01:16:46 I think it would be cool for monero to adopt shielded transaction pool from ZCash. Shielded transaction pool does not have transaction graph, but ring signatures do. Transaction graph can be analyzed eventually by neural net AIs. 01:17:26 Shielded transaction pool will not need trusted setup soon. 01:19:49 https://usercontent.irccloud-cdn.com/file/APUxUJgj/5269725.jpg 01:21:37 It seems matrix is better than monero subreddit where people just downvote any mention of other coins.... and refuse to talk. 01:23:08 By the way, I criticize every coin, not just monero... 01:23:27 OK, I'm a little bored... what would it mean to adopt the "shielded pool from Zcash"? 01:23:51 The proving system? The transaction protocol? The actual Merkle tree? 01:27:08 I don't know details. But, you can definitely look into proving system and transaction protocol. 01:28:37 Well, the current Zcash transaction protocol permits avoiding the shielded pools altogether. Or transitioning into or out of or within them. And these situations do not necessarily imply having no transaction graph 01:28:52 As far as I know, none of that is planned to change 01:28:52 The simple fact that I know is that shielded transaction pool doesn't have any transaction graph that can be analyzed. 01:28:56 It seems that removing transaction graph scales better than increasing ring size. 01:29:03 Shielded transactions are not free of metadata 01:30:26 Pirate Chain allows only shielded transactions... Pirate Chain is a sibling of ZCash. 01:31:08 Assuming there is no unshielded transaction, you definitely want to at least figure out what it is about... 01:31:16 What what is about 01:31:42 Do you think no one here understands or follows Zcash dev? 01:31:48 We obviously keep a close eye on developments to see what the best path forward for Monero is. 01:32:26 We disagree (generally) with many of their protocol design choices but that doesn't mean we ignore them or the things they research or develop. 01:33:07 Sadly, they've chosen to expose users to harm by not enforcing shielded transactions and have no plans to change that, but there are definitely pros and cons to their approach to privacy. 01:34:10 How do you compare ring signature with Pirate Chain's shielded transaction pool? I'm curious of what you think. 01:34:46 Right now it requires a trusted setup and has heavy generation and verification costs IIRC, so its not an option. 01:35:13 Maybe Halo 2+ will be interesting to explore more in depth, but not a good solution for Monero at-present. 01:35:14 https://twitter.com/fluffypony/status/1353256285987336194?s=20 01:35:24 A proving system is not a transaction protocol 01:35:28 I continue to say this 01:35:30 That's a good pointer to the mindset of Monero. 01:35:51 Halo 2 is not a transaction protocol 01:35:54 Nor is Halo 01:35:57 etc. 01:36:10 I loved playing halo 2 in the past. 01:36:15 As have many 01:36:16 Ah yes I always conflate the two 😅 01:36:36 Triptych and Arcturus and Lelantus all use zk proving systems with limited anonymity sets 01:38:32 With triptych and arcturus, how large will the ring size be? 01:39:11 Triptych and Arcturus and Lelantus all permit whatever size you want (it actually has a particular exponent form, but whatever) 01:39:33 But this value affects proving and verifying time, and transaction size (but this is logarithmically scaled) 01:40:44 By the way, ZCash and Firo were started by Johns Hopkins university and Israel. Johns Hopkins university and Israel have very strong connection to central banks. Pirate Chain devs said ZCash cannot eliminate transparent tranasctions because they were prevented from doing so by someone above them. Pirate Chain is what ZCash and Firo aspire to be but cannot because they were bought by central banking system and 01:40:45 will need to integrate with central banking system. 01:41:55 This sounds like a discussion specifically about Pirate Chain. Not sure that's on topic for this channel 01:42:35 If you want to discuss technical details about Triptych or Arcturus or Lelantus, that could be more on topic here, I dunno 01:42:50 What will the actual ring size be? 01:43:16 I don't recall a decision being made among Monero communities to specifically adopt a new transaction protocol at this point 01:43:50 As far as I know, verification time is linear. If monero migrates to arcturus or triptych, will the ring size be somewhere near 256,000? 01:44:05 Likely 64-128, but not set yet. 01:44:38 As Sarang said earlier its log, not Lin scaling. 01:44:39 I'll bite. Why 256000 01:44:56 Verification time scales as O(n/lg(n)) 01:44:58 I arbitrarily chose a random large number. 01:45:05 Proof size scales as O(lg(n)) 01:45:19 However 01:45:25 It could be 8000 too. 01:45:28 Verification can benefit from batching in ways that are a bit subtle 01:45:42 This batching can apply similarly across Lelantus, Arcturus, and Triptych 01:45:51 (they all use the same proving system structure underneath) 01:46:47 I suspect anything above 8000 would be too computationally expensive. 01:46:56 Depends on batching 01:47:06 I also suspect there could be chain analysis methods that may see right through rings of any size, given analyzable spending patterns. 01:47:18 Chain analysis companies already see through coin join. 01:47:40 CoinJoin-type operations are interactive 01:47:48 Monero-type operations are non-interactive 01:49:22 By the way, what kind of metadata does shielded transaction pool leak? 01:49:56 Input count, output count, block height, possible network information (depending on network structure), etc. 01:50:08 No transaction in any protocol I've seen is a uniform blob of nothing 01:50:38 If used in a pool-transition protocol, could leak a heck of a lot more, like amount and transparent addresses (and associated graph) 01:51:12 Reducing metadata is important, but eliminating it altogether is not possible 01:51:52 Fee is another piece of metadata, I suppose 01:52:54 Monero surely has a lot of good researchers... 01:53:33 By the way, do you discuss Tari, too? 01:53:39 You're talking to one of the best across the entire ecosystem, not just Monero 😉 01:53:42 Me personally? Not really 01:53:46 I don't follow Tari development 01:53:48 (And its not me lol) 01:53:56 I would not claim to be "one of the best" 01:54:11 I'll claim it for you 01:54:13 Tari seems to be the smart contract layer on top of monero..? 01:54:18 It is not 01:54:19 No 01:54:30 Its only direct link is merge mining. 01:54:32 The Monero protocol does not support such things 01:54:55 sarang: If you know enough to propose triptych, you are a good researcher. 01:55:13 Tari.com and their TG are good resources if you want to learn more, tokineko 01:55:51 Tari claims to be private, and I don't understand how the hell they stay private with different kinds of tokens on blockchain. Tokens are not uniform. 01:56:23 Privacy is a scale, it will not be as private as Monero. 01:56:39 They aim for "good enough" privacy using MimbleWimble. 01:56:43 Last I heard, Tari was investigating Mimblewimble-type approaches 01:56:47 But this channel isn't the best place for that chat. 01:56:58 #monero:matrix.org maybe, or their Telegram 01:57:27 Triptych isn't anything revolutionary. It uses the same base proving system that Lelantus and Arcturus use, which none of those constructions or their authors invented 01:57:49 That proving system was invented by Groth and Kohlweiss, and updated by Bootle (et al?) 01:58:03 tokineko[m], there's a tari channel somewhere 01:58:18 #tari on freenode 01:58:34 It may not be anything new, but monero surely has enough brain power to adapt. 01:59:08 I didn't say it wasn't new :D 01:59:26 And, it's not bought by central banking system. Not yet, at least. 01:59:34 Notify me when you are bought by central bankers. 01:59:50 Working for a bank does not sound that interesting to me... 02:02:38 What other privacy measures do you plan other than ring signature, ringCT, and one-time public address? 02:02:44 Me personally? 02:02:54 you and others. 02:02:59 I can't speak for others 02:03:21 By "ring signature" do you mean "prover/signer-specific anonymity set"? 02:03:37 anonymity set for each transaction. 02:03:39 And by "ringCT" do you mean "the use of Pedersen commitments within a signer-ambiguous transaction protocol"? 02:04:09 I mean hiding transaction amount. I only watched tech introduction videos. I don't know details. 02:04:38 One-time public address hides receiver. RingCT hides amount. Ring signature hides senders inside a ring. 02:04:51 FWIW those terms are often poorly- and non-technically defined 02:05:12 "ring signature" can mean many things in the context of a formal security model, I assure you 02:05:36 I intuit that increasing anonymity set has limits as long as it has transaction graph. 02:05:50 Every protocol has a transaction graph of some kind 02:05:59 It can be made "maximally complex" 02:06:05 for some definition of that phrase 02:06:35 And, monero devs has no plan yet to utilize triptych or arcturus? 02:06:42 * And, monero devs have no plan yet to utilize triptych or arcturus? 02:06:58 a discussion we are having on #monero where you are not sarang 02:07:21 Implementations of Triptych or Arcturus have unanswered questions as of yet 02:07:36 As to anonymity set selection, multisignature algorithms, etc. 02:07:43 It is surprisingly subtle 02:08:13 roughly: on avg is it easier to check historically if a inflation bug was exploited on monero than zcash? 02:08:25 (assuming you know what was exploited to begin with) 02:08:40 There are situations where neither is detectable 02:08:47 and situations where either, or both, is/are detectable 02:08:56 It's not a simple yes/no/this/that 02:09:23 thanks 02:09:37 If the question is "can we guarantee no exploit happened in all cases with either asset" the answer is a definitive "no" 02:10:01 yes, that I was aware 02:10:30 Is this a question about the transparent migration approach that Zcash has used? 02:10:36 oh 02:10:41 they did do that? 02:10:50 I thought they only floated the idea 02:10:52 Between the Sprout and Sapling pools, yes 02:10:55 Yes, its related to that 02:11:08 To be clear, that approach _cannot_ detect inflation within a pool 02:11:33 was it a z to t to new z pool migration? 02:12:10 Yes. Sprout -> Sapling (via a particular tx construction) or Sprout -> Tcash -> Sapling (via separate txns) 02:12:17 ok 02:12:38 so they just deprecated the pool 02:12:47 Kinda sorta not really 02:12:59 A recent change says that no new value may enter the Sprout pool 02:13:07 But Sprout -> Sprout txns are still allowed 02:13:11 inflation could have still happened on sprout 02:13:24 and those coins could have not been moved yet 02:13:24 If inflation happened within that pool, it cannot be detected until/unless "too much" Tcash is seen exiting 02:13:33 because it would be obvious once that would happen? 02:13:39 Should that happen, ECC has said they intend to freeze any additional value 02:13:46 Yup, they just might have been the first out and beaten other users or lost funds 🙃 02:14:06 so yes we were kinda discussing that 02:14:07 Turnstiles just mean first out wins if there is inflation 02:14:26 and how with the inflation bug on Monero luigi1111 and others 02:14:31 where able to check historically 02:14:33 And if you're the one who broke something and inflated supply you would have the advantage getting out in time. 02:14:40 and such thing wasn't possible on sprout 02:14:49 The Monero key image flaw was detectable, and we can 100% say it was not exploited 02:14:55 I guess it obviously depends a lot which bug was exploited to begin with 02:15:14 Exactly, highly dependent. 02:15:17 This is why I said that not all inflation is created equal 02:15:31 There could exist other Monero-related inflation flaws that we don't know about 02:15:39 Is it easy to detect unintended inflation on monero? 02:15:57 and both Zcash and Monero could be subject to inflation if certain cryptographic assumptions are broken (but this is considered _highly_ unlikely) 02:17:34 and there could exist other Zcash-relation inflation flaws that we don't know about 02:17:37 same with Bitcoin 02:17:41 or any asset 02:17:55 This topic is complex 02:18:11 *Zcash-related 02:19:35 Governments and bank counterfeit their own money crazily. At least, we are safe from counterfeiting by governments and banks. 02:19:41 * Governments and banks counterfeit their own money crazily. At least, we are safe from counterfeiting by governments and banks. 02:20:26 Federal reserve even boast the fact that they are counterfeting trillions of US dollars every year. 02:20:33 * Federal reserve even boasts the fact that they are counterfeting trillions of US dollars every year. 02:20:57 It's an interesting thought experiment that a hypothetical Monero protocol could be designed to support transparent migrations 02:21:09 (Note that I think this is a bad idea and do not support such a thing) 02:21:18 transparent migration to what? 02:21:24 Some new output pool 02:21:32 (this is all a thought experiment) 02:21:43 I don't understand what you mean by output pool. 02:21:59 A pool of outputs that could be referenced in future transactions 02:22:01 Something like shielded transaction pool on Pirate Chain? 02:22:05 from the existing output pool to a new one tokineko[m] 02:22:36 Another mention of Pirate for no reason 🙄 02:22:44 Not even subtle 02:22:44 lol 02:22:52 <3 02:23:08 Interestingly, the use of Triptych/Arcturus would require a non-transparent pool migration 02:23:13 I like pirate for some things but the shilling is so obnoxious. 02:23:13 (it would _not_ reveal amounts) 02:23:25 hmm 02:23:28 The reason for this migration is a new key image format 02:23:35 That would be enforced by the protocol at hard fork, correct? 02:23:44 Presumably 02:23:48 Spends have to go through an initial migration before spend? 02:24:02 so two types of key image formats and outputs would need to cohexist on chain? 02:24:06 It would be _possible_ to enforce some kind of amount-revealing migration if people really wanted this (the math is not hard) 02:24:08 "Don't mention other coins" is tribal. 02:24:08 Or would they just be direct from CLSAG->Triptych 02:24:22 If it was even close to on topic sure 02:24:23 sethsimmons: it would be direct 02:24:34 Mention what you want if its helpful to the convoy, tokineko 02:24:36 perhaps "migration" is a poor term 02:24:39 Great 02:24:55 To be 100% clear, I do NOT advocate revealing amounts 02:24:57 Yeah we might need clearer messaging before then 🙂 02:25:10 Absolutely no one here does either that I know of 02:25:26 sarang, so after hard fork every output spent from the previous pool would be migrated into the new output pool? 02:25:30 I am merely stating that the idea of a transparent migration is not somehow impossible with the Monero protocol 02:26:01 Pool reminded me of Pirate Chain and ZCash because I didn't know that monero was using any pool. 02:26:07 ComplyLast: yes, basically 02:26:14 the software would handle it all 02:26:39 I am using the term "pool" to mean "the set of outputs that can be referenced as being possibly consumed in a given transaction" 02:26:53 Good details I wasn't aware of around the move to a new proving system! 02:27:04 sarang, what are your thoughts personally on something akin to what haven is doing with free floating supply? 02:27:13 sethsimmons: AFAIK there are no concrete plans to move to a new proving system 02:27:52 ComplyLast: sorry, I don't know what "free floating supply" means 02:28:27 non predictable rate of supply growth 02:28:38 I'm not an economist 02:28:39 it's more a game theoretical question that a crypto one I guess 02:28:49 I have limited knowledge of what Haven is doing 02:28:56 Will monero adopt mimblewimble? 02:29:00 They're materializing but not set yet, for sure. 02:29:11 A Haven developer did contact me with questions about CLSAG for multi-asset use, but did not reveal their Haven affiliation until later 02:29:13 Not that I have heard of, its not a good fit. 02:29:13 By the way, haven is discontinued by OB1... 02:29:37 sarang, oh I thought they were upfront about it to begin with 02:29:40 Different haven 02:29:41 Also note that I specifically noted to Haven that their use of CLSAG for this purpose had _not_ been reviewed or audited as part of the Monero-related audit 02:30:10 MW is great for scaling but not ideal as the sole privacy solution. 02:30:15 MimbleWimble is touted as a scalability solution that saves HDD space. 02:30:15 and as such, I want to note that I do not vouch for Haven 02:30:31 I guess mimblewimble can save HDD space... 02:30:32 I never though you did :) 02:30:45 I have seen my name mentioned related to Haven's protocol, which I do not like 02:31:07 Their use of CLSAG for multi-asset use was in a small side note in an original version of the CLSAG preprint... we removed it later 02:31:32 Their use of it might be secure, but it might not... I do not know 02:31:33 I've mentioned that to them, they're borderline affiliation scamming sometimes, but I think its more from zeal than malice. 02:31:34 Good intentions that sometimes go wrong. 02:32:40 anyway from reading some of their documentation 02:32:52 sarang: Be proud. They gave you credit. 02:33:07 it does seem that you were somehow more involved that you were in reality hence my questions 02:33:45 They offered to pay me for technical advice, but I instead suggested they consider a donation to a local charity 02:33:46 I was mostly interesting on the game theoretical attack vectors on how to completely disrupt supply on both directions with different types of attacks 02:34:02 this is offtopic at this point though 02:34:55 speaking on attack vectors 02:35:33 not jokingly, do you have any opinion on using external sources of data (i.e oracles) to potentially calculate fee rates for Monero? 02:38:40 That seems inherently gameable 02:38:55 and difficult/challenging/impossible to later verify without trust 02:39:03 yup 02:39:26 I would certainly not personally advocate for such a thing 02:39:40 in Monero or an asset with a similar desired trust model 02:39:55 to follow-up on that do you foresee any scenario where a pure fee market could develop on Monero? 02:39:59 In a different trust model, the answer might be quite different 02:40:21 Again, I'm no economist, and I don't want to speculate on something like that where I have such limited knowledge 02:40:30 sorry 02:40:38 it's not so much from an economical stand point 02:40:51 more of a trade-off given that fees leak metadata 02:41:30 Fees certainly do inherently leak metadata, and there have been proposals to at least stratify them by reducing their precision 02:41:31 so its more a question of instead of tweaking fee rates via hard forks have you envisioned something different? 02:42:24 Removing them entirely would presumably open up the project to easy DoS (AFAIK Zcash is still vulnerable to this in theory?) 02:42:55 ("removing them entirely" == "not enforcing minima that depend on transaction structure") 02:43:17 Yes, removing them entirely doesn't seem like a good solution 02:43:22 By the way, what is the average transaction fee on monero? 02:44:07 tweaking them via hard fork ad eternum is not a great solution either, albeit better than removing them lol 02:46:47 tokineko[m], https://localmonero.co/blocks/block/2281910 check this block 02:47:31 I can't really speak to what kind of fee structure is "optimal" 02:47:46 is that something even on the radar of the MRL? 02:47:48 But I agree that limiting fee-based metadata seems like a generally good idea, if done safely 02:47:53 Why do people pay a lot of fee for the same bytes? 02:48:02 * Why do some people pay a lot of fee for the same bytes? 02:48:07 ComplyLast: others may be thinking about fees 02:48:16 I can't speak for others 02:48:23 I know others are 02:48:27 Great! 02:48:28 even for the next hard fork 02:49:00 but it's more of a tweaking the parameters strategy approach 02:49:33 still reliant on later hard-forks for correction if needed, etc 02:49:39 Someone paid 0.02126342XMR as transaction fee. Someone else paid 0.00001156XMR as transaction fee. Bitcoin transactions felt pretty painful with transaction fee of 0.001 BTC. 02:50:13 Why do people pay different fees? 02:50:47 on that specific example someone loves miners, someone doesn't 02:51:55 people could pay higher fee rates to assure they're included in the next block 02:52:51 I am looking to host a bittorrent tracker are there any subdomains I could get a host added to? 02:53:20 sarang, would a pure fee market approach even be compatible with dynamic blocksizes as they work in monero? 02:53:53 as in each user would be able to pick how much monero per byte they would be willing to pay 02:54:29 I understand this might be less than ideal for privacy reasons 02:54:56 ComplyLast: verification time and space do not scale the same way 02:55:21 At least, not with constructions like BP, BP+, and some other proving systems that are being looked into 02:55:25 When XMR is expensive, it might not be suitable for microtransactions... 02:55:40 you can replace bytes with cost in the question 02:55:52 0.001 BTC is already more than 6 US dollars. I wouldn't pay 6 US dollars as a fee for sending 1 US dollar worth of BTC. 02:55:57 ok not quite grammatically, but whatever 02:56:01 luigi1111w, care to explain? 02:56:21 verification cost, which can include bytes and operations to verify, since it's not linear 02:56:40 oh I see what you mean 02:56:45 that would be an interesting approach 02:58:03 Is Tari like ethereum for monero? 02:58:19 define like ethereum 02:58:32 smart contracts. Codes on blockchain. 02:58:49 tari has smart contract capability yes 02:58:59 and scripting through scriptless scripts 02:59:45 as I mentioned before there's a channel if you're into that :p 03:11:21 Is it more profitable to mine tari and monero than to mine monero alone? 05:56:12 Naughty... 06:12:51 Is it possible to implement something like bisq exchange on top of monero multisig? 06:14:51 MMS 07:16:06 test 07:16:06 Test failed 07:44:55 tokineko[m]: I think that splitting liquidity between Bisq and some homegrown system wouldn't be wise 07:45:15 better to concentrate liquidity on Bisq for now, once it's sufficiently large then it's time to build out an alternative 07:45:31 No. 07:45:49 I just wanted to know whether it's possible. I didn't ask whether it's wise to do so now. 07:46:19 I don't see why not - MMS is just a messaging system 07:46:23 you can send whatever messages you want on it 07:46:29 so you could use it to maintain a DHT, for instance 07:48:43 Yes, it should be possible. 07:48:50 By the way, you are the man who gave a presentation on Tari. How do you plan to make Tari private? Do you have any big-picture plan other than mimblewimble? 07:49:55 Non-fungible token transactions haven't been made private, yet. Do you already have a game plan? Or, are you trying to make it private? 07:50:27 fluffypony: ^^ 07:51:33 yeah the base layer of Tari is MW, but not the asset layer 07:51:46 https://rfc.tari.com/RFC-0300_DAN.html 07:53:29 Mimblewimble, tor, XXX? 08:06:34 fluffypony: Monero's game plan for privacy is ring signature, RingCT, and stealth address. What is Tari's game plan for privacy going to be? 08:29:11 tokineko[m]: suggest you read the RFCs thoroughly, and if you have any input on the evolving architecture then #tari-dev is the place for that discussion :) 08:30:33 I guess the plan is still undecided. 08:50:19 I looked at the Tari website, and honest to God, I have no idea what it is. I guess I'm stupid 😭 09:21:39 fluffydonkey: Think ethereum for monero. 09:24:46 Hello, is there a Monero technical support IRC channel I can join and ask a question or does that all happen on Reddit? 09:25:06 #monero-pools 09:25:19 #monero for non-mining related questions 09:26:07 Many thanks! 10:17:55 That makes sense! Thanks. I wish they just said that. :\ I use monero, but i'm in "into" crypto that much 10:18:19 > <@tokigami.kineko:matrix.org> fluffydonkey: Think ethereum for monero. 10:18:19 * That makes sense! Thanks. I wish they just said that. :\ I use monero, but i'm not "into" crypto that much 12:35:36 I bought more XMR.... 12:35:59 * tokineko[m] uploaded an image: 2021-01-25 21:35:12.png (46KiB) < https://matrix.org/_matrix/media/r0/download/matrix.org/yHaogPCRWJgPsTlkdJIpyAKp/2021-01-25 21:35:12.png > 12:36:25 What does this mean? How do quantum computers destroy governments and large corporations? 12:36:55 My suspicion is that governments and banks and large corporations will use quantum computers to oppress people. 12:52:24 it doesn't mean anything. quantum computers are SciFi fantasies 12:53:50 I hope I live to see affordable quantum modems, as in the idea of having to atoms in alignment (or whatever it is called) and being able to send bits between them no matter where or how far in the universe they are. This would allow to create networks without physical boundaries. Total internet privacy, including for financial transactions or miner communication. 12:56:05 that's also fantasy. all the entanglement communications have a second conventional channel for actual data transmisisons. and those entangelents aren't solid over time/distance 12:57:30 We already have quantum computers. They are just expensive for now. 12:57:47 do we? 12:58:10 what are they computing? 12:58:13 Even if they keep requiring cold environment, quantum computers can still evolve in large datacenters owned by google. 13:01:46 Google will use quantum computers to harass people. 13:01:57 Quantum harassment. 13:11:09 Quantum computing = witchcraft 13:16:31 Let me dream 14:43:14 What kind of person steals from their own community? www.reddit.com/r/Monero/comments/6d5yt5/what_fluffypony_just_did_is_not_ok/ 15:07:26 was anything done practically based on this research yet? https://repo.getmonero.org/monero-project/ccs-proposals/-/merge_requests/142 16:05:01 ayahuaza: don't think so - we'd move very cautiously around implementing any PQC unless it's layered on top of "regular" crypto 16:05:23 eg. the thing that Google is doing with some HTTPS connections 16:05:38 https://blog.cloudflare.com/the-tls-post-quantum-experiment/