It's not completely clear what your objections are in the 1st paragraph. The current system already allows every miner to construct their own valid block. PoW is one way to pick one out of them (actually, a few, since work for several blocks may be completed at about the same time). But there are other ways to pick one. For example, a public lottery. And if you say that the winner may not be broadcast soon enough to all miners — it's even worse with the winner(s) chosen by PoW (which is why there may be several blocks considered winners for a while by the network in the PoW method).

@rapt PoW is a public lottery. For any other kind of lottery, who would decide who gets a ticket? Present a detailed alternate proposal because you're hand-waving around all the reasons the implementation won't actually work. Who would choose the winner and how?

Off the top of my head, let every miner submit their proposed block to the network within a certain time interval, and use an open-source deterministic algorithm to pick a winner.

@rapt That assumes every node agrees on the same set of proposed blocks within that timeframe. To accomplish that... you need a consensus algorithm.

@rapt That can't work. How do I know that I saw the same set of proposed blocks that you did? How do I know that you and I agree on which blocks were received before the end of the time interval? What keeps an attacker from submitting more blocks than any of us can look through in the time interval? Present a detailed alternate proposal and you'll find you always come back to the same problem -- you need something scarce and what is that going to be? With PoW, it's hashing power. It has to be something or work is unbounded.

@PieterWuille "That assumes every node agrees on the same set of proposed blocks" — we need not assume that every node agrees. Consensus is a majority of >50%, not 100%. The same way that in a PoW system, when a miner broadcasts a claim to find PoW, not everyone gets the news at once. Gradually a consensus is formed, so it's each node's responsibility to keep abreast of the BC status, or they might waste their resources. Similarly, a consensus may be formed on the list of proposed blocks to go into the next lottery. Assuming, most users are honest. Which brings me back to my original question.

Consensus means everyone agrees. PoW is secure when a majority chooses to work on the longest chain curve, but as a result, everyone is in consensus.

@rapt Consensus is a way to ensure that every honest node eventually agrees on the same history. For the system to be useful, we want individual honest nodes to be relatively certain that a particular transaction will eventually be accepted by all honest nodes. These are the things PoW does. Try to explain how to do it without having something scarce. The problem you will keep running into is that dishonest participants an create can infinite amount of noise and honest participants can't identify each other. Think deeply about it -- >50% of what?

@DavidSchwartz The questions you raise are relevant to every propagation of knowledge across a decentralized network. Nothing specific to PoF. Equivalent questions exist in PoF systems as well, and these questions are not solved by PoF, since the questions only become relevant after the selection mechanism (PoF in Bitcoin case) is completed and what is left is to spread the decision across the network and form consensus. Which seems to be possible only if majority of users are honest. Which is the very assumption that the system claims not to make. Which brings me back to my original question.

@rapt You say "majority of users" but that's an imprecise term. What is a "user"? Try to make it rigorous and you'll see the problem. Bitcoin's communication reliability has nothing to do with a majority of anything. It can be 99.9% dishonest and there can still be no way to keep Alice from talking to Charlie if Alice wants to talk to Charlie and Charlie wants to hear what Alice has to say. You need no majority of anything for communications to work, just a non-broken Internet. Thanks to PoW, so long as Alice can get the right chain from someone, she can be sure she knows which one is right.

@DavidSchwartz You had to read the article I linked to to understand what user is, and why users matter. "Communication"? Alice/Charlie? Speaking of communication, you constantly change the subject. Just take a claim I made and try to agree/disagree, and explain why. E.g., I wrote "Equivalent questions exist in PoF systems as well, and these questions are not solved by PoF, since the questions only become relevant after the selection mechanism (PoF in Bitcoin case) is completed" — agree/disagree? What are the equivalent questions in PoW systems that you neglected to point to?

@PieterWuille "PoW is secure when a majority chooses to work on the longest chain curve" — Yes, but they only choose so because they voluntarily agree to honestly follow the PoW rules, not because the PoW mechanism can prevent the majority of users from abusing the system. So if honesty is the root cause for the system not being abused, how could you say that PoW is the root cause, rather than just being an expression, a symptom of this fundamental honesty?

@rapt I honestly have no idea what you're saying at this point.

@rapt Anyone can choose to follow any rules they want. If they choose to ignore the PoW rules, they're not using Bitcoin any more, they're using something else. If you want to ignore PoW rules, go ahead, you won't hurt Bitcoin, you'll only hurt yourself because everyone will ignore your blocks.

@rapt This has happened, though. Every cryptocurrency other than Bitcoin itself is "a bunch of people changing the Bitcoin rules".

@rapt We only care what happens for honest participants. Of course dishonest participants can lie to themselves. I can modify my bitcoin code so it says I have ten billion bitcoins. So long as I can't convince honest people of this, what dishonest people can do to themselves and each other does not matter. The goal is to make a system that works for all honest people, even if there are some dishonest people around.

@DavidSchwartz You had no idea what I mean by "questions equivalent [to your questions] that exist in PoW systems as well" (I had a typo there, should be PoW). So let me help you. Your first counter-question was "That can't work. How do I know that I saw the same set of proposed blocks that you did?" — the equivalent question in Bitcoin may be: "How do I know that I saw the same newly completed PoW that you did, if you saw any at all?". And I (and maybe you) can do the same with your two other questions. Agree/disagree?

No, those aren't equivalent at all. Without PoW, the possible set of valid proposed blocks is unbounded and our problem is completely intractable. With PoW, the possible set of valid proposed blocks is tightly bounded to, on average, one every ten minutes.

The former case (without PoW) is completely unsolvable. The latter case (with PoW) is trivially solvable -- you just need a network where if two people want to communicate, a third party can't easily stop them.

We have that -- the Internet.

Without something verifiably scarce, two people trying to agree have an unbounded number of possibilities and so it's not even possible to agree on the possibilities. With something verifiably scarce required to be associated with each possibility, the problem goes from impossible to trivial.

Without PoW, each dishonest participant could propose thousands of valid candidate blocks in each round. There's no way the honest participants could even agree on which were received before some cutoff. And if you have no cutoff after which new candidates are not considered, you can never make forward progress.

When you talk about a majority being honest, it has to be a majority of something. With PoW, in the short term, it's a majority of hashing power that has to be honest. And PoW's purpose is to make short-term decisions about which transactions to treat as irreversible.

Without PoW, you need to find something else that a dishonest person can't have a majority of. PoS uses a token, again, something also scarce. With nothing scarce though, there's nothing for the honest people to have a majority of and the system will not work.