, or any block signer, in the first place.
And that’s essentially Proof of Stake, where the answer is, “the signer has some number of blockchain coins, and they stake them.” It works like this:
Sally has a node on a Proof of Stake blockchain, and Sally also owns some coins that are traded on that blockchain. She bought them for US Dollars, or maybe the Proof of Stake blockchain used to be a Proof of Work blockchain (this is true of the Ethereum blockchain, for instance) and she mined them.
Sally has decided she wants to be a validator. She’s put those coins into a kind of pool. That is, she has “staked” them.
Sally’s node is also keeping a copy of the blockchain, just like everybody else, and recording transactions as they come in.
The current block fills up, and the other nodes get together and decide (randomly, pseudo-randomly, or maybe they vote, or something else) that Sally will be the Validator for this block.
Sally presents her copy of the block. The rest of the nodes decide whether her block has the right list of transactions on it (they vote, or maybe a few other potential validators verify it, or something else).
If Sally’s copy passes muster, she signs the block with her private key, and that signature becomes the Validation Word that everybody puts at the top of their next block. Sally gets some kind of reward, like a small transaction fee for every transaction on the block she just validated.
If Sally’s copy doesn’t pass muster – like she tried to cheat, she didn’t make sure she had all the transactions everybody else had, or maybe she wasn’t around when she was selected as the Validator and didn’t respond in time – Sally gets fined. The rest of the nodes, at the top of the next block, are going to write, “Sally gets -50 Dogecoins because she sucked, signed everybody.” They’ll go and and find somebody else to be the Validator for the current block and go through the same process again until there’s a block that the network can agree upon.
As stated previously, this is a pretty gross oversimplification of Proof of Stake, but on the other hand it’s a pretty good general picture of how it works. It turns out – for some reasons I’ll talk about in the next section, and some reasons that I’ll just wave at because they’re deeply arcane – that it’s really hard to make Proof of Stake secure in the same way that Proof of Work is secure (though again, Proof of Work isn’t really totally secure either). The primary example of this in the world is, again, Ethereum, which spent the better part of ten years working on migrating from Proof of Work to Proof of Stake. They still weren’t sure, when they switched over six months ago, that they’d solved all the problems. I guess it’s gone okay so far? Cryptocurrencies have crashed repeatedly since then (not due to anything specifically with Ethereum, more due to the fact that the whole thing is, actually, a scam) so it’s kind of hard to tell.
Some Things That I Think
Here, to me, is the key difference between Proof of Work and Proof of Stake. It is time versus authority. A Proof of Work blockchain is a record of time – all the compute time that it took to find hashes to make Validation Words for the chain. As long as the current laws of computing hold (and there are no guarantees on that, obviously, but that’s probably outside the scope of this article), there’s no way to forge that. So once a thing is a couple of blocks deep onto a Proof of Work blockchain, it’s there forever (well, forever until the laws of computing change).
A Proof of Stake blockchain is a record of authority. What grants that authority? Whatever is written into that blockchain before the authority comes into play. If you want to validate a block of a Proof of Stake blockchain signed by Sally, you don’t just need Sally’s public key. You also need some way of telling that Sally was authorized to have signed that block then. You need to go back and see that Sally indeed also owned coins on the blockchain, and that she properly staked them, according to whatever the stated rules of that blockchain were.
And – and this is important to understand – you can’t try to write that authority anywhere else than on the blockchain itself. Otherwise the blockchain is no longer decentralized. If you, for instance, want to keep some canonical list of who authorized Validators for a blockchain were and when they were authorized…well, somebody has to keep that list, and that somebody is now a centralized authority for that blockchain. Or if you want to somehow timestamp all of the pages and signatures and thereby encode time into the blockchain the way Proof of Work does, you’re going to need some kind of centralized authoritative time server, and whoever runs that time server is now a really important authority that controls the blockchain.
This makes it…I’m going to say tricky, but tricky is not the right word…to keep a Proof of Stake blockchain from being taken over and tampered with. Maybe it’s more like: there are a lot of things you have to think about. It would take another 10,000 words for me to explore this in more depth, so instead what I’m going to do is paraphrase Vitalik Buterin, the CEO of the Ethereum Blockchain. He switched his blockchain from Proof of Work to Proof of Stake, so he has thought a lot about the problems of securing a Proof of Stake blockchain. He knows they exist, and he acknowledges them – he’s a pretty smart dude, as far as I can tell (this is actually somewhat unusual in the Crypto space. Most of the folks in it seemed smart because they understood finance, or at least “spoke” finance. Most of these folks were also astonishingly stupid. Yes I’m talking about you, SBF).
I’m going to summarize some of Buterin’s arguments in bullet points below. These arguments are all paraphrased from his Medium account. Obviously Buterin’s first argument is the whole thing about Proof of Work burning up the world whereas Proof of Stake doesn’t. His second thing is about a 51% attack:
He says: look, what if somebody gets 51% of the compute power in a particular shard of Bitcoin? They’ll start getting all of the Bitcoins because they’ll have the mining power and they can just manufacture longer chains. All the other miners are just going to drop out and then that party will have the shard all to themselves. Nobody will ever get it back. That blockchain – at least that part of it – is dead forever.
At that point, all of the stuff that’s already written to the Proof of Work chain won’t matter, even if it can’t be changed. Bob might have a Bitcoin written in that part of the ledger, but he won’t be able to spend it because the party that controls the shard will just drop the transaction off the blockchain every time he tries to. They’ll, like, hold it hostage, demanding a share of the profits before they let him transfer it to somebody else.
Buterin goes on to talk about why his implementation of Proof of Stake is better.
He says: yeah, there’s no compute time requirement to secure stuff written to my chain, but I have this thing called ‘Casper the Friendly Finality Gadget’ which secures my chain, and it makes it so that once something’s written to the Ethereum Blockchain, you’d have to knock out ⅓ of the computers on the network, take over another ⅓ of them, and burn up $10 billion worth of Ethereum in the process in order to get it off.
He also says: even if that happened, the rest of the nodes could get together and decide that the chain that the bad person took over was not the real chain and just continue with the prior chain, taking away the bad person’s Ether at the same time.
Buterin calls this last thing “Social Recovery” and points out that it’s not possible with Proof of Work because of the “Longest Chain Wins” rule.
A general line of thought in Blockchain is basically that, because of their own self-interest, nobody will want to attack the blockchain. Right now Cryptocurrencies have value – you can, even now, exchange them for US Dollars – and basically all of that value is due to some general shared belief in the technology of blockchain. If someone starts attacking the blockchain and makes it so that people stop believing they can reliably hold – or spend – coins in that chain, that belief will be shaken and the value of those coins will drop. So nobody who holds coins in a blockchain will want to attack the integrity of the chain. This is one of the things Buterin is relying on in his arguments. To do the 51% attack on Bitcoin, you don’t have to hold any Bitcoin – you just need money to buy compute time. So you might try that attack to see if you can make money holding Bitcoins hostage, and if the value of Bitcoins drops a lot, you don’t directly care. Your concern is only, “is the money I spend on compute time less than the money I make holding Bitcoins hostage?”
But that’s not true of Proof of Stake – you have to have Ether if you want to attack the Ethereum Blockchain, because the only way to try and take it over is to become a Validator, and to do that you have to become someone with a stake in the value of Ether. Yeah, you could try and take over the chain, Buterin argues, but you’d have to destroy an enormous amount of Ether, and whatever Ether you have left wouldn’t be worth anything because everybody would stop believing in Ether. So you’d hurt a lot of people, but you’d also hurt yourself.
The first thing I want to point out here is that this logic only holds if the only thing you’re trying to store in the blockchain is the blockchain’s cryptocurrency itself. If you try to put anything else of value – say, the deeds to people’s houses – this logic no longer holds. For instance the total value of privately held real estate in King County Washington (where I live) is well and far into the trillions of dollars. If ownership of that were all transferred via Smart Contract on the Ethereum blockchain, it would make economic sense to burn $10 billion of Ether in order to get yourself into a position where you hold those transactions hostage, to take, say, a 10% cut of every single one of them. We live in a world where Elon Musk just spent $44 billion to burn Twitter to the ground for, as far as anyone can tell, his own amusement. So I don’t relish the thought of giving him or really anyone else similarly priced options for wreaking havoc where he might actually, you know, make money at everybody else’s expense.
I’m also incredibly skeptical of the idea of Social Recovery. I think that it just fundamentally misunderstands the nature of power, and the nature of blockchain in the world. Blockchain perhaps seems like a democratizing force due to, like, mathematics and aesthetic beauty. People just believe in it, especially Bitcoin itself. But Blockchain has to exist in the world, and the world has other forces that affect those mathematics. You can prove that stuff works within a well-defined mathematical framework, but that framework might not hold when you get that stuff into the world. Bitcoin is DaVincian, yes, but it’s only that way within the realms of mathematics and computers. Here, for instance, are some factors that made Satoshi’s framework shatter when it was released into the world:
Compute time costs money and money’s distribution in the world is unequal.
Compute time requires energy and energy usage is incinerating the world.
The world mostly runs on Capitalism, so if there’s a scarce resource that some people value, markets will immediately spring up to buy and sell that resource and its price will fluctuate, possibly wildly, as people speculate on that price. If that scarcity is artificial and well-defined, speculators need not worry about sudden gluts of it appearing in the market and so much the better for them.
A thing with a wildly fluctuating price is not a good currency. People will not spend it.
Proof of Stake solved some of those problems, but it introduced, in my opinion, a far bigger one: it codifies – like, literally writes into code – an amount of money you can spend in order to take control of a system. It’s not that, you know, money isn’t power already. But actually literally writing it into code takes us one giant step farther into that direction.
And to me that’s the real dystopian truth behind Proof of Stake (and maybe all blockchains – I’m not quite sure). Imagine a world where our systems run on blockchain, and where they can be systematically taken over just by spending money – no subverting governments, no overriding public institutions or bureaucracies – you can literally just buy control of the system (I’m not even going to entertain the Libertarian argument that this would be, like, good somehow). At that point, if blockchain were ingrained as part of the systems that ran our lives, I suspect we’d just normalize it as something that happened; as something that was, if not fair or right, “just the way things are.”
We do a lot of this right now – the US for-profit healthcare system leaps easily to mind. Imagining that something like “Social Recovery” would somehow overcome it seems about as likely to happen as the citizens of the US demanding socialized medicine and then it, you know, happening. That’d be great. But our collective social desire does not cause this thing to occur.
If we could vote automatically by computer, and the results were somehow binding, would that all change? That’s essentially the pitch of the Proof of Stake blockchain here – people with lots of power and money would try and take over, but We The People could, via Social Recovery, overcome it. But the thing about Social Recovery in Proof of Stake is this: it’s not social. You’re not voting with your computer. You’re voting with whatever stake you hold – you have to own the chain’s cryptocurrency to have a say in the blockchain. Buterin calls it “social” to make it sound like The People would Rise Up, but it is not the people. It is Capital, and it is whoever holds it – the more held, the more votes, and the more sway. That sway will always go where the money goes, and if power in the world has decided which way Capital will flow, well, Capital must follow.
Count me out of formally codifying that into our systems.
No comments:
Post a Comment