<p>In addition to the technical factors mentioned by MCCCS, it's important to consider economical factors as well.</p>
<p>If the problem being solved has value outside of the Bitcoin network, it allows miners to essentially &quot;double dip&quot; on the rewards - they earn both from the Bitcoin received as block rewards, as well as the incentive structure off chain.</p>
<p>For example, if the problem being solved is character recognition, it would enable a number of companies who seek good character parsing systems, such as Google, self driving car companies, etc, to double dip. These companies are then incentivized to build a a mining farm to not only train their programs, but also use that training to earn Bitcoin, subsidizing the operation they're already doing.</p>
<p>Being such large companies, their primary goal is likely to have a good text recognition system - the value of Bitcoin earned is secondary. This allows them to invest much more into their mining farms, potentially outstripping other miners who do not have a dual incentive. Moreover, as they get paid twice, it is in their favour to attempt to resolve minor reorgs to build on top of their blocks - they are already subsidized via the off chain incentive, so the cost of losing a block proportional to their operating cost is much lower, allowing them to take riskier routes to resolving minor forks.</p>
<p>This also reduces the cost of mounting attacks - if the mining power required to launch an attack is subsidized by external incentives, it is easier to pay for and acquire.</p>
<p>This also changes the reward structure overall - if the majority of the earnings for a miner are from an outside source, they are less concerned with the effects of bad blocks, 51% attacks, or other bitcoin issues that drop the value of bitcoin. The risk:reward calculation for attacking the chain becomes skewed, allowing for high reward attacks to have a lower cost than in a single use system.</p>

CC BY-SA 4.0
2020-07-17T17:38:22.513Z
Too bad they didn't pick protein folding. High utility, low value of each one.
Joshua
CC BY-SA 4.0
2020-07-16T10:16:35.343Z
2020-07-16T11:40:30.130Z
2020-07-16T11:40:30.130Z
Raghav Sood
<p>The problem is that one can find a proof of work algorithm that gives a useful output. However, it may not stay useful forever. When the research is done, it will have to be replaced. When proof of work is replaced, years of research about ASIC designing for a specific algorithm is waster. The CPU =&gt; GPU =&gt; ASIC cycle starts again. In the first two stages of cycle, the coin is vulnerable to botnets. Since we're in the ASIC stage in Bitcoin, botnets would be relatively significantly inefficient, and there's no fear of a new miner coming in and <a href="https://www.reddit.com/r/Bitcoin/comments/o6qwx" rel="nofollow noreferrer">killing the coin</a>.</p>
<p>It is also unadvisable for a coin to have the same PoW algorithm as a coins with a larger hashrate, in which case the difficulty adjusting algorithm is abused and blocks are only feasible when the difficulty value drops.</p>
<blockquote>
<p>But why not use ideas from captchas of which the usage can be monetarized (e.g. by improving character recognition systems)?</p>
</blockquote>
<p>Because the most of proof of works aren't reusable. I can request a proof-of-work for a math problem but once you're done, there's no trustless way of generating original problems.</p>

CC BY-SA 4.0
2020-07-17T09:04:39.897Z
Changing the PoW puzzle also involves centralised mechanisms like checkpoints, doesn't it?
Chris Chen
CC BY-SA 4.0
2020-07-17T09:30:16.000Z
Yes, the Bitcoin protocol developers would be accused of conflict of interest. "We all know that the ASIC producer X who can't compete anymore paid you to change it!"
MCCCS
CC BY-SA 4.0
2020-07-17T09:36:58.423Z
I also remember that Satoshi himself said the idea of Bitcoin was originated from Nick Szabo's Bitgold proposal and Wei Dai's b-money proposal (https://satoshi.nakamotoinstitute.org/posts/bitcointalk/249/), while Hal Finney's RPOW (Reusable Proofs of Work) is "a variant of bit gold". I think that "trustless", "decentralization" and "reusable" should be deeply in the DNA of Bitcoin.
Chris Chen
CC BY-SA 4.0
2020-07-16T09:49:22.543Z
2020-07-16T09:49:22.543Z
MCCCS
<blockquote>
<p>I wonder why the proof-of-work under no circumstances may be usable.</p>
</blockquote>
<p>Proof of work <em>is</em> useful: it allows a network of untrusted participants to reach consensus without the need for a trusted party.</p>
<p>As others have mentioned, making the work useful in other ways actually reduces this network security, as the cost of attack is subsidized by the external usefulness of the work.</p>
<blockquote>
<p>Is a crypto currency system unconceivable where the user must pass the results of the proof-of-work to a central instance which can use them?</p>
</blockquote>
<p>If the user would need the approval of the centralized party in order to add the next block, then this would be a huge security risk to the network: the centralized party would have the ability to arbitrarily censor users and transactions from participating. This is very unattractive, nobody should want to participate in a system that they might be unfairly censored from.</p>
<p>If the user would not need approval from the central party to add the next block, then how is the validity of their solution determined?</p>
<hr />
<p>A good PoW algo will be hard to compute but easy to verify, and it should include a method to adjust the network difficulty.</p>
<p>In addition to this, the proof-of-work must somehow be tied to the specific block and transactions that are being mined. A good proof-of-work cannot just be some useful-equation-solution that has been arbitrarily attached to a block, that wouldn't provide much security at all!</p>
<p>As example: you wouldn't want a user to be able to take the solutions to past problems, build new blocks to attach them to, and then start broadcasting a conflicting history to network peers. By what method would a new network peer be able to decide <em>which</em> blockchain history is the correct one? It wouldn't be possible, since the work would not be inherently tied to any block.</p>
<p>On the other hand, energy spent on Bitcoin's proof-of-work <a href="https://bitcoin.stackexchange.com/questions/83951/how-does-proof-of-work-inspire-trust-when-the-work-is-just-guessing/83953#83953">inspires trust</a> in the security of the network history, and in doing so it irrevocably attaches specific transactions to specific blocks.</p>

CC BY-SA 4.0
2020-07-17T08:02:19.433Z
2020-07-17T11:39:53.890Z
2020-07-17T11:39:53.890Z
chytrik
<p>I wonder why the <a href="https://en.wikipedia.org/wiki/Proof_of_work" rel="noreferrer">proof-of-work</a> under no circumstances may be usable. The argument I understand is: If the proof-of-work could be used, its results could be sold, and doing the proof-of-work would cost the user nothing - or even could be valuable - and so would not restrict the usage of the service (e.g. bitcoins).</p>
<p>But why not use ideas from captchas of which the usage can be monetarized (e.g. by improving character recognition systems)?</p>
<p>Is a crypto currency system unconceivable where the user must pass the results of the proof-of-work to a central instance which can use them? (Prohibiting that the user can monetarize them on his own account.)</p>
<p>This would make crypto currencies much more sustainable than they currently are.</p>

CC BY-SA 4.0
2020-07-16T09:42:01.450Z
Here's an example of a useful proof of work: https://primecoin.io/about.php#advantages-xpm
MCCCS
CC BY-SA 4.0
2020-07-17T07:18:25.233Z
Related, if not a duplicate of: https://bitcoin.stackexchange.com/questions/331/is-there-a-way-to-set-up-proof-of-work-systems-so-they-would-be-even-more-useful
chytrik
CC BY-SA 4.0
2020-07-17T09:41:27.753Z
https://satoshi.nakamotoinstitute.org/posts/bitcointalk/337 "The heat from your computer is not wasted if you need to heat your home." However this is not quite a convincing argument because in reality the heat generated is barely utilised. There are experimental/conceptual products like "mining heater" but its maintenance burden (the machine may malfunction, then it must be repaired or even discarded) and obsoletion (newly developed mining equipments will be always more powerful and energy-efficient) may overweight its potential profits.
Chris Chen
<mining-profitability><currencies><proof-of-work>
Beginner's question: Why must proof-of-work be useless?
Hans-Peter Stricker
# Beginner's question: Why must proof-of-work be useless?

(Asked by: username_0 on 2020-07-16)

I wonder why the [proof-of-work](https://en.wikipedia.org/wiki/Proof_of_work) under no circumstances may be usable. The argument I understand is: If the proof-of-work could be used, its results could be sold, and doing the proof-of-work would cost the user nothing - or even could be valuable - and so would not restrict the usage of the service (e.g. bitcoins).

But why not use ideas from captchas of which the usage can be monetarized (e.g. by improving character recognition systems)?

Is a crypto currency system unconceivable where the user must pass the results of the proof-of-work to a central instance which can use them? (Prohibiting that the user can monetarize them on his own account.)

This would make crypto currencies much more sustainable than they currently are.

**Tags:** mining-profitability, currencies, proof-of-work

> **Comments:**
> **username_1**: Here's an example of a useful proof of work: https://primecoin.io/about.php#advantages-xpm  
> **username_2**: Related, if not a duplicate of: https://bitcoin.stackexchange.com/questions/331/is-there-a-way-to-set-up-proof-of-work-systems-so-they-would-be-even-more-useful  
> **username_3**: https://satoshi.nakamotoinstitute.org/posts/bitcointalk/337 "The heat from your computer is not wasted if you need to heat your home." However this is not quite a convincing argument because in reality the heat generated is barely utilised. There are experimental/conceptual products like "mining heater" but its maintenance burden (the machine may malfunction, then it must be repaired or even discarded) and obsoletion (newly developed mining equipments will be always more powerful and energy-efficient) may overweight its potential profits.  

---

## 3 answers

### Answer by username_4 on 2020-07-16. Score: 10

In addition to the technical factors mentioned by username_1, it's important to consider economical factors as well.

If the problem being solved has value outside of the Bitcoin network, it allows miners to essentially "double dip" on the rewards - they earn both from the Bitcoin received as block rewards, as well as the incentive structure off chain.

For example, if the problem being solved is character recognition, it would enable a number of companies who seek good character parsing systems, such as Google, self driving car companies, etc, to double dip. These companies are then incentivized to build a a mining farm to not only train their programs, but also use that training to earn Bitcoin, subsidizing the operation they're already doing.

Being such large companies, their primary goal is likely to have a good text recognition system - the value of Bitcoin earned is secondary. This allows them to invest much more into their mining farms, potentially outstripping other miners who do not have a dual incentive. Moreover, as they get paid twice, it is in their favour to attempt to resolve minor reorgs to build on top of their blocks - they are already subsidized via the off chain incentive, so the cost of losing a block proportional to their operating cost is much lower, allowing them to take riskier routes to resolving minor forks.

This also reduces the cost of mounting attacks - if the mining power required to launch an attack is subsidized by external incentives, it is easier to pay for and acquire.

This also changes the reward structure overall - if the majority of the earnings for a miner are from an outside source, they are less concerned with the effects of bad blocks, 51% attacks, or other bitcoin issues that drop the value of bitcoin. The risk:reward calculation for attacking the chain becomes skewed, allowing for high reward attacks to have a lower cost than in a single use system.

> **Comments:**
> **username_5**: Too bad they didn't pick protein folding. High utility, low value of each one.  

---

### Answer by username_1 on 2020-07-16. Score: 4

The problem is that one can find a proof of work algorithm that gives a useful output. However, it may not stay useful forever. When the research is done, it will have to be replaced. When proof of work is replaced, years of research about ASIC designing for a specific algorithm is waster. The CPU => GPU => ASIC cycle starts again. In the first two stages of cycle, the coin is vulnerable to botnets. Since we're in the ASIC stage in Bitcoin, botnets would be relatively significantly inefficient, and there's no fear of a new miner coming in and [killing the coin](https://www.reddit.com/r/Bitcoin/comments/o6qwx).

It is also unadvisable for a coin to have the same PoW algorithm as a coins with a larger hashrate, in which case the difficulty adjusting algorithm is abused and blocks are only feasible when the difficulty value drops.

> But why not use ideas from captchas of which the usage can be monetarized (e.g. by improving character recognition systems)?

Because the most of proof of works aren't reusable. I can request a proof-of-work for a math problem but once you're done, there's no trustless way of generating original problems.

> **Comments:**
> **username_3**: Changing the PoW puzzle also involves centralised mechanisms like checkpoints, doesn't it?  
> **username_1**: Yes, the Bitcoin protocol developers would be accused of conflict of interest. "We all know that the ASIC producer X who can't compete anymore paid you to change it!"  
> **username_3**: I also remember that Satoshi himself said the idea of Bitcoin was originated from Nick Szabo's Bitgold proposal and Wei Dai's b-money proposal (https://satoshi.nakamotoinstitute.org/posts/bitcointalk/249/), while Hal Finney's RPOW (Reusable Proofs of Work) is "a variant of bit gold". I think that "trustless", "decentralization" and "reusable" should be deeply in the DNA of Bitcoin.  

---

### Answer by username_2 on 2020-07-17. Score: 3

> I wonder why the proof-of-work under no circumstances may be usable.

Proof of work *is* useful: it allows a network of untrusted participants to reach consensus without the need for a trusted party.

As others have mentioned, making the work useful in other ways actually reduces this network security, as the cost of attack is subsidized by the external usefulness of the work.

> Is a crypto currency system unconceivable where the user must pass the results of the proof-of-work to a central instance which can use them?

If the user would need the approval of the centralized party in order to add the next block, then this would be a huge security risk to the network: the centralized party would have the ability to arbitrarily censor users and transactions from participating. This is very unattractive, nobody should want to participate in a system that they might be unfairly censored from.

If the user would not need approval from the central party to add the next block, then how is the validity of their solution determined?

---

A good PoW algo will be hard to compute but easy to verify, and it should include a method to adjust the network difficulty.

In addition to this, the proof-of-work must somehow be tied to the specific block and transactions that are being mined. A good proof-of-work cannot just be some useful-equation-solution that has been arbitrarily attached to a block, that wouldn't provide much security at all!

As example: you wouldn't want a user to be able to take the solutions to past problems, build new blocks to attach them to, and then start broadcasting a conflicting history to network peers. By what method would a new network peer be able to decide *which* blockchain history is the correct one? It wouldn't be possible, since the work would not be inherently tied to any block.

On the other hand, energy spent on Bitcoin's proof-of-work [inspires trust](https://bitcoin.stackexchange.com/questions/83951/how-does-proof-of-work-inspire-trust-when-the-work-is-just-guessing/83953#83953) in the security of the network history, and in doing so it irrevocably attaches specific transactions to specific blocks.


---

