经济与社会科学2018faculty.chicagobooth.edu编辑精选
比特币与区块链的经济极限
The Economic Limits of Bitcoin and the Blockchain
进阶 · 约 90 分钟读完前置知识：区块链与工作量证明基础、博弈论基础、金融做空机制
导读
芝加哥大学 Eric Budish 的论文从经济学角度分析比特币与区块链的根本限制：核心论点是只要攻击网络（双花或砸盘做空）的收益超过挖矿成本，51% 算力攻击就有利可图，而挖矿成本随区块奖励递减，安全预算难以长期维持。作者据此认为工作量证明的持续安全性存在经济上的天花板。
HN 关注点：论文挑战了比特币“算力多数即安全”的核心假设，触及 HN 读者长期争论的 PoW 安全性与矿工激励问题
HN 评论精选
这几条评论里：质疑 1 补充 3
补充提出比论文更温和的攻击：算力卡特尔通过审查区块垄断区块奖励，且低于 50% 算力也可能实现
论文列出了算力多数方可发动的两种攻击：双花和破坏（压低汇率）。但还有一种更温和且更有利可图的攻击：垄断全部区块奖励——无需告知任何人，也不会因双花而惹恼用户，一切照常。换句话说，建立一个“善意的挖矿垄断”：算力多数通过审查卡特尔之外的区块形成有效垄断，激励等于一半的区块奖励。若操作得当且循序渐进，很少有用户会察觉，在意的人离开即可。我怀疑还存在卡特尔公开威胁审查其不认可的区块的版本——BIP-9 本质上就是这么做的。UASF 就有先例：威胁审查区块的那批人算力远低于 50%，但这一威胁足以终结 segwit2x。
apo查看英文原文
The paper outlines two attacks that a hash rate majority can undertake: (1) double-spending; and (2) sabotage (force a decline in exchange rate). But there is a far more benign and profitable attack: collect all of the block reward. No need to tell anybody, and no need to upset users by double-spending. Business as usual. In other words, establish a benevolent mining monopoly: https://bitzuma.com/posts/bitcoins-end-game-the-benevolent-mining-monopoly/ The hash rate majority becomes an effective monopoly by censoring blocks from outside the cartel. The incentive is equal to half the block reward. If done properly and gradually, few users would notice. Nor would many care. Those who did would simply leave. I suspect there's even a version of this attack in which a cartel makes public threats to censor blocks it disapproves of. This is, after all, what BIP-9 does: https://github.com/bitcoin/bips/blob/master/bip-0009.mediawiki Using this approach, a cartel may be able to leverage a hash rate below 50% to 100%. There's some precedent for this with UASF. The hash rate of the group threatening to censor blocks there was quite small (certainly below 50%). Depending on who you talk to, the threat of block censorship by this group was enough to shut down segwit2x.
质疑认可论文框架，但质疑其依赖矿工零利润假设，若挖矿本身持续盈利则结论需修正
快速读后，主要论点可归结为：网络的挖矿成本必须高于破坏或攻陷网络所能获得的利润，否则攻击就有利可图。例如，若挖矿成本低于做空砸盘的一次性利润，就可以先大额做空，再投入较小资金获取多数算力来破坏网络。这个结论正确……但前提是矿工之间满足零利润条件——即比特币网络像标准的寻租锦标赛那样达到经典均衡，而不是像分布式交易处理网络那样让矿工持续盈利。我没见过关于矿工盈利能力的严肃研究，但许多矿工声称处理交易是赚钱的！如果挖矿确实有利可图，还需附加条件：破坏网络的利润现值必须超过持续正常运营的利润现值……
cs702查看英文原文
Great paper! Based on a quick first read, and ignoring numerous important details, the main argument boils down to this: "mining" costs (i.e., the computational and other costs of processing transactions) in the network must be greater than the profits that could be obtained by compromising or sabotaging the network. Otherwise, it becomes profitable to compromise or sabotage the network. For example, if the cost of mining is lower than the one-time profit that could be made by betting a large sum against the price, it becomes profitable to bet such a large sum against the price and then investing a smaller sum necessary to acquire a majority of the computing power to sabotage the network. This is correct... but only if there is a zero-profit condition among miners -- i.e., if the Bitcoin network behaves like a standard theoretical rent-seeking tournament that reaches and settles into a classical equilibrium, instead of behaving like a distributed transaction processing network that produces profits for the parties that process transactions (AKA "miners"). I have not seen a good study (or actually any study) on the profitability of miners, but many miners claim to be making money by processing transactions! If mining is profitable, as miners claim, we have to add another condition: the net present value of the profits that could be obtained from compromising or sabotaging the network would need to exceed the net present value of the profits that could be obtained in perpetuity from behaving honestly. If the value of the profits that could be obtained in perpetuity by behaving honestly are greater, there would be no incentive to compromise or sabotage the network. Those are my initial thoughts, based on a quick first read. But I'm barely doing justice to the paper, which I found to be well-written and easy-to-follow. I've downloaded it to read it (and think about it) more carefully. Highly recommended reading if you have an interest in cryptoassets!
补充纠正论文对中本聪原意的引用：中本聪早已预见专用挖矿硬件的出现
作者声称中本聪的设想是矿工使用可通用 repurposable 的芯片（“一 CPU 一票”），这是错误的。中本聪正确预见到挖矿最终会使用专用硬件：『当网络增长超过某个程度后，挖矿将越来越多地留给拥有专用硬件服务器农场的专业人士』（见 satoshi.nakamotoinstitute.org 的邮件）。
mrb查看英文原文
The author claims Satoshi Nakamoto's vision was that miners would use repurposable chips ("one-CPU-one-vote") but this is false. Satoshi correctly envisioned mining farm would eventually use specialized hardware: «as the network grows beyond a certain point, it would be left more and more to specialists with server farms of specialized hardware» https://satoshi.nakamotoinstitute.org/emails/cryptography/2/
补充提出替代方案“地理分布证明”：用光速延迟验证节点间最小物理距离来抑制矿场
上周有一篇论文指出对小众加密货币发动 51% 攻击的成本效益非常高。工作量证明已变得非常昂贵，权益证明又有另一套问题。不如试试“地理分布证明”？如果要求每个节点与其他节点保持最小物理距离，将大大限制矿场。距离可以验证：利用光速延迟验证两节点不近于某距离——可以伪造更远的距离，但无法伪造更近的。可以要求每个节点距其他节点至少几百米，给郊区和农村地区优势。
Animats查看英文原文
There was a paper last week pointing out how cost effective 51% attacks are on the lesser cryptocurrencies. Proof of work has become very expensive. Proof of stake has another set of problems. How about proof of geographical distribution? If each node had to be a minimum physical distance from another node, that would put a big crimp into mining farms. Distance can be verified. You can use speed of light lag to verify that two nodes are not further apart than some distance. So set up a mesh network. If you claim to be at a location, others in the mesh can verify that it's roughly correct by pinging it and measuring the round trip time. You can fake a longer distance, but not a shorter one. You might be able to do something in the WiFi bands in the 100m - 1KM range. Require that each node be at least a few hundred meters from any other node. Give an advantage to suburbs and rural areas. "HeartlandCoin"?
相关资源
从这篇论文所有 HN 讨论帖的全部评论里整理出来的链接。
历次讨论
- 2018Hacker News 讨论帖176 分 · 37 评
同领域还值得读
一切的回报率，1870–2015
The Rate of Return on Everything, 1870–2015
利用1870–2015年多国的长期数据，估算股票、住房等各类资本的回报率，并将其与经济增长率进行比较。
经济与社会科学2019 · 487 分 · 260 评进阶 · 约 100 分钟编辑精选一切资产的回报率，1870–2015
The Rate of Return on Everything, 1870–2015
构建了 1870–2015 年 16 个国家的长周期资产回报数据集，覆盖股票、住房、政府债券和短期票据，系统比较各类资产的真实回报与波动性。
经济与社会科学2018 · 215 分 · 151 评进阶 · 约 120 分钟编辑精选一切资产的回报率，1870–2015（2019）
The Rate of Return on Everything, 1870–2015 (2019)
这篇发表于《经济学季刊》的论文构建了 1870–2015 年间 16 个主要发达国家的股票、债券、房地产等资产收益率的长周期数据库。
经济与社会科学2024 · 190 分 · 148 评进阶 · 约 80 分钟编辑精选想法是否越来越难找？
Are ideas getting harder to find?
探讨“想法是否越来越难找到”：通过衡量多个领域的“研究生产率”，发现维持相同的增长需要投入指数级增长的研究资源，即研究效率在持续下降。
经济与社会科学2016 · 182 分 · 106 评入门 · 约 60 分钟编辑精选没有人会因解决从未发生的问题而获得赞誉（2001）
Nobody ever gets credit for fixing problems that never happened (2001)
讨论组织为何总奖励“救火”而忽视防患于未然：预防性维护和流程改进因问题没有发生而不可见、难以归功，危机处理却因戏剧性和可量化而获得资源与晋升。
经济与社会科学2015 · 1,232 分 · 474 评入门 · 约 20 分钟