Oleg Andreev



Software designer with focus on user experience and security.

You may start with my selection of articles on Bitcoin.

Переводы некоторых статей на русский.



Product architect at Chain.

Author of Gitbox version control app.

Author of CoreBitcoin, a Bitcoin toolkit for Objective-C.

Author of BTCRuby, a Bitcoin toolkit for Ruby.

Former lead dev of FunGolf GPS, the best golfer's personal assistant.



I am happy to give you an interview or provide you with a consultation.
I am very interested in innovative ways to secure property and personal interactions: all the way from cryptography to user interfaces. I am not interested in trading, mining or building exchanges.

This blog enlightens people thanks to your generous donations: 1TipsuQ7CSqfQsjA9KU5jarSB1AnrVLLo

Time and money

Time is not easily measured in money. It’s rather money that can be measured in time.

Time is not fungible, money is. Yesterday’s missed opportunity not necessarily comes back today, even if you have all day. Everyone has their own money, but timeline is shared by all of us.

You can buy some time with money, but that will be different time, not the one you want to get back. Good thing, though, you can buy money with time and that will be the same money.

Turns out, it’s more accurate to say “money is time”, not “time is money”. Because making money always takes time, while some time cannot be bought back with any amount of money.

Original vision of Bitcoin

Some people feel bad about Bitcoin being harder to scale than any successful centralized system such as Myspace or Altavista. They often claim that “I signed up for a P2P Electronic Cash System, not a settlement layer” which is a way to say that Satoshi envisioned something else than what we have today.

I’d like to challenge this argument, even though I realize that it is absolutely irrelevant: whatever Satoshi thought he was doing, existence and evolution of Bitcoin is not subject to anyone’s wishful thinking, but to a humankind’s ability to actually improve it.

So Satoshi called Bitcoin an “electronic cash system”. What does that mean?

First of all, “cash” means something else than “quick settlement”. It primarily means a bearer instrument as opposed to a contract with a third party providing credit (as with credit cards, for instance). When accepting “cash” instead of a credit card, I am somewhat protected against reversal of the transaction by a third party — a credit card company. But how exactly am I protected? Turns out, there is another third party involved: a centrally controlled mint (e.g. a central bank) that provides difficult-to-counterfeit notes and uses a subsidized (by taxes) police force to discover and eliminate counterfeiters. So instead of two third parties (CB + CC company), cash leaves only one (CB) in our threat model. CB also adds a risk of debasement of currency, so if you receive 0.10% of total currency today, tomorrow it may turn out to be just 0.09%. You are essentially paying a rent on money with little assurances of stability of that rent. Also note a somewhat hidden cost of tax-subsidized minting and law enforcement to protect authenticity of the money.

Lets scroll back a few hundred years to the age of silver and gold coins. “Cash” was more decentralized: gold is gold no matter what face is printed on it. But why have faces on gold coins at all? Elementary, Watson: because it’s a huge pain in the arse to verify the coin on the spot. So central mints were used to provide hard-to-counterfeit stamps that allow quicker verification of coin validity. Mints were still a source of debasement risk, but at least some independent verification was more possible and debasement could not have been done overnight (as the saying goes, Rome was not debased in one day).

So even precious metal coins are not better than paper cash (if they were, paper would never take off in the first place): they seem to be decentralized, but related costs are so high, that to make them useful we still need centralized authorities built around them.

Is it the kind of cash Satoshi attempted to turn into electronic form? Lets read bitcoin.pdf from the very beginning:

A purely peer-to-peer version of electronic cash would allow online payments to be sent directly from one party to another without going through a financial institution.

Note that the Mint (or Central Bank) involved in coinage and printing paper bills is as much a financial institution as your bank or Visa.

If one is to create a truly decentralized bearer instrument, one must make both issuance and authenticity checks decentralized, not simply the transfer mechanism. And the only workable way that we know so far is to collectively (as a civilization) continuously build a proof-of-work chain of transfers authenticated via public key cryptography.

Folks who focus on payments without discussing issuance and corresponding holding costs (risks of debasement) are like grasshoppers who spend before saving, so when winter comes they all go to ants begging for the share of what the ants saved. This has happened all the time in the history: first, ants abstain from unnecessary spending in order to save some food for later, then ants are forced to abstain even more by all the stupid and hungry grasshoppers who come to take their savings. A truly decentralized cash would prevent the most badass grasshoppers issuing and debasing their own currency and asymmetric security of public key cryptography allows all ants, no matter how poor or rich, have equally cheap protection against even the strongest of grasshoppers.

But lets get back to our “original vision of Bitcoin”. We now clearly see that it is not fair to compare Bitcoin’s performance to performance of Visa electronic payments (large throughput, but a lot of trusted third parties and risks of reversal and censorship) or even paper bills or minted coins.

So how does Bitcoin compare to a fully decentralized gold bullion then, the best known decentralized money before Bitcoin? How many transactions a day can the naked chunks of gold settle around the world? How quick is each payment verification? How do costs scale with different amounts of payments, from the smallest to the largest? We will leave answering these questions as an exercise to the reader and jump right to the conclusion:

Decentralized physical cash sucks in all ways imaginable compared to Bitcoin. Bitcoin is faster, cheaper and safer than any other forms of decentralized cash that ever existed.

In addition, if you take Bitcoin and build payment layers on top of it by relaxing some underlying security requirements, you will still get better electronic cash than the paper cash today: faster, easier to verify, better protected against debasement etc etc.

Satoshi was building a basis layer for electronic cash by eliminating trusted third parties as a requirement. He succeeded. Everything else is simply an optimization. If some optimizations relax security requirements of Bitcoin (e.g. need some level of centralization), then they do not belong to Bitcoin, but to additional layers around Bitcoin.

Bitcoin is designed to be free from intervention as in “fuck you”.


Discuss: Reddit, HN.

Problem with Proof of Stake and “coin voting” in general

The problem with “voting by coins” is that most coins do not vote. This leaves a small fraction of UTXO to actually vote which is not representative and highly volatile since anyone risking to use idle keys to a large stash of coins can dramatically affect the voting outcome.

Most coins are locked up well “under matress” with multisig, time locks and possibly even with HSM-controlled keys. Also, pubkeys to long-term stashes do not want to be exposed from under their hashes in order to be better protected against a QC development in the long term.

In other words, most coins that matter, cannot and will not vote.

This leaves only the least important coins to perform voting. Obviously, the result of such voting will be worthless.

UPDATE: it is possible that people annotate output scripts with a dummy “voting hash” that commits to a separate pubkey, intended only for voting and stored elsewhere. But then security of the voting keys is not equivalent to the security of bitcoin keys which is what we want to begin with: that voters perfectly map to actual bitcoin holders.

Craig Wright is a brilliant troll

First, it is very easy to prove if you are Satoshi:

  1. Take the key from genesis block or from transaction paying to Hal Finney.
  2. Sign a message that includes your meatspace name, your relation to Bitcoin and the recent timestamp in a form of a recent block hash (that’s how you prove that the message could not be fabricated long time ago and/or with careful choice of contents).
  3. Publish the message and the signature anywhere.

No one has done that yet.

Second, it’s quite easy to prove that all claims by Mr. Wright regarding his link to Satoshi are either irrelevant (such as general knowledge of how Bitcoin works) or outright fabricated (such as backdated PGP key demonstrated last year, or a signature copy-pasted from a Satoshi’s transaction).

Third, it’s easy to see how mass media and some prominent voices in the Bitcoin space are turning “burden of proof” upside down. Some express doubts, but still prefer to trust (!) and believe (!!) even after being educated about the invalidity of the presented “evidence”. They still wait for a “better proof” coming from Mr. Wright.

In this story Mr. Wright brilliantly demonstrated who should not be trusted anymore on any matters in finance, cryptography or Bitcoin. Oh, what the heck, who is not to be trusted, period.

PS. This video is just perfect: https://www.youtube.com/watch?v=H2euMNmsb_s

wat

Why I think hysteria about block size is market manipulation by big buyers

Yesterday I was bored and tweeted that people flood reddit and blogs with concerns about the block limit in order to buy as many coins as possible before July’s halving that will trigger a huge price increase and expose to the whole world how important and valuable Bitcoin has become.

Seriously speaking, I don’t see another explanation for seemingly inconsistent behaviour on part of some people than either outright stupidity or participation in a mild short term conspiracy aimed at supressing the price until the next mining reward drop.

1. If someone’s business model is really at stake, they’d be coding real scalability solutions rather than debating opinions and appealing to authority.

I can understand how respectable Bitcoin businesses such as online exchanges and payment processors earn fees from the users’ activity. They obviously would like to process as many transactions as possible in order to earn as much commission as possible. Nothing wrong with it. However, if that’s really the case, then these companies should really invest into better codebase, improved block propagation techniques, better wallets etc - in order to be able to say “hey, we’ve improved the overall infrastructure and now we can raise the stupid limit” .

However, the only people who actually fix the infrastructure are those who care about long-term value of Bitcoin which is self-consistent and does not need any conspiracy theory to explain.

2. Some people point to ETH pumping as an evidence that people sell BTC for ETH.

This is total bullshit. Ethereum is much harder to scale. Dumping BTC for ETH because of scaling concerns makes no sense.

3. Some think that miner’s hashrate should decide hard fork matters, but yet do not like miner-enforced soft fork that improves Bitcoin in multiple ways

If miners “should” decide some matters, wouldn’t it be easier to just implement whatever you want using their existing powers (soft forks) rather than demanding that they have more power?

These inconsistent arguments can be explained either by total stupidity, by a big conspiracy theory (“USG wants to sabotage Bitcoin”) or by a small conspiracy theory (“Bitcoin is going to eat the world in a few months and we need to win some time to improve our position in it ahead of Chinese/Russians/Americans”).


Discussion on Reddit

Bitcoin Maximalism

Ok, here’s a rant in favor of so-called “bitcoin maximalism”.

TL;DR: Bitcoin will win the “cryptographic gold” title and every other altcoin imaginable will die. All fancy features like higher capacity, smart contracts etc will be bolted on top of Bitcoin as long as it’s safe to do with all excessive demand satisfied by commercial blockchain networks, separate layers and protocols on the side and on top of Bitcoin.

Why I’m so sure? Lets bust some myths.

“Bitcoin must scale to accomodate more users and more transactions, otherwise it will be dumped for another system”

If another system demonstrates how it can offer the same level of safety as Bitcoin (e.g. not being highly centralized and vulnerable to opinions and politics) while allowing higher capacity, it will immediately be implemented by Bitcoin via soft or hard fork with full support from major holders. It will be much less risky than to replay 7 years of market price discovery. We’ve already have seen examples when bugfixes and improvements are smoothly deployed via soft forks.

“Bitcoin must support fancy features like Ethereum has does in order to not lose to ETH”

If stakeholders are seriously considering this, they’d rather hardfork into Aethereum preserving all their balances than buying into a corporate offering which Ethereum is and aspires to become to an even bigger extent.

Also, Ethereum is much-much harder to scale and harder to upgrade to better privacy options than BTC. So if Bitcoin cannot survive because “it does not scale”, then Ethereum could not for sure as well.

“If the miners adopt a hard fork to boost capacity, Big Holders will be required to follow the larger hashrate”

No. Big Holders tolerate existing mining cartel only as long as it behaves. The mining cartel knows very well that Big Holders are those who give the value to BTC that’s converted into their daily earnings and that these holdings are well-protected by tons of irreversible proof of work. Should the mining cartel decide to play dirty, a different proof of work algorithm will be adopted (still cheaper than to buy into a completely new blockchain) and someone else will get paid for mining all blocks after the block N. Coins will be immediately dumped on the legacy chain and safely kept on the new chain with a different PoW.

But most importantly, and above all these specific issues, there’s one fundamental property of Bitcoin:

Should there be a precedent of a market abandoning one consensus in favor of another without all possible attempts to maintain it, that would become an eternal proof that such consensus is not safe long-term and can be sabotaged infinite number of times to satisfy politics du jour.

And that’s the main reason why Bitcoin will not go away after multi-billion dollar capitalization achieved over 7 years of expensive market activity. If miners want to stay in the game, Bitcoin will be infinitely extended with soft forks to address real concerns (those that put on-chain value at risk, not somebody’s business model). And if miners decide to fool around, they’d be hard-forked out of the game, not the other way around. In the worst case a bad precedent hurting stakeholders will trigger a nuclear war: everyone will lose money and all decentralized blockchain experiments will be considered irredeemably failed.

None of the above are due to specific design decisions. Bitcoin is the civilization’s consensus first of all, no matter how beautiful, ugly, efficient or inefficient it is. Should we prove just once that we can’t reach consensus, we will not deserve a second chance.


Discussion on Reddit

How segregated witness is not the same as bumping block size limit

“Segregated witness” (“segwit”) is a proposed feature to improve transaction mutability, enable smooth script upgrades and double Bitcoin capacity by moving signature scripts out of the transaction inputs into a separate data structure committed to a block using a new rule compatible with older nodes.

Bumping block size limit is a hard fork: first, everyone must agree to follow new rules, then everyone willing to verify a payment to themselves has to download and verify bigger blocks. So a minority of less-powerful miners and/or recipients is out of luck: they have to beef up their bandwidth and CPU resources or disconnect from the network. This is how “hard fork” works.

Segregated witness, among other things, increases capacity of the blocks without forcing everyone to validate bigger blocks. If you expect old-style transactions, you can still validate 1 Mb base blocks as you always did. However, if you wish to accept payments using segwit transactions, you have two options: 1) either validate additional data (that is, loading and validating all segregated signature scripts that do not fit into base blocks); 2) or trust majority of miners to validate these for you, then you can validate only base blocks ignoring segwit data, or even just use SPV proofs.

Segregated witness can only be used safely if the super-majority of miners enforce it. This can be done in two ways: validating segwit transactions according to the new rules, or not mining segwit transactions yourself and only trusting other miners to mine segwit transactions correctly (see below on why it’s not a huge security hole).

If you are a miner with sufficient resources, you can fully enforce and validate segwit transactions at the expense of larger consumed bandwidth and higher CPU consumption.

If you receive payments and have sufficient resources, you can accept both old-style and segwit transactions doing full validation yourself (at the expense of higher consumed bandwidth and higher CPU consumption).

If you wish to receive only old-style transactions, you can safely ignore all extra overhead of segwit transactions.

If your resources are very constrained, you can opt into accepting old-style transactions at old costs and using SPV proofs (trusting miners) to validate segwit payments. You may choose supporting segwit transactions for lower-value payments and require old-style transactions for higher-value payments if you only can afford old-style validation.

If you are mining with constrained resources, then you may resort to not mining segwit transactions at all and trust other miners to validate segwit transactions (if any) correctly. You can validate old-style transactions at no extra cost. Why can you trust others not to mess with you? It’s easy. Imagine some miner with 20% hashrate directs half of their hashrate (10%) to create blocks with invalid segwit data. They make you lose 10% of earnings, but they themselves lose 50% of their income because half of their blocks are invalid. The cost of attacking a constrained minority of miners is hugely asymmetric: large-scale attack makes the attacker run out of money much faster than the victim.

As a result, segwit allows scaling Bitcoin capacity in a opt-in way. Those who want to take advantage of extra capacity need to expend extra resources, but those who do not want to use the feature (no matter how small that minority is), do not need to expend any extra resources at all. Therefore, censorship-resistance property of Bitcoin remains unchanged.

Why Bitcoin is called Bitcoin

— Would you like to know why it is called “Bitcoin”?

Jane touched her glasses to show she’s preparing for one of those lengthy and passionate discussions. She sipped her orange juice and continued, without waiting for an answer.

— The closest who has ever come to creating Bitcoin was Nick Szabo. Have you read his pieces on bit gold, secure property titles and smart contracts?

— I’ve heard of bit gold. It was a precursor of Bitcoin which did not take off, right?

— Not quite. Nick never proposed any specific protocol or an algorithm, only an overview. Bit gold was just an open-ended idea. It was not clear how exactly such bit gold “coins” should be generated in a trustless manner and how their ownership could be verified. Also, in his proposal gold coins were not fungible. Their value depended on scarcity defined by complexity of per-coin proof-of-work. There were a few other problems. Nick identified the need for a secure title registry, but never proposed a concrete protocol to make it work on a global scale.

— So what ingredient was missing then?

Mike started feeling impatient. It’s not the first time he would be involved in a conversation filled with words “trustless”, “ledger” or “coins”. He prepared to listen for a hundredth time about mechanics of Bitcoin, signatures, hashing and all that.

— Ha! There was none.

Mike looked genuinely puzzled.

— Look, Nick actually laid down all the ideas necessary for a functional system: proof of work for scarcity, need for secure decentralized title registry, smart contracts. All pieces of the puzzle were there, just not arranged as needed.

Jane’s eyes sparkled and she made a dramatic pause.

— Enlighten me :)

— What if you make scarce not the bit gold coins themselves, but the entire title registry? And make it so scarce that there could only be one, which automatically solves the synchronization problem. Individual coins then become perfectly fungible because they all (eventually) share the same proof of work. And since the proof of work gets stale over time and we need to add new transactions, we could timestamp new transactions with extra proof of work thus maintaining the scarcity by piling up all proofs of work into a one giant proof. Issuance of new units follows naturally: some programmed amount could be allocated for each batch of proof-of-work.

— Impressive. Does that mean that Nick is Satoshi?

— I’m not sure. Satoshi did not mention Nick Szabo’s writings at all. Either Nick naively tried to hide his relation to Bitcoin, or it was someone inspired by Nick who tried to direct attention to him.

— Or it is still Nick and he tries to make us think precisely that :)

— Either way, Bitcoin is clearly a result of studying Nick Szabo’s work which was incomplete without this tiny, but powerful unifying idea.

— You promised to tell me why it is called “Bitcoin”.

— Don’t you see it already? The ledger, blockchain, is just a single coin of bit gold with scarcity maintained by a growing proof of work. Hence “bit coin”, singular.

— Whoa. And this coin records its own history of ownership in itself. Fascinating! Sounds like a science fiction.

— It gets better! There are a few other interesting things that become evident from that perspective.

— I’m all ears.

— It’s getting late now. Lets continue next time.

Комментарий к статье о сбитой велокореянке

Илья Бирман все правильно написал, но не до всех дошло о чем.

Задача: избежать наезда на велосипедиста, который достаточно редко попадается на трассе.

Допустим, по ПДД нужно всегда быть готовым объехать велосипед. Особенно при плохой погоде.

Допустим, наказание за сбивание велосипедиста — $1000. Допустим, водитель готов рискнуть заплатить в среднем $100 в год за все нарушения. Т.е. его внимательность и осторожность зависят исключительно от того, сколько ему придется за это заплатить. (На совесть мы не можем рассчитывать, это личное дело каждого.)

Если велосипедисты на данной трассе попадаются 365 раз в год в среднем, то математическое ожидание штрафов за сбивание каждого из них будет $1000×365, т.е. $365000. А это гораздо больше, чем сумма, которой готов рискнуть водитель ($100 в год). Если же велосипедист попадается на трассе раз в 100 лет, то математическое ожидание штрафа будет $1000/100. Т.е. $10 в год. А это гораздо ниже, чем сколько может позволить себе водитель. Следовательно, водитель не будет более внимательно следить за наличием велосипедистов. Причем совершенно не важно, как учат в автошколе, сколько предупреждающих статических знаков стоит на трассе. Если водитель знает, что велосипедисты попадаются раз в сто лет, то он не будет их ожидать в принципе. Риск не стоит того, чтобы нервничать и переживать.

Как можно решить задачу? Люди поступают тремя способами, лишь один из которых работает.

1) Можно просто выключить мозг, наказать водителя за формальное нарушение, сказать “ну он же виноват сам”, и ничего не поменяется. Этот и все остальные водители совершенно рационально продолжат ездить как ездили и через сто лет собьют очередного велосипедиста.

2) Можно сыграть в Умного Депутата и повысить штраф на столько, что математическое ожидание штрафа даже за редкого велосипедиста окажется слишком высоким. Например, не $1000, а $100000. Тогда риск сбить одного-в-сто-лет велосипедиста составит $1000 в год, а это уже слишком много и водители станут внимательнее.

Однако, это решение плохо тем, что открывает богатую возможность рэкета. Велосипедисты могут симулировать попадание под колеса. Следователи будут решать в их пользу, чтобы получить откат от штрафа или обширную взятку от водителей чтобы не быть оштрафованными.

3) Можно посмотреть правде в глаза и понять, что на этой конкретной трассе велосипедистов никто не ожидает. И что если ты хочешь ехать по ней, то позаботься сам о своей безопасности. Поставь фонарь, мигалку, гудок, найми эскорт, выбери ясный день для катания, выбери объезд по-безопаснее или просто воздержись. Короче, сделай что-нибудь сам для своей безопасности. И сам будешь цел, и водители будут благодарны.

UPDATE: Еще один способ, который я посчитал не входящим в сферу решаемой задачи: построить велодорожку на трассе. Если велосипедисты достаточно часто ездят, чтобы оправдать расходы на строительство велодорожки (либо в связи с доходом от платы за проезд, либо от экономии на выплате страховых за сбитых велосипедистов, or both), то дорожка будет построена. А если нет, то нет. В анализе выше мы полагаем, что дорожки нет, и ее экономически нецелесообразно строить.

There is only one blockchain and it’s called Bitcoin

The purpose of the blockchain is to help those who are interested to continuously establish global consensus on an ever-growing dataset without trusting any authority and assuming presence of active attackers that may gain measurable advantage by manipulating that consensus.

Consensus is securely established because every updated version of the dataset has a sufficiently large proof of work attached to it. Contrary to a popular belief, this proof of work should not simply be marginally larger than any alternative version. Active attacker may not advertise their version equally to all nodes so you could comfortably choose the most difficult one. What we need from the proof of work is to be infeasible to redo. There should not be even a possibility for someone to build a secret facility that can redo the same amount of proof of work that was produced by all “honest” (i.e. open) participants.

Lets imagine I receive $1M on a Bitcoin address and wait 1 week for it to be buried under a 1-week worth amount of work. What we need is to make redoing this work cost more than $1M. The amount of work done in one week should really cost more than $1M. In other words, for a blockchain to be actually secure, there must be a huge gap in cost between that blockchain and the next best competitor. In addition, number 2 blockchain cannot be considered secure or valuable because it has a dramatically lower cost of attack and the very existence of number 1 shows how feasible that attack is.

Note that choosing an incompatible PoW algorithm does not change that. In a well-developed Bitcoin world where mining is done with highly-specialized hardware, mining algorithms do not matter. Both Bitcoin and your scrypt altcoin are measured in amount of bucks to be invested to rewrite their histories.

This gap between number 1 and number 2 keeps growing because of opportunity cost. Those who invest in mining have to invest 100% into the most potentially profitable blockchain. Those who speculatively invest in coins themselves have to invest in the most promising and most secure storage (i.e. blockchain), inviting more miners to make it even more secure and more speculative investors to make it more valuable.

In the end there could only be one blockchain worth talking about and so far it seems like Bitcoin is winning that title.

Talk on Multisignature Transactions at The Family (Paris, October 7, 2014)

Yesterday I’ve been talking about multisig transactions: what they are, what are use cases and how we can build an awesome super-secure Bitcoin storage solution.

Video: https://www.youtube.com/watch?v=xaFVpdJhKnM

Slides: http://oleganza.com/MultisigOctober2014.pdf

The Ultimate Wallet

After designing a Bitcoin wallet for over a year, I’ve came up with 9 core ingredients that make up a perfect Bitcoin wallet: easy to use and ultimately secure.

We understand that any additional security measure removes from simplicity. The key to smooth user experience is to spread inconvenience over several security tiers and do so in a smart way.

Overall checklist looks like this:

1) Personal pocket device (iPhone, Android).

2) Secure UI.

3) Fully-auditable wallet behaviour.

4) Password-encrypted master key private backup.

5) Self-encrypted automatic wallet backup.

6) Unencrypted 2-of-3 paper master backup.

7) Two-tier keys (system-encrypted and user-encrypted).

8) Bitcoin Wallet API.

9) Blind multisignature custody for long-term savings.

To learn more, see the PDF:

http://oleganza.com/SecureWalletSeptember2014.pdf

Bitcoin is not compatible with the State

In Italian: http://www.partito-pirata.it/2014/11/bitcoin-vs-stato/
In Russian: http://bitnovosti.com/2014/08/16/bitcoin-i-gosudarstvo/


Bitcoin and State do not go together at all. Neither logically, nor economically.

Logically, if you think that the state is a useful and viable institution and Bitcoin is a useful and viable technology, you are lying to yourself. State is a hierarchical construction of “trusted third parties” (TTPs). In theory, some social interactions may involve a conflict that may be resolved by a trusted third party (arbiter). In a nation state it is ultimately some government agency (e.g. a cop). In case there’s a conflict between a citizen and a government agency, there is another government agency to watch over it. Thus, a cop is watched by his chief, a chief is watched by a court, court is watched by a parliament or a president, and those are being overthrown by an angry mob from time to time. The theory goes that every single conflict can be justly resolved by the state if parties cannot resolve it by themselves.

Bitcoin is an attempt to remove some trusted third parties from equation. That is all sorts of financial institutions including government regulators. From the Bitcoin perspective, it is a moral hazard to enable control over money supply and monetary flows to a hierarchy of trusted third parties. History is full of examples when private banks and government agencies could manipulate and destroy entire economies by being able to produce money without limits or censor its use. Bitcoin is strange and a bit complicated way to protect all users of money. Users can transact without need for any third party to record and acknowledge their transactions, and what’s more, no one can even become a third party by hijacking the system and imposing controls and rules on its usage. The former is not possible without the latter.

So if you support the idea of Bitcoin, you acknowledge the hazard of entrusting the entire economy to trusted third parties. You acknowledge that the ultimate power must be spread thin among every single participant and never be entrusted in hands of a few, even if it’s a democratically elected government. (Trusted third parties on top of decentralized foundation are fine as long as every person has equal access to that foundation and can jump off anytime.) But if you acknowledge the hazard of TTPs, then what arguments are left for any other government activity? Government is the ultimate trusted third party to resolve disputes in the entire economy. If there’s a conflict in a monetary system and we need Bitcoin to resolve it so no banker, judge or president could have personal interest in it, then the same applies to any other conflict. Every conflict could have someone’s personal interest in it to screw things up. The fact that we rely on the government to resolve it only shows that we couldn’t find a safer way yet. By supporting Bitcoin you give up all arguments for validity of the State.

If you, however, prefer the State, then supporting Bitcoin is illogical: why do you need such a complex and hard to understand (for non-hackers) system if every problem can be solved with trusted third parties? Look, Visa processes bazillion of transaction per day by just flipping the bits in their database. Bitcoin cannot do that, it is a consensus network that needs everyone to be aware of all transactions. Making instant payments requires extra complexity on top of that existing complexity. Also, there’s constant hazard of computer viruses and backdoors that steal your coins. If you believe that problems can be efficiently solved simply by electing trusted people, than Bitcoin is a huge overhead. So you should pick one: Bitcoin or State.

But most importantly, Bitcoin and State will never survive together for economical reasons.

State exists because it can. It can pay for its expenses, pay for those who enforce the laws, write the laws, brainwash children in schools and adults in evening news.

How does the state pay for its expenses? First, the government controls money supply. If needed, money is just being “borrowed” from the government’s puppet bank under promise to repay the debt (with interest!) from the extracted taxes (or by borrowing even more from the same place). When the state wants to go to war, enormous amount of money can’t be just extracted and is being printed. Extra money flows into markets, prices go up, business plans get messed up, people’s savings get destroyed and they lose their jobs at the same time. But we are at war, so folks are better to work harder “for the children” and maybe even join the army (you lost your job, after all).

Second, the state is paid by all those good businesses that must use banking system to operate. And the banking system is all heavily licensed and cooperative with the state. A lot of monetary flows are monitored by the tax collectors. Natural greed makes people avoid taxation just like all other costs, but taxes are avoided only in black market and by small businesses working with cash. Everyone who accepts cash hides some percentage from the taxman. If not for personal greed, but at least under competitive pressure by tax evaders (e.g. your café cannot survive if you don’t increase your profit margin by not paying 10% of the taxes like all your competitors do). If you business has to work with partners over the wire, you had to use banks and pay 100% of your taxes. With Bitcoin banks are not necessary. Bitcoin allows you to trade with anyone on the entire planet with near-zero costs. More businesses would bypass Banks and as a side effect, more businesses would be able to withhold their taxes from the state. Competition would force other businesses to drive their costs down the same way. Bitcoin will become a black hole that grows and attracts more and more people in it.

From the point of view of tax collectors, however, it’s the other way around. In Bitcoin world government cannot pay cops IOUs it makes up. It must pay real bitcoins that it must extract first from the businesses. But as more and more businesses avoid paying more and more taxes, there is less money being left for the government. That means that extraction will become increasingly less effective and therefore allowing even more people to avoid taxation on even larger scale. This cycle would repeat until all government employees will run away to seek real jobs because their bosses wouldn’t be able to pay them a single penny.

So if Bitcoin continues to grow, the nation state would peacefully dissolve. If state is to be preserved, Bitcoin must be stopped and never allowed again. However, the more people invest in Bitcoin, the more interest, wealth and power is on its side to protect it against any aggression. They didn’t invest in Bitcoin to try it out. They invested to make it ubiquitous and global phenomenon and they all will fight hard to make it happen. At some point we will witness a critical mass of supporters that no one will be able to stop. And then there will be no state anymore.

Bitcoin ideas worth pursuing

Here are some ideas for services around Bitcoin that are highly interesting to me.

1. Truly secure wallet & vault. Protected from institutional risks, backdoors in software and hardware, losing backups and forgetting passwords. Works on regular computers (phones, laptops). Multisig with blind signatures for privacy. Authenticating with a circle of friends or arbitrary services instead of a single centralized institution. Only this can make people safely invest in Bitcoin and push the entire economies to it unlocking the rest of the features (low fees, autonomous agents, smart contracts etc.)

Btw, I have a working implementation of blind signatures already with a demo app: Code: https://github.com/oleganza/CoreBitcoin/blob/master/CoreBitcoin/BTCBlindSignature.h Paper: http://blog.oleganza.com/post/77474860538/blind-signatures-for-bitcoin-the-ultimate-solution-to Demo app: https://github.com/oleganza/blindsignaturedemo

2. Wallet API for web sites and native apps. A standard way for any app to request user’s wallet to allocate and sign certain amount of bitcoins to be used in a custom transaction. The unified API would allow maximum flexibility for any sorts of schemes and contracts while preserving user’s keys secure and his financial details completely private. Wallet requests approval from the user and gives the absolute minimum of information to the app. Wallet will also sign its inputs only if all the change outputs are respected. Use case: your app does some fancy scripts and needs user’s coins. Today you have to make your own wallet in which the user must send coins (and you have to reinvent all security measures as described above). Tomorrow you could simply request what you need from an existing wallet without having user to do extra movements.

I helped to develop a draft of the spec: http://bitcoin-wallet-api.github.io

3. Decentralized clearing mesh network for frequent and instant payments. Similar to Ripple, but without made-up currency and without any trust. Nodes form point-to-point contracts using bilateral 2-of-2 deposits that put a limit on IOUs issued between two nodes. Thus nodes can connect anonymously without any trust. When two people pay each other, they simply find the cheapest path (every node may ask for any fee) between them and propagate an IOU denominated in BTC. There’s no global consensus and no single point of failure. If you owe 50% of the amount deposited, you have to clear the debt with real BTC transaction. Any amount of money can be moved back and forth and all IOUs are 200% insured. This mesh could be used to buy a latte or for one automated service to pay another automated service.

4. Decentralized markets. People can use the same bilateral insurance scheme to create a “nash equilibrium” escrow without any 3rd party. This makes free trade possible without risk of fraud or censorship. My friends in San Francisco already have a working prototype that uses Bitmessage to post products and bids. And it works great!

When released, the app will be published here: http://voluntary.net/

5. Crowdfunding protocol and apps where majority vote controls the funds. Bitcoin already allows some neat schemes to crowdfund money directly by the founders, but these schemes do not allow for X% (typically 50%) vote to unlock, or otherwise control funds. If that was possible, then founders could still have a comfortable guarantee of funds for their enterprise, but wouldn’t be able to waste them all at once. If their business plan is no longer aligned with the interest of majority of stakeholders, they could take the remaining money back or redirect to entirely different managers. This is a very big thing! If done in absolutely p2p manner, it will enable fantastic possibilities for mankind. For instance, non-targeted crowdfunding will become possible: “someone please repair our road and we’ll pay you $5000”. The funds can be directed to the guys who solved the problem by a majority vote of the backers (unless all backers turn out to be total jerks, of course).

The problem with modern corporations is that they are de-jure owned by stakeholders, but the real power to make decisions is on managers who are hired to manage the capital. In other words, it is really hard for thousands of small stakeholders to coordinate and affect decisions of the top management. More strict crowdfunding protocol with direct democracy built in would allow all stakeholders, small and large, to better control the flow of funds.