0. Here I’ll tag people to whom I wish to explain my reasoning why IMO PoS > PoW: @BtcLiberty, @pd_myers, @jronkain.

Feel free to tag anyone else you think might find this conversation interesting.
1. This is a subject I’ve been thinking about for years now – whether Bitcoin’s Proof of Work system is the optimal solution for the problem of how to secure an immutable ledger, or can Proof of Stake or some other system produce a better outcome.
2. I’ve come to the conclusion that Bitcoin with its basis on PoW is the best solution _I can think of_ for a “digital gold standard” that could be useful for big actors like nation states, but not much else. This may change if I’m given convincing arguments.
3. I think 80+% of all value that’ll be within the cryptocurrency / blockchain space will not come from BTC becoming The One Coin to Rule Them All, but instead from a diverse ecosystem of blockchains suited for different applications & with unique market niches.
4. So why do I think Bitcoin can be seen as digital gold?
5. The BTC blockchain uses Proof of Work where people spend electricity to solve SHA256 puzzles in a competitive environment that balances so that a set amount of coins are created approximately every 10 minutes & the rewards halves every 4 years. This has quite a few outcomes:
6. Digital scarcity. BTC can’t be double-spent. Anything that is scarce & in demand has value. The markets are currently in the process of setting that value for Bitcoin. This makes BTC a Store of Value, like gold.

See https://en.wikipedia.org/wiki/Double-spending
7. BTC’s immutable ledger can be used as an authority on what transactions happened & in what order. In addition to that, arbitrary data can be checkpointed against the blockchain if a hash of it has been saved in some previous transaction. This is useful beyond gold!
8. Bitcoin is divisible into 100,000,000 sub-units, and being borderless & native to the internet make it a superior to gold as a Method of Exchange. Not just digital gold, but gold 2.0. The way PoW works though, transactional capacity stays constant even as user count increases.
9. This is why layer 2 solutions like Lightning Network, transaction bundling etc. are necessary. The network getting congested and transaction fees rising are a _necessity_ for the whole model to remain sustainable as block rewards diminish in value.
10. If the blockchain really is valuable, real estate on it can’t be free. The more valuable & used BTC becomes, the more expensive L1 transactions become. This isn’t something that can be solved by code; it rises from the fact that it costs real resources to secure the network.
11. It’s an emergent property of PoW. The need to use real world resources (electricity) to mine a digital currency is like an umbilical cord attaching it to the physical realm. PoS doesn’t have it… but there are both upsides and downsides to the unforgeable costliness of PoW...
12. In PoW, miners will keep mining as long as their equipment can be expected to produce enough blocks to cover the cost of electricity & equipment during the lifetime of that equipment. This leads to the mining business centralizing more around big actors as time goes on.
13. There are only a few fab labs in the world that can produce circuitry w/ 7nm features & smaller. Economies of scale has lead to them dominating the industry. These fabs will likely overtake the entirety of SHA256 ASIC markets.

See https://en.wikipedia.org/wiki/7_nm_process
14. BTC embraced ASICs. There are options like https://www.monerooutreach.org/stories/RandomX.html that aims to make the home PC stay relevant in the mining competition, but this is a little out of scope for this thread. Let’s just say ASICs lead to mining centralization.
15. ASIC manufacturers are incentivized to use their newest hardware to mine BTC for themselves instead of selling them on the open markets. To participate you need access to competitive hardware & competitive electricity prices. There’s a barrier for entry for smaller actors.
16. ASICs, being only good for one thing and becoming obsolete as they get unprofitable, are an environmental disaster, until some half-decent way of recycling the materials in their components becomes widely used. But gold mining is also environmentally bad so there’s that.
17. There’s no upper boundary on how much electricity miners can be incentivized to use – it’s only correlated with the price of Bitcoin. In 2017 when BTC was approaching the $20k mark, Bitcoin mining was responsible for something like 0.3% of global electricity use.
18. If we assume this ratio between price of Bitcoin and electricity used is somewhat constant, and BTC rises to $200,000 per coin, 3% of worlds electricity would be used on mining it. With $1m, 15%. That would be an absolutely ridiculous waste of resources.
19. People make the argument that it’s mostly renewable energy. But electricity is the ultimate be-all asset. It can be used in producing all other assets we use and need. Food. Transportation. Housing. In a way, there’s never an excess of it. Tying all money to it is a bad idea.
20. Increased demand in energy without the accompanying increase in production capacity eventually makes absolutely everything become more expensive. If 15% of the global energy production was used in running BTC, the rest of our economic activity would only have 85% left for it.
21. The reason gold was an excellent form of money for many centuries, was the fact that it was scarce, easy to melt and shape, and _not very useful_.

Pretty, yes. Useful, no. Electricity is the opposite in that energy is like infinite potential, which make it infinitely useful.
22. Even now, gold markets are affecting how much our electronics cost, for example, because it’s somewhat useful in electronics. IMO the best general form of money should be based purely on people believing it’s valuable, rather than it directly having any real world use.
23. In fact, Fiat money was an incredible invention. It made all economic activity rise to another level when compared to barter or forms of money that are based on physical resources. The problem with Fiat isn’t that it’s “made out of nothing”... it’s that central banks make it.
24. A select few decide how much inflation we have. It leads to Cantillon effect & ever furthering chasm between the rich & the poor. Being close to the printer when it goes BRRR is all one needs to profit while being far from it makes one’s purchasing power diminish each year.
25. Bitcoin solves the problem of who gets to make the money & control its flow by removing the middlemen (central banks). They aren’t completely gone but replaced with mining cartels instead. But inflation with BTC is predictable & scheduled. Like physical gold, it’s hard money.
26. But it takes a huge step backwards in tying itself to a real world asset that is the most useful of them all, when more than a century of paper money proves beyond any doubt that money doesn’t need to be based on anything else than people’s belief in said money having value.
27. As the BTC data structure is a chain of transactions that can always be traced back into the genesis block, the chain is bound to grow forever. To maintain decentralization, block size is limited. 1MB may be too small, but certainly gigabyte blocks are too big.
28. Big blocks make running a full node the special right of those who can afford the disk space. That’s why I think BCH and BSV as are trade-offs between decentralization and transactional capacity. Keeping the network in sync also gets harder as block size increases.
29. The space requirements of PoW and PoS blockchains are identical. The electricity spent on producing new coins and securing the immutable distributed ledger is vastly different though. If a PoS algo produces identical security & immutability as PoW, it’s a superior solution.
30. PoW’s unforgeable costliness (the need to spend electricity to produce new Bitcoins) makes it somewhat useful to nation states, because a competing nation state can’t just print money to produce coins. They can, however, print money to buy coins.
31. The market dynamics are such that if you print money to buy BTC, someone sells those coins to you & gets the newly printed Fiat. That Fiat ends up trickling through the global economy & results in inflation of your currency. Also Bitcoin price rises with increased demand.
32. So printing Fiat is not really an option for nation states to compete against each other to acquire Bitcoins. This is also true for PoS coins, but their price information is only relying on market places, so they need to not be co-opted by a competing nation state…
33. ...whereas BTC’s production cost is tied to a physical resource so the price on the markets cannot simply disconnect itself from the money & energy spent to make the coins. That said, the threat of all global markets being co-opted by some nation state is theoretical at best.
34. We do have Forex & global stock exchanges after all, where all prices are simply dictated by market dynamics and it seems to work. Now that central banks are directly buying individual stocks, the system might very well collapse into chaos.
35. So maybe using 3% of global electricity production to mine Bitcoin can be somewhat justified? I’m not sure. Certainly some amount of electricity can and should be used to secure the value & possibilities that are produced by having a network like Bitcoin.

15%, certainly not.
36. For now, I see BTC as THE digital gold and see it becoming useful for nation states and maybe multinational corporations, but eventually centralizing further & L1 becoming out of reach of the common folks. I think BTC has some further upside potential but not infinitely much.
36. I’ve been talking about BTC specifically, but PoS as a general term for many different kinds of Proof of Stake networks. But many PoS protocols have tradeoffs when compared to Bitcoin’s model.

I’m invested in Cardano, however, because I think they’ve solved PoS.
37. Writing this stuff took me many hours so I’ll stop for today and continue sometime later when I have the time. Next step is to explain _why_ I think Cardano is a superior solution to become the global financial operating system.

It’ll take a few days at least.
38. Let’s continue this thread. Commenting on previous tweets in the thread, @jronkain asked me to address how Cardano solves the problems of “Nothing at Stake”, “Long Range” attacks on PoS protocols, and “weak subjectivity”.
39b. I’ll tag some more people into our discussion, mainly people who understand the Ouroboros family of PoS protocols much better than I do, so they can may chime in & correct me if I’m wrong: @SebastienGllmt, @vsubhuman, @IOHK_Charles, and IOHK Chief scientist @sol3gga.
39c. Previous contributors @pd_myers, @cyberat2600, @wintermuteXBT et al hopefully also have time to do some more discussion & bouncing of ideas back and forth once again. I really enjoyed our previous exchange of ideas earlier in this thread!
40. So what is a Nothing at Stake attack? In PoW there is a real cost (electricity + equipment) for Proof of Work puzzles. Nodes validating the chain know how much hash power was spent to produce a chain. With competing chains, they just pick the one with most accumulated work.
41. The Nothing at Stake Attack is based on the assumption that, if someone wants to maximize profits as a PoS validator, he can just vote on all chains being valid. There’s “nothing at stake” for them. Many PoS protocols have tackled this problem already.
42. There are essentially three paths one can walk to defend a PoS protocol from this kind of attack. The difference between them comes down to stick vs carrot, or a combination of the two.
43. The stick is slashing. In slashing PoS protocols, stakers have locked up their stake to vote for what blocks are valid & what are malicious. If they are caught cheating, their stake is slashed. There are many problems w/ slashing so Cardano uses the carrot. I’ll explain how.
44. In part 2 of the Medium articles I mentioned in tweet number 39, some solutions to the Nothing at Stake attack are introduced but the writer of the articles doesn’t seem to be familiar with the family of consensus protocols used in Cardano (Ouroboros).
45. I believe there’s a general lack of knowledge about https://iohk.io/en/research/library/ within the cryptocurrency space. I think this is due to their research being “the real deal” instead of hype & simplified white papers. I do think IOHK research has in fact solved PoS problems.
46. Ouroboros was designed in a rigorous way. The team behind it started by looking deeply into the Bitcoin protocol, defining what properties arise from its implementation of PoW, and then designed a line of PoS protocol that would result in same or better security properties.
47. If you are a CS major, see their 2015 research https://eprint.iacr.org/2014/765.pdf , and their later paper further formalizing how the Bitcoin backbone works taking into account the difficulty adjustment algorithm: https://eprint.iacr.org/2014/765.pdf 
48. The proofs in IOHK’s papers go way over my head. But I’m only able to follow general reasoning expressed in words instead of equations. These two studies being peer reviewed and widely cited though, I am willing to take it as a fact that their proofs are in fact correct.
49. Full disclosure: I’m a dropout, but I’ve read 100s of research papers on many different subjects incl. Computer Science, Comparative Religion, Psychology etc. I’ll do my best to describe how the Ouroboros family of protocols approach PoS.
50. Sidenote: the name itself is cool & descriptive. Ouroboros is the snake that is eating its own tail. It symbolizes the cycle of reincarnation of souls ( https://en.wikipedia.org/wiki/Metempsychosis). Somewhat similar to the concept of Saṃsāra.
51. Ouroboros (Classic) consensus protocol solves how a “slot leader” (analogous to a miner solving the PoW puzzle for the right to make a block) is selected by using data in the blockchain as a source of randomness. This is where the snake is eating its own tail.
53. In Ouroboros, a slot is assigned to the holder of a certain coin beforehand (“follow-the-Satoshi”). This is possible in Cardano but not in ETH 2.0 due to Cardano using the UtxO data structure with discrete coins instead of Ethereum-style accounts of balances.
53b. (I’m pretty sure the ETH 2.0 could be spun up rather trivially by them adopting Ouroboros as a consensus mechanism, if only they had a UtxO data model underlining their blockchain! It might be too bitter a pill to swallow for the ETH devs though to ditch all their research.)
54. The Ouroboros Classic version of the consensus protocol is no longer in use.
55. In the current implementation running behind the Cardano network, called Ouroboros Praos ( https://eprint.iacr.org/2017/573.pdf ), each stakeholder knows which slots they lead ahead of time but others do not. A slot can have multiple or no slot leaders.
56. On each slot, the nodes ask a question: “Am I the slot leader?”. If yes, they get to make a block & attach to it a proof that they were indeed entitled to make a block for that slot, and then broadcast it.
57. How about doublespends & long range attacks? In BTC you always pick the fork in the chain that has the most accumulated PoW. Theoretically, without PoW you could make competing chains in secret, then publish them to change history, but it will not work in Ouroboros Praos.
58. The nodes always select the chain with the most blocks, thus that chain also has the most slot leaders signing a block. If a bad actor signs a block that has a transaction that spends coins that an honest node has seen spent before, the honest node rejects that block.
59. As long as 50+% of nodes are always honest, more nodes will reject the bad block than accept it. The bad fork gets orphaned and is not built upon.
60. In Ouroboros Praos, blocks freeze once they are far enough in the past. Honest nodes do not accept different history from theirs further than 2 epocs ago. There is sort of a “rolling checkpoint” in the protocol. This results in a problem though: can’t bootstrap from Genesis.
62. Ouroboros Genesis gets rid of the checkpointing and introduces a new chain selection rule alongside the longest chain rule, called the “plenitude rule”.
63. In short range comparisons of rival chains, nodes follow longest chain, but in long range comparisons, nodes use the plenitude rule to pick the right chain. I found a clearly worded explanation of this rule here https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=8653269:
64. (Which I’ll prune like fuck thanks to the 280 character limit to fit into the next 10 tweets:)
65. "A [...] countermeasure for Long-Range attacks is the Plenitude Rule which was first presented [...] as part of the PoS-based protocol Ouroboros Genesis [44]. This chain selection rule is based on detecting the sparsity and density of blocks in conflicting branches.”...
66. ..."[...] an adversary cannot manipulate her stake in the main chain. [She] with a starting stake of 20% will have the same stake on all branches of the blockchain, assuming that all branches derive from the same starting block [...]."…
67. ...”In Long-Range attacks, the adversary starts with a small chance to produce blocks and as block rewards are gained, and stake is accumulated more and more stake will add up for the adversary. The more stake a validator has, the more chances she gets to produce blocks.”…
68. ...”Before the [bad guys] accumulate enough stake to accelerate their block generation rate, [...] the honest ones, [...] will be elected for generating 80% of blocks. Based on the latter, [...] one branch will produce only a portion of the blocks the other branch does.”…
69. ...”This is because at a given slot one branch has at least 80% of generating a block while the other has at most 20%.”…
70. ...”[...] we can observe how stake accumulation could work. [The malicious branch], in the first two segments, has [...] sparser block generation [compared to] the third one. On the other branch [we see] a smoother distribution in block generation throughout all segments.”…
71. ...”Having empty blocks does not necessarily mean that a validator is blocking the chain on purpose [...]. Sometimes, slots can be empty as no transactions were performed during a specific period. On the third segment, the upper chain has accumulated enough stake and
72. ...”generation starts becoming denser. [Now] the adversary’s stake will keep increasing in their own minted branch, [whereas] the stake of the honest validators which will gradually decrease. As a result, blocks will be presented more often in the alternate branch and”…
73. ...”eventually overtake the main-chain. [...] The plenitude rule tries to determine the block density of a branch from its very formation, and use it as a measure to
detect substantial changes to the block density.”…
74. ...”If we assume that [bad guys are always] the minority the main branch will always be denser than [rival] branches. This rule enables us to identify whether an attack is taking place in a blockchain fork and identify the honest branch, defeating [...] weak subjectivity.
75. This addresses Nothing at Stake / weak subjectivity.
76. Cardano is moving from a federated chain into a totally decentralized one incrementally. Right now there is a collection of trusted nodes running Ouroboros BFT, and stake pools running Ouroboros Praos. Praos could run indefinitely, but the plan is to go to Ouroboros Hydra.
77. There is a parameter d in the protocol, that moves incrementally towards 0 each epoc. This parameter correlates with how big a part of the network is run by the trusted node. Once it reaches 0, the network becomes entirely decentralized.
78. Currently, 32% of the blocks are produced by stake pools. The protocol functionality was tested on an incentivized testnet already, where block producers were given real Ada as rewards for running the nodes.
79. Research, then testnet(s), then smooth, responsible integration into the mainnet, then gathering results and feedback for further research is the cycle they are following, and I think they have nailed best practices on how a blockchain protocol should be built. Best in class.
80. Cardano plans to implement smart contract functionality (Goguen) before the network becomes entirely decentralized. A new implementation of Ouroboros, and a voting / governance layer (Voltaire) is also on the horizon. These are all developed in parallel.
81. I think 99% of the cryptocurrency scene has no idea of what kind of a Juggernaut is being built right under their noses. This is IMO due to the theory behind Cardano being pretty hard to grasp, so the motivation to write this tweetstorm is to make it more accessible.
82. I myself have been looking into it since 2017 & I’m learning more about the workings of the protocol every day. Discussions on PoW vs PoS with folks on Twitter has been an interesting topic, but I’ve only ever discussed on snippets of the Big Picture.
83. I am making this thread as long as it needs to be to also be able to express the thoughts and ideas I’ve had on this matter for the past 4 years.
84. Wow! Writing tweets 38-83 took HOURS so I’ll take some time off again & continue this megathread later! We have barely begun talking about the ways a PoS chain can be superior to a PoW chain, just how Ouroboros can be equally secure. Looking forward to comments on this chunk.
85. BTW I see I forgot to add some people who took part in the first part of this conversation (tweets 0 to 37).

So @dlancashi and @BtcLiberty, I managed to find the time to scribble 35 more tweets on my "why I think PoS > PoW" monster thread. :D
86. In addition to already posted links, here's some good info on the Cardano project I've come across during the past nearly 4 years.

In 2017, the essay at https://why.cardano.org/  made me grasp the big picture vision behind the Cardano project. I very much recommend reading it.
87. For the audiovisual learners like me, Charles' YouTube AMAs have been a valuable resource, countless hours of material. AFAIK no other cryptocurrency company CEO gives this level of info on development. Needless to say I've watched all his videos: https://www.youtube.com/c/charleshoskinsoncrypto/videos
91. Inception time! As I stated earlier, disk space requirements for both PoW & PoS are identical. Let’s dive deeper into this statement and what logical conclusions can be drawn from it: https://twitter.com/joni_koskimaa/status/1306916935158960134?s=20
92. So increasing block size makes running nodes harder. Nodes matter for security (unlike BSV folks, who think only miners matter, claim). The deepest layer of security in the system is in the “meatspace”. Layer 0 is made of people who decide what code to run.
93. The harder / more expensive running nodes is, the more they centralize.

The more centralized they become, the more prone they are to be co-opted by some adversary. They also become more vulnerable to some catastrophic central point of failure.

Decentralization = resilience.
94. Relying on ASIC mining centralizes the mining business around (A) chip manufacturing capabilities and (B) access to cheap electricity, so vigilant people running full nodes are _extra_ important to keep the system at check. That’s one reason to keep BTC blocksize small.
95. Real costs for a PoW network like BTC = disk space + networking incl. server infra + ASICS + electricity spent on nodes and PoW.

Real costs to run a PoS coin like Cardano: disk space + networking incl. server infra + electricity spent on nodes.
96. TANSTAAFL. Costs eventually translate into costs for the users (as tx fees etc.), or then someone else pays the bill later (inflation), but someone always eventually pays.

We can already see from previous description that PoS is cheaper. Later I’ll dive deeper into the math.
97. Let’s start by looking into the extra costs for PoW. The electricity spent on mining correlates with the price of BTC. The higher the price, the more security it can afford via inflation. As inflation shrinks, that cost translates into tx fees or losing hash power (security).
98. Without PoW, more of the value captured within the system can be spent for (A) disk space, (B) networking, and/or (C) nodes. A PoS system can afford bigger blocks, for example. However, there’s a sweet spot for it because there’s interaction between these variables:
99. Space requirements for the chain grow → less nodes. Big blocks require beefy networking to keep in sync → network becomes geographically sparser.

All the value saved by ditching PoW needs to be spread between A, B and C strategically.
100. Let function Cost() return real resource cost.

Cost(A) = chain size * node count. On-chain data cost correlates w/ node count.

Cost(C) = node cost * node count. Computation isn’t free.

B is more complicated:

Cost(B) = Cost(C) * cost of bandwidth. Moving data isn’t free.
101. The chaotic interaction between A, B and C defines what running a blockchain costs.

All three parameters can be optimized to achieve higher TPS, cheaper txs etc...

...but _they can’t be static_ on a system with dynamic node count due to a sort of a https://en.wikipedia.org/wiki/Three-body_problem.
102. To optimize the system we must use the Layer 0 of human brains & market forces. Setup the system with certain trade-offs & parameters, then update according to feedback from the system “in the wild”.

This means a governance system is a prerequisite for a sustainable system.
102b. I'm starting to think a tweetstorm wasn't the easiest platform to express this whole idea... but I like the fact that the thread can fork into sub-discussions from each tweet.

If only Twitter had a tree-like UI to follow them more easily. Oh well... I need to take a break.
102c. @pd_myers, @cyberat2600, @dlancashi, @jronkain, @wintermuteXBT I managed to scribble down some more thoughts on PoS vs. PoW: https://twitter.com/joni_koskimaa/status/1308323135603826688?s=20
103. Due to the economics of PoW, the more expensive the coin, the bigger the portion of total work securing the network is “wasted”; the chance of winning the block lottery / kW spent decreases as price increases. https://twitter.com/joni_koskimaa/status/1306916946475180037
104. For the security to not drop, transactions will need to become more expensive to make up for diminishing inflation. Miners cover their costs by selling coins, resulting in a downward pressure on price. This has a weird consequence: price can’t rise indefinitely.
105. As the system gets more expensive to run as a whole, either the downward pressure on price increases, or the hashrate securing the network starts to fall.

There is an equilibrium somewhere where price stabilizes. The people calling for $10,000,000 BTC don’t understand this.
106. As PoS security is relational to the market cap of the coin instead of real world resources spent on securing the network (electricity + equipment on PoW), it doesn’t have this dynamic.
107. Tx fees, for example, reflect the costs of the infrastructure relaying & storing them.

Capturing more value makes a PoW network more expensive to use, while it has no relation to the price of using a PoS network.

This leads to PoS being able to capture more value than PoW.
108. This is one reason why I stated earlier: https://twitter.com/joni_koskimaa/status/1306915966165700610
109. As every piece of functionality in a blockchain makes the transactions bigger, BTC needs as simple transactions as possible to make them as cheap as possible, for whatever price the coin is at. Whatever they do, the higher the price (or hash), the more expensive the tx fees.
110. For a rich ecosystem of blockchains with different market niches, expressive smart contracts are a must.

PoS systems with their security being untangled from electricity usage, can get away with richer transactions: https://twitter.com/joni_koskimaa/status/1308330249625665542
111. This all leads to PoS systems being better suited for rich applications.

And this is ultimately why PoS > PoW. This is why 80+% of the value captured / created by cryptocurrencies will not come from Bitcoin.

PoS systems, not BTC, will decentralize stocks, real estate etc..
112. This doesn’t mean Bitcoin can’t be gold 2.0, or goes to 0. Gold only captures a fraction of all value on traditional markets anyway.

Even if Bitcoin’s tech _never evolved_, it would have a place as the first working decentralized currency – an antique collectible of sorts.
113. Phew! If you, dear reader, have gotten this far I congratulate you.

This thread may continue, but I feel like I've expressed most insights I've had about PoS & PoW.

So PoS > PoW. If you still don't get why, maybe go back to 1 & loop through it again until you do. ;)
Thanks for the signal boost, @InputOutputHK, never had this many retweets and likes! :D

As this thread kind of exploded, and I don't have a Soundcloud or anything... but wait a minute, I actually do! https://soundcloud.app.goo.gl/t1Xr 
You can follow @joni_koskimaa.
Tip: mention @twtextapp on a Twitter thread with the keyword “unroll” to get a link to it.

Latest Threads Unrolled: