Received-SPF: pass (sog-mx-1.v43.ch3.sourceforge.com: domain of gmail.com
	designates 74.125.82.53 as permitted sender)
	client-ip=74.125.82.53; envelope-from=mh.in.england@gmail.com;
	helo=mail-ww0-f53.google.com; 
MIME-Version: 1.0
Sender: mh.in.england@gmail.com
In-Reply-To: <CABsx9T2MKTYCeOqERXKBMYEqNEK4eo9jGt81gZE1=Fv=s3wEqA@mail.gmail.com>
References: <CABsx9T2MKTYCeOqERXKBMYEqNEK4eo9jGt81gZE1=Fv=s3wEqA@mail.gmail.com>
Date: Thu, 15 Sep 2011 13:45:04 +0200
Message-ID: <CANEZrP3FFEK0xrZqQkPyi8uoyb=XiPU7fSJDcGCLxiGH2uh3dQ@mail.gmail.com>
From: Mike Hearn <mike@plan99.net>
To: Gavin Andresen <gavinandresen@gmail.com>
Content-Type: multipart/alternative; boundary=0016e6d7e6b456e74904acf968d7
Cc: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] Request review: drop misbehaving peers
Precedence: list

--0016e6d7e6b456e74904acf968d7
Content-Type: text/plain; charset=UTF-8

Probabilistic disconnections could make it quite hard to debug protocol
implementations and increases the risk of flaky behaviour in the wild
significantly. I don't see why a simpler solution isn't better.

The most likely failure mode of this is not an attack but the same as
previous breakages - scaling or legitimate version skew that causes problems
as the network evolves.

Agree with Luke that non-standard transactions should not be considered an
attack.

If you stay with the scoring system I'd be tempted to have a flag (defaults
to 100) that sets a minimum threshold for the badness scores and ignores any
below that. Attacks based on sending transactions that aren't syntactically
valid don't seem likely to me, this isn't a good way to DoS somebody because
discarding them is so cheap. If it turns out later there is a problem,
people under attack could flip the flag until a new version is released.

The formula for the DoS score in the case of invalid signatures/merkle roots
seem unnecessarily elaborate. An invalid signature should never occur and
could always result in immediate disconnection.

Treating a block with too many sigops as invalid means legitimate relayers
might be treated as an attacker if/when the constant changes in future. I'd
suggest not treating this as an attacking situation at all.

Why use a mutable field with a const setter?

Unit tests that rely on sleeps like this can be flaky because the OS delay
isn't always precise, not to mention slow/irritating to run. It's better if
tests can override the clock, eg, if GetTime() did something like

   if (nMockTime) { return nMockTime} else { ... }

then unit tests could reliably modify and advance the clock in a
fast/efficient manner.

--0016e6d7e6b456e74904acf968d7
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Probabilistic disconnections could make it quite hard to debug protocol imp=
lementations and increases the risk of flaky behaviour in the wild signific=
antly. I don&#39;t see why a simpler solution isn&#39;t better.<br><div>
<br></div><div>The most likely failure mode of this is not an attack but th=
e same as previous breakages - scaling or legitimate version skew that caus=
es problems as the network evolves.=C2=A0</div><div><br></div><div>Agree wi=
th Luke that non-standard transactions should not be considered an attack.<=
/div>
<div><br></div><div>If you stay with the scoring system I&#39;d be tempted =
to have a flag (defaults to 100) that sets a minimum threshold for the badn=
ess scores and ignores any below that. Attacks based on sending transaction=
s that aren&#39;t syntactically valid don&#39;t seem likely to me, this isn=
&#39;t a good way to DoS somebody because discarding them is so cheap. If i=
t turns out later there is a problem, people under attack could flip the fl=
ag until a new version is released.</div>
<div><br></div><div>The formula for the DoS score in the case of invalid si=
gnatures/merkle roots seem unnecessarily elaborate. An invalid signature sh=
ould never occur and could always result in immediate disconnection.</div>
<div><br></div><div>Treating a block with too many sigops as invalid means =
legitimate relayers might be treated as an attacker if/when the constant ch=
anges in future. I&#39;d suggest not treating this as an attacking situatio=
n at all.</div>
<div><br></div><div>Why use a mutable field with a const setter?</div><div>=
<br></div><div>Unit tests that rely on sleeps like this can be flaky becaus=
e the OS delay isn&#39;t always precise, not to mention slow/irritating to =
run. It&#39;s better if tests can override the clock, eg, if GetTime() did =
something like</div>
<div><br></div><div>=C2=A0 =C2=A0if (nMockTime) { return nMockTime} else { =
... }</div><div><br></div><div>then unit tests could reliably modify and ad=
vance the clock in a fast/efficient manner.</div>

--0016e6d7e6b456e74904acf968d7--