"Even Hal Finney started to get it. In December 2010, Hal said:

Ultimately, it’s good for the network for mining to be expensive. It makes it that much harder for a well-financed attacker to dominate the network.

So, unlike the earlier idea of needing to put a cap on and slowly build to
allow many nodes, he started to get it. Unfortunately, by that time I was already disillusioned.

He still saw Bitcoin as the store-of-value and digital-gold ideal, though.

I see Bitcoin as ultimately becoming a reserve currency for banks, playing much the same role as gold did in the early days of banking. Banks could issue digital cash with greater anonymity and lighter weight, more efficient transactions.

He never got around to understanding how efficient Bitcoin can be. I guess
we all have baggage that weighs us down from the ideas we had before."

Pag. 21
Satoshi's Vision:
The Art of Bitcoin.
By Craig Wright
August 2019
https://t.me/theArtofBitcoin/20

https://www.amazon.com/Satoshis-Vision-Bitcoin-Craig-Wright/dp/168873592590

“Both Satoshi and I objected that [Bitcoin] wouldn't scale at 1MB. Hal was concerned about a potential DoS attack though, and after discussion, Satoshi agreed... But all 3 of us agreed that 1MB had to be temporary because it would never scale.”

-Ray Dillinger

https://bitcointalk.org/index.php?topic=946236.msg10388435#msg10388435

 The Many Facts Pointing to Hal Being Satoshi
The identity of Bitcoin’s pseudonymous founder is the subject of endless and dedicated speculation among the hardcore crypto crowd, and for good reason: the mystery truly is enticing. While the…
Read More

Reusable Proofs of Work
by Hal Finney
(hal at finney dot org)
https://web.archive.org/web/20041202180250/http://rpow.net:80/

Legendary Bitcoin contributor Hal Finney's Twitter profile is safe — for now
Bitcoin fans can rest easy as Twitter has backpedalled on its plans to purge inactive accounts until it can figure out how to memorialize them. - thenextweb.com

Re: [bitcoin-list]
Bitcoin v0.1 released
From: <hal@fi...>
- 2009-01-11

Satoshi Nakamoto writes:
> Announcing the first release of Bitcoin, a new electronic cash
> system that uses a peer-to-peer network to prevent double-spending.
> It's completely decentralized with no server or central authority.
>
> See bitcoin.org for screenshots.
>
> Download link:
> http://downloads.sourceforge.net/bitcoin/bitcoin-0.1.0.rar

Congratulations to Satoshi on this first alpha release. I am looking forward to trying it out.

> Total circulation will be 21,000,000 coins. It'll be distributed
> to network nodes when they make blocks, with the amount cut in half
> every 4 years.
>
> first 4 years: 10,500,000 coins
> next 4 years: 5,250,000 coins
> next 4 years: 2,625,000 coins
> next 4 years: 1,312,500 coins
> etc...

It's interesting that the system can be configured to only allow a certain maximum number of coins ever to be generated. I guess the idea is that the amount of work needed to generate a new coin will
become more difficult as time goes on.

One immediate problem with any new currency is how to value it. Even ignoring the practical problem that virtually no one will accept it at first, there is still a difficulty in coming up with a reasonable
argument in favor of a particular non-zero value for the coins.

As an amusing thought experiment, imagine that Bitcoin is successful and
becomes the dominant payment system in use throughout the world. Then the
total value of the currency should be equal to the total value of all the wealth in the world. Current estimates of total worldwide household
wealth that I have found range from $100 trillion to $300 trillion. With 20 million coins, that gives each coin a value of about $10 million.

So the possibility of generating coins today with a few cents of compute time may be quite a good bet, with a payoff of something like 100 million
to 1! Even if the odds of Bitcoin succeeding to this degree are slim, are they really 100 million to one against? Something to think about...

Hal

https://sourceforge.net/p/bitcoin/mailman/bitcoin-list/?viewmonth=200901

From hal at finney.org Thu Mar 1 2001
From: hal at finney.org (hal at finney.org)
Date: Thu, 1 Mar 2001 11:24:24 -0800
Subject: the three-services model
Message-ID: <200103011924.LAA20764@finney.org>


Wei Dai's original article on the Three Services Model has appeared on
the openp2p.com news ticker (look at the lower right part of that page,
or the news page at http://www.openp2p.com/p2p/news.csp). The link
ponints directly into the Bluesky archives. The OpenP2P site does not
provide a discussion forum on its news page, but this could lead to
wider distribution of information about this list.

Hal

The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com


From hal at finney.org Sat Jan 10 21:22:01 2009
From: hal at finney.org (Hal Finney)
Date: Sat, 10 Jan 2009 18:22:01 -0800 (PST)
Subject: Bitcoin v0.1 released
Message-ID: <20090111022201.C084C14F6E1@finney.org>

Satoshi Nakamoto writes:
> Announcing the first release of Bitcoin, a new electronic cash
> system that uses a peer-to-peer network to prevent double-spending.
> It's completely decentralized with no server or central authority.
>
> See bitcoin.org for screenshots.
>
> Download link:
> http://downloads.sourceforge.net/bitcoin/bitcoin-0.1.0.rar

Congratulations to Satoshi on this first alpha release. I am looking
forward to trying it out.

> Total circulation will be 21,000,000 coins. It'll be distributed
> to network nodes when they make blocks, with the amount cut in half
> every 4 years.
>
> first 4 years: 10,500,000 coins
> next 4 years: 5,250,000 coins
> next 4 years: 2,625,000 coins
> next 4 years: 1,312,500 coins
> etc...

It's interesting that the system can be configured to only allow a
certain maximum number of coins ever to be generated. I guess the
idea is that the amount of work needed to generate a new coin will
become more difficult as time goes on.

One immediate problem with any new currency is how to value it. Even
ignoring the practical problem that virtually no one will accept it
at first, there is still a difficulty in coming up with a reasonable
argument in favor of a particular non-zero value for the coins.

As an amusing thought experiment, imagine that Bitcoin is successful and
becomes the dominant payment system in use throughout the world. Then the
total value of the currency should be equal to the total value of all
the wealth in the world. Current estimates of total worldwide household
wealth that I have found range from $100 trillion to $300 trillion. With
20 million coins, that gives each coin a value of about $10 million.

So the possibility of generating coins today with a few cents of compute
time may be quite a good bet, with a payoff of something like 100 million
to 1! Even if the odds of Bitcoin succeeding to this degree are slim,
are they really 100 million to one against? Something to think about...

Hal https://www.metzdowd.com/pipermail/cryptography/2009-January.txt

The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com


From hal at finney.org Sat Jan 24 11:48:03 2009
From: hal at finney.org (Hal Finney)
Date: Sat, 24 Jan 2009 08:48:03 -0800 (PST)
Subject: Bitcoin v0.1 released
Message-ID: <20090124164803.A3B7414F6E1@finney.org>

Jonathan Thornburg writes:
> In the modern world, no major government wants to allow untracable
> international financial transactions above some fairly modest size
> thresholds. (The usual catch-phrases are things like "laundering
> drug money", "tax evasion", and/or "financing terrorist groups".)
> To this end, electronic financial transactions are currently monitored
> by various governments & their agencies, and any but the smallest of
> transactions now come with various ID requirements for the humans
> on each end.
>
> But if each machine in a million-node botnet sends 10 cents to a
> randomly chosen machine in another botnet on the other side of the
> world, you've just moved $100K, in a way that seems very hard to
> trace. To me, this means that no major government is likely to allow
> Bitcoin in its present form to operate on a large scale.

Certainly a valid point, and one which has been widely discussed in
the debates over the years about electronic cash. Bitcoin has a couple
of things going for it: one is that it is distributed, with no single
point of failure, no "mint", no company with officers that can be
subpoenaed and arrested and shut down. It is more like a P2P network,
and as we have seen, despite degrees of at least governmental distaste,
those are still around.

Bitcoin could also conceivably operate in a less anonymous mode, with
transfers being linked to individuals, rather than single-use keys. It
would still be useful to have a large scale, decentralized electronic
payment system.

It also might be possible to refactor and restructure Bitcoin to separate
out the key new idea, a decentralized, global, irreversible transaction
database. Such a functionality might be useful for other purposes. Once
it exists, using it to record monetary transfers would be a sort of side
effect and might be harder to shut down.

> I also worry about other "domestic" ways nasty people could exploit
> a widespread Bitcoin deployment:
> * Spammer botnets could burn through pay-per-send email filters
> trivially (as usual, the costs would fall on people other than the
> botnet herders & spammers).
> * If each machine in a botnet sends 1 cent to a herder, that can add
> up to a significant amount of money. In other words, Bitcoin would
> make botnet herding and the assorted malware industry even more
> profitable than it already is.

It's important to understand that the proof-of-work (POW) aspect of
Bitcoin is primarily oriented around ensuring the soundness of the
historical transaction database. Each Bitcoin data block records a set
of transactions, and includes a hash collision. Subsequent data blocks
have their own transactions, their own collisions, and also chain to
all earlier hashes. The result is that once a block is "buried" under
enough new blocks, it is essentially certain (given the threat model,
namely that attackers cannot muster more than X% of the compute power
of legitimate node operators) that old transactions can't be reversed.

Creating new coins is indeed currently also being done by POW, but I
think that is seen as a temporary expedient, and in fact the current
software phases that out over several years. Hence worries about botnets
being able to manufacture large quantities of POW tokens are only a
temporary concern, in the context of Bitcoin.

There have been a number of discussions in the past about POW tokens as
anti spam measures, given the botnet threat. References are available from
"Proof-of-work system" on Wikipedia. Analyses have yielded mixed results,
depending on the assumptions and system design.

If POW tokens do become useful, and especially if they become money,
machines will no longer sit idle. Users will expect their computers to
be earning them money (assuming the reward is greater than the cost to
operate). A computer whose earnings are being stolen by a botnet will
be more noticeable to its owner than is the case today, hence we might
expect that in that world, users will work harder to maintain their
computers and clean them of botnet infestations.

Countermeasures by botnet operators would include moderating their take,
perhaps only stealing 10% of the productive capacity of invaded computers,
so that their owners would be unlikely to notice. This kind of thinking
quickly degenerates into unreliable speculation, but it points out the
difficulties of analyzing the full ramifications of a world where POW
tokens are valuble.

Hal Finney
https://www.metzdowd.com/pipermail/cryptography/2009-January.txt

The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com


From hal at finney.org Tue Jan 27 14:35:43 2009
From: hal at finney.org (Hal Finney)
Date: Tue, 27 Jan 2009 11:35:43 -0800 (PST)
Subject: Proof of Work -> atmospheric carbon
Message-ID: <20090127193543.67F9314F6E1@finney.org>

John Gilmore writes:
> The last thing we need is to deploy a system designed to burn all
> available cycles, consuming electricity and generating carbon dioxide,
> all over the Internet, in order to produce small amounts of bitbux to
> get emails or spams through.

It's interesting to consider the ultimate technological resolution to this
issue. Will a global-scale proof-of-work based system inherently consume
substantial amounts of energy? Or are there ways of doing computing
which would allow such a system to use only moderate energy consumption?

This question relates to the thermodynamics of computation. It has
long been known that logically reversible transformations can be done
with arbitrarily low energy dissipation. Hence attention is focused on
irreversible transformations, particularly those that require bit erasure.
Erasing a bit dissipates approximately energy of approximately kT where
k is Boltzmann's constant and T is temperature.

The question is whether a POW system inherently involves a great deal
of irreversible logical transitions, causing bit erasure and dissipating
energy? Or could a POW token be created using solely reversible logic?

One note is that any algorithm can in principle be made reversible except
for the size of the output: compute it using reversible logic, possibly
creating many excess bits which will allow the reversal, until we get
the answer; then make a copy of the output; then reverse the calculation,
consuming all the excess bits until we get back to the original value. The
only irreversible step was saving the output. However this is impractical
for large calculations like we are talking about, because the number of
excess bits would dwarf the size of the calculation.

The hash collisions used in systems like Bitcoin or Hashcash (technically
not collisions, rather searches for pre-images of hash values with many
leading zero bits) seem inherently irreversible. The algorithm typically
sets up a pre-image that includes a counter value, computes the hash,
increments the counter and repeats until a hash is found with the desired
properties. The hash function itself typically uses many intrinsically
irreversible transitions, since logical irreversibility is a defining
requirement of a hash function. Even if we use the trick in the preceding
paragraph to eliminate the cost of the intermediate steps in computing
the hash, we would still need to erase the output result each iteration,
dissipating energy. Typical POW systems in use today require millions
to billions of iterations, and this would be likely to increase in the
future, so the dissipation could be substantial.

Replacing the hash with a logically invertible function might help to
reduce the number of intermediate bits, and eliminate the need to use
the run-backwards trick. One would require that both the pre-image and
the post-image contain a number of bits in fixed positions. However this
would still seem to require the same kind of search algorithm, causing
dissipation as each intermediate result is erased.

Perhaps a variation on this idea would work, if the logically invertible
function was itself very slow, perhaps paramaterized to have a huge number
of rounds. Then only a relatively small number of iterations would be
needed before a lucky result is found, for a given level of POW effort.
This would reduce dissipation. However it would slow down verification,
and since verification of the POW will be done far more often than
creation, we can't afford to tip things too far in that direction.

Another idea I had was to use a deterministic POW rather than a random
one like hash collision. Cryptographic work on "timed commitments" and
related topics has shown that repeated squarings modulo an unknown RSA
modulus allow for a relatively concise and quickly verifiable proofs that
some very large number of squarings had taken place, with no shortcuts
possible for the creation of the resulting certification. Broadly
speaking, modular squaring is logically reversible, in that one could
theoretically compute the square root. But in practice, as with the
hash computation, computing a modular square using logically reversible
operations will produce a large number of excess bits. Even if the excess
from a single squaring could be consumed using the trick mentioned
above, one would still be forced to erase the temporarily result of
each individual squaring operation, as the POW would require a very
large number of squarings. So the overall dissipation would appear to
be similar to the hash computation.

(Also, it's not clear that a deterministic POW works well for an
application like Bitcoin; it might let the owner of the fastest computer
win every POW race, giving him too much power.)

So the question from John's challenge remains open: is there a POW
system which could be built solely on logically reversible computation?
The computation has to be intrinsically time consuming, but with a short
and quickly verifiable certificate of validity.

Hal Finney
https://www.metzdowd.com/pipermail/cryptography/2009-January.txt