The ultimate level of "influence in the network" is full control which requires more than one account. It wasn't just creating multiple accounts that made this a Sybil attack. As you've already mentioned, Steem has fairly good protections against that attack. It's the combination of stake and creating multiple pseudonymous identities which made this attack possible and that is, to me, undeniably a Sybil attack. I'm confused why you're stuck on this point because multiple pseudonymous identities was clearly required to pull this off. Those accounts were not real people. They were one person pretending to represent 20 different entities. DPoS is designed to have individual block producers, not one producer pretending to be individual block producers. These 20 accounts may be running in the same datacenter or even the same server for all we know!
From: https://steempeak.com/dpos/@dantheman/dpos-consensus-algorithm-this-missing-white-paper
Under normal operation block producers take turns producing a block every 3 seconds
How is it "taking turns" if they are all the same person in control because of this Sybil activity pretending to be multiple, separate accounts?
The DPOS algorithm is divided into two parts: electing a group of block producers and scheduling production. The election process makes sure that stakeholders are ultimately in control because stakeholders lose the most when the network does not operate smoothly. How people are elected has little impact on how consensus is achieved on a minute by minute basis. Therefore, this document will focus on how consensus is reached after the block producers have been chosen.
The election process failed because exchanges don't have skin in the game. They didn't vote with their tokens so they don't care if it impacts the token price negatively.
I think this document didn't spend enough time on the election process as that's where this Sybil attack became a reality.
And you wouldn't consider that a form of Sybil attack? To me, that's the very definition of it, and it's not a matter of scale which determines the identity.
IMO, very few systems (if any) are sybil-resistant. Some are wide open to it, and some have some protections which can still be bypassed under extreme or unusual circumstances. Maybe it's better to release a false assumption than to claim this wasn't a sybil attack. The term, to me, is still very useful, regardless of scale employed because the identifying characteristic of a pseudonymous identity is the problem. We want distributed, decentralized systems, not centralized systems pretending to be otherwise.
The point is if it got Sybil attacked, we have to improve how we validate witnesses as actually being individual entities. To launch as successful Sybil attack (to date), apparently you do.
No, I don't think "everybody" but maybe some type of advanced reputation system for witnesses that have some kind mechanism for determining the likelihood that the witnesses are individually controlled or part of a sybil attempt.
I've been thinking about some of this stuff for a while:
I don't know if 1t1v or max votes of 1 is the answer, but I hope something is better than what we have now.
I agree @lukestokes , this will help to brainstorm different ways to avoid this situation in the future. Perhaps placing an obligatory restriction that witnesses could not be created on same datacenters, same servers, etc.
Perhaps a rule on the smart contract similar to PROSPECTORS Gold game that their is like a police. So, when someone makes an attack like this one or similar types, all the stake being powered up is frozen for lets say 1 year, or even according to the type of attacks, it gets frozen more or less amount of time. Your thoughts?