Video for Jack: PoW versus PoS

Opens May 21st 2021 making a video for Jack Dorsey, who said proof of work is better than proof of stake because it is less centralized and more secure.

Most laymen have no consensus-protocol opinions, like a favorite surgical procedure, but everyone wants to be an expert, so he will offer resources to develop a real opinion.

Cites Leslie Lamport's 1978 paper Time, Clocks, and the Ordering of Events in a Distributed System, one of the most-cited in computer science with 12,000 citations.

The ordering problem where Alice sees event A then B while Bob sees B then A, a partial ordering Lamport analyzed that founded distributed systems, for which he won the Turing award and now works on TLA+ rather than Paxos.

Recommends MIT 6.824 distributed-systems lectures and Martin Kleppmann's Cambridge series for a rigorous background, though not for laymen.

Cites the GKL Bitcoin Backbone Protocol paper with 1100 citations by Juan Garay of Texas A&M, chief scientist Aggelos Kiayias, and Nikos Leonardos of Athens, which creates definitions and foundations yielding the common prefix and chain quality properties from which you develop a security model defining when an adversary wins.

The adversary's capabilities matter, like a classical or quantum computer, so quantum insecurity means the security model may not hold against a quantum-capable adversary.

Consensus protocols may be Byzantine fault tolerant or not, giving a non-BFT example of picking the minimum random number that you can hijack, versus Intel's Sawtooth proof of elapsed time running on SGX so the code cannot be modified.

Every protocol needs a definition and security foundations, which Satoshi did not do, so cryptographers spent years retroactively modeling Nakamoto proof of work built on hashcash.

A blockchain protocol has three steps, pick someone to make a block, make and push it, and have the network accept it, with all Bitcoin's energy in the picking step where mining buys computational lottery tickets requiring an ASIC.

Proof of stake and proof of work are functionally identical in making and accepting blocks, so you could plop a proof-of-stake algorithm onto Bitcoin, like a poker game where you pick a dealer, deal cards, and validate the hand.

Bitcoin is a trustless deterministic system where you check the proof of work and contents assuming honest majority, rare with complete decentralization, but the picking step uses 99.9999 percent of the energy.

Proof of stake invents a synthetic resource, so 25 percent of it means being selected dealer 25 percent of the time on average, and the question is whether its distribution is fair and secure, needing a security model to compare with proof of work.

The Ouroboros paper from 2017 updated in 2019 uses the GKL model to make a synthetic resource correctly pick block-makers, covering time and synchrony citing Lamport's 1978 work, liveness, chain growth, and common prefix, building security equivalent to proof of work under its assumptions.

Assumption is the most dangerous term in computer science, since a peer-reviewed paper does not guarantee security against all adversaries and conditions, with different synchronous, partially-synchronous, and asynchronous communication models.

Cites the Fischer-Lynch-Paterson impossibility result on fundamental limits in asynchronous systems, and the number of Byzantine actors tolerated, a third for sharded protocols or a half.

Bitcoin has amazing properties where an honest minority can undo a majority chain over time, a disaster-recovery mechanism, operating in asynchronous conditions per Andrew Miller.

Bitcoin is unpredictable about who finds the next magic value, unlike consensus algorithms where you know the next dealer to coerce, and generates reasonable randomness despite grinding attacks with 50 percent Byzantine resistance.

Replicating those for proof of stake is non-trivial, needing creative randomness sources, 51-attack recovery, and a proper clock, usually inherited from NTP but they wrote Chronos to create a clock from within the system.

The many Ouroboros papers exist because those properties were not solved in the original, pointing to Aggelos Kiayias's IACR ePrint archive of Ouroboros Praos, the universally-composable time model, Chronos, BFT for side chains, Genesis for bootstrapping without checkpoints, Crypsinous for privacy, and Consensus and Ledger Redux for 51-attack self-healing.

Uses an engine analogy where proof of work has throughput, latency, and capacity, and proof of stake is another engine with the same concepts, plus you can have N synthetic resources beyond just ADA.

Proof-of-work resources need physical hardware that monopolizes into a race to centralization, so under 10 mining operations control over 50 percent of Bitcoin, while a synthetic resource moves instantly and can be weighted.

Proof of stake tends to be faster with higher throughput since it eliminates the expensive energy step, and knowing the leader schedule ahead while obfuscating it optimizes resource use into a heterogeneous specialized network.

Proof-of-stake security is endogenous and internal, unlike proof of work which dislikes nearest neighbors, since an external attacker can Goldfinger-attack one of two chains sharing an algorithm like Zcash or ETC, destroy its value anonymously, then reuse the equipment on the other chain.

Proof of work only works without nearest neighbors like Bitcoin dominating hash power, while proof of stake does not care since Polkadot and Cardano share a consensus and comparable price with no security risk because it is internal and quantifiable via token price.

Cites the Cryptocurrency Egalitarianism paper showing ASIC resistance increases egalitarianism, and that Ouroboros and the hybrid Decred can be perfectly egalitarian under correct parameters, contradicting folklore belief.

There is no silver bullet, since proof of work versus stake depends on your adversary, security assumptions, network structure, whether you value heterogeneity, external or internal security, and performance.

Proof of stake is ridiculously hard in practice, needing knowledge of time, VRFs, and recovery models, where pristine assumptions like a fixed quorum in a synchronized network give high performance but are a brittle glass cannon.

The Ouroboros papers had deep thought, precise language, and harsh external review, and academia gives credence to related work, citing FruitChain and Algorand.

The Algorand paper by Silvio Micali cites Ouroboros, since academia is best-practice collaboration unlike crypto's tribalism, and Micali is a Turing-award winner honoring the industry by being in it.

The paper is not the product, which is the assumptions, economics, and social dynamics, and that not all transactions are equal since a Bitcoin transaction moves one asset while Ethereum is a general-purpose computer.

A transaction has five properties, assets, identity, metadata, contractual construction, and jurisdiction, but Bitcoin only moves one asset blind to identity, contracts, and jurisdictions, which is why they built Ethereum.

Doing all that with a high-throughput, low-latency, always-available engine is super hard, and proof of stake gives a better, more egalitarian engine by reusing the eliminated expensive step to operate far more efficiently.

Proof of work still has its place with new efficient families like Viveck Cadambe's Prism protocol they contribute to, and Log Space Mining by Dionysios Zindros and Aggelos Kiayias.

Jack that proof of work is not equal to proof of stake, like saying a truck is better than a Lamborghini, since it depends on context, and he would not take a Chevy 2500 to a track or a Lamborghini to a Wyoming ranch.

For assets, identity, metadata, contracts, and automated law with internal security, proof of stake is significantly better, and that Bitcoin maximalists are a cult who do not care about evidence, like the cult of steam refusing a battery car.

In 2015 they did not know if proof of stake was real with no foundation or security models, and years of research and peer review let them say it is the best protocol in certain contexts while humbly admitting the road is long.

Claiming everything was achieved on January 3rd 2009 is like a religious fanatic saying the earth is 7000 years old, trading one god for another, when distributed systems is a five-decade field with deep tradition.

Ouroboros runs a global network moving 10 billion dollars daily for under six gigawatts a year, while Bitcoin uses hundreds of terawatts like a nation-state and growing, so proof of stake is forever greener.

Thousands of registered stake pool operators make blocks every 10 to 15 seconds in a dynamic quorum that changes every epoch as ADA's value rises, more decentralized than proof of work.

A synthetic resource survives a country ban like China's, since ASICs in data centers are hard to move but a synthetic resource relocates jurisdiction with a click to Liechtenstein, Chile, or Australia with no sovereign seizure via public-key cryptography.

Security only matters against an adversary, so Jack must define security under specific assumptions and a model against a type of adversary with evidence, which maximalists do not do because they are a cult.

Closes hoping to make Ouroboros classes and, once Omega is done, a lecture series, since Omega is the magnum opus tying the whole Ouroboros agenda together for a long time so you can focus on layer two.