Received-SPF: pass (sog-mx-4.v43.ch3.sourceforge.com: domain of coinbase.com
	designates 209.85.212.180 as permitted sender)
	client-ip=209.85.212.180; envelope-from=adrian@coinbase.com;
	helo=mail-wi0-f180.google.com; 
MIME-Version: 1.0
In-Reply-To: <20150619154054.GA13498@savin.petertodd.org>
References: <20150619103959.GA32315@savin.petertodd.org>
	<CABsx9T1pnT=Tty3+tg+EUphLwQrWXf9EEwUOGuyNcdu=4wAqTg@mail.gmail.com>
	<20150619135245.GB28875@savin.petertodd.org>
	<CAMK47c_kCgb6hEUf_JePAC_tBK8aCF1W4f1guiAah-Gj_cFfSw@mail.gmail.com>
	<20150619140815.GA32470@savin.petertodd.org>
	<CAMK47c9NhX2gzCioTycEPXqyYeKRM9XgXuW9MGyj=OdGsKVbFg@mail.gmail.com>
	<20150619145940.GB5695@savin.petertodd.org>
	<CAMK47c8Mc8v2C4aG=7GdAQ7ZCR2qXhfq-dktNS7bDa00RdKThw@mail.gmail.com>
	<20150619154054.GA13498@savin.petertodd.org>
Date: Fri, 19 Jun 2015 09:18:54 -0700
Message-ID: <CAMK47c84w=2c9y8MKHTzFf05DmKXz74a=iFViA-oZ1uRDZCAWg@mail.gmail.com>
From: Adrian Macneil <adrian@coinbase.com>
To: Peter Todd <pete@petertodd.org>
Content-Type: multipart/alternative; boundary=f46d0442724ec1a4600518e14791
Cc: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] F2Pool has enabled full replace-by-fee
Precedence: list

--f46d0442724ec1a4600518e14791
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

>
> > So connecting to many nodes just because we can and it's not technicall=
y
> > prevented is bad for the network and creating systemic risks of failure=
,
>
> Well it is actually; that's why myself, Wladimir van der Laan, and
> Gregory Maxwell all specifically=C2=B9 called Chainalysis's actions a syb=
il
> attack.
>
> The Bitcoin P2P network is resilliant to failure when the chance of any
> one node going down is uncorrelated with others. For instance if you
> accidentally introduced a bug in your nodes that failed to relay
> transactions/blocks properly, you'd simultaneously be disrupting a large
> portion of the network all at once.
>

This is exactly what your RBF patch is doing. By your own logic, nodes on
the network should be allowed to relay (or not relay) whatever they wish.


> How many nodes is Coinbase connecting too? What software are they
> running? What subnets are they using? In particular, are they all on one
> subnet or multiple?
>

We're running about a dozen nodes running regular Bitcoin Core in various
subnets. We aren't doing anything particularly out of the ordinary here.
Nothing that would fall under your definition of a sybil attack or harmful
to the network.

> > You know, you're creating an interesting bit of game theory here: if I'=
m
> > > a miner who doesn't already have a mining contract, why not implement
> > > full-RBF to force Coinbase to offer me one? One reason might be becau=
se
> > > other miners with such a contract - a majority - are going to be aske=
d
> > > by Coinbase to reorg you out of the blockchain, but then we have a
> > > situation where a single entity has control of the blockchain.
> > >
> >
> > If someone did enter into contracts with miners to mine certain
> > transactions, and had a guarantee that the miners would not build on
> > previous blocks which included double spends, then they would only need
> > contracts with 51% of the network anyway. So it wouldn't really matter =
if
> > you were a small time miner and wanted to run full-RBF.
>
> But of course, you'd never 51% the network right? After all it's not
> possible to guarantee that your miner won't mine double-spends, as there
> is no single consensus definition of which transaction came first, nor
> can there be.
>
> Or do you see things differently? If I'm a small miner should I be
> worried my blocks might be rejected by the majority with hashing power
> contracts because I'm unable to predict which transactions Coinbase
> believes should go in the blockchain?
>

You seem so concerned that we are actively trying to harm or control the
network. We're simply trying to drive bitcoin adoption by making it easy
for people to spend their bitcoin with merchants online. The problems we
face are no different from other merchant processors, or small independent
merchants accepting online or point-of-sale payments.

We've historically had relatively little interest in what miners were doing
(until RBF came out) - for the most part it didn't affect our business.
However, most large merchants would be simply uninterested in accepting
bitcoin if we forced their customers to wait 10-60 minutes for their
payments to confirm. Many have inventory management systems which can not
even place items on hold that long.

If full-RBF sees any significant adoption by miners, then it will actively
harm bitcoin adoption by reducing or removing the ability for online or POS
merchants to accept bitcoin payments at all. I do not see a single benefit
to running full-RBF.

FWIW, I'm fine with the first-seen-safe RBF, that seems like a sensible
addition and a good way to allow fees to be added or increased on existing
transactions, without harming existing applications of bitcoin.

Adrian

--f46d0442724ec1a4600518e14791
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote"><blo=
ckquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #c=
cc solid;padding-left:1ex"><span class=3D"">&gt; So connecting to many node=
s just because we can and it&#39;s not technically<br>
&gt; prevented is bad for the network and creating systemic risks of failur=
e,<br>
<br>
</span>Well it is actually; that&#39;s why myself, Wladimir van der Laan, a=
nd<br>
Gregory Maxwell all specifically=C2=B9 called Chainalysis&#39;s actions a s=
ybil<br>
attack.<br>
<br>
The Bitcoin P2P network is resilliant to failure when the chance of any<br>
one node going down is uncorrelated with others. For instance if you<br>
accidentally introduced a bug in your nodes that failed to relay<br>
transactions/blocks properly, you&#39;d simultaneously be disrupting a larg=
e<br>
portion of the network all at once.<br></blockquote><div><br></div><div>Thi=
s is exactly what your RBF patch is doing. By your own logic, nodes on the =
network should be allowed to relay (or not relay) whatever they wish.</div>=
<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex">How many nodes is Coinbase =
connecting too? What software are they<br>
running? What subnets are they using? In particular, are they all on one<br=
>
subnet or multiple?<br></blockquote><div><br></div><div>We&#39;re running a=
bout a dozen nodes running regular Bitcoin Core in various subnets. We aren=
&#39;t doing anything particularly out of the ordinary here. Nothing that w=
ould fall under your definition of a sybil attack or harmful to the network=
.</div><div><br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0=
 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class=3D"">&gt; =
&gt; You know, you&#39;re creating an interesting bit of game theory here: =
if I&#39;m<br>
&gt; &gt; a miner who doesn&#39;t already have a mining contract, why not i=
mplement<br>
&gt; &gt; full-RBF to force Coinbase to offer me one? One reason might be b=
ecause<br>
&gt; &gt; other miners with such a contract - a majority - are going to be =
asked<br>
&gt; &gt; by Coinbase to reorg you out of the blockchain, but then we have =
a<br>
&gt; &gt; situation where a single entity has control of the blockchain.<br=
>
&gt; &gt;<br>
&gt;<br>
&gt; If someone did enter into contracts with miners to mine certain<br>
&gt; transactions, and had a guarantee that the miners would not build on<b=
r>
&gt; previous blocks which included double spends, then they would only nee=
d<br>
&gt; contracts with 51% of the network anyway. So it wouldn&#39;t really ma=
tter if<br>
&gt; you were a small time miner and wanted to run full-RBF.<br>
<br>
</span>But of course, you&#39;d never 51% the network right? After all it&#=
39;s not<br>
possible to guarantee that your miner won&#39;t mine double-spends, as ther=
e<br>
is no single consensus definition of which transaction came first, nor<br>
can there be.<br>
<br>
Or do you see things differently? If I&#39;m a small miner should I be<br>
worried my blocks might be rejected by the majority with hashing power<br>
contracts because I&#39;m unable to predict which transactions Coinbase<br>
believes should go in the blockchain?<br></blockquote><div><br></div><div>Y=
ou seem so concerned that we are actively trying to harm or control the net=
work. We&#39;re simply trying to drive bitcoin adoption by making it easy f=
or people to spend their bitcoin with merchants online. The problems we fac=
e are no different from other merchant processors, or small independent mer=
chants accepting online or point-of-sale payments.</div><div><br></div><div=
>We&#39;ve historically had relatively little interest in what miners were =
doing (until RBF came out) - for the most part it didn&#39;t affect our bus=
iness. However, most large merchants would be simply uninterested in accept=
ing bitcoin if we forced their customers to wait 10-60 minutes for their pa=
yments to confirm. Many have inventory management systems which can not eve=
n place items on hold that long.</div><div><br></div><div>If full-RBF sees =
any significant adoption by miners, then it will actively harm bitcoin adop=
tion by reducing or removing the ability for online or POS merchants to acc=
ept bitcoin payments at all. I do not see a single benefit to running full-=
RBF.<br></div><div><br></div><div>FWIW, I&#39;m fine with the first-seen-sa=
fe RBF, that seems like a sensible addition and a good way to allow fees to=
 be added or increased on existing transactions, without harming existing a=
pplications of bitcoin.</div><div><br></div><div>Adrian</div><div><br></div=
></div></div></div>

--f46d0442724ec1a4600518e14791--