回复：比特币
首次公开证据
打开首次公开证据查看 1 个交叉存档
来源说明
Published on GitHub in February 2024 as part of Martti Malmi's testimony in the COPA v. Wright trial. Original Sent: Sun, 03 May 2009 23:32:26 +0100 (= 22:32:26 UTC).
好的，我可以做网站和常见问题。我现在就开始写常见问题， 先写我能想到的问题。
那太好了！我已经把你（dmp1ce）作为开发者加入了 sourceforge 项目，并授予你编辑网站空间及其他所有内容的权限。
我对这个程序有一个功能建议：做一个用于创建 受密码保护的私钥并将其保存到自定义位置的 UI 工具。 为防止失去对这些币的控制，需要备份密钥， 而且在多台计算机上使用这些币时也需要备份。需要密码 保护，以便让碰巧找到你的密钥文件的人更难动用你的钱。
当然。一旦事情发展起来，这将是一项绝对不可或缺的功能， 让你能用强加密锁住自己的财富，并以比任何实体保险箱都更安全的方式 进行备份。到目前为止，我一直把它往后放，优先开发其他功能， 因为在比特币开始具有价值之前，它还不是关键功能。
我计划接下来开发托管功能，要让 实物商品的实际交易更加安全，并为货币开始由 法定货币支撑做准备，这项功能是必需的。
只要我的 PC 开着，我就一直运行一个比特币节点，也就是说 差不多全天候运行。比特币是个很棒的项目，能参与其中 真的很酷！
谢谢！现在网络中有许多人无法 接收入站连接，所以每一个确实能接收的节点都有很大帮助。 拥有更多这样的节点，眼下有助于减少“（未接受）”问题，直到我 在 v0.1.6 中降低这种情况发生的概率。
我想，常见问题里应该有一个答案，说明如何设置防火墙， 转发端口 8333，以便接收入站连接。问题 可以类似于“如果我的连接数是 0 怎么办”，答案则可以是： 这可能是因为，如果不进行这项设置，你能连接的节点 会受到限制。
下面汇集了我在论坛和电子邮件中回答过的问题， 应该能帮助你了解哪些问题经常被问到，以及我用过的一些 回答。这里的材料并不是要全部或大部分采用， 只需挑选使用。这只是我所做过的全部回答的汇总。
有些问题没有简单的答案，最好不要 提起。普通用户似乎满足于假定系统如所述那样运行 （它确实如此），而深入设计细节只会打开一个 棘手的问题之盒，如果不深入理解系统便无法回答。 我收到的高级问题大多因人而异， 最好分别回答。
**** 问题与答案汇总 ****
常见问题中采用的任何问题或许都应该重新措辞。
问题：
UI 底部显示：
正在生成 4 个连接 4024 个区块 164 笔交易
我理解“正在生成”；我猜自己连接到了另外 4 个节点；而且 我知道自己记录了 164 笔交易（包括失败的生成 尝试）。我不清楚“区块”这个数字描述的是什么。它比 我所有交易旁显示的全部区块数总和小得多。
这是区块链中的区块总数，也就是 网络的区块链，每个人都有一份副本。每个比特币节点 显示的数字都相同，每当有人生成一个区块时，它大约每 10 分钟 增加一次。如果你有一段时间没运行程序， 一旦连接上，它就会快速增加，因为程序会下载你离开期间 生成的内容以赶上进度。我不确定究竟该怎样描述它（要能以 1 个词， 最多或许 2 个词放进状态栏），有什么想法吗？
交易旁边状态栏中的区块数，是 在该交易之后出现的区块数量。实质上，你的 交易“位于”这么多个区块之中。
中本聪
我最好的猜测是——它 是全局链的长度，而开始时快速增长 是因为软件正在下载并验证链中之前的区块 是否有效。
对。我正在想一个更清楚的说法，也许是“%d 个 网络区块”或“%d 区块链”。
我这里异常地连续出现了多次（区块未接受）失败，想到 万一这有什么重要意义，应该告诉你一声。
你看到的未接受比例是多少？我这边没有看到任何异常。 如果连续出现超过，比如说 4 次，那就不正常， 可能是网络通信中断了。如果只是零散出现且 低于 25%，那只是随机的坏运气。随机出现百分之几的 未接受情况很正常，也没有危害；当然，随机情况有时会 聚集起来，看起来像某种规律。
增加一个“显示/隐藏未接受区块”的选项是个好主意， “显示/隐藏所有已生成区块”也一样，这样你就能更容易看到 传入的交易。看到未接受区块只会令人烦恼和沮丧。 每个人面对的未接受比例都一样，这只是流程的一部分。 默认隐藏未接受区块可能是最好的，这样就不会显示 某个从未真正存在的东西被给予又被拿走；新生成的区块在 至少得到一次确认之前也完全不显示。这只意味着 你会比正常情况晚 15 分钟得知自己生成了一个区块， 而且无论如何，在它成熟之前你仍然还要等待 119 个区块。 这已列入 v0.1.6 的待办事项。
中本聪
[注：我在 0.1.6 中做了一些改进，以稍微缓解这个问题， 而且网络规模扩大后情况也会改善]
不知为什么，你给我的转账显示为“发件人：未知”，尽管 我已经把你加入了地址簿。
我的交易列表里有一行“已生成（未接受）”， 看起来像是生成新币的尝试不知何故出了问题。不确定 这里发生了什么——大概是我的节点成功解出了一个区块， 但在它被发送到网络之前我就下线了？
发送到比特币地址的交易始终会显示“发件人：未知”。 交易只说明它要发给谁。通过比特币地址发送 存在许多问题，但能保留这个备用选项实在很好： 无论对方是否在线，都可以向任何人发送。以后可以尝试 许多想法来改善这些问题。目前，如果事情像现实世界那样发展， 绝大多数交易都是与商户进行的，那么他们几乎总会确保 设置好通过 IP 接收。P2P 文件共享网络似乎相当成功， 能让很大比例的用户设置防火墙来转发一个端口。
我非常想找到某种方法，在间接转账中附加一条备注，但实在没有办法做到。比特币使用 EC-DSA，这对于让区块链足够紧凑、能以当今技术投入实际使用至关重要，因为它的签名比 RSA 小一个数量级。但 EC-DSA 不能像 RSA 那样加密消息，它只能用于验证签名。
“已生成（未被接受）”通常发生在两个节点几乎同时发现一个区块时，其中一个区块不会被接受。这很正常，也不可避免。我计划在 v0.1.6 中把这些隐藏起来，因为它们只会令人困惑和烦恼，用户没有理由非得看到它们。网络还像现在这样规模很小时，如果你无法接收入站连接，就会处于更不利的地位，因为你无法那么直接地收到区块通知。
……到目前为止，它有两条“已生成”消息，不过它们的 “入账”字段是 0.00，余额也没有变化。这是因为币需要满足 币龄/成熟度要求才有效吗？
没错，在它成熟之前，入账字段会一直是 0.00，之后就会变成 50.00。顺便说一句，你可以双击某一行查看详情。
……如果我理解正确，全球只有一条（或者可能有几条） 链，所有交易都被哈希进其中。如果只有一条链记录着 可以说是“经济活动的故事”，它要如何扩展？设想在全球范围内部署， 每小时会有数百万甚至数十亿笔交易被哈希进链中……
……我觉得激励机制那一节很难理解。具体来说，我不清楚 从以铸造新币作为运行节点的理由，转变为收取交易费的 触发条件是什么（无论如何，比特币的主要意义不就是把交易成本降至零吗？）。 想必会有某个人负责掌管这个系统……
……你是如何决定 v1 的通胀计划的？2100 万枚币这个数字 是怎么来的？这些币的计价单位是什么？你提到了一种合并和拆分价值的 方法，但我不清楚它如何运作。例如，比特币总是以整数计价， 还是也可以有小数比特币？……
……我很少遇到真正 具有革命性的想法。上一次我对一种新的货币方案如此兴奋， 还是在发现 Ripple 时。如果你对 Ripple 有任何看法， 我也很想听听。
全球只有一条链。
现有的 Visa 信用卡网络每天在全球处理约 1500 万笔互联网购物交易。使用现有硬件，比特币的扩展规模已经可以远大于此，而成本只是其一小部分。它实际上永远不会触及扩展上限。如果你感兴趣，我可以详细说明它应对极端规模的各种方式。
根据摩尔定律，我们可以预期硬件速度在 5 年后提高到 10 倍，在 10 年后提高到 100 倍。即使比特币以惊人的采用速度增长，我认为计算机速度仍会领先于交易数量的增长。
我预计近期内不需要收取交易费，但如果运行节点的负担变得太重，可以运行一种只处理包含交易费的交易的节点。节点所有者将决定他们愿意接受的最低费用。目前，这样的节点什么也得不到，因为没有人会附加费用；但如果足够多的节点都这样做，那么用户附加费用时交易会更快被接受，不附加时则会更慢。市场最终确定的费用应该很低。如果一个节点要求更高的费用，它就会放弃所有费用较低的交易。通过尽可能多地处理付费交易，它可以处理更大的交易量，或许也能赚到更多钱。不过，这种转变并非由某个掌管系统的人控制，而只是各个个体自行对市场力量作出反应。
比特币的一个关键方面是，网络的安全性会随着网络规模以及需要保护的价值量增长而增强。缺点是，它在早期规模较小时很脆弱，不过可能被盗取的价值应该始终小于实施盗取所需付出的成本。如果有人出于其他动机，只为证明某个观点，那么他们不过是在证明一个我已经承认的观点。
我对币的数量和发行计划的选择，是经过推断的估计。这是一个艰难的选择，因为一旦网络开始运转，它就被锁定了，我们也只能接受它。我想选一个能让价格与现有货币相近的数值，但由于无法预知未来，这非常困难。最后我选择了一个居中的数值。如果比特币仍然只是一个小众领域，那么每单位价值会低于现有货币。如果你设想它被用于全球商业活动的某一部分，那么全世界总共只有 2100 万枚币，所以每单位价值会高得多。数值是带 8 位小数的 64 位整数，因此 1 枚币在内部表示为 100000000。如果通常的价格变得很小，也有足够的精度。例如，如果 0.001 值 1 欧元，那么改变小数点的显示位置可能会更方便，这样，如果你有 1 比特币，现在就显示为 1000，而 0.001 则显示为 1。
Ripple 的有趣之处在于，它是除把信任集中到中央服务器之外，唯一一个以其他方式处理信任的系统。
中本聪
如果我们假设 0.1% 是一个合理的风险率，那么 z=5，因此 任何交易都必须等待略少于一小时，才能在链中 得到固化。由于为网页内容或虚拟物品进行的小额支付，顾名思义 要求较低的开销，等待一小时似乎是一个相当大的障碍。
对于实际风险，应将 0.1% 乘以买方是拥有庞大计算机网络的攻击者的概率。
对于小额支付，你可以安全地立即接受付款。付款金额太小，不值得花力气去盗取。小额支付几乎总是用于知识产权，商家不会遭受实体损失。任何试图盗取小额付款的人可能本来也不会成为付费客户，而且如果他们想窃取知识产权，完全可以使用文件共享网络。
目前，企业会接受一定的坏账率。我相信，等待 1 个甚至 0 个确认区块的风险，会远低于已验证信用卡交易的退款撤销率。
针对不等待确认区块的商家，常见的诈骗手法是先向商家付款，然后赶在商家持有的交易副本之前，迅速设法将一笔双重支付传播到网络中。商家可以广播自己的交易，然后监控网络中是否出现任何双重支付副本。窃贼无法在监控期间进行广播，否则商家的节点就会收到副本。商家只需监控一两分钟，等到网络中的大多数节点都收到了他的版本，窃贼的版本就来不及赶上并传到许多节点了。只要延迟一两分钟，就能让逃避付款的概率低到不足以实施诈骗。窃贼通常需要有很高的概率免费拿到商品，这样才值得下手。在上述诈骗之外，再投入大量 CPU 算力实施论文中讨论的暴力攻击，也不会大幅提高窃贼成功的概率。
任何授予某种访问权的东西，比如需要一段时间下载的内容、网站访问权、网站托管、订阅或服务，如果交易被拒绝，都可以在几分钟后取消。
每个区块所需的难度是如何通过网络传达并达成一致的？
它并不会被传达。公式被硬编码在程序中，每个节点都进行相同的计算，以获知下一个区块所需的难度。如果有人偏离了这个公式，其区块就不会被多数节点接受。
代码是自由/开源软件，还是仅仅开源？
它是自由开源软件。采用的是 MIT 许可证，只要求随源代码保留一些免责声明文字，除此之外，你几乎可以随心所欲地使用它。源代码包含在主下载包中。
中本聪
有没有办法获知新版本？应用程序会自动更新自身吗？要是有某种邮件列表就太好了。
邮件列表是： bitcoin-list@lists.sourceforge.net 订阅/退订页面： http://lists.sourceforge.net/mailman/listinfo/bitcoin-list 存档： http://sourceforge.net/mailarchive/forum.php?forum_name=bitcoin-list
我总会在那里发布新版本。自动更新，或者至少提供新版本通知，肯定已列入计划。
[这段关于通胀的讨论发生在交易费机制和 2100 万枚币的固定计划发布之前，因此现在可能已不再那么适用]
既然它们可以免费创造（或者成本只是人们本来就会出于其他原因拥有的计算机算力）， 将它们货币化就意味着纯粹是在白送钱。
你仍然在假设难度会低到人们想生成多少比特币就能生成多少。
想象一下，你必须让电脑全天候运行一个月，才能生成 1 美分。一年后，你可以生成 12 美分。这并不会让人们想生成多少用于消费的比特币就能生成多少。
比特币的价值将与生产它们所消耗的电力相关。所有现代 CPU 都会在空闲时节省电力。如果你全天候运行一个计算任务，不让 CPU 空闲，它就会消耗多得多的电力，而且你会注意到它产生了更多热量。额外消耗的瓦数会直接计入你的电费账单，而你生产的比特币价值将会低于这笔费用。
既然他们可以通过生成新币赚钱，为什么还会这样做？
不，他们无法通过这种方式赚钱。他们花掉的电费会高于出售比特币所得的钱。
历史上，人们曾采用稀缺商品作为货币，必要时会采用任何手边可用的东西，例如贝壳或石头。每种东西都有一点实用性，有助于启动这一过程，但其货币价值最终会远远超过单纯的功能价值。其大部分价值来自其他人赋予它的价值。例如，黄金美观、耐腐蚀且易于塑形，但其大部分价值显然并非源于这些特性。黄铜也有光泽，颜色也相似。绝大多数黄金闲置在金库中，归那些根本不在乎它是否美观的政府所有。
迄今为止，还没有一种稀缺商品能够不依赖可信第三方、通过通信信道进行交易。如果人们希望采用一种无需 TTP 即可通过互联网交易的货币形式，那么现在这已经成为可能。
中本聪
随着性能更强的计算机硬件问世， 每个用户的自然供应量会在摩尔定律的每个周期翻倍。
实际上，这一点已经处理好了。有一个移动平均机制会对投入的总算力进行补偿，使总产量保持恒定。随着计算机性能增强，难度也会相应提高以作补偿。
我想不起经济史上有哪种受自然通胀影响的商品曾被用作货币。
黄金就是一例。黄金供应量每年增长约 2%-3%。任何法定货币的平均通胀率通常都高于这个数字。
随着计算机速度提升、能够更快地解决工作量证明问题，难道不会出现大规模通胀吗？
难度由一个移动平均机制控制，该机制会对投入的总算力进行补偿，以保持总产量恒定。随着计算机性能增强，难度也会相应提高以作补偿。
如果有人进行双重支付，是否可以对交易记录解除盲化，从而揭示作弊者的身份？
这里不使用身份，也不依赖事后追索。一切都靠预防。
……你的意思是，完全不尝试识别并排除不合作的节点？我怀疑这会带来麻烦，并可能引发 DOS 攻击。
这里不依赖识别任何人的身份。正如你所说，这样做徒劳无功，而且用马甲账号就能轻易绕过。
证明某人真实存在的凭证，是其提供 CPU 算力的能力。
但在没有身份的情况下，如果支付变为无效，他们也不会承受任何损失， 前提是他们已经收到了用双重支付换来的东西（网站访问权、下载内容等）。 商家只能拿着“无效”的币承担损失，除非他们等上那神奇的“几个区块” （可他们怎么知道该等多少个？），然后才把付款人视为已经支付。
如果消费者花掉币后还要等一个小时完成清算，才能使用币所购买的东西，他们就不会这么做。 如果商家发现币无效是因为客户进行了双重支付，却又无法向客户撤单，他们也不会这么做。
这是一个版本 2 的问题，我相信对于大多数应用来说，可以相当令人满意地解决。
这场竞赛比的是谁先在网络上传播自己的交易。想想六度 分隔理论——它会呈指数级传播。一笔交易大概只需 2 分钟 就能传播到足够广的范围，使得较晚开始的竞争者几乎没有机会在第一笔交易 席卷整个网络之前抢占很多节点。在这 2 分钟内，商家的节点可以 留意是否出现双重支付交易。双重支付者无法在商家 收不到的情况下把他的替代交易广播到全世界，因此他必须先等待再行动。
如果真实交易到达了 90% 的节点，而双重支付交易到达了 10%，双重支付者只有 10% 的概率不用付款，而有 90% 的 概率他的钱会被花掉。对于几乎任何类型的商品，这对 骗子来说都不值得。
像网站访问权或下载内容这样的信息类商品 无法设防。没人能靠 盗取网站访问权或下载内容谋生。他们大可以去文件 共享网络盗取那些东西。大多数即时访问型产品都不会 带来很强的盗取动机。
如果商家确实遇到了盗窃问题，可以让 顾客等 2 分钟，或者等待电子邮件中的某些内容，许多商家 已经这样做了。如果他们真的想优化，而且下载文件很大， 那么如果交易返回为双重支付，他们可以在下载途中取消 下载。如果是网站访问权， 通常让顾客访问 5 分钟，然后在交易被拒绝时切断访问 也不是什么大问题。反正很多这类网站都有免费试用。
中本聪
[回应一个关于规模的问题]
把 100,000 个区块生成节点视为一个大致的大规模体量 是合理的。让一笔交易在整个网络中传播 两次，按今天的价格总共会消耗价值 US$ 0.02 的带宽。 实际中，许多人用的是较便宜的骨干网络之一，消耗的只是多余的已分配 带宽或不限流量套餐。SPV 客户端可能会有数百万个。它们只在 所生成的交易数量方面有影响。如果它们支付 1 或 2 美分的 交易费，就足以负担自身成本。我编写的代码允许你 支付任意金额的可选交易费。当激励 补贴最终逐渐减少时，可能有必要为你的交易附上 由市场决定的交易费，以确保节点及时处理它们。
为了想象真正巨大的交易负载会是什么样子， 我参考了现有的信用卡网络。我又找到了一些关于 在线购物交易数量的估算。全球互联网的 全部电子商务负载大约是每天 1500 万笔交易。按每笔交易 1KB 计算， 每个区块生成节点每天要承载 15GB 的 带宽，或者大约相当于两部 DVD 电影。即使用今天的技术，看起来也可行。
重要的是要记住，即使比特币以互联网泡沫时期的速度 增长，也仍需数年才能在所有交易中占到任何可观的 比例。我相信硬件最近已经 强大到足以应对大规模使用，但如果对此还有任何 疑虑，等真正需要时，带宽速度、价格、磁盘空间和 计算能力都会好得多。
中本聪
我还有一个问题……是什么阻止拥有最多 CPU 算力的单个节点生成并保留大多数比特币？ 如果每个节点都独立于所有其他节点工作，而其中一个节点 明显比其他节点强大，那么这个节点不是很可能 比其他节点更早得出正确结论吗？算力不足的节点 偶尔可能会走运，但如果某个节点在算力上具有 显著优势，我预计大多数比特币都会由最强大的节点生成。
这不像赛车，不是说一辆车快一倍，它就总会 获胜。这里是一次用时不到一微秒的 SHA-256 计算，每次猜测 都有独立的成功概率。每台计算机找到 哈希碰撞的概率与其 CPU 算力呈线性正比。一台 速度只有一半的计算机会得到一半数量的币。
[关于备份内容的问题]
文件位于“%appdata%\Bitcoin”中，那就是需要 备份的目录。
%appdata% 具有按用户划分的访问权限。大多数新程序，例如 Firefox，都会把设置文件存放在那里，尽管 Microsoft 每发布一个 Windows 版本 就会更改目录名称，目录名中还满是空格，而且长到超出屏幕，造成了不少阻力。
[关于备份内容的问题]
目录是“%appdata%\Bitcoin” 其中有空格，所以需要引号 cd "%appdata%\bitcoin"
在 XP 上通常会是： C:\Documents and Settings[username]\Application Data\Bitcoin
备份整个目录。所有数据文件都在那个 目录中。没有临时文件。
[关于备份内容的问题]
需要备份的关键文件是 wallet.dat。如果 bitcoin 正在运行， 那么你必须备份整个 %appdata%\bitcoin 目录， 包括 database 子目录，但即使它没有运行， 始终备份整个目录显然还是让人放心些。
遗憾的是，数据库把文件命名为“log.0000000001”。对 其他人来说，“log”意味着可以随意删除，但对数据库 人员来说，它意味着删掉它就会丢失其他文件中的一切。我 试图把它们放进 database 子目录，免遭误删。 以后我会编写代码，在每次钱包变更后刷新日志， 这样 wallet.dat 几乎随时都能单独安全备份。
你知道，我觉得 90 年代对此感兴趣的人要多得多， 但在基于可信第三方的系统（Digicash 等）失败了十多年后， 他们认为这事已经没希望了。我希望他们能看出其中的区别：据我所知， 这是我们第一次尝试一种不基于信任的系统。
是的，这正是吸引我注意的主要特点。真正的难点 是让人们真正认可比特币的价值，使它们成为 货币。
哈尔算是暗示过，它有可能被视为一项 胜算很低的投资。既然我们已经知道一种不会在 可信第三方临阵退缩时不可避免地被削弱的实现方式，如果 10 年后 我们还没有以某种方式使用电子货币， 我会很惊讶。
一旦它自我启动起来，如果你能像往自动售货机里投 硬币一样，毫不费力地向网站支付几美分，那就会有数不清的应用。
[下面这部分后来引发了很大争议。人们对 垃圾邮件解决方案抱有极深的偏见，尤其是工作量证明方案。]
它已经可以用于付费发送电子邮件。发送对话框可以 调整大小，你想输入多长的消息都可以。 建立连接后消息会直接发送。收件人双击 交易即可查看完整消息。如果某位名人收到的 电子邮件多到看不过来，但仍希望 让粉丝有办法联系自己，他可以设置好比特币，并 在自己的网站上公布 IP 地址。“向我这个 IP 的 优先热线发送 X 个比特币，我会亲自阅读这条消息。”
那些需要为免费试用增加一些额外工作量证明、以免其蚕食订阅收入的 订阅网站，可以对试用收取 比特币。
[再说一次，我不知道为什么要把这段写进来，因为最好还是避免 声称它能解决垃圾邮件问题。人们一听到任何关于垃圾邮件解决方案的建议， 都会本能地激烈反对。]
垃圾邮件发送者的僵尸网络可以轻而易举地突破按发送付费的电子邮件过滤器 （一如既往，成本会落到僵尸网络操控者和垃圾邮件发送者以外的人 身上）。
那么，你可以通过设置按发送付费的 电子邮件地址并收取所有垃圾邮件费用，赚取一笔可观的利润。你可以 把它卖回给那些僵尸网络规模不足、无法自行 生成这些币的垃圾邮件发送者，从而帮助这种货币的价值起步。随着 越来越多的人意识到这一点，他们会设置越来越多的虚假地址 来收割这些币。等到《我是如何靠利用 垃圾邮件发送者致富的，你也可以》这本书出版时，虚假 地址就会多到让垃圾邮件发送者不得不放弃。
- 垃圾邮件发送者的僵尸网络可以轻而易举地突破按发送付费的电子邮件过滤器 如果 POW 代币确实变得有用，特别是如果它们变成了货币， 机器就不会再闲置。用户会期望自己的计算机 为他们赚钱（假设收益高于运行成本）。一台收益 正被僵尸网络窃取的计算机，会比现在这种情况更容易被 它的主人察觉，因此我们可以预期，在那样的世界里，用户会更努力地维护 自己的计算机，并清除其中的僵尸网络感染。
如果 POW 代币具有价值，还有一个因素会缓解垃圾邮件问题： 人们会有逐利动机，建立海量 虚假电子邮件账户，从垃圾邮件中收割 POW 代币。 他们实质上是在用自动邮箱对垃圾邮件发送者进行反向垃圾轰炸， 这些邮箱收取对方的 POW，却不阅读邮件内容。虚假邮箱与真实用户 的比例可能会高到让垃圾邮件失去成本效益。
这个过程有可能首先确立 POW 代币的价值， 因为没有僵尸网络的垃圾邮件发送者可以从收割者手中 购买代币。虽然回购会暂时 让更多垃圾邮件通过，但它只会加速 这个自我挫败的循环，最终导致利用垃圾邮件发送者的收割者过多。
有趣的是，其中一个电子黄金系统已经出现了一种 名为“撒尘”的垃圾邮件形式。垃圾邮件发送者会发送极少量的金粉， 以便在交易的备注字段中放入垃圾信息。 如果系统允许用户配置他们愿意接收的最低付款金额， 或者至少配置允许附带消息的最低金额， 用户就可以设定自己愿意收多少钱来接收垃圾邮件。
我们最不需要的，就是在整个互联网上部署一个旨在耗尽所有 可用运算周期、消耗电力并产生二氧化碳的系统， 只为生成少量 bitbux， 好让电子邮件或垃圾邮件通过。
难道我们不能直接把银行账户里的真金白银转换成 bitbux 吗—— 成本低廉，而且不附带碳税？拜托了？
如果我们最终不得不在经济自由和 资源保护之间做出选择，那还真是讽刺。
遗憾的是，工作量证明是我找到的唯一一种 能在没有可信第三方的情况下让 P2P 电子现金运作的解决方案。即使我 不把它次要地用作分配货币初始 发行量的方式，PoW 对协调网络和 防止双重支付也是不可或缺的。
如果它真的发展到消耗大量能源，我认为它 仍会比其所取代的劳动和资源密集型 传统银行活动更少浪费。其成本会比数十亿银行手续费 低一个数量级；正是这些手续费支付了所有那些实体营业场所、 摩天大楼和信用卡推销垃圾邮件的开销。
中本聪
顺便说一句，我不记得我们是否谈过这个，但前几天有人 提到了安全时间戳。你希望能够 证明某份特定文档在过去某个特定时间已经存在。 在我看来，比特币的区块堆栈非常适合做这件事。
确实，比特币是一个用于交易的分布式安全时间戳服务器。 只需几行代码，就可以创建一笔交易， 在其中额外放入任何需要加时间戳之物的哈希。 我应该添加一条命令，以这种方式给文件加时间戳。
摘自 p2presearch 上的一个帖子串，开头是我关于信任 是所有传统金融系统根本弱点的一番激烈抨击。 http://listcultures.org/pipermail/p2presearch_listcultures.org/2009-February/thread.html
我开发了一个名为比特币的新型开源 P2P 电子现金系统。它 完全去中心化，没有中央服务器或可信方， 因为一切都基于密码学证明，而不是信任。不妨试用一下， 或看看截图和设计论文：
在 http://www.bitcoin.org 下载 Bitcoin v0.1
传统货币的根本问题在于，它的运作需要 太多信任。我们必须相信中央银行不会 让货币贬值，但法定货币的历史充斥着 对这种信任的背弃。我们必须相信银行会保管我们的钱并 以电子方式转账，但它们只留极少一部分准备金，便在一轮轮信贷 泡沫中把钱贷出去。我们不得不把隐私托付给它们，相信它们不会让身份窃贼 掏空我们的账户。它们庞大的运营成本让小额支付无法实现。
上一代的多用户分时计算机系统也有一个类似的 问题。在强加密出现之前，用户不得不依赖密码 保护来保障文件安全，也就是相信系统 管理员会对其信息保密。管理员总可以根据自己的判断， 在隐私原则与其他考量之间权衡，或应其 上级要求，凌驾于隐私之上。后来，普通大众也能使用强加密了， 信任便不再是必需的。数据能够以一种 他人实际上不可能访问的方式得到保护，无论出于什么原因， 无论借口多么充分，无论如何都不行。
现在是时候让货币也拥有同样的机制了。有了基于 密码学证明的电子货币，无需信任第三方中间人， 货币可以安全无虞，交易也可以轻松完成。
这种系统的一个基本构件是数字 签名。一枚数字货币包含其所有者的公钥。要 转移它，所有者要将这枚币与下一位所有者的公钥一起签名。 任何人都可以检查签名，以验证所有权链。 这能很好地保障所有权，却留下一个尚未解决的重大 问题：双重支付。任何所有者都可以尝试重复花费一枚 已经花掉的币，方法是再次签名，把它转给另一位所有者。通常的 解决方案是由一家拥有中央数据库的可信公司检查 双重支付，但这不过是又回到了信任模型。凭借其 中心地位，公司可以凌驾于用户之上，而维持公司所需的 费用会让小额支付变得不切实际。
比特币的解决方案是使用点对点网络来检查双重支付。 简而言之，该网络就像一台分布式时间戳服务器， 为最先花费某个币的交易加盖时间戳。它利用了信息易于传播却 难以遏制的特性。有关其工作原理的详情，请参阅设计论文： http://www.bitcoin.org/bitcoin.pdf
由此形成的是一个不存在单点故障的分布式系统。 用户持有自己资金的加密密钥，并彼此直接进行交易， 由 P2P 网络协助检查双重支付。
Martien van Steenbergen Martien at AardRock.COM Thu Feb 12 08:40:53 CET 2009
非常有意思。这类似于 David Chaum 的匿名数字 货币吗？他的构想确保货币保持匿名，除非它被 滥用，也就是同一笔钱被花费不止一次。一旦发生 滥用，“伪造者”就会立刻被公开揭露。
另外，在比特币中，货币供应量是否有限（因而必须 加以管理）？还是说货币恰好在交易发生的那一刻被创造出来？
祝你成功、愉快，
Martien。
非常有意思。这类似于 David Chaum 的匿名数字货币吗？ 他的构想确保货币保持匿名，除非它被滥用，也就是 同一笔钱被花费不止一次。一旦发生滥用， “伪造者”就会立刻被公开揭露。
两者的相似之处在于都对币使用数字签名，但在 隐私保护和防止双重支付的方法上有所不同。 比特币付款的收款人能够检查这是否是第一次 花费，第二次花费不会被接受。它不存在这样一种 离线模式，即事后抓住双重支付者并使其蒙羞， 因为那会要求参与者具有身份。
为了保护隐私，每个密钥对只使用一次， 每笔交易都使用一个新的密钥对。币的所有者就是持有其私钥的人。
当然，最大的区别是没有中央服务器。那正是 Chaum 式系统的阿喀琉斯之踵；中央公司一旦关闭， 货币也会随之消失。
另外，在比特币中，货币供应量是否有限（因而必须 加以管理）？还是说货币恰好在交易发生的那一刻被创造出来？
货币供应量是有限的。流通量将为 21,000,000 个币。交易只转移所有权。
感谢你的提问，
中本聪
这让我想起：
* AardRock » Wizard Rabbit Treasurer <http://wiki.aardrock.com/Wizard_Rabbit_Treasurer>；以及 * AardRock » Pekunio <http://wiki.aardrock.com/Pekunio>
确实，就把每笔交易的冗余副本散发给网络中的多个 对等节点这一理念而言，它非常像 Pekunio，但其 实现并不是 Wizard Rabbit Treasurer 那样的信誉网络。 事实上，比特币完全不使用信誉。它把网络 仅仅视为一大群人，不太在意自己在与谁交谈，也不在意是谁告诉它 某件事，只要其中至少有一个节点会转发正在整个网络中 广播的信息即可。它之所以不在意，是因为没有办法 对它撒谎。你必须向它提供某件事的加密证明；提供不了，它就 会无视你。
你熟悉 Ripple 吗？
在各种信任系统中，Ripple 的独特之处在于它将信任分散开来， 而不是把信任集中起来。
[至少还有另外 4 次有人问我“你听说过 Ripple 吗？”]
你的项目实际运行到什么程度了？你认为人们多久以后才能 在现实生活中使用它？
它已经完全可以运行，而且网络正在增长。如果你试用这款 软件，请把你的比特币地址用电子邮件发给我，我会给你发送几个币。
我们只需要把消息传播出去，并继续吸引更多人感兴趣。
这里有一个链接，指向这篇论文最初在 Cryptography 邮件列表上的介绍。（后来我为支持交易费和 有限流通计划所做的修改，已经取代了当时关于通胀问题的处理方式。 这个链接指向的内容会变化，这个归档页面只显示此前某个固定 天数范围内的内容，随着讨论不断滚动，它会移到 下一页。） http://www.mail-archive.com/cryptography@metzdowd.com/mail3.html
软件发布时的一点后续消息。 http://www.mail-archive.com/cryptography@metzdowd.com/mail2.html
我对比特币如何解决拜占庭将军问题的说明： http://www.bitcoin.org/byzantine.html
英文原文
展开英文原文
All right, I can do the website and the FAQ. I'll start writing the FAQ now with the questions that I can think of.
That would be great! I added you (dmp1ce) as a dev to the sourceforge project and gave you access to edit the web space and everything.
I have a feature suggestion for the program: a UI tool for creating password protected private keys and saving them into a custom location. Backups of the key will be needed to be safe from losing the control of your coins, and for using the coins on more than one computers. Password protection would be needed to make using your money more difficult for someone who happens to find your key file.
Definitely. This will be an absolutely essential feature once things get going, making it so you can lock your wealth up with strong encryption and back it up more securely than any physical safe. So far I've been putting it off in favour of other features because it's not crucial yet until bitcoins start to have value.
I plan to work on the escrow feature next, which is needed to make actual trades for physical stuff safer and before backing the currency with fiat money can begin.
I'm running a bitcoin node always when my PC is powered on, which means about 24/7. Bitcoin is a great project, and it's really cool to participate!
Thanks! Right now there are a lot of people on the network who can't receive incoming connections, so every node that can really helps. Having more helps keep down the "(not accepted)" issue for now until I reduce the chances of that happening in v0.1.6.
I guess one answer for the FAQ should be how to set up your firewall to forward port 8333 so you can receive incoming connections. The question could be something like "what if I have 0 connections" and that could be the answer that it might be because the nodes you can connect with is limited if you don't set that up.
Here's a compilation of questions I've answered in forums and e-mail that should help you see what questions are frequently asked and some answers I've used. It's not intended to use all or most of the material here, just pick and choose. This is just a dump of everything I've answered.
Some issues that we don't have easy answers for are best not to bring up. Casual users seems content to assume that the system works as stated (which it does), and getting into the design details just opens a can of worms that can't be answered without a deep understanding of the system. The advanced questions I've received have mostly been unique per person and best answered individually.
**** QUESTION AND ANSWER DUMP ****
Any questions used for the FAQ should probably be rephrased.
questions:
The bottom of the UI shows:
Generating 4 connections 4024 blocks 164 transactions
I understand "generating"; I assume I am connected to 4 other nodes; and I know I have recorded 164 transactions (including failed generation attempts). I'm not clear what the "blocks" figure describes. It's much smaller than the total of all the blocks shown against all my transactions.
It's the total number of blocks in the block chain, meaning the network's block chain, which everyone has a copy of. Every Bitcoin node displays the same number and it goes up about every 10 minutes whenever someone generates a block. When you haven't had it running for a while, once you're connected it spins up rapidly as it downloads what was generated while you were gone to catch up. I'm not sure exactly how to describe it (that would fit on the status bar in 1 word, maybe 2 words max), any ideas?
The blocks number in the status column next to your transactions is the number of blocks that have come after that transaction. Your transaction is essentially "in" that many blocks.
Satoshi
My best guess - it is the length of the global chain, and the rapid advance at the start is as the software downloads and verifies the preceding blocks in the chain as being valid.
Right. I'm trying to think of more clear wording for that, maybe "%d network blocks" or "%d block chain".
I'm having an unusual run of (block not-accepted) failures, and thought I'd let you know in case this was of any significance.
What rate of not-accepted did you see? I didn't see anything unusual on my end. If you had more than, say, 4 in a row, that would be abnormal and probably a loss of network communication. If it's scattered and less than 25%, just random bad luck. It's normal and harmless to randomly get some per cent of not-accepted, and of course randomness can sometimes bunch up and look like a pattern.
The idea of an option to View/Hide unaccepted blocks is a good one, as well as View/Hide all generated blocks so you can more easily see incoming transactions. Seeing the unaccepted blocks is just annoying and frustrating. Everyone faces the same rate of unaccepted, it's just a part of the process. It would probably be best to default to hide unaccepted blocks, so as not to show giving and taking away something that never was, and not show new generated blocks at all until they have at least one confirmation. It would only mean finding out you have a generated block 15 minutes later than normal, and then you still have 119 blocks to go before it matures anyway. This is on the to-do list for v0.1.6.
Satoshi
[note: I have some improvements in 0.1.6 to reduce this problem somewhat, and it'll also improve when the network is larger]
For some reason your transfer to me shows up as "From: unknown" even though I added you to my address book.
I have a "Generated (not accepted)" line in my transaction list, it seems like an attempt to generate a coin went wrong somehow. Not sure what happened here - presumably my node successfully solved a block but then I went offline before it was sent to the network?
Transactions sent to a bitcoin address will always say "from: unknown". The transaction only tells who it's to. Sending by bitcoin address has a number of problems, but it's so nice having the fallback option to be able to send to anyone whether they're online or not. There are a number of ideas to try to improve things later. For now, if things work out like the real world where the vast majority of transactions are with merchants, they'll pretty much always make sure to set up to receive by IP. The P2P file sharing networks seem fairly successful at getting a large percentage of their users to set up their firewalls to forward a port.
I badly wanted to find some way to include a comment with indirect transfers, but there just wasn't a way to do it. Bitcoin uses EC-DSA, which was essential for making the block chain compact enough to be practical with today's technology because its signatures are an order of magnitude smaller than RSA. But EC-DSA can't encrypt messages like RSA, it can only be used to verify signatures.
The "Generated (not accepted)" normally happens if two nodes find a block at close to the same time, one of them will not be accepted. It's normal and unavoidable. I plan in v0.1.6 to hide those, since they're just confusing and annoying and there's no reason for users to have to see them. While the network is still small like it is now, if you can't receive incoming connections you're at more of a disadvantage because you can't receive block announcements as directly.
...So far it has two "Generated" messages, however the "Credit" field for those is 0.00 and the balance hasn't changed. Is this due to the age/maturity requirement for a coin to be valid?
Right, the credit field stays 0.00 until it matures, then it'll be 50.00. BTW, you can doubleclick on a line for details.
...understand correctly, there is only one (or maybe a few) global chain[s] into which all transactions are hashed. If there is only one chain recording "the story of the economy" so to speak, how does this scale? In an imaginary planet-wide deployment there would be millions of even billions of transactions per hour being hashed into the chain...
...I found the section on incentives hard to follow. In particular, I'm not clear on what triggers the transition from minting new coins as a reason to run a node, to charging transaction fees (isn't the point of BitCoin largely to zero transaction costs anyway?). Presumably there's some human in charge of the system...
...How did you decide on the inflation schedule for v1? Where did 21 million coins come from? What denominations are these coins? You mention a way to combine and split value but I'm not clear on how this works. For instance are bitcoins always denominated by an integer or can you have fractional bitcoins?...
...it's rare that I encounter truly revolutionary ideas. The last time I was this excited about a new monetary scheme was when I discovered Ripple. If you have any thoughts on Ripple, I'd also love to hear them.
There is only one global chain.
The existing Visa credit card network processes about 15 million Internet purchases per day worldwide. Bitcoin can already scale much larger than that with existing hardware for a fraction of the cost. It never really hits a scale ceiling. If you're interested, I can go over the ways it would cope with extreme size.
By Moore's Law, we can expect hardware speed to be 10 times faster in 5 years and 100 times faster in 10. Even if Bitcoin grows at crazy adoption rates, I think computer speeds will stay ahead of the number of transactions.
I don't anticipate that fees will be needed anytime soon, but if it becomes too burdensome to run a node, it is possible to run a node that only processes transactions that include a transaction fee. The owner of the node would decide the minimum fee they'll accept. Right now, such a node would get nothing, because nobody includes a fee, but if enough nodes did that, then users would get faster acceptance if they include a fee, or slower if they don't. The fee the market would settle on should be minimal. If a node requires a higher fee, that node would be passing up all transactions with lower fees. It could do more volume and probably make more money by processing as many paying transactions as it can. The transition is not controlled by some human in charge of the system though, just individuals reacting on their own to market forces.
A key aspect of Bitcoin is that the security of the network grows as the size of the network and the amount of value that needs to be protected grows. The down side is that it's vulnerable at the beginning when it's small, although the value that could be stolen should always be smaller than the amount of effort required to steal it. If someone has other motives to prove a point, they'll just be proving a point I already concede.
My choice for the number of coins and distribution schedule was an educated guess. It was a difficult choice, because once the network is going it's locked in and we're stuck with it. I wanted to pick something that would make prices similar to existing currencies, but without knowing the future, that's very hard. I ended up picking something in the middle. If Bitcoin remains a small niche, it'll be worth less per unit than existing currencies. If you imagine it being used for some fraction of world commerce, then there's only going to be 21 million coins for the whole world, so it would be worth much more per unit. Values are 64-bit integers with 8 decimal places, so 1 coin is represented internally as 100000000. There's plenty of granularity if typical prices become small. For example, if 0.001 is worth 1 Euro, then it might be easier to change where the decimal point is displayed, so if you had 1 Bitcoin it's now displayed as 1000, and 0.001 is displayed as 1.
Ripple is interesting in that it's the only other system that does something with trust besides concentrate it into a central server.
Satoshi
If we assume that 0.1% is a good risk rate, then z=5 thus any transaction must wait a bit less than an hour before being solidified in the chain. As micropayments for things like web content or virtual goods are by definition something that requires low overhead, waiting an hour seems like quite a significant hurdle.
For the actual risk, multiply the 0.1% by the probability that the buyer is an attacker with a huge network of computers.
For micropayments, you can safely accept the payment immediately. The size of the payment is too small for the effort to steal it. Micropayments are almost always for intellectual property, where there's no physical loss to the merchant. Anyone trying to steal a micropayment would probably not be a paying customer anyway, and if they want to steal intellectual property they can use the file sharing networks.
Currently, businesses accept a certain chargeoff rate. I believe the risk with 1 or even 0 confirming blocks will be much less than the rate of chargebacks on verified credit card transactions.
The usual scam against a merchant that doesn't wait for confirming blocks would be to send a payment to a merchant, then quickly try to propagate a double-spend to the network before the merchant's copy. What the merchant can do is broadcast his transaction and then monitor the network for any double-spend copies. The thief would not be able to broadcast during the monitoring period or else the merchant's node would receive a copy. The merchant would only have to monitor for a minute or two until most of the network nodes have his version and it's too late for the thief's version to catch up and reach many nodes. With just a minute or two delay, the chance of getting away without paying could be made much too low to scam. A thief usually needs a high probability of getting an item for free to make it worthwhile. Using a lot of CPU power to do the brute force attack discussed in the paper in addition to the above scam would not increase the thief's chances very much.
Anything that grants access to something, like something that takes a while to download, access to a website, web hosting, a subscription or service, can be cancelled a few minutes later if the transaction is rejected.
How is the required difficulty of each block communicated through the network and agreed upon?
It's not communicated. The formula is hardcoded in the program and every node does the same calculation to know what difficulty is required for the next block. If someone diverged from the formula, their block would not be accepted by the majority.
Is the code free/open source or just open source?
It's free open source. It's the MIT license, which just requires some disclaimer text be kept with the source code, other than that you can do just about anything you want with it. The source is included in the main download.
Satoshi
Is there a way to be told of new versions? Does the app auto update itself? Some kind of mailing list would be excellent.
The list is: bitcoin-list@lists.sourceforge.net Subscribe/unsubscribe page: http://lists.sourceforge.net/mailman/listinfo/bitcoin-list Archives: http://sourceforge.net/mailarchive/forum.php?forum_name=bitcoin-list
I'll always announce new versions there. Automatic update, or at least notification of new versions, is definitely on the list.
[this inflation discussion was before the transaction fee mechanism and fixed plan of 21 million coins was posted, so it may not be as applicable anymore]
Since they can be created for free (or at the cost of computer power people have anyway for other reasons), monetizing them means simply giving away money.
You're still thinking as if the difficulty level will be so easy that people will be able to generate all the bitcoins they want.
Imagine you have to run your computer 24/7 for a month to generate 1 cent. After a year, you could generate 12 cents. That's not going to make it so people can just generate all the bitcoin they want for spending.
The value of bitcoins would be relative to the electricity consumed to produce them. All modern CPUs save power when they're idle. If you run a computational task 24/7, not letting it idle, it uses significantly more power, and you'll notice it generates more heat. The extra wattage consumed goes straight to your power bill, and the value of the bitcoins you produce would be something less than that.
Why would they, when they make money by generating new ones
No, they can't make money that way. It would cost them more in electricity than they'd be selling the bitcoins for.
Historically, people have taken up scarce commodities as money, if necessary taking up whatever is at hand, such as shells or stones. Each has a kernel of usefulness that helped bootstrap the process, but the monetary value ends up being much more than the functional value alone. Most of the value comes from the value that others place in it. Gold, for instance, is pretty, non-corrosive and easily malleable, but most of its value is clearly not from that. Brass is shiny and similar in colour. The vast majority of gold sits unused in vaults, owned by governments that could care less about its prettiness.
Until now, no scarce commodity that can be traded over a communications channel without a trusted third party has been available. If there is a desire to take up a form of money that can be traded over the Internet without a TTP, then now that is possible.
Satoshi
As more capable computer hardware comes out, the natural supply per user doubles at every cycle of Moore's law.
Actually, that is handled. There's a moving average that compensates for the total effort being expended so that the total production is a constant. As computers get more powerful, the difficulty increases to compensate.
I do not recall any economic history of a commodity subject to natural inflation ever being used as money
There's gold for one. The supply of gold increases by about 2%-3% per year. Any fiat currency typically averages more inflation than that.
Won't there be massive inflation as computers get faster and are able to solve the proof-of-work problem faster?
The difficulty is controlled by a moving average that compensates for the total effort being expended to keep the total production constant. As computers get more powerful, the difficulty increases to compensate.
If someone double spends, then the transaction record can be unblinded revealing the identity of the cheater?
Identities are not used, and there's no reliance on recourse. It's all prevention.
...You're saying there's no effort to identify and exclude nodes that don't cooperate? I suspect this will lead to trouble and possible DOS attacks.
There is no reliance on identifying anyone. As you've said, it's futile and can be trivially defeated with sock puppets.
The credential that establishes someone as real is the ability to supply CPU power.
But in the absence of identity, there's no downside to them if spends become invalid, if they've already received the goods they double-spent for (access to website, download, whatever). The merchants are left holding the bag with "invalid" coins, unless they wait that magical "few blocks" (and how can they know how many?) before treating the spender as having paid.
The consumers won't do this if they spend their coin and it takes an hour to clear before they can do what they spent their coin on. The merchants won't do it if there's no way to charge back a customer when they find the that their coin is invalid because the customer has doublespent.
This is a version 2 problem that I believe can be solved fairly satisfactorily for most applications.
The race is to spread your transaction on the network first. Think 6 degrees of freedom -- it spreads exponentially. It would only take something like 2 minutes for a transaction to spread widely enough that a competitor starting late would have little chance of grabbing very many nodes before the first one is overtaking the whole network. During those 2 minutes, the merchant's nodes can be watching for a double-spent transaction. The double-spender would not be able to blast his alternate transaction out to the world without the merchant getting it, so he has to wait before starting.
If the real transaction reaches 90% and the double-spent tx reaches 10%, the double-spender only gets a 10% chance of not paying, and 90% chance his money gets spent. For almost any type of goods, that's not going to be worth it for the scammer.
Information based goods like access to website or downloads are non-fencible. Nobody is going to be able to make a living off stealing access to websites or downloads. They can go to the file sharing networks to steal that. Most instant-access products aren't going to have a huge incentive to steal.
If a merchant actually has a problem with theft, they can make the customer wait 2 minutes, or wait for something in e-mail, which many already do. If they really want to optimize, and it's a large download, they could cancel the download in the middle if the transaction comes back double-spent. If it's website access, typically it wouldn't be a big deal to let the customer have access for 5 minutes and then cut off access if it's rejected. Many such sites have a free trial anyway.
Satoshi
[in response to a question about scale]
100,000 block generating nodes is a good ballpark large-scale size to think about. Propagating a transaction across the whole network twice would consume a total of US$ 0.02 of bandwidth at today's prices. In practice, many would be burning off excess allocated bandwidth or unlimited plans with one of the cheaper backbones. There could be millions of SPV clients. They only matter in how many transactions they generate. If they pay 1 or 2 cents transaction fees, they pay for themselves. I've coded it so you can pay any optional amount of transaction fees you want. When the incentive subsidy eventually tapers off, it may be necessary to put a market-determined transaction fee on your transactions to make sure nodes process them promptly.
To think about what a really huge transaction load would look like, I look at the existing credit card network. I found some more estimates about how many transactions are online purchases. It's about 15 million tx per day for the entire e-commerce load of the Internet worldwide. At 1KB per transaction, that would be 15GB of bandwidth for each block generating node per day, or about two DVD movies worth. Seems do-able even with today's technology.
Important to remember, even if Bitcoin caught on at dot-com rates of growth, it would still take years to become any substantial fraction of all transactions. I believe hardware has already recently become strong enough to handle large scale, but if there's any doubt about that, bandwidth speeds, prices, disk space and computing power will be much greater by the time it's needed.
Satoshi
One other question I had... What prevents the single node with the most CPU power from generating and retaining the majority of the BitCoins? If every node is working independently of all others, if one is significantly more powerful than the others, isn't it probable that this node will reach the proper conclusion before other nodes? An underpowered node may get lucky once in a while, but if they are at a significant horsepower advantage I would expect the majority of BitCoins to be generated by the most powerful node.
It's not like a race where if one car is twice as fast, it'll always win. It's an SHA-256 that takes less than a microsecond, and each guess has an independent chance of success. Each computer's chance of finding a hash collision is linearly proportional to it's CPU power. A computer that's half as fast would get half as many coins.
[question about what to backup]
The files are in "%appdata%\Bitcoin", that's the directory to backup.
%appdata% is per-user access privilege. Most new programs like Firefox store their settings files there, despite the headwind of Microsoft changing the directory name with every Windows release and being full of spaces and so long it runs off the screen.
[question about what to backup]
The directory is "%appdata%\Bitcoin" It has spaces in it so you need the quotes cd "%appdata%\bitcoin"
On XP it would typically be: C:\Documents and Settings[username]\Application Data\Bitcoin
Backup that whole directory. All data files are in that directory. There are no temporary files.
[question about what to backup]
The crucial file to backup is wallet.dat. If bitcoin is running then you have to backup the whole %appdata%\bitcoin directory including the database subdirectory, but even if it's not running it certainly feels safer to always backup the whole directory.
The database unfortunately names its files "log.0000000001". To the rest of the world, "log" means delete-at-will, but to database people it means delete-and-lose-everything-in-your-other-files. I tried to put them out of harm's way by putting them in the database subdirectory. Later I'll write code to flush the logs after every wallet change so wallet.dat will be standalone safe almost all the time.
You know, I think there were a lot more people interested in the 90's, but after more than a decade of failed Trusted Third Party based systems (Digicash, etc), they see it as a lost cause. I hope they can make the distinction that this is the first time I know of that we're trying a non-trust-based system.
Yea, that was the primary feature that caught my eye. The real trick will be to get people to actually value the Bitcoins so that they become currency.
Hal sort of alluded to the possibility that it could be seen as a long-odds investment. I would be surprised if 10 years from now we're not using electronic currency in some way, now that we know a way to do it that won't inevitably get dumbed down when the trusted third party gets cold feet.
Once it gets bootstrapped, there are so many applications if you could effortlessly pay a few cents to a website as easily as dropping coins in a vending machine.
[this next bit turned out to be very controversial. there is extreme prejudice against spam solutions, especially proof-of-work.]
It can already be used for pay-to-send e-mail. The send dialog is resizeable and you can enter as long of a message as you like. It's sent directly when it connects. The recipient doubleclicks on the transaction to see the full message. If someone famous is getting more e-mail than they can read, but would still like to have a way for fans to contact them, they could set up Bitcoin and give out the IP address on their website. "Send X bitcoins to my priority hotline at this IP and I'll read the message personally."
Subscription sites that need some extra proof-of-work for their free trial so it doesn't cannibalize subscriptions could charge bitcoins for the trial.
[again, I don't know why I'm including this, as it's best to stay away from claims about spam. people automatically react violently against any suggestion of a spam solution.]
Spammer botnets could burn through pay-per-send email filters trivially (as usual, the costs would fall on people other than the botnet herders & spammers).
Then you could earn a nice profit by setting up pay-per-send e-mail addresses and collecting all the spam money. You could sell it back to spammers who don't have big enough botnets to generate their own, helping bootstrap the currency's value. As more people catch on, they'll set up more and more phony addresses to harvest it. By the time the book "How I got rich exploiting spammers and you can too" is coming out, there'll be too many fake addresses and the spammers will have to give up.
- Spammer botnets could burn through pay-per-send email filters trivially If POW tokens do become useful, and especially if they become money, machines will no longer sit idle. Users will expect their computers to be earning them money (assuming the reward is greater than the cost to operate). A computer whose earnings are being stolen by a botnet will be more noticeable to its owner than is the case today, hence we might expect that in that world, users will work harder to maintain their computers and clean them of botnet infestations.
One more factor that would mitigate spam if POW tokens have value: there would be a profit motive for people to set up massive quantities of fake e-mail accounts to harvest POW tokens from spam. They'd essentially be reverse-spamming the spammers with automated mailboxes that collect their POW and don't read the message. The ratio of fake mailboxes to real people could become too high for spam to be cost effective.
The process has the potential to establish the POW token's value in the first place, since spammers that don't have a botnet could buy tokens from harvesters. While the buying back would temporarily let more spam through, it would only hasten the self-defeating cycle leading to too many harvesters exploiting the spammers.
Interestingly, one of the e-gold systems already has a form of spam called "dusting". Spammers send a tiny amount of gold dust in order to put a spam message in the transaction's comment field. If the system let users configure the minimum payment they're willing to receive, or at least the minimum that can have a message with it, users could set how much they're willing to get paid to receive spam.
The last thing we need is to deploy a system designed to burn all available cycles, consuming electricity and generating carbon dioxide, all over the Internet, in order to produce small amounts of bitbux to get emails or spams through.
Can't we just convert actual money in a bank account into bitbux -- cheaply and without a carbon tax? Please?
Ironic if we end up having to choose between economic liberty and conservation.
Unfortunately, proof of work is the only solution I've found to make p2p e-cash work without a trusted third party. Even if I wasn't using it secondarily as a way to allocate the initial distribution of currency, PoW is fundamental to coordinating the network and preventing double-spending.
If it did grow to consume significant energy, I think it would still be less wasteful than the labour and resource intensive conventional banking activity it would replace. The cost would be an order of magnitude less than the billions in banking fees that pay for all those brick and mortar buildings, skyscrapers and junk mail credit card offers.
Satoshi
BTW I don't remember if we talked about this, but the other day some people were mentioning secure timestamping. You want to be able to prove that a certain document existed at a certain time in the past. Seems to me that bitcoin's stack of blocks would be perfect for this.
Indeed, Bitcoin is a distributed secure timestamp server for transactions. A few lines of code could create a transaction with an extra hash in it of anything that needs to be timestamped. I should add a command to timestamp a file that way.
From a thread on p2presearch which starts with my rant about trust being the root weakness of all conventional financial systems. http://listcultures.org/pipermail/p2presearch_listcultures.org/2009-February/thread.html
I've developed a new open source P2P e-cash system called Bitcoin. It's completely decentralized, with no central server or trusted parties, because everything is based on crypto proof instead of trust. Give it a try, or take a look at the screenshots and design paper:
Download Bitcoin v0.1 at http://www.bitcoin.org
The root problem with conventional currency is all the trust that's required to make it work. The central bank must be trusted not to debase the currency, but the history of fiat currencies is full of breaches of that trust. Banks must be trusted to hold our money and transfer it electronically, but they lend it out in waves of credit bubbles with barely a fraction in reserve. We have to trust them with our privacy, trust them not to let identity thieves drain our accounts. Their massive overhead costs make micropayments impossible.
A generation ago, multi-user time-sharing computer systems had a similar problem. Before strong encryption, users had to rely on password protection to secure their files, placing trust in the system administrator to keep their information private. Privacy could always be overridden by the admin based on his judgment call weighing the principle of privacy against other concerns, or at the behest of his superiors. Then strong encryption became available to the masses, and trust was no longer required. Data could be secured in a way that was physically impossible for others to access, no matter for what reason, no matter how good the excuse, no matter what.
It's time we had the same thing for money. With e-currency based on cryptographic proof, without the need to trust a third party middleman, money can be secure and transactions effortless.
One of the fundamental building blocks for such a system is digital signatures. A digital coin contains the public key of its owner. To transfer it, the owner signs the coin together with the public key of the next owner. Anyone can check the signatures to verify the chain of ownership. It works well to secure ownership, but leaves one big problem unsolved: double-spending. Any owner could try to re-spend an already spent coin by signing it again to another owner. The usual solution is for a trusted company with a central database to check for double-spending, but that just gets back to the trust model. In its central position, the company can override the users, and the fees needed to support the company make micropayments impractical.
Bitcoin's solution is to use a peer-to-peer network to check for double-spending. In a nutshell, the network works like a distributed timestamp server, stamping the first transaction to spend a coin. It takes advantage of the nature of information being easy to spread but hard to stifle. For details on how it works, see the design paper at http://www.bitcoin.org/bitcoin.pdf
The result is a distributed system with no single point of failure. Users hold the crypto keys to their own money and transact directly with each other, with the help of the P2P network to check for double-spending.
Satoshi Nakamoto http://www.bitcoin.org
Martien van Steenbergen Martien at AardRock.COM Thu Feb 12 08:40:53 CET 2009
Very interesting. Is this akin to David Chaum's anonymous digital money? His concept makes sure money is anonymous unless it is compromised, i.e. the same money spent more than once. As soon as it's compromised, the 'counterfeiter' is immediately publicly exposed.
Also, in bitcoin, is there a limited supply of money (that must be managed)? Or is money created exaclty at the moment of transaction?
Succes en plezier,
Martien.
Very interesting. Is this akin to David Chaum's anonymous digital money? His concept makes sure money is anonymous unless it is compromised, i.e. the same money spent more than once. As soon as it's compromised, the 'counterfeiter' is immediately publicly exposed.
It's similar in that it uses digital signatures for coins, but different in the approach to privacy and preventing double-spending. The recipient of a Bitcoin payment is able to check whether it is the first spend or not, and second-spends are not accepted. There isn't an off-line mode where double-spenders are caught and shamed after the fact, because that would require participants to have identities.
To protect privacy, key pairs are used only once, with a new one for every transaction. The owner of a coin is just whoever has its private key.
Of course, the biggest difference is the lack of a central server. That was the Achilles heel of Chaumian systems; when the central company shut down, so did the currency.
Also, in bitcoin, is there a limited supply of money (that must be managed)? Or is money created exaclty at the moment of transaction?
There is a limited supply of money. Circulation will be 21,000,000 coins. Transactions only transfer ownership.
Thank you for your questions,
Satoshi
Reminds me of:
* AardRock » Wizard Rabbit Treasurer <http://wiki.aardrock.com/Wizard_Rabbit_Treasurer>; and * AardRock » Pekunio <http://wiki.aardrock.com/Pekunio>
Indeed, it is much like Pekunio in the concept of spraying redundant copies of every transaction to a number of peers on the network, but the implementation is not a reputation network like Wizard Rabbit Treasurer. In fact, Bitcoin does not use reputation at all. It sees the network as just a big crowd and doesn't much care who it talks to or who tells it something, as long as at least one of them relays the information being broadcast around the network. It doesn't care because there's no way to lie to it. Either you tell it crypto proof of something, or it ignores you.
Are you familiar with Ripple?
As trust systems go, Ripple is unique in spreading trust around rather than concentrating it.
[I've been asked at least 4 other times "have you heard of Ripple?"]
how operational is your project? how soon do you think people will be able to use it in real life?
It's fully operational and the network is growing. If you try the software, e-mail me your Bitcoin address and I'll send you a few coins.
We just need to spread the word and keep getting more people interested.
Here's a link to the original introduction of the paper on the Cryptography mailing list. (Inflation issues were superseded by changes I made later to support transaction fees and the limited circulation plan. This link is a moving target, this archive page is just a certain number of days back and the discussion will keep scrolling off to the next page.) http://www.mail-archive.com/cryptography@metzdowd.com/mail3.html
A little follow up when the software was released. http://www.mail-archive.com/cryptography@metzdowd.com/mail2.html
My description of how Bitcoin solves the Byzantine Generals' problem: http://www.bitcoin.org/byzantine.html