WEBVTT - Automatic transcript; recognition may contain errors. Reviewed for technical wording and speaker labels. Times match the published episode. 00:00:17.870 --> 00:00:20.030 Live from Utrecht, this is Bitcoin, 00:00:20.030 --> 00:00:21.370 Explained. 00:00:22.230 --> 00:00:25.910 Sjors, are you ready for book shill episode 2 out of 2? 00:00:26.290 --> 00:00:26.770 Absolutely. 00:00:27.470 --> 00:00:32.370 So today we're going to discuss two more electronic cash proposals that predated 00:00:32.370 --> 00:00:36.990 Bitcoin that I've also written about in my brilliant... No, I'm not. 00:00:37.190 --> 00:00:40.890 So should we call these things shitcoins or is that not fair because they are 00:00:40.890 --> 00:00:41.490 pre-Bitcoin? 00:00:43.240 --> 00:00:46.000 Well, no, they're definitely not shitcoins then, right? 00:00:46.570 --> 00:00:47.070 Right. 00:00:47.370 --> 00:00:50.130 I don't think that wouldn't qualify as shitcoin. 00:00:50.390 --> 00:00:51.790 We'll have to ask Giacomo. 00:00:52.770 --> 00:00:57.050 Yes, good idea. So we're going to discuss b-money and RPOW. But first, 00:00:58.490 --> 00:01:04.290 dear listener, do you always lose your coins? Have you tried everything? 00:01:04.470 --> 00:01:07.370 Have you tried passwords, firewalls? 00:01:07.530 --> 00:01:08.190 Brain wallets. 00:01:08.470 --> 00:01:13.470 Have you tried hiding your computer under your mattress? Nothing works well. 00:01:14.390 --> 00:01:19.830 there's a solution for you. It's called the COLDCARD, produced by Coinkite, which 00:01:19.830 --> 00:01:24.430 happens to be our sponsor, a hardware wallet, completely offline, 00:01:25.020 --> 00:01:29.140 where you can store your Bitcoin. Sjors, what's great about the COLDCARD? 00:01:29.320 --> 00:01:29.780 PSBT. 00:01:30.240 --> 00:01:30.800 There you go. 00:01:31.400 --> 00:01:33.520 All righty. Thank you, COLDCARD, for sponsoring the show. 00:01:35.490 --> 00:01:35.730 Indeed. 00:01:37.010 --> 00:01:37.470 So. 00:01:37.770 --> 00:01:38.150 b-money. 00:01:38.600 --> 00:01:43.400 b-money yes, um, so a little bit of I'll start with a little bit of context right 00:01:43.400 --> 00:01:49.020 so in the previous episode we discussed uh what was it Hashcash 00:01:49.020 --> 00:01:53.280 and bit gold right? And then in another episode I don't remember the episode 00:01:53.280 --> 00:01:59.080 number we did e-cash as well because these are sort of the five main 00:01:59.080 --> 00:02:04.200 digital cash projects that I detail in my book there's a couple more that are 00:02:04.200 --> 00:02:07.900 sort of mentioned in passing, but the main sort of ones that are highlighted are 00:02:07.900 --> 00:02:13.620 eCash Hashcash bit gold and b-money and RPOW. So today we're going to 00:02:13.620 --> 00:02:18.460 discuss— we're going to do sort of a deep dive, deep dive into b-money and RPOW. 00:02:18.460 --> 00:02:20.040 Sounds good. What's the name of the book? 00:02:20.040 --> 00:02:25.900 It's called the Genesis Book: The story of the people and projects that inspired 00:02:25.900 --> 00:02:31.580 Bitcoin. Nice. By Aaron van Wirdum. He just bought it. It's right here on his table. 00:02:31.780 --> 00:02:32.960 Exactly. He's going to need to sign it. 00:02:33.180 --> 00:02:36.360 So one more sale for this guy. 00:02:38.870 --> 00:02:43.330 Yes, I'm going to give you some little bit of context on b-money. If you want to 00:02:43.330 --> 00:02:45.130 know more context on b-money. 00:02:45.290 --> 00:02:46.290 Yeah, tell me about b-money. 00:02:46.510 --> 00:02:47.470 You can read it. 00:02:47.610 --> 00:02:48.330 Was it code? 00:02:48.750 --> 00:02:54.290 Okay, let's start here. So b-money was a proposal. It was proposed by 00:02:54.290 --> 00:02:59.250 Wei Dai shortly after bit gold. So bit gold, we discussed in the previous 00:02:59.250 --> 00:03:04.550 episode, proposal by Nick Szabo. If you haven't listened to that episode, this 00:03:04.550 --> 00:03:08.090 would be a good time to maybe pause this episode and go back one. one episode, 00:03:08.630 --> 00:03:14.610 listen to how b-gold, sorry, bit gold works. b-money was, it was sort 00:03:14.610 --> 00:03:20.240 of, so Nick Szabo and Wei Dai and a couple of other people, they had this 00:03:20.240 --> 00:03:24.480 separate mailing list where they were discussing digital cash ideas as well. So 00:03:24.480 --> 00:03:28.020 there was the Cypherpunks mailing list and then it was also the libtech mailing 00:03:28.020 --> 00:03:31.310 list. And so it's pretty... 00:03:33.700 --> 00:03:37.720 Basically, they were discussing these ideas with each other. So bit gold and 00:03:37.720 --> 00:03:42.940 b-money are fairly similar because of that. They were sort of just discussing how 00:03:42.940 --> 00:03:47.920 to realize this, so they were coming up with similar designs, essentially. Now, 00:03:48.060 --> 00:03:52.900 we're not going to repeat how bit gold worked, but b-money... 00:03:53.510 --> 00:03:58.270 Okay, so here we reach that point again. Who's going to take the lead on... 00:03:58.270 --> 00:03:59.610 You're going to explain this one. 00:03:59.650 --> 00:04:02.890 I'm going to take the lead on this one. Well, what I will say, 00:04:04.100 --> 00:04:08.620 one thing about b-money, yeah, you just asked, was there code, I think? 00:04:08.740 --> 00:04:08.980 Yes. 00:04:09.080 --> 00:04:13.880 So the answer is no. So b-money was actually never implemented. It is mentioned 00:04:13.880 --> 00:04:17.760 in the Bitcoin white paper, by the way, but it was never actually implemented, 00:04:17.760 --> 00:04:20.440 like bit gold, which was also never actually implemented. 00:04:20.760 --> 00:04:21.060 Yeah. 00:04:21.360 --> 00:04:26.400 And I would say b-money, even more than bit gold, there's definitely some... 00:04:26.700 --> 00:04:32.780 There's significant hand-waving going on with several parts of the design. 00:04:32.940 --> 00:04:37.200 Right, so we don't exactly know how it works because it wasn't described in a lot 00:04:37.200 --> 00:04:39.220 of detail and there were a lot of unsolved problems. 00:04:39.640 --> 00:04:45.400 Yeah, it was a rough sketch of a digital 00:04:45.400 --> 00:04:51.080 cash system. It was an idea, it was almost sort of brainstorming, but 00:04:51.080 --> 00:04:56.720 it was getting there, but a lot of problems sort of unsolved. 00:04:57.180 --> 00:04:58.740 So to 00:05:01.370 --> 00:05:07.290 sort of get to the essence of how it works, it is good to have listened 00:05:07.290 --> 00:05:11.690 to the bit gold episode because it's similar in several ways, as I mentioned. But 00:05:11.690 --> 00:05:17.490 the way it works essentially is the coin creation would probably have been 00:05:17.490 --> 00:05:21.310 similar. That's a safe assumption, even though that's not really fleshed out in 00:05:21.310 --> 00:05:24.450 the proposal either. But that seems sort of... 00:05:24.960 --> 00:05:29.060 I thought you mentioned there were two kinds of coin creation mechanisms. 00:05:30.060 --> 00:05:35.960 uh well what I'm referring to is mostly the the the actual proof 00:05:36.080 --> 00:05:40.270 of work like the proof of work system would have probably been similar. 00:05:40.270 --> 00:05:43.110 It's just they're just hashing something. Yeah, yeah. 00:05:43.110 --> 00:05:46.370 And it would have probably started with a candidate string in the same way that 00:05:46.370 --> 00:05:51.840 bit gold did and then you hash on that candidate string. Okay, so b-money 00:05:51.840 --> 00:05:57.790 it… It's not even really one proposal. It's sort of several proposals wrapped 00:05:57.790 --> 00:06:02.730 into one. It's like an idea and there's several ways to do it. Now, what I think 00:06:02.730 --> 00:06:08.210 was the most interesting thing about b-money is 00:06:08.210 --> 00:06:13.370 how double spending is prevented. Or at least one of the ways. 00:06:13.710 --> 00:06:18.710 This is getting tricky to explain this because of all the possibilities if you 00:06:18.710 --> 00:06:20.570 fork the different design options. 00:06:23.690 --> 00:06:28.670 So if you want to send coins from one public key to another, similar like 00:06:28.670 --> 00:06:33.930 bit gold or Bitcoin, I guess, if you want to send coins. Now, the problem, of 00:06:33.930 --> 00:06:37.830 course, is how do you prevent double spending? How do you prevent that one coin 00:06:37.830 --> 00:06:41.790 is sent to multiple people at once and there's a discrepancy there? 00:06:43.960 --> 00:06:49.720 Wei Dai's proposal essentially was everyone's going to keep track of the state of 00:06:49.720 --> 00:06:53.630 the ledger. So again, you know, everyone who's been listening to Bitcoin 00:06:53.630 --> 00:06:56.510 Explained for a while knows that this is essentially how Bitcoin works. 00:06:56.690 --> 00:06:57.090 Exactly. 00:06:57.330 --> 00:07:02.110 Everyone's keeping track of who owns what. So this was an idea that b-money 00:07:02.110 --> 00:07:06.850 introduced, that Wei Dai introduced, which is very relevant to Bitcoin. Now, 00:07:06.970 --> 00:07:12.750 unfortunately, Wei Dai also concluded pretty quickly that this 00:07:12.750 --> 00:07:17.590 doesn't actually prevent double spending, of course, because you can still do the 00:07:17.590 --> 00:07:19.910 double spend and then people will just have... 00:07:21.710 --> 00:07:24.990 Yeah, they'll have different versions of history. They don't know which is the 00:07:24.990 --> 00:07:29.390 real one, especially if they got it after the fact, I guess. Because if you're 00:07:29.390 --> 00:07:33.510 following it live, you can at least say, well, you know, whichever comes first. 00:07:33.810 --> 00:07:36.830 But even that can split it up if it happens at the same time. But at least if 00:07:36.830 --> 00:07:39.730 there's like two weeks between it, you could say, well, clearly this one was 00:07:39.730 --> 00:07:44.370 first and this one was second. But if you're coming online a year later, you have 00:07:44.370 --> 00:07:45.490 no idea, right? 00:07:45.790 --> 00:07:51.620 Yeah, pretty much. So the only way it could work, Wei Dai mentioned it in this 00:07:51.620 --> 00:07:57.600 proposal, if you have an unjammable, you know, instant communication network or 00:07:57.600 --> 00:07:58.780 something like that, which... 00:07:58.780 --> 00:07:59.020 Magic. 00:07:59.360 --> 00:08:03.670 Yeah, essentially. So that is... 00:08:03.670 --> 00:08:07.630 Yeah, but I guess, yeah, if everybody knows about it at the exact same time and 00:08:07.630 --> 00:08:11.990 with no delay, then you can, everybody can see who's first. But it does require 00:08:11.990 --> 00:08:15.730 everybody not just to store all the transactions, but to be online all the time. 00:08:16.420 --> 00:08:20.760 Right. So I would qualify this, and the way I sort of describe this in my book is 00:08:20.760 --> 00:08:25.640 I think it was, you can sort of see it as a breakthrough in thinking, like it was 00:08:25.640 --> 00:08:30.500 a novel approach to do it this way. However, it wasn't actually possible. 00:08:31.280 --> 00:08:37.060 But then Wei Dai had a second idea, and this actually very much resembles what 00:08:37.060 --> 00:08:42.030 Nick Szabo proposed for bit gold, which is to have some sort of, you know, 00:08:42.750 --> 00:08:48.710 server. a group of servers that maintain this registry. So 00:08:48.710 --> 00:08:53.890 there's sort of two types of participants in the network. One type of participant 00:08:53.890 --> 00:08:58.350 that's just a user and one type of participant that's keeping track of the state 00:08:58.350 --> 00:09:02.610 of the ledger. And then regular users would have to inquire by these special 00:09:02.610 --> 00:09:07.090 servers. And what Wei Dai specifically proposed is you inquire with 00:09:07.090 --> 00:09:12.930 a number of these servers. And if a great enough number of them all 00:09:12.930 --> 00:09:18.870 say, yep, this transaction is valid, then you accept the transaction. So say 00:09:18.870 --> 00:09:23.010 there are 20 of these servers, then Wei Dai may have said, I don't think he 00:09:23.010 --> 00:09:26.690 mentioned, I'm sure actually he didn't mention specific numbers, but he may have 00:09:26.690 --> 00:09:32.420 said, check with. two-thirds, and then if two-thirds of them say yes, then it's 00:09:32.420 --> 00:09:35.960 good. So in that case, it would have been 14, I guess, my example. Yeah. 00:09:37.490 --> 00:09:43.320 Now, again, this sort of reintroduces the problem that Nick Szabo had, which 00:09:43.320 --> 00:09:49.080 is who gets to be one of these servers? How do you prevent Sybil attacks? 00:09:49.320 --> 00:09:54.720 And then Wei Dai, again, came up with sort of his own solution here, which is 00:09:54.720 --> 00:10:00.540 these servers would have to deposit like stake so they would have to have 00:10:00.540 --> 00:10:05.880 a certain amount of b-money tokens and then if they would try to 00:10:05.880 --> 00:10:11.220 cheat then these tokens could be taken from them. By whom 00:10:11.220 --> 00:10:16.020 exactly? So again it's sort of this hand wavy thing where it's sort of an 00:10:16.020 --> 00:10:21.080 interesting idea but who's gonna decide that you're that you've been cheating if 00:10:21.080 --> 00:10:26.710 it's not these servers themselves like how how can you or I don't think 00:10:27.640 --> 00:10:33.360 Or it's not clear to me if he had an answer for it that he just 00:10:33.360 --> 00:10:36.300 didn't spell out, or... 00:10:36.300 --> 00:10:37.760 Or maybe he didn't have an answer for it. 00:10:37.900 --> 00:10:43.650 Yeah, that sort of seems to be the case, as I mentioned in the 00:10:43.650 --> 00:10:49.600 beginning. The way I'm reading it, it's sort of, here's this idea, here's what 00:10:49.600 --> 00:10:54.580 I come up with, do with it what you want. And it kind of makes sense in a way as 00:10:54.580 --> 00:10:59.240 well. This is also something I describe in my book, is that Wei Dai had sort of, 00:10:59.440 --> 00:11:03.780 actually by the time he published b-money, he'd sort of already given up on the 00:11:03.780 --> 00:11:09.170 idea of digital cash. He'd become disillusioned with the whole concept, 00:11:09.170 --> 00:11:15.030 in particular because he thought people don't actually care. So there was this 00:11:15.030 --> 00:11:18.870 cypherpunk group. I'm not going to get into all of that. But they were building 00:11:18.870 --> 00:11:23.750 all these privacy technologies. But then... When people start to go online in 00:11:23.750 --> 00:11:28.250 greater numbers, they were just using, you know, centralized, non-anonymous 00:11:28.250 --> 00:11:33.290 services and credit cards online to make payments. So this sort of vision of the 00:11:33.290 --> 00:11:38.210 cypherpunks that they were building privacy tools for the people wasn't really 00:11:38.210 --> 00:11:42.650 coming through because no one seemed to care. And for that reason, Wei Dai also, 00:11:42.690 --> 00:11:48.230 he became kind of disillusioned. So from that perspective, it might make sense 00:11:48.230 --> 00:11:52.210 that he sort of reached this point of, all right, this is what I came up with. 00:11:52.210 --> 00:11:56.470 I'll just post it in case someone wants to, you know, build on this, but I 00:11:56.470 --> 00:11:57.610 haven't got all the solutions. 00:11:57.930 --> 00:11:58.150 Yeah. 00:11:58.490 --> 00:12:03.390 Even the way he posted the proposal, like on the Cypherpunks mailing list 00:12:03.390 --> 00:12:09.330 anyways, like it's not even an email about the money, the digital cash system 00:12:09.330 --> 00:12:15.310 itself. It's like an email about an upgrade to PipeNet he was building, which is 00:12:15.310 --> 00:12:15.810 some other. 00:12:17.230 --> 00:12:20.610 Anonymity tool. And then there was like this, by the way, I also came up with 00:12:20.610 --> 00:12:21.510 this b-money thing. 00:12:21.730 --> 00:12:23.750 But wait, there's more. Yeah. 00:12:26.990 --> 00:12:32.590 Was this a reference? Were you referring to me telling more about b-money? 00:12:32.810 --> 00:12:34.210 No, I was referring to Steve Jobs here. 00:12:34.410 --> 00:12:38.170 Yeah, okay. There is something else that's interesting to say about b-money, 00:12:38.410 --> 00:12:43.970 which is that Wei Dai had this idea of he wanted to 00:12:43.970 --> 00:12:45.370 build... 00:12:46.870 --> 00:12:52.750 introduce a monetary policy in b-money. So we discussed with bit gold 00:12:52.750 --> 00:12:58.290 or with Hashcash before that, that the problem is inflation, essentially. It 00:12:58.290 --> 00:13:02.510 becomes easier and easier to produce valid hashes. So there's more and more 00:13:02.510 --> 00:13:08.510 coins, if we want to call them coins, in circulation. And so there's 00:13:08.510 --> 00:13:14.450 this sort of inflation because of that and the money is not very desirable. So 00:13:14.450 --> 00:13:20.000 bit gold, solve this as we discussed I think we discussed this right with the 00:13:20.000 --> 00:13:25.240 second layer with banks and these buckets and that whole thing, by the Wei Dai 00:13:25.240 --> 00:13:30.740 instead he proposed that he wanted the monetary 00:13:30.740 --> 00:13:36.300 purchasing power to be stable like in a CPI type of way although 00:13:36.300 --> 00:13:41.100 he doesn't define this as either he doesn't define what is stable actually 00:13:41.100 --> 00:13:44.720 specifically or— but then importantly who's gonna decide it? 00:13:45.160 --> 00:13:48.820 But the idea was then that the amount of proof of work needed depends on the 00:13:48.820 --> 00:13:53.380 supply that's out there and then the desire for keeping the price at a certain level. 00:13:54.000 --> 00:13:59.640 So there's two proposals. So the first idea was, again, let's for 00:13:59.640 --> 00:14:04.300 simplicity just take this. It doesn't really matter, but let's take this 00:14:04.300 --> 00:14:10.160 registry, like the version of b-money where there's this 00:14:10.160 --> 00:14:14.240 group of servers that sort of decides, you know, prevents double spending. Now 00:14:14.240 --> 00:14:19.860 then this group of servers would have to kind of come to some kind of 00:14:19.860 --> 00:14:25.540 consensus of how hard or expensive it is to produce 00:14:25.540 --> 00:14:30.800 a valid hash of a certain value. And then they would sort of take this basket of 00:14:30.800 --> 00:14:35.140 goods and then they would match, like, okay, so this is now how expensive a hash 00:14:35.140 --> 00:14:40.160 is to produce to match this basket. And they would, so in a way, they would sort 00:14:40.160 --> 00:14:44.940 of set the difficulty of b-money. So there would be sort of a committee, if you 00:14:44.940 --> 00:14:48.040 will, setting the difficulty. So there's not a difficulty algorithm. 00:14:48.040 --> 00:14:52.960 Yeah, so it's not even an oracle. It's really a committee that has to look at how 00:14:52.960 --> 00:14:53.760 difficult it should be. 00:14:54.100 --> 00:14:58.660 Yeah, pretty much. So that's how they keep... 00:15:00.460 --> 00:15:04.710 what's the best way to put it? I think I've been pretty clear, right? Yeah, yeah. 00:15:05.310 --> 00:15:10.740 Producing a difficulty should be as expensive over time 00:15:10.740 --> 00:15:12.420 compared to this basket. 00:15:12.420 --> 00:15:15.520 I mean, the eventual breakthrough was to realize that if you want to have a 00:15:15.520 --> 00:15:21.340 constant amount of new supply every so much time, then you just 00:15:21.340 --> 00:15:25.400 use time as a way to decide how much you should, how high the difficulty should 00:15:25.400 --> 00:15:30.120 be. That was the insight by Satoshi. So you don't need a committee. but you can 00:15:30.120 --> 00:15:31.060 actually just use a clock. 00:15:32.160 --> 00:15:32.560 Yes. 00:15:32.800 --> 00:15:35.440 He was getting there, but he didn't make it all the way. 00:15:36.520 --> 00:15:41.700 Well, but it is very different because Bitcoin does not have this goal of 00:15:41.700 --> 00:15:47.400 a stable, you know, stable in quote marks, I guess, because we define 00:15:47.400 --> 00:15:51.280 stable, but stable purchasing power, at least not in a CPI type of way. 00:15:50.640 --> 00:15:54.880 That's a separate thing right? So there's two things you want to do is you want 00:15:54.880 --> 00:15:58.380 the supply itself to be at least predictable. And that's, I think, what they both 00:15:58.380 --> 00:16:02.400 have in common. And Satoshi figured out how to make the supply predictable. But 00:16:02.400 --> 00:16:05.880 then the secondary goal is like how to make the purchasing power stable. And that 00:16:05.880 --> 00:16:10.500 is something that Bitcoin simply has not solved. Some people see that as a 00:16:10.500 --> 00:16:14.160 feature. Other people see it as a bug. Stablecoins solve that problem, but then 00:16:14.160 --> 00:16:15.460 they have all the other problems. 00:16:17.120 --> 00:16:21.220 I mean, this to an extent comes down to the definition of stable, right? 00:16:21.920 --> 00:16:23.440 Stable purchasing power, basically. 00:16:25.180 --> 00:16:29.100 I think you can objectively see that the purchasing power of Bitcoin is less 00:16:29.100 --> 00:16:33.960 stable than that of the euro, at least so far. Maybe in the long run it becomes 00:16:33.960 --> 00:16:34.540 more stable. 00:16:34.940 --> 00:16:40.360 That I would probably agree with. However, that doesn't— 00:16:40.360 --> 00:16:46.240 you're always stuck with defining stable, which is 00:16:46.240 --> 00:16:47.160 never... 00:16:47.220 --> 00:16:51.380 No, that's what I'm saying. Stable compared to purchasing power. You have to pick something. 00:16:52.310 --> 00:16:53.230 No, sure. 00:16:53.790 --> 00:16:55.270 It doesn't have to be CPI. 00:16:55.530 --> 00:16:58.850 Purchasing power of what? What are you purchasing? 00:17:00.010 --> 00:17:01.890 Yeah, of whatever lifestyle you're having. 00:17:03.360 --> 00:17:07.260 But I agree, there's all sorts of factors that decide that, right? So that's a 00:17:07.260 --> 00:17:08.320 whole economics discussion. 00:17:08.680 --> 00:17:13.840 Yeah, so let's sidestep that. But I do get into that aspect in my book as well, 00:17:13.920 --> 00:17:17.460 at least for part, especially Hayek's ideas about that is sort of what I 00:17:17.460 --> 00:17:17.880 highlight. 00:17:19.230 --> 00:17:24.820 Anyway, sidestepping that. Wei Dai had this idea of stability in this kind of a 00:17:24.820 --> 00:17:29.060 CPI type of sense, basket of goods type of sense. And so, yeah, there's this 00:17:29.060 --> 00:17:33.480 committee that says, okay, that means that right now the difficulty should be X. 00:17:34.420 --> 00:17:40.120 Alternatively, b-money had this other idea, or Wei Dai had this other idea, which 00:17:40.120 --> 00:17:46.000 was, okay, to keep the value stable, we now need X amount of new coins to come 00:17:46.000 --> 00:17:51.670 into circulation today or tomorrow, per day, say. And we're going to auction this 00:17:51.670 --> 00:17:56.490 off to the highest amount of proof of work. So whoever is willing to produce the 00:17:56.490 --> 00:18:02.450 highest, you know, most difficult string, highest proof of work, they'll get 00:18:02.450 --> 00:18:04.990 the new coins. That's sort of an auction system. 00:18:05.150 --> 00:18:07.710 And interestingly, that is also very close to what Bitcoin is doing. 00:18:09.430 --> 00:18:13.470 It lets the market figure out how much hash power there is and who is willing to 00:18:13.470 --> 00:18:16.970 mine and who is not. But it's not a winner-takes-all system, right? This proposal 00:18:16.970 --> 00:18:20.790 would have been a winner-takes-all system. Like, you win the auction, you get to 00:18:20.790 --> 00:18:21.330 make the coins. 00:18:23.740 --> 00:18:26.900 Well, Bitcoin is that as well, right? There's only one winner of a block, essentially. 00:18:27.080 --> 00:18:28.080 Per block, yeah. 00:18:29.360 --> 00:18:34.100 But on average, everybody can contribute hash power. And it's not the case that 00:18:34.100 --> 00:18:39.220 any given hash is predetermined to go to you, right? With this proposal, I think, 00:18:39.220 --> 00:18:44.180 if you win the auction, then you are doing the mining. for a certain period of time. 00:18:44.800 --> 00:18:49.940 I mean, I think the way b-money, I think this proposal would have been, okay, 00:18:50.020 --> 00:18:54.800 we're going to bring 100 coins into circulation today. How much hash do you want 00:18:54.800 --> 00:18:58.320 to show for it? And then people would produce different hashes and there would be 00:18:58.320 --> 00:18:59.220 only one winner. 00:19:00.110 --> 00:19:04.190 Oh, okay, but that's more of a race then, where everybody has to put in effort. 00:19:04.350 --> 00:19:07.770 Because an auction is something where only the winner pays or has to do something. 00:19:08.070 --> 00:19:09.270 Yeah, but how do you know? 00:19:10.030 --> 00:19:15.770 So what I thought, he was doing, but I haven't read it, so maybe that's why I'm wrong. 00:19:15.850 --> 00:19:19.130 Well, it's not detailed, but it's hand-wavy, so that's why I can't. 00:19:18.520 --> 00:19:21.930 It's like a [unclear], right? Where you say, okay, who wants to, for the next 00:19:21.930 --> 00:19:25.210 week, produce hash power? And then somebody says, okay, I have like a 10 tera 00:19:25.210 --> 00:19:28.730 hash machine, I'll turn it on for a week. And then it's okay, okay, you get this 00:19:28.730 --> 00:19:31.630 job for the next week, and then next week, somebody else gets a job. 00:19:32.110 --> 00:19:32.550 Yeah, yeah, yeah. 00:19:32.910 --> 00:19:36.030 Because otherwise, a lot of people are wasting, well, wasting, yeah, basically 00:19:36.030 --> 00:19:39.390 doing a lot of effort, but they're not winning at all, because they are not 00:19:39.390 --> 00:19:41.460 the... The very best. They are the second best. 00:19:41.620 --> 00:19:46.880 Yeah, but I do suspect that that is how it would have worked in Wei Dai's mind. I 00:19:46.880 --> 00:19:51.600 don't know. That was my assumption. So yeah, you have to sort of factor in the 00:19:51.600 --> 00:19:54.680 probability that you'll be the highest one. I don't know. It introduces an 00:19:54.680 --> 00:19:57.220 interesting dynamic to an auction. 00:19:57.460 --> 00:19:57.600 Yeah. 00:19:57.840 --> 00:20:00.400 Like it could work, right? There's no technical reason it can't work. 00:20:00.780 --> 00:20:01.160 Yeah. 00:20:01.300 --> 00:20:03.260 And it's sort of simpler to implement it that way. 00:20:04.100 --> 00:20:07.200 I don't think it's an auction because in an auction you only pay if you win. 00:20:07.760 --> 00:20:11.780 Whereas here, you always have cost as a miner. You're always spending energy, but 00:20:11.780 --> 00:20:15.960 you may or may not get the reward based on whether you're the highest bidder. So 00:20:15.960 --> 00:20:16.640 it's not proportional. 00:20:17.060 --> 00:20:22.520 Yes. Yes, it is a bit different in that sense. Anyway, so this stuff is kind of 00:20:22.520 --> 00:20:27.440 hand-waved. Like, these details are not fleshed out in the b-money proposal. 00:20:27.700 --> 00:20:32.740 Again, to clarify this, the b-money proposal is not like... a white paper like 00:20:32.740 --> 00:20:38.180 Bitcoin was it's more like a post of you know one or two pages sort of on a on a 00:20:38.180 --> 00:20:40.420 web forum so to say. Yeah, so yeah. 00:20:40.420 --> 00:20:46.000 Which which brings my question is why given that it was just a side note why is 00:20:46.000 --> 00:20:47.220 it then still remembered? 00:20:48.690 --> 00:20:54.110 um well for one it's of course in the Bitcoin white paper 00:20:54.110 --> 00:20:59.990 referenced uh I think what I emphasize in my book as sort of 00:20:59.990 --> 00:21:03.650 the breakthrough step that b-money in a way introduced is this idea that 00:21:03.650 --> 00:21:08.310 everyone's going to keep track of balances even though he didn't actually propose 00:21:08.310 --> 00:21:14.230 a way to do it that's you know consensus robust it was still the 00:21:14.230 --> 00:21:19.370 first time that this was proposed in a digital currency context and 00:21:19.370 --> 00:21:23.980 you know is used in Bitcoin today so that I see a 00:21:25.100 --> 00:21:29.360 relevant step there. Although it's a smaller part of my book than, for example, 00:21:29.580 --> 00:21:33.480 something like bit gold. I do see that sort of this intermediate thing a little 00:21:33.480 --> 00:21:38.120 bit, but it's still interesting. It's still, you know, a thing that people were 00:21:38.120 --> 00:21:38.800 thinking about. 00:21:40.340 --> 00:21:45.040 You know, it was one of the notable digital cash proposals before Bitcoin. 00:21:47.000 --> 00:21:51.320 The last thing I can mention about b-money, which I'm not going to get into 00:21:51.320 --> 00:21:53.700 detail on, is that it was very 00:21:55.490 --> 00:21:58.090 heavily focused on smart contracts as well. 00:21:59.880 --> 00:22:04.840 bit gold was kind of as well, but b-money as well. There was this idea with like 00:22:04.840 --> 00:22:10.780 an arbitration system and there was a bigger idea than just cash. It really 00:22:10.780 --> 00:22:16.220 was sort of meant to be a platform for smart contracts. So it's kind of, 00:22:16.340 --> 00:22:22.330 it's also, you could argue, sort of a pre-echo for Ethereum because 00:22:22.330 --> 00:22:28.120 you've got both. sort of a pre-proof-of-stake kind of thingy 00:22:28.120 --> 00:22:32.140 going on, even though it's not fleshed out. And then there's sort of heavy 00:22:32.140 --> 00:22:37.460 emphasis on smart contracts, even though it's not actually purely smart contract 00:22:37.460 --> 00:22:42.160 because there's still a lot of arbitration going on. But anyways, it's 00:22:42.160 --> 00:22:45.960 interesting to see that these ideas kind of pre-existed as well, maybe. 00:22:46.320 --> 00:22:49.220 Yeah. All right. Sounds like there was another proposal. 00:22:49.990 --> 00:22:54.890 Yes, so now we're going to take kind of a jump in time, actually, because 00:22:54.890 --> 00:22:59.150 bit gold and b-money were both proposed in 1998. 00:23:00.870 --> 00:23:05.670 Of course, both not implemented. And then for a couple of years, actually, 00:23:05.830 --> 00:23:11.360 interest in this whole domain sort of died down a little bit. The Cypherpunk 00:23:11.360 --> 00:23:15.440 mailing list itself sort of went defunct. But then in 2004, 00:23:16.780 --> 00:23:22.520 Hal Finney pops up and he... Actually, I believe he explicitly says that he 00:23:22.520 --> 00:23:28.330 wants to implement something like bit gold and b-money, but he's going to use a 00:23:28.330 --> 00:23:33.730 simplified version of it. I would say that's even kind of a misnomer. He just 00:23:33.730 --> 00:23:37.690 sort of comes up with his own thing. But there's some similarities, sure. 00:23:37.870 --> 00:23:41.590 But it was inspired by these ideas. But what was very unique about this proposal 00:23:41.590 --> 00:23:42.810 is that it had code. 00:23:43.890 --> 00:23:49.870 Yes, yeah, that's right. RPOW was actually implemented by Hal Finney and run by 00:23:49.870 --> 00:23:54.310 Hal Finney. So shall I take the lead on this one again? 00:23:54.490 --> 00:23:54.910 Yes, please. 00:23:55.190 --> 00:23:56.470 Okay, so RPOW, 00:23:58.270 --> 00:24:03.350 it's sort of interesting. It starts with eCash, which was centralized, 00:24:03.350 --> 00:24:08.990 and then that failed and that sort of made Cypherpunks 00:24:08.990 --> 00:24:14.730 move to a more decentralized direction of thinking, so both bit gold and... 00:24:14.950 --> 00:24:18.930 well, Hashcash before that, even bit gold, b-money, they all have this idea of 00:24:18.930 --> 00:24:21.930 how can we centralize the protocol. 00:24:22.470 --> 00:24:22.970 Decentralize. 00:24:23.170 --> 00:24:28.730 Oh, sorry, yeah, decentralize. And then RPOW actually sort of goes back to just 00:24:28.730 --> 00:24:32.350 doing it centralized. Now, there were some ideas, or Hal Finney had some ideas, 00:24:32.390 --> 00:24:36.110 where it could be also kind of decentralized or multiple servers. 00:24:37.940 --> 00:24:41.300 But the system he implemented was essentially centralized. 00:24:42.280 --> 00:24:44.060 But it was transparent, right? 00:24:44.440 --> 00:24:49.120 Yeah, yeah. So I'm getting there. So let me first just mention real quick how it 00:24:49.120 --> 00:24:54.180 works, essentially. It's also worth mentioning at this point, for example, Tor 00:24:54.180 --> 00:24:59.960 has been invented, the Onion router. So now it's possible to connect to the 00:24:59.960 --> 00:25:05.680 server anonymously, which sort of did away 00:25:05.680 --> 00:25:10.340 with some other... anonymity technologies that, for example, eCash used. So 00:25:10.340 --> 00:25:15.640 actually, what you did with RPOW is you connect with the server. The server then 00:25:15.640 --> 00:25:21.340 gives you a proof of work assignment. And if you perform this proof of 00:25:21.340 --> 00:25:26.520 work, you get coins. So the server issues coins to you. Now, these coins are just 00:25:26.520 --> 00:25:27.360 numbers, essentially. 00:25:30.400 --> 00:25:35.080 And then if you want to pay someone, you just send that person these numbers and 00:25:35.080 --> 00:25:40.140 that person sends these numbers to the server. And then the server says, 00:25:40.600 --> 00:25:45.400 yep, these are indeed numbers that I generated. Like the server keeps track of 00:25:45.400 --> 00:25:51.020 what numbers it issued essentially. And at that time, it also 00:25:51.020 --> 00:25:54.540 makes these numbers invalid and gives new numbers in return. 00:25:54.820 --> 00:25:55.200 Yeah. 00:25:55.320 --> 00:25:56.220 Does it make sense so far? 00:25:56.400 --> 00:25:59.560 Well, yeah, the making things invalid and giving new ones in return is something 00:25:59.560 --> 00:26:01.660 you see with the eCash as well. 00:26:01.760 --> 00:26:02.720 Yes, indeed. 00:26:03.040 --> 00:26:05.460 Except that these are not blinded at all. 00:26:05.720 --> 00:26:10.320 Right. So the privacy in this case, as I mentioned, is you can just connect with 00:26:10.320 --> 00:26:13.700 the server through something like Tor and then the server doesn't know who you 00:26:13.700 --> 00:26:18.430 are anyways. Yeah. So instead of like this. you know, blind signature technology 00:26:18.430 --> 00:26:23.350 that eCash uses. RPOW kind of takes a simpler approach and the server just 00:26:23.350 --> 00:26:24.550 doesn't know who you are anyways. 00:26:24.870 --> 00:26:28.510 Yeah, which has, I believe, one of the benefits is that it's easier to check the supply. 00:26:33.820 --> 00:26:37.040 Yeah, I guess that's a good point. Well... 00:26:37.300 --> 00:26:38.780 How was the supply created? 00:26:39.020 --> 00:26:43.820 Well, hang on. So the server, there's two ways that the server essentially issues 00:26:43.820 --> 00:26:48.080 coins, right? So one way is in return for proof of work. 00:26:49.320 --> 00:26:55.260 And another way is in return for other valid coins. Now, there's no actual 00:26:55.260 --> 00:26:59.120 limit on the supply, or at least the way Hal Finney implemented it. There's no 00:26:59.120 --> 00:27:00.660 limited supply, if that's your question. 00:27:00.920 --> 00:27:06.060 Yeah, it was completely inflationary, but you can at least check the amount of 00:27:06.060 --> 00:27:08.620 proof of work that goes in. I don't know if you can check it, actually, because 00:27:08.620 --> 00:27:11.420 you'd have to ask for the whole transaction log, and I don't know if the server 00:27:11.420 --> 00:27:13.860 will give you the entire transaction log. 00:27:15.960 --> 00:27:21.480 I don't think it would. No, I don't think so. Not that I know of. I haven't 00:27:21.480 --> 00:27:25.540 looked at the code itself, but I've not read that this would have been the case. 00:27:25.540 --> 00:27:29.760 No, I think then the model was different, right? But we'll get to the 00:27:29.760 --> 00:27:34.360 transparency side of it later. But I think you rely on understanding what code is 00:27:34.360 --> 00:27:37.720 running, and you can see that that code is not creating inflation, therefore 00:27:37.720 --> 00:27:42.020 you're trusting extra inflation. I mean, it's not like printing money for the owner. 00:27:43.240 --> 00:27:47.280 but only because you know that that code should do what it says it does. 00:27:48.220 --> 00:27:53.700 Yes. Well, that's the next point where we're getting at. So the part of creating 00:27:53.700 --> 00:27:57.960 coins makes sense, right? It's just proof of work. So it's called RPOW, which 00:27:57.960 --> 00:28:03.140 stands for reusable proof of work. And really, if you read 00:28:03.140 --> 00:28:09.060 Hal Finney's comments on it, it was more supposed to be kind of like Hashcash, 00:28:09.280 --> 00:28:14.460 kind of like postage, just reusable postage. So there wasn't, again, there wasn't 00:28:14.460 --> 00:28:20.420 like this big idea of monetary reform or scarcity, or it was really just, 00:28:20.580 --> 00:28:24.560 let's make proof of work reusable, you know, sort of Hashcash. 00:28:24.600 --> 00:28:29.000 Yeah, because the idea of being able to get change for the work, that's new here. 00:28:29.390 --> 00:28:29.970