Witnesses in Byteball

Witnesses play a essential role on the network, but their power is very limited What the??

When some role in a system is essential, we often think that role has to have some special power over the system. But this is not the case.
Any user have the same power a witness has: posting units into database. The difference: user address is not written on units witnesses lists.

Who controls witnesses lists?

The user who post the unit, with some restrictions.

What restrictions?

Your witnesses list has to be a compatible parent, this is, your witnesses list has to be at least same 11 witnesses as the parent one.

So, I have no freedom to choose more than one witness...

Of course not. That makes no sense. If any user can choose their own witnesses, why having a common ledger then?
Any user acts as a witness for himself because when he posts a unit is declaring their view of the ledger.
He knows their view of the ledger is the real one because he checks if majority of witnesses units posted on it.

Let's back to the power of witnesses

A single witness is expected to do two things:

Declaring their existence and their view of the ledger by posting frequently enough (they are incentivized to do so).
Not posting on an attacker shadow chain.

If an attacker builds a shadow chain (with or without some double spend) and tries to merge with the main chain, users will reject that chain because it has not any witness unit on it.
A single witness can not do any harm to the network, even if it doesn't behaves like is expected, because it is easily replaceable. Network will continue running under those conditions.

And, and, a group of witnesses?

A group of witnesses, only if collude, could:

Censor transactions.
Block all attempts to remove them from witnesses list.

How is that? Could they form a cartel to block any attemps to replace them?

Yes. This is very unlikely to happen since they should care about their reputation.

Seems like an unrecoverable error...

No, this unlikely state of the ledger is contemplated on the whitepaper.

So, witnesses form a cartel because they don't want to be replaced, then what?

Schism. The protocol is ready to fork in a easy and panicless way.

Schism? Forking??

All units posted has an "alt" field. New good units would have a different "alt " field and a different witnesses list.
So users would have two coins with same balances at a certain point. Also all data until the fork will be available to both.
Then, market would decide which is the right one :)

Ok, clear. So what happen if all witnesses stop posting?

Transactions would not confirm, and nobody would know if their ledger view is the same than rest of nodes.

So witnesses choose which transactions confirm?

They could do it (because any node can choose the parent of the unit is going to post), but it would be immediately visible on the DAG, hence they would lose all trust they had.
Trust is something hard to gain but very easy to lose.

Is it all a matter of trust? I thought it was a trustless system.

Byteball is not a trustless system. However, the entity which roots the system into reality has almost no power except saying "I am here, this is what I see". Even then, could be replaced if there was another witness with more reputation and more trustable.
Consequence of this, any user can trust the witnesses list of the last confirmed unit if he does not know who to trust.