1
00:00:00,880 --> 00:00:08,960
Alright, so next talk on the list, You're Not The Money Printer, or Why We Should Separate Coinbase and Non-Coinbase Rings.

2
00:00:09,200 --> 00:00:29,360
So, during the talk today, I mean, this talk might not take the full 30 minutes, but one thing I've been really passionate about over the last few years is the idea of treating Coinbase outputs differently than non-Coinbase outputs because people typically spend them in different ways.

3
00:00:29,360 --> 00:00:37,580
So, ultimately, I made the joke of You're Not The Money Printer because I'll cover who actually prints these Coinbase outputs, whoever handles or touches them.

4
00:00:37,620 --> 00:00:44,340
And I'm also going to be keeping a note of the live chat, so I will be able to answer questions on YouTube.

5
00:00:44,340 --> 00:00:48,480
Hopefully, the quality is working well for everyone here, and the stream is going really well.

6
00:00:48,480 --> 00:00:49,760
Lots of really good talks today.

7
00:00:49,760 --> 00:00:52,960
Thank you, Daniel Kim, for everything you did on the slide before.

8
00:00:52,960 --> 00:00:56,340
So, first, let's get started about what...

9
00:00:57,420 --> 00:01:03,080
Let's first cover, you know, what is an output period, right?

10
00:01:03,160 --> 00:01:06,500
So, outputs are simply piggy banks.

11
00:01:06,500 --> 00:01:07,980
I heard this example from someone else.

12
00:01:07,980 --> 00:01:11,220
I can't take credit for considering outputs piggy banks.

13
00:01:11,220 --> 00:01:18,380
I previously have called them pots of gold or bills or many different other things.

14
00:01:18,380 --> 00:01:35,280
But I like the idea of you taking an amount of money, you put it in a container, this piggy bank, and then in order to spend this amount, the receiver needs to break open the piggy bank and put it in a new output, a new piggy bank.

15
00:01:36,120 --> 00:01:37,820
They are single-use.

16
00:01:37,820 --> 00:01:42,040
So, unlike the pot example, it definitely stresses the idea of these being single-use.

17
00:01:42,040 --> 00:01:48,300
You cannot continue to keep, you know, putting these outputs elsewhere.

18
00:01:48,540 --> 00:01:52,960
So, as a result, an output you can think of just as a container of money.

19
00:01:52,960 --> 00:02:01,560
It's a really horrible name, output, honestly, just because, you know, there's many things that, you know, else you should be referring to.

20
00:02:03,360 --> 00:02:05,140
Sorry, I'm checking the stream again.

21
00:02:05,480 --> 00:02:07,300
Making sure it's working just fine.

22
00:02:10,060 --> 00:02:10,940
Sorry.

23
00:02:11,560 --> 00:02:12,400
Sunday live stream.

24
00:02:12,400 --> 00:02:13,480
Okay, perfect.

25
00:02:13,780 --> 00:02:19,780
So, the output's a bad example because the source of funds could either be going in or out of a transaction.

26
00:02:19,780 --> 00:02:21,240
So, it definitely is misleading.

27
00:02:21,860 --> 00:02:26,160
With Bitcoin, outputs do have connections to addresses, however.

28
00:02:26,160 --> 00:02:35,280
You would have, you know, a specific source of funds that is tied to a public address, and you would be able to search that on the blockchain.

29
00:02:35,280 --> 00:02:40,860
However, for Monero, you need to not think of outputs as tied to addresses.

30
00:02:40,860 --> 00:02:43,940
You'll see a specific output on the blockchain.

31
00:02:44,120 --> 00:02:52,000
You should think about these having ties to the date they were created, not to the address that they are associated with.

32
00:02:52,000 --> 00:02:57,020
Because, of course, with Monero, we do not have addresses to concern ourselves with.

33
00:02:57,020 --> 00:03:06,660
Sure, you send and receive funds with addresses, but the blockchain, from a, you know, perspective of what it shares publicly, does not reveal addresses anywhere.

34
00:03:06,660 --> 00:03:11,140
They are never present, so, therefore, do not think of outputs as addresses.

35
00:03:11,140 --> 00:03:14,420
Think of them as containers of funds that are single-use.

36
00:03:14,480 --> 00:03:19,680
It's important that you understand what an output is before I go through the rest of this presentation.

37
00:03:20,740 --> 00:03:23,340
Okay, next, what are ring signatures?

38
00:03:23,340 --> 00:03:31,520
Well, ring signatures are an important privacy feature of Monero that obfuscates the source of funds.

39
00:03:31,520 --> 00:03:40,700
They're often, you know, inconsiderately referred to as mixing, but it really is very, very different than a Bitcoin mixing process.

40
00:03:40,700 --> 00:03:57,040
So, the idea is, if you want to spend one of your sources of funds, let's say you go to a store with a $10 bill and a $5 bill, and you want to spend $11, of course, you would give the teller both bills, and they would give you $4 back in change.

41
00:03:57,540 --> 00:04:12,400
So, in this case, what you would do is you take your Monero output, which contains a certain number of Monero, and you would include it in a single ring, and then you would include other possible outputs, which we call decoys in Monero.

42
00:04:12,400 --> 00:04:21,060
These are not money that you're actually spending, but funds that you ideally convincingly seem to spend, and you include them all in this one ring.

43
00:04:21,060 --> 00:04:29,880
So, you would say, in the top example there, that perhaps the Monero transaction would conceivably spend one of these 11 outputs.

44
00:04:29,880 --> 00:04:35,300
Only one is actually spent, but the outside observer does not know which source of funds is actually being spent.

45
00:04:35,300 --> 00:04:40,740
However, granted, we're able to verify that someone is actually spending funds that they have the right to.

46
00:04:40,740 --> 00:04:44,780
They're not just pretending to spend other people's money, because that would be absurd.

47
00:04:46,160 --> 00:04:52,680
So, if a transaction is trying to spend two bills, like I described in the $10 and $5 case, there would be two ring signatures.

48
00:04:52,680 --> 00:04:53,880
Two independent amounts.

49
00:04:53,880 --> 00:04:56,840
They're each spending one of these piggy banks, let's say.

50
00:04:57,120 --> 00:05:02,880
And for each piggy bank, we grab 10 other piggy banks, and we say, hey, that might be a source.

51
00:05:02,880 --> 00:05:04,640
That might be where the money is coming from.

52
00:05:04,640 --> 00:05:08,820
And an outside observer, ideally, would not know any better.

53
00:05:08,820 --> 00:05:20,820
However, a ton of Monero research and history has shown that in many cases, people are able to learn information more than what we expect, based off how these inputs are selected.

54
00:05:20,820 --> 00:05:33,380
One of these is whether or not outputs are coin-based outputs or not, which is an additional point of metadata that you can use to determine whether or not an individual is convincingly spending certain outputs.

55
00:05:33,380 --> 00:05:37,340
So, what are coin-based outputs?

56
00:05:37,340 --> 00:05:51,360
And of course, just to get it out of the way, I should very clearly state that coin-based outputs, in this example, are not in reference to outputs that are associated with coin-based decentralized exchange.

57
00:05:51,360 --> 00:05:52,780
Not at all.

58
00:05:52,780 --> 00:06:00,120
Coin-based outputs refer to the idea of money that is from the block reward.

59
00:06:00,120 --> 00:06:03,480
So, if you are taking coins and you successfully...

60
00:06:03,480 --> 00:06:12,500
Sorry, not taking coins, but if you successfully mine a block, let's say, you have the right to make yourself a coin-based output that consists of a few things.

61
00:06:12,500 --> 00:06:15,280
It consists of the block reward.

62
00:06:15,280 --> 00:06:24,420
This is basically money that's coming out of thin air, but it's coming out of thin air according to a very set, regulated process that the network agrees on.

63
00:06:24,620 --> 00:06:25,120
Dr.

64
00:06:25,120 --> 00:06:28,080
Daniel Kim talked about this in the earlier talk, of course.

65
00:06:28,080 --> 00:06:35,660
And then, of course, you are able to pull in the transaction fees that people say that you're entitled to include if people mine them.

66
00:06:35,660 --> 00:06:41,920
Of course, fees are included as an incentive for people to choose certain transactions over others.

67
00:06:41,920 --> 00:06:51,320
And of course, in Monero's case, they help compensate for the decreased block reward if you are putting in a substantial number of transactions.

68
00:06:51,380 --> 00:06:53,600
So, those are coin-based outputs.

69
00:06:53,600 --> 00:06:56,480
Again, not coin-based the exchange.

70
00:06:56,480 --> 00:07:02,380
Coin-based outputs refer to outputs that are generated with the mining process.

71
00:07:02,380 --> 00:07:07,880
If a coin, let's say, used proof-of-stake or something, it would be through the staking process.

72
00:07:07,880 --> 00:07:21,080
But really, you can think of it as coins that are generated new into the system or based off whoever the person who is authorized to sign the transaction, in this case, sign the block, sorry, which would be the miner.

73
00:07:21,280 --> 00:07:27,500
So, you can see I have sets of piggy banks going through here just to try and simplify things.

74
00:07:27,500 --> 00:07:32,420
But on the left there, that's the initial source of funds in the piggy bank.

75
00:07:32,420 --> 00:07:34,200
Those are generated from the block reward.

76
00:07:34,200 --> 00:07:35,920
They are highlighted, that yellow there.

77
00:07:35,920 --> 00:07:40,260
And then the funds, in all actuality, are passed along further.

78
00:07:40,260 --> 00:07:42,780
Their histories are no longer coin-based outputs.

79
00:07:42,780 --> 00:07:46,260
They're other outputs, non-coin-based outputs, let's say.

80
00:07:46,800 --> 00:07:57,020
Of course, just because Monero is Monero, and we obfuscate all this information, you don't necessarily know that there's this nice, lovely, straight line going through.

81
00:07:57,020 --> 00:08:08,060
In all actuality, it looks super, super messy and really looks like this nonsense, where transactions may appear to go a bunch of different ways, of course, but that's not the point of this talk.

82
00:08:08,640 --> 00:08:11,780
Instead, we're going to talk about who the actual money printers are.

83
00:08:11,780 --> 00:08:16,320
Who has the ability to print money in Monero?

84
00:08:16,320 --> 00:08:18,080
Those are the miners.

85
00:08:18,220 --> 00:08:20,820
Here is a chart showing who the miners are.

86
00:08:20,820 --> 00:08:25,860
You can see that minexmr and supportxmr are the two dominant pools on the Monero network.

87
00:08:25,860 --> 00:08:27,020
But you have a few others.

88
00:08:27,020 --> 00:08:33,020
You have ones like xmrpool, f2pool, nanopool, smallpools, 2miners.

89
00:08:33,120 --> 00:08:40,920
Smallpools consists of a substantial number of really small pools that, in sum, equal 7% of the total network.

90
00:08:40,920 --> 00:08:44,160
And then you have that 5% of unknown.

91
00:08:44,340 --> 00:08:50,800
So this is something that minexmr is not able to associate with a specific mining pool.

92
00:08:50,800 --> 00:08:52,880
These can be solo miners.

93
00:08:52,880 --> 00:08:55,160
These can be private pools.

94
00:08:55,200 --> 00:09:07,380
Ultimately, it's just network hash rate that's coming out of an unknown situation from people that might either just not bother sharing information publicly or care about mining privately or who knows what.

95
00:09:07,880 --> 00:09:11,380
So these are who the money printers are in Monero.

96
00:09:12,380 --> 00:09:16,640
And a lot of them reveal a lot of information for quite a few reasons.

97
00:09:16,640 --> 00:09:21,980
We have a breaking Monero episode about public mining pool data that I strongly recommend you watch.

98
00:09:22,080 --> 00:09:26,540
But supportxmr, for example, they show the list of all the blocks that they mine.

99
00:09:26,540 --> 00:09:44,600
So if someone appears to spend a coinbase output that you know was mined by supportxmr, the only convincing way that that output could have actually been spent in that transaction is if it was supportxmr actually spending it.

100
00:09:44,600 --> 00:10:02,800
So if your friend, for example, sent you a transaction that spent funds that supportxmr publicly describes as mining, your friend either better run supportxmr or they are not actually sending you that money.

101
00:10:02,800 --> 00:10:08,780
That's a fake decoy and it's known to you to be fake given the information that the public mining pool publishes.

102
00:10:08,780 --> 00:10:13,960
So I put it red there because it does reveal a pretty substantial amount of metadata.

103
00:10:14,780 --> 00:10:17,640
Most pools will show the blocks they mine.

104
00:10:17,640 --> 00:10:24,840
I only looked up supportxmr, minexmr, and nanopool because they're the largest, but this continues for many pools.

105
00:10:24,840 --> 00:10:28,160
Minexmr also shows the blocks mined, so does nanopool.

106
00:10:28,340 --> 00:10:33,300
And then a few also reveal information about what transactions they make to users.

107
00:10:33,300 --> 00:10:46,860
And as I show in other talks, this allows outsiders to pretty reliably form a list of all transactions, really all outputs that the pool has controlled.

108
00:10:46,860 --> 00:10:54,520
So as a result, supportxmr does not actually show the specific payouts as far as the transactions are concerned.

109
00:10:54,520 --> 00:10:57,680
They don't say, this is the specific transaction we sent.

110
00:10:57,680 --> 00:11:17,640
Instead they say, we sent this much money, which is much better than revealing the exact transactions, it makes things much more difficult, but it still likely incurs possible limitations related to timing attacks, where, okay, well, what if it's the only transaction that gets mined around this time period?

111
00:11:17,640 --> 00:11:19,220
Well, then it would be more visible.

112
00:11:19,220 --> 00:11:22,240
It still reveals more information, but it's not as bad.

113
00:11:22,340 --> 00:11:25,560
Nanopool, for example, shows all payout details.

114
00:11:25,560 --> 00:11:28,280
You can see who the specific miners are.

115
00:11:28,280 --> 00:11:32,040
You can see how the payments are specifically made.

116
00:11:32,040 --> 00:11:35,360
You can see the exact Monero transactions that go to these users.

117
00:11:35,360 --> 00:11:37,840
So they reveal a ton of information.

118
00:11:37,840 --> 00:11:42,400
So within, you know, Nanopool, they are making a lot of information public.

119
00:11:42,720 --> 00:11:46,800
Minexmr is only showing payouts to users that are the actual miners.

120
00:11:46,800 --> 00:11:51,940
You have to put in your mining address first, and then it will show what payouts were made.

121
00:11:51,940 --> 00:12:03,460
This makes it more difficult for someone who's trying to track this sort of information, reveal a lot of information, learn a lot about pool-held outputs.

122
00:12:04,400 --> 00:12:06,480
So this is really who the money printers are.

123
00:12:06,480 --> 00:12:10,920
But of course, you also have this unknown portion here that I talked about, like who these potentially could be.

124
00:12:10,920 --> 00:12:16,280
Well, we really do not, to all intents and purposes, know anything about who's mining these funds.

125
00:12:16,280 --> 00:12:35,220
But at the maximum, this unknown refers to, again, the maximum amount of solo miners or private miners that might be potentially impacted if we start meddling with Coinbase outputs, because clearly these mining pools don't really care about revealing information publicly,

126
00:12:35,220 --> 00:12:38,680
because they have done so for ages and continue to do so.

127
00:12:38,680 --> 00:12:47,660
So the only people that do care about their privacy from this perspective happen to actually be those that are mining in unknown pools or solo mining, right?

128
00:12:48,340 --> 00:12:52,580
So we need to talk about who actually owns these outputs.

129
00:12:52,580 --> 00:12:56,760
Who is the one that's actually likely to spend, control, et cetera, these outputs?

130
00:12:56,760 --> 00:13:07,320
Well, Coinbase outputs are only spent by two groups of people, mining pools or people that are solo mining or mining on a private pool.

131
00:13:07,460 --> 00:13:14,360
And there's only about 10 total mining pools that consistently mine blocks.

132
00:13:14,600 --> 00:13:17,480
And for solo miners, there aren't that many of those either.

133
00:13:17,480 --> 00:13:20,460
There's a relatively small number, let's say.

134
00:13:21,460 --> 00:13:23,780
Well, there's also the next set.

135
00:13:23,780 --> 00:13:31,580
So instead of just funds that come from Coinbase, there's also, okay, what's the from Coinbase outputs, let's say?

136
00:13:31,580 --> 00:13:32,420
The next set.

137
00:13:32,420 --> 00:13:38,020
Once they're spent from Coinbase, who convincingly may actually hold these outputs?

138
00:13:38,020 --> 00:13:49,760
Well, it's still the mining pools, because mining pool mines a block, they send a transaction to someone, the Coinbase output, and then they receive change back to the mining pool.

139
00:13:49,760 --> 00:13:51,640
So they still will hold on to these blocks.

140
00:13:51,640 --> 00:13:56,020
So they are convincing holders of the from Coinbase outputs.

141
00:13:56,720 --> 00:13:59,780
But solo miners are still also convincing holders.

142
00:13:59,780 --> 00:14:12,920
But really, the extra layer of protection for users comes in the idea that pool miners, not just the pool operators, but the pool miners are likely recipients of these from Coinbase outputs.

143
00:14:12,920 --> 00:14:17,520
Because a mining pool, again, will mine a block, and they'll send a payout to someone.

144
00:14:17,520 --> 00:14:19,140
They need to send that payment somehow.

145
00:14:19,140 --> 00:14:21,180
So they need to spend that Coinbase output.

146
00:14:21,180 --> 00:14:26,560
They might give the output that's generated next to specific users.

147
00:14:26,560 --> 00:14:43,040
And so therefore, the entropy set of who actually may touch these outputs, even though on chain, it's only one level away from the mining, so the Coinbase outputs, in all actuality, holding one of these outputs covers a much wider scope of activity.

148
00:14:43,040 --> 00:14:44,400
And so it's much more convincing.

149
00:14:44,400 --> 00:14:58,620
If your friend, let's say, sends you a decoy that includes one of these outputs, they perhaps might have just been mining with their laptop on a mining pool and eventually got a tiny fraction of a payout.

150
00:14:58,620 --> 00:15:00,060
That's possible.

151
00:15:00,060 --> 00:15:04,200
That's certainly much more possible than them sending you an actual Coinbase output.

152
00:15:04,200 --> 00:15:05,620
It's completely different.

153
00:15:05,620 --> 00:15:07,380
It's much, much more convincing.

154
00:15:07,460 --> 00:15:11,440
So it's important to consider who actually touches these outputs.

155
00:15:11,440 --> 00:15:18,360
And this wraps around to the scope of the talk or name of the talk again in saying that, are you a convincing money printer?

156
00:15:18,360 --> 00:15:22,040
Are you a convincing person to actually touch these initial Coinbase outputs?

157
00:15:22,040 --> 00:15:25,480
For the vast majority of people, the answer is no.

158
00:15:25,480 --> 00:15:30,040
Very, very few predictable people are the ones that typically touch these Coinbase outputs.

159
00:15:30,720 --> 00:15:32,400
So what can we do?

160
00:15:32,520 --> 00:15:35,680
Well, we can handle Coinbase outputs differently.

161
00:15:35,680 --> 00:15:43,760
We can optionally decide to say, hey, we would like Coinbase rings to remain separate from non-Coinbase rings.

162
00:15:43,760 --> 00:15:54,560
One thing we can also do with consensus changes is say that Coinbase rings must be a certain size and non-Coinbase rings must be a certain size.

163
00:15:54,560 --> 00:16:04,040
Of course, for Minero transactions right now, we mandate a ring size of 11 for all transactions, whether they're spending Coinbase outputs or not spending Coinbase outputs.

164
00:16:04,040 --> 00:16:17,200
But we could say, well, since there's so much information available public anyway for Coinbase outputs because mining pools make so much information public, we can instead say, well, let's just say that these can have a smaller ring size.

165
00:16:17,200 --> 00:16:18,960
We'll drop them down to three.

166
00:16:18,960 --> 00:16:29,180
We will inform network participants that Coinbase outputs themselves are not reasonably protected because, you know, it's predictable to figure out who actually owns them.

167
00:16:29,720 --> 00:16:37,220
So therefore, we can save transaction efficiency, you know, network efficiency for these specific outputs.

168
00:16:37,300 --> 00:16:45,620
And those who are actually solo mining or mining on private pools will just be told, well, don't specifically send these funds you generate to someone else.

169
00:16:45,620 --> 00:16:47,820
You will at least want one level of separation.

170
00:16:47,820 --> 00:16:50,920
So you include a much wider scope of activity there.

171
00:16:51,640 --> 00:17:06,000
And then, of course, with a non-Coinbase ring, we can say, oh, well, we can keep this at size 11, let's say, or maybe we can pop it up to size 12 or 13, just to take advantage of those additional efficiency benefits.

172
00:17:06,060 --> 00:17:09,680
So the network overall is still as efficient as it was before to verify.

173
00:17:09,820 --> 00:17:12,500
But the users who do care about privacy are actually getting it.

174
00:17:12,500 --> 00:17:18,260
And the people who don't care are not having efficiency wasted on them in a way.

175
00:17:19,380 --> 00:17:24,740
So, yeah, again, in the Coinbase rings, the only ones that actually would construct these are mining pools and solo miners.

176
00:17:24,740 --> 00:17:31,380
For the non-Coinbase rings, these would be constructed by everyone, including mining pools and solo miners, of course.

177
00:17:31,380 --> 00:17:35,740
So the whole network is constructing these, but we can make separate rules for Coinbase rings.

178
00:17:35,740 --> 00:17:42,760
And that might be warranted if network activities suggest that it will actually be impacting certain users' behavior.

179
00:17:43,860 --> 00:17:50,520
So Serang Noether looked at the actual spend distribution of Coinbase and non-Coinbase outputs in Monero.

180
00:17:50,520 --> 00:17:57,520
Now, granted, the only way we were actually able to look at these is by looking at Monero's traceable old history.

181
00:17:57,520 --> 00:18:03,720
So Monero from 2014 to 2017 definitely did not have very strong ring signature protections.

182
00:18:03,800 --> 00:18:09,180
And so we were able to determine when certain outputs were spent.

183
00:18:09,180 --> 00:18:10,220
And then we, you know, Dr.

184
00:18:10,220 --> 00:18:15,460
Serang Noether broke them down to whether or not they were Coinbase or non-Coinbase outputs.

185
00:18:15,460 --> 00:18:18,620
And as you can see, there's very little difference.

186
00:18:18,620 --> 00:18:27,560
So we have the option, too, to say, oh, well, we can have different time selection periods for whether or not we're selecting decoys for Coinbase or non-Coinbase rings.

187
00:18:27,560 --> 00:18:31,000
But the evidence so far shows that there's no need to actually do this.

188
00:18:31,000 --> 00:18:44,380
But if there was a need to do that, then the benefit to overall privacy for people would be far greater because we're able to segregate by this required point of network metadata, whether or not an output is a Coinbase output or not.

189
00:18:44,440 --> 00:18:45,860
So just something to think about.

190
00:18:45,860 --> 00:18:50,720
That's something we can do, but there's no need to, given current research so far.

191
00:18:51,660 --> 00:18:55,280
So I know the point of the talk is like, you know, why we should.

192
00:18:55,520 --> 00:19:00,100
But ultimately, one of the big takeaways I want is you don't need to panic as a result of this.

193
00:19:00,100 --> 00:19:05,860
Coinbase outputs are increasingly rare as a proportion of total network activity.

194
00:19:05,860 --> 00:19:11,180
And ring sizes are pretty large already, and they will most likely get substantially larger in the future.

195
00:19:11,300 --> 00:19:18,520
So looking at some transaction data on total number of transactions per block, there are about two outputs per transaction.

196
00:19:18,520 --> 00:19:19,480
Or at least two.

197
00:19:19,480 --> 00:19:22,340
So actually the average is a little bit more than two.

198
00:19:22,340 --> 00:19:25,020
But to all intents and purposes, let's just consider it two.

199
00:19:25,120 --> 00:19:32,180
Over the past month, year, there's been about 13 Monero transactions per block, which is quite a bit.

200
00:19:32,180 --> 00:19:35,560
A lot more than in Monero's early history.

201
00:19:35,600 --> 00:19:39,820
So that means 13 transactions times two outputs per transaction.

202
00:19:39,960 --> 00:19:45,920
We're generating 26 outputs per block just by non-Coinbase related transactions.

203
00:19:45,920 --> 00:19:50,280
And then, of course, we have that one Coinbase output that's being generated per block.

204
00:19:50,280 --> 00:19:57,500
So really, the total proportion of Coinbase outputs that are being generated is a pretty low 3.7%.

205
00:19:57,500 --> 00:20:08,060
So all things being equal, if you are selecting decoys from the blockchain, the likelihood you're going to choose a new Coinbase output is much lower than choosing a non-Coinbase output.

206
00:20:08,060 --> 00:20:17,880
In the past, with a smaller transaction amount, this used to be closer to 20% even a year or so ago.

207
00:20:17,880 --> 00:20:21,260
So it really has changed with the additional adoption of Monero activity.

208
00:20:21,260 --> 00:20:23,060
That is really what has changed.

209
00:20:23,200 --> 00:20:40,200
The discussion here is based off Monero having far more transactions that will make the absolute impact of Coinbase outputs, the proportional impact be small and absolute for each transaction be smaller too.

210
00:20:40,200 --> 00:20:43,680
So that's pretty exciting to think about.

211
00:20:43,680 --> 00:20:46,620
Also, large ring sizes still minimize.

212
00:20:46,900 --> 00:20:53,020
Like pretty much for all things Monero attack related, one solution is always, well, why don't we just bump the ring size?

213
00:20:53,020 --> 00:20:56,380
Just increase the ring size, just keep bumping the ring size, right?

214
00:20:56,380 --> 00:21:06,120
So with the current situation, you have 11 ring members and on average, you're probably going to select one or zero Coinbase outputs per transaction.

215
00:21:06,120 --> 00:21:13,160
Again, it used to be more like one to three, but really at the moment, it's zero or one for most transactions.

216
00:21:13,160 --> 00:21:23,780
So you can say that, oh, well, if one Coinbase output is selected, really, unless you know that they're a miner, a mining pool operator, not even just a miner, the effective ring size is actually 10.

217
00:21:23,780 --> 00:21:25,140
It's reduced by one.

218
00:21:25,620 --> 00:21:37,900
Well, if we do not segregate Coinbase rings, well, we still will have a proportional scale where the total proportion of Coinbase outputs are still going to be selected for even larger ring sizes.

219
00:21:37,900 --> 00:21:46,440
And so more outputs are going to be compromised, but ultimately at the end of the day, the effective ring size is still going to increase quite substantially, right?

220
00:21:46,440 --> 00:21:56,160
Where, you know, the difference between 128 and 116 is far lower, even though it's a proportional same, than the difference between 11 and 10, right?

221
00:21:56,420 --> 00:22:03,800
The actual decoy difference is much bigger in practice for smaller numbers than bigger numbers.

222
00:22:03,800 --> 00:22:09,380
So in conclusion, you are not the money printer, right?

223
00:22:09,380 --> 00:22:11,600
You are not actually spending Coinbase outputs.

224
00:22:11,600 --> 00:22:15,080
There's no convincing way that you would ever control these for any reason.

225
00:22:15,540 --> 00:22:22,000
But this only materially matters if Monero has small adoption.

226
00:22:22,000 --> 00:22:30,780
If Monero has only a handful of transactions per block, then yes, it does matter.

227
00:22:30,780 --> 00:22:34,180
The proportion of Coinbase outputs would be quite significant.

228
00:22:34,240 --> 00:22:44,160
However, if you have the tune of dozens of Monero transactions per block on average, then really, Coinbase outputs aren't getting in the way that much.

229
00:22:44,160 --> 00:22:45,360
They just aren't.

230
00:22:45,740 --> 00:22:58,020
So, you know, the most important thing for resolving this problem is making sure that Coinbase outputs are rare, proportional to the total number of transactional nodes.

231
00:22:58,020 --> 00:23:02,560
And really, the total number of Coinbase outputs is not changing per day.

232
00:23:02,560 --> 00:23:04,040
That's like stagnant.

233
00:23:04,040 --> 00:23:06,860
Every two minutes on average, a block is going to be mined.

234
00:23:06,860 --> 00:23:08,000
That's predictable.

235
00:23:08,000 --> 00:23:16,060
So network activity for all other transactions needs to be substantial in order to cover users, right?

236
00:23:18,160 --> 00:23:26,000
So really, we should, in my opinion, still separate Coinbase outputs.

237
00:23:26,000 --> 00:23:37,820
Because in all reality, if you see a transaction still that appears to spend a Coinbase output, the likelihood it actually is spending this is very, very low.

238
00:23:37,860 --> 00:23:38,820
Very, very low.

239
00:23:38,820 --> 00:23:40,240
It's not super likely.

240
00:23:40,500 --> 00:23:42,320
So we should still separate it.

241
00:23:42,320 --> 00:23:47,580
But at the end of the day, it's also not the end of the world if we don't.

242
00:23:47,580 --> 00:23:50,560
And so that's one of those good problems to have, I guess.

243
00:23:50,560 --> 00:24:08,280
And then as ring sizes increase too, you likely will have, or you also will have an increase in the absolute protection provided by the rings anyway, even if a few of them are going to be selecting from these toxic Coinbase output pools.

244
00:24:08,460 --> 00:24:13,160
So ultimately, that's the main takeaway from this whole talk.

245
00:24:14,120 --> 00:24:22,140
OK, so if you want to get more educated on Monero, learn more, get started, join the communities, you can get educated by going to masteringmonero.com.

246
00:24:22,140 --> 00:24:24,320
You can get to read a free book there, buy a print version.

247
00:24:24,320 --> 00:24:27,640
You can go to moneromeans.money and watch a movie that Dr.

248
00:24:27,640 --> 00:24:30,440
Daniel Kim was the star in.

249
00:24:30,440 --> 00:24:38,200
It was actually number one box office in the United States for two days and number two for the week and weekend back in April.

250
00:24:38,440 --> 00:24:42,080
You can download cakewallet.com and get the app there.

251
00:24:42,080 --> 00:24:44,260
You can go to getmonero.org and download that wallet.

252
00:24:44,260 --> 00:24:48,880
There's also other great wallets like Monerubio you can download or you can join the Monero communities.

253
00:24:49,040 --> 00:24:52,200
The Monero community workgroup is communityworkgroup.org.

254
00:24:52,200 --> 00:24:55,500
It will actually be changing shortly to monerocommunity.org.

255
00:24:55,500 --> 00:24:58,440
And the other communities are listed on getmonero.org.

256
00:24:58,440 --> 00:25:03,240
My specific information is, you know, contact there at above.

257
00:25:03,340 --> 00:25:10,040
I just really was interested in Coinbase outputs and felt that it was necessary to have a talk about them at some point.

258
00:25:10,040 --> 00:25:27,120
I know it's kind of niche, but it's important to think about certain points of metadata on the Monero blockchain and then try and connect these points of metadata to user behavior to see if anything is revealing and will potentially degrade Monero privacy.

259
00:25:27,120 --> 00:25:30,960
So it's important to think about these things going forward.

260
00:25:30,960 --> 00:25:32,280
All right, that's the end of my talk.

261
00:25:32,280 --> 00:25:33,940
We have some wonderful other talks coming up.

262
00:25:33,940 --> 00:25:39,000
So I'm going to hand it off to the rest of the Monero village and hope you enjoy the rest of your time here.

263
00:25:39,000 --> 00:25:39,640
Take care.