Monero supply is auditable. Every time you make a transaction, you have to mathematically prove you have the amount you spent. All you have to do is verify every proofs.
Sure, the maths involved is more complex than a simple summation, but it's still maths at the end of the day. The robustness of bulletproof (the proving scheme used) has been proven mathematically, the likelyhood of crafting fake proofs is metaphorically the same as being able to mine bitcoin blocks without having to do proof of work.
(the metaphor is somewhat accurate, bulletproof literally relies on the robustness of hash functions to be safe)
With that knowledge, let's imagine how an inflation bug would look like. A bug means there's something wrong in the verification process. On bitcoin, the code would not detect an invalid transaction (because it's buggy) but anyone who knows how to sum numbers will spot that something wrong is going on.
On monero, the code would not detect it, but anyone who knows how to verify proofs will spot something wrong is going on. It's pretty much the same.
It's a bit scary because we all know how to sum stuffs (but really there isn't as many people who know how to write code that sums all UTXO), while we don't necessarily know how to verify these proofs, but there are multiple implementation of verifiers, audited and well tested.
If you're not scared of maths, I highly encourrage reading Zero To Monero, it's not that hard and really demystifies the protocol. It's not a magic black box, it's just good old maths.
And finally, I believe there's still plenty of stuffs to improve bitcoin privacy without having to go as far as obfuscating transaction amounts. If we manage to improve anonymity sets, amounts will be obfuscated by being distributed into multiple uncorrelable UTXOs (the uncorrelable is the hard part).
Do you have a link for zero to monero?
Also what do you think about pay joins and ecash/fedi?
https://www.getmonero.org/library/
Ecash/fedimint are a great invention and used under the right circumstances they are a wonderful thing.
The community is about to finish a Nostr client and there is already a bounty to implement ecash on top of Monero.
Because from a pure privacy perfect ecash is a great extension (if also pairs with other privacy tech like i2p) where custody is already given up and is limited in reach and time.
Think gift cards, in conference/festival tokens to buy food and drinks, casinos,....
This all seems like nonsense. I like Monero, but I don't trust the supply to be verifiably limited. You basically have to trust the protocol itself in order to trust the "proofs" you describe, as I understand it; they're not actual proof, you're relying on an assumption.
I’m trying to keep an open mind but this is basically how it sounds to me. Relies on a lot of trust.
Yall are incorrect that there is significantly more trust than you already put in bitcoin.
Range proofs have been around for a looong time and are well understood.
How do you know the Monero network rejects malicious nodes like you know with the Bitcoin network?
For me as a Monero user, the answer is "blind hope."
He is precisely correct.
A monero transaction must prove no its inputs and output equal zero to meet consensus agreements.
We can prove that without knowing the amounts involved because of zero knowledge proofs.
This isn't rocket science,you are already trusting more complicated maths using bitcoin.
Replied to this already but can't see my reply now so saying it again:
I don't know if it's true that the maths I trust in Bitcoin are more complicated.
I do know the maths I trust in Bitcoin have been tested and proven by the smartest people on earth with very high stakes beyond anything we've seen with "zero knowledge proofs."
I'm not sure what you mean by "there is no proof". Proving you own the private key that can spend a UTXO without revealing that private key (asymetric cryptography) is also complex math, but pretty much everyone is trusting this math and has likely never tried to do it by hand. That's also a mathematical proof, although the assumption being made that it cannot be faked are vastly different.
Maybe I should have mentioned, "bulletproof" is a proving scheme that comes from academic cryptographers, just like SHA256, ECDSA and Schnorr signatures used by Bitcoin, it's not a Monero-specific protocol, although it's likely its biggest user. It follows the same scrutiny from bright and smart people.
At best we could argue zero knowledge proofs are younger than the other cryptographic primitives I mentioned, and we might want to wait to see if new schemes can offer different speed or proof size. But I believe the fear against them is largely unfounded now.
Anyway, as I said, I'm not a zero-knowledge maximalist, they are a means to an end, and the end is large anonymity sets, make multiple users indistinguishable from one another. Maybe we could manage to reach that end differently. But in our search for solutions, it would be a shame to not take into consideration the track record that some of them already have.
You pretty much get it. It's the fact that zero knowledge proofs are younger.
I also do think a lot about how a privacy token could work while having verifiable supply. The best option I've thought of so far would work like this:
There are no UTXOs, every unit of the currency has a keypair.
Every time there's a new block, every keypair changes based on seeds.
To send a transaction, you say to a network node "here's an encrypted message with moneys in it for a certain pubkey"
To confirm a transaction, the recipient says to the network "here are some moneys and their old keys and some new keys for them to change to"
To retain anonymity, the sender and recipient can also listen for other network nodes sending the same kind of messages, and they can all mix in fake spam messages without blocking each other for it, within reason. You can also just pay a transaction fee to manually cycle your seeds now and then, or to cycle additional seeds other than the ones you're sending or receiving every time you send or receive any.
I'm kinda retarded and sometimes miss obvious flaws in my ideas but I'm pretty sure this would work or is close to something that would
I should clarify: this should result in the network easily knowing what units of currency there are, with chainalysis being much more difficult to perform / easier to evade compared to Bitcoin - anonymity still wouldn't be a blanket guarantee, if I'm wrapping my head around my own idea correctly
This is also my first time writing it all down so I might be missing parts of my thoughts. Like I just realized I'm pretty sure the point of having keypairs cycle based on seeds was to let partial chunks of the network operate in isolation e.g. your home server saying "leave verifying these keys up to me and those I transact with" and then staying connected to the network constantly cycling all its seeds without transaction fees and without the network knowing which ones are for new transactions and which ones aren't.
Also to be clear this wouldn't be a free lunch, the constant connection to the network would be used for the network's functionality instead of paying fees.
It is not plausible to suggest zero knowledge proofs are unreliable because "they are younger"
They've been around since the 80s and are well understood.
People have been talking about adding them to bitcoin since forever. I'm not aware of *anyone* who is opposed because they're skeptical of their mathematical properties.
Here Hal discussing them back in the day.
https://cointelegraph.com/news/bitcoin-pioneer-hal-finney-talks-zero-knowledge-proofs-newly-surfaced-video
Zero knowledge proofs in the context of cryptocurrency have been much less tested than the cryptographic signatures and other complex components of Bitcoin. I don't know why I keep having to explain this in different words here. Both Bitcoin and Monero have complex components that most users can't be expected to understand directly, but with Bitcoin those components were broken and fixed in world war 2 and with Monero those components are being tested for the first time.
By the way, I think most users can and should read about the basic premises of public-key cryptography and zero-knowledge proofs. But most users might not ever have any idea how to sign a Bitcoin transaction or verify a Monero wallet amount by hand without having software handle it for them.
This is just incorrect.
ECDSA was not standardized until 2005.
Relying on ECDSA without question but being suspicious of Pedersen committments is weird and arbitrary.
I have zero logical room for doubt that if the cryptography in Bitcoin can be broken by human efforts, it will be. I'd bet the network could survive by freezing and reverting to a previous block and continuing under an updated version of the protocol with different cryptographic standards.
In the mean time, Bitcoin supply is verifiable. A layman can access overwhelming proof that Bitcoin's available on-chain supply is what it's supposed to be, instead of relying on blind hope that the experts know what they're doing.
I don't know why you're refusing to recognize this.
If Monero's supply is perfectly verifiable to the experts out there, I am still waiting for an understandable explanation of how, and so are many other Monero users.
You can't revert without screwing over all the users who just gave away products/services for fake Bitcoin that would go poof. That happens to your blockchain even if it's transparent anyway.
Bitcoin is verifiable with "napkin math" but we both know you are never going to do that for billions of transactions.
You simply run a node like any Monero users would (If you are the tiny fraction that even runs a node) and "blindly trust"
For that "advantage" that almost no one takes advantage of (no pun intended) you lose fungibility, privacy, targeted-censorship resistance, etc. Cool.
Here you go. Should take all of five minutes for you to understand what pedersen commitments are and the math behind them. Can't dumb it down more than this and we're not going to spoonfeed you just because you're too lazy to learn high school level math.
https://docs.grin.mw/wiki/miscellaneous/switch-commitments/
Got better things to do than expect that link to have useful information, sorry. If you have an explanation, you're free to explain it.
And if you can't explain it, I won't believe you're lying, I will just continue to operate on the assumption that you could be. If that upsets you, you basically just need to chill.
You got better things to do...that's why you're replying to anons on Nostr for the past few days but can't skim a brief introduction on commitments for a couple minutes. Suuuuure lol.
No one is upset. You didn't address anything else I said because you cant.
If you can't click a link that's your own willful ignorance. I really don't care if you do or don't.
You just got very confused very quickly. Sorry about your brain issues, good luck.
Again, that is incorrect.
You trust ECDSA to secure your utxos and ensure only your private key can reassign them.
There is no plausible reason to trust ECDSA but mistrust Pedersen commitments.
Unless you've gone thru every single line of Bitcoin and understand it (no single dev does), then you are "trusting the protocol". Have you gone thru all billion+ transaction inputs/outputs? How about all new transactions every ten minutes? Ok, then you're trusting software that you don't fully understand. Completely different from merely running a node.
Bitcoin relies on cryptographic assumptions too. All cryptocurrencies do.
With Bitcoin, the trust in the protocol is all based on proven understanding. It's not "blind" trust. I don't know how to sign a Bitcoin transaction, but I know Satoshi Nakamoto knew how to sign a Bitcoin transaction.
With Monero, my little trust in the protocol is based purely on blind hope.
You have no clue what you are talking about.
Everything Monero uses is based on proven and understood math and crypto from the 80s it's about as old as Bitcoins tech. Which funny enough you probably don't understand so are trusting too.
https://image.nostr.build/c83c0f72d509c443c3faf801c53b6be145f22fb4a36166c7a1cca5de09046a79.jpg
You don't take advantage of "amounts in the clear" to verify the billion+ txns anyway. No Bitcoiner does. You just run a node and pay no mind like any Monero user would.
I fail to see your advantage if you never do it in practice.
"Can, but doesn't" is essentially the same thing as "Can't"
It's larping
Not sure where you're getting this stuff but no, what you're saying is not correct.
Oddbean new post about login | logout 
