<p>This is actually an economic issue, not a cryptographic one.</p>

<p>Suppose hypothetically that I'm mining, and I'm making a good healthy profit.  I'm naturally going to keep adding more and more computers, to get more and more profit.  But of course, the cryptocurrency can't let me expand forever, because it can't afford to pay me an infinite amount.  It has to lower its payout, to get me to stop gobbling up more and more profit.  I'll finally stop expanding when the cryptocurrency lowers my profit margins to almost nothing.</p>

<p>But, if my profit margins are tiny, then everyone else's are too.  Then that means there's no room for inefficiency.  Anybody who's in a place where electricity is expensive, or where they have to pay for cooling, or where land to build a datacenter is expensive, is not going to be able to make money.</p>

<p>That's why it's rough for home miners to make any money: a home-based mining operation generally isn't as efficient as a carefully optimized datacenter.</p>

<p>However, home-based miners have one advantage: they usually already have a computer that's already paid for, and whose cost can be considered "free" considering that the computer would probably have been doing nothing otherwise.</p>

<p>Memory-based proof of works don't change the basic economic reality that profit margins are going to be super-tight.  But they do make it possible to leverage that "free" computer to get a slightly higher return, insofar as the cost of the computer was a meaningful part of the cost to begin with.</p>

<p>Unfortunately, in my opinion, memory-based proof of works have a flaw: they make it possible to hire a conventional datacenter (say, an Amazon EC2 datacenter) and use it for mining.  That makes it inexpensive to temporarily bring a lot of hashpower online for use in attacks.</p>

<p>For instance, imagine that I had a cryptocurrency with 100,000 nodes, each with a single powerful CPU doing mining.  How much does it cost to rent 101,000 powerful CPUs for an hour, to do a 51% attack?  Answer: a few million dollars.  Very much within the reach of any significant organization.  You couldn't launch a 51% attack against an ASIC-based cryptocurrency for anywhere near that price.</p>

<p>I'm not honestly sure how big a risk 51% attacks are: I'm not sure many people are actually motivated to do that.</p>

CC BY-SA 3.0
2017-11-16T20:00:39.903Z
2017-11-16T20:00:39.903Z
jyelon
<p>May be you could take a look on the next crypto currency named <a href="https://chia.network/" rel="nofollow noreferrer">« Chia »</a> created by Bram Cohen (BitTorrent creator), it's a proof based on the available space on the disks of the miners (farmers). <a href="https://drive.google.com/file/d/0ByHuc4xBso7TaEpWSlozWlpxcVk/view" rel="nofollow noreferrer">He claim this will be more distributed and energy saver</a></p>

CC BY-SA 3.0
2017-11-17T14:14:37.987Z
2017-11-17T14:14:37.987Z
lakano
<p>One major criticism against <a href="https://en.wikipedia.org/wiki/Hashcash" rel="nofollow noreferrer">usual SHA-based proof-of-work systems</a> in main cryptocurrencies (except the ecological concerns) is the fact that, years after years, it's more and more dominated by a minority having developped specific hardware (CPU -> GPU -> FPGA -> ASIC), making it impossible for the average user with a laptop to solve a single proof-of-work problem in a lifetime.</p>

<p><strong>What are nowadays' solutions to this problem?</strong></p>

<ul>
<li><p>I heard about <a href="https://www.cryptolux.org/index.php/Equihash" rel="nofollow noreferrer">Equihash</a>, a memory-hard proof-of-work scheme, linked to the Generalized Birthday problem </p></li>
<li><p>are there other (working) attempts? what are they based on?</p></li>
</ul>

<hash><proof-of-work>
Review of "equitable" proof-of-work systems
Basj
# Review of "equitable" proof-of-work systems

(Asked by: username_0 on 2017-11-16)

One major criticism against [usual SHA-based proof-of-work systems](https://en.wikipedia.org/wiki/Hashcash) in main cryptocurrencies (except the ecological concerns) is the fact that, years after years, it's more and more dominated by a minority having developped specific hardware (CPU -> GPU -> FPGA -> ASIC), making it impossible for the average user with a laptop to solve a single proof-of-work problem in a lifetime.

**What are nowadays' solutions to this problem?**

* I heard about [Equihash](https://www.cryptolux.org/index.php/Equihash), a memory-hard proof-of-work scheme, linked to the Generalized Birthday problem
* are there other (working) attempts? what are they based on?

**Tags:** hash, proof-of-work


---

## 2 answers

### Answer by username_1 on 2017-11-16. Score: 1

This is actually an economic issue, not a cryptographic one.

Suppose hypothetically that I'm mining, and I'm making a good healthy profit. I'm naturally going to keep adding more and more computers, to get more and more profit. But of course, the cryptocurrency can't let me expand forever, because it can't afford to pay me an infinite amount. It has to lower its payout, to get me to stop gobbling up more and more profit. I'll finally stop expanding when the cryptocurrency lowers my profit margins to almost nothing.

But, if my profit margins are tiny, then everyone else's are too. Then that means there's no room for inefficiency. Anybody who's in a place where electricity is expensive, or where they have to pay for cooling, or where land to build a datacenter is expensive, is not going to be able to make money.

That's why it's rough for home miners to make any money: a home-based mining operation generally isn't as efficient as a carefully optimized datacenter.

However, home-based miners have one advantage: they usually already have a computer that's already paid for, and whose cost can be considered "free" considering that the computer would probably have been doing nothing otherwise.

Memory-based proof of works don't change the basic economic reality that profit margins are going to be super-tight. But they do make it possible to leverage that "free" computer to get a slightly higher return, insofar as the cost of the computer was a meaningful part of the cost to begin with.

Unfortunately, in my opinion, memory-based proof of works have a flaw: they make it possible to hire a conventional datacenter (say, an Amazon EC2 datacenter) and use it for mining. That makes it inexpensive to temporarily bring a lot of hashpower online for use in attacks.

For instance, imagine that I had a cryptocurrency with 100,000 nodes, each with a single powerful CPU doing mining. How much does it cost to rent 101,000 powerful CPUs for an hour, to do a 51% attack? Answer: a few million dollars. Very much within the reach of any significant organization. You couldn't launch a 51% attack against an ASIC-based cryptocurrency for anywhere near that price.

I'm not honestly sure how big a risk 51% attacks are: I'm not sure many people are actually motivated to do that.


---

### Answer by username_2 on 2017-11-17. Score: 1

May be you could take a look on the next crypto currency named [« Chia »](https://chia.network/) created by Bram Cohen (BitTorrent creator), it's a proof based on the available space on the disks of the miners (farmers). [He claim this will be more distributed and energy saver](https://drive.google.com/file/d/0ByHuc4xBso7TaEpWSlozWlpxcVk/view)


---

