Date: Thu, 01 Oct 2020 01:36:35 +0000
To: Mike Brooks <m@ib.tc>
From: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Reply-To: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Message-ID: <6DNfWVT6VsuQvFamBbqyGZYokENNopo28FZO6P5-4F0uoOMz2xAAQQZxBxsOmue4J3miOoMq_2MJVpiTtUy3bE9-qMOSVXqRhQoyfriTpXU=@protonmail.com>
In-Reply-To: <CALFqKjSiyjvtkmdSodP8pXdjxw+k0nJn_jTy06CQ6VHe3XTn2g@mail.gmail.com>
References: <CAPaMHfTSqyDDBfmdM=z-FtLRTUxed2pNmoOFx-t2w0MyZ_mgCg@mail.gmail.com>
 <CACAqsqOSBrdUo4VTUsG68dSDpfZfVOXvnMK5nqmvuhxRCC0gjQ@mail.gmail.com>
 <CALFqKjQP75TdaDeop-bxpcW5PHpmG4RwW-MDjUFGrqUy=xNdoQ@mail.gmail.com>
 <5RgK7X_rcpeMbdOdFxKiWkzg6dVcjD0uF_KI8Wt2w7WCBd7dB552EZuRqNQiBbgF4dGBcojwE9GzdWdJeCNmaAlYGYDMAyz6yzSl2QmLC98=@protonmail.com>
 <CALFqKjQDx7BrGEUJLhN=VXS8c--bVOJV4pvQTV6ag2Cy+GjWbw@mail.gmail.com>
 <SSp6MfYHW3q4TqoWyK-2ZUzLQbAqaWxTzJd62cAwKd1tFRac-embhjUZKogr3m__GcIezY5-llLyO91lur7bamlM6tiHRs-nGCNMxe2UKLE=@protonmail.com>
 <CALFqKjSiyjvtkmdSodP8pXdjxw+k0nJn_jTy06CQ6VHe3XTn2g@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>,
 Mike Brooks <f@in.st.capital>
Subject: Re: [bitcoin-dev] Floating-Point Nakamoto Consensus
Precedence: list

Good morning Mike,

> ZmnSCPxj,
>
> The growing tare in growing disagreement continues to divide mining capac=
ity while the network waits for formation of future blocks - you'll never g=
et to complete=C2=A0consensus=C2=A0unless three is a way to avoid ambiguity=
 in=C2=A0disagreement,=C2=A0which you have not addressed.=C2=A0 The topic o=
f my discussion is an exploitable condition, your three block plan does not=
 add up.
>
> I wrote the exploit before I wrote the paper. It is telling that still no=
 one here has refenced the threat model, which is the largest section of th=
e entire 8 page paper.=C2=A0 The security came before the introduction of F=
PNC because security=C2=A0fundamentals=C2=A0is what drives the necessity fo=
r the solution.
>
> The text you are reading right now was delivered using the mailing list m=
anager=C2=A0Majordomo2, which I shelled in 2011 and got a severity metric a=
nd an alert in the DHS newsletter. Correct me if I am wrong, but I bet that=
 just of my exploits has probably=C2=A0popped more shells than everyone on =
this thread combined.=C2=A0=C2=A0 Cryptography?=C2=A0 Sure, I'll brag about=
 the time I hacked Square Inc. This is actually my current favorite crypto =
exploit=C2=A0=E2=80=94 it was the time I used DKIM signature-malleability t=
o conduct a replay-attack that allowed an adversary to replay another user'=
s transactions an unlimited number of times. After receiving=C2=A0a normal =
payment from another Square user you could empty their account.=C2=A0 This =
was reported ethically and it was a mutual joy to work with such a great te=
am.=C2=A0 Now it is not just impact, but I am also getting the feeling that=
 I have collected more CVEs, all this is to say that I'm not new to difficu=
lt vendors.

Argument screens off authority, thus, even if I have no CVEs under this pse=
udonym, argument must still be weighted more highly than any authority you =
may claim.

> To be blunt; some of you on this thread are behaving like a virgin=C2=
=A0reading a trashy love novel and failing to see the point =E2=80=94 Just =
because you aren't excited, doesn't mean that it isn't hot.
>
> The exploit described in this paper was delivered to the Bitcoin-core sec=
urity team on August 4 at 9:36 PM PST.=C2=A0 The industry standard of 90 da=
ys gives you until November 2nd. Now clearly, we need more time. However,=
=C2=A0if the consensus is a rejection, then there shouldn't be any concerns=
 with a sensible 90-day disclosure policy.=C2=A0

I am not a member of this security team, and they may have better informati=
on and arguments than I do, in which case, I would defer to them if they ar=
e willing to openly discuss it and I find their arguments compelling.

The attack you describe is:

* Not fixable by floating-point Nakamoto consensus, as such a powerful adve=
rsary can just as easily prevent propagation of a higher-score block.
* Broken by even a single, manually-created connection between both sides o=
f the chain-split.

Regards,
ZmnSCPxj