Received-SPF: pass (sog-mx-1.v43.ch3.sourceforge.com: domain of gnomon.org.uk
	designates 93.93.131.22 as permitted sender)
	client-ip=93.93.131.22; envelope-from=roy@gnomon.org.uk;
	helo=darla.gnomon.org.uk; 
Date: Thu, 30 Jan 2014 12:20:16 +0000
From: Roy Badami <roy@gnomon.org.uk>
To: Chuck <chuck+bitcoindev@borboggle.com>
Message-ID: <20140130122016.GX38964@giles.gnomon.org.uk>
References: <52E9E787.8080304@borboggle.com>
	<CANEZrP0soR0xRqW=vsKaL__HRuWstA5vW=6_JkGZm=8wkm8Q3g@mail.gmail.com>
	<52EA343E.4010208@borboggle.com>
	<CAPg+sBg8AGrbny=2tXp3gsok4TX7XV5307Cx1+ArBwxM6xL4jQ@mail.gmail.com>
	<CANEZrP2MHqw+c+AVSLzmc6A1xyMvVK=DfR_R-tH1ypGQLRqo_A@mail.gmail.com>
	<CAPg+sBhzLVxdU+Kg2N7eW=34X1-6qbg1+rPzyMqfsy01zqnfGA@mail.gmail.com>
	<52EA3FAD.5080802@borboggle.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <52EA3FAD.5080802@borboggle.com>
User-Agent: Mutt/1.5.20 (2009-06-14)
Cc: Bitcoin-Dev <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] BIP70 message delivery reliability
Precedence: list

On Thu, Jan 30, 2014 at 07:03:57PM +0700, Chuck wrote:
> On 1/30/2014 7:02 PM, Pieter Wuille wrote:
> > On Thu, Jan 30, 2014 at 12:59 PM, Mike Hearn <mike@plan99.net> wrote:
> >> With the way it works in bitcoinj, the tx is only committed to the wallet if
> >> the server accepts the Payment message and ACKs it. So the tx would not be
> >> retried if there's a failure submitting or some kind of internal server
> >> error, and the UI would show that the payment failed. That seems
> >> straightforward and how I'd expect things to work as a user.
> > That's one right way to do it imho, but not what is suggested or
> > required by the specification, and not what bitcoin core master
> > currently implements.
> >
> If you sent the Payment message and the server goes silent after 
> receiving it, you retry to delivery.  However, the merchant can 
> broadcast the transactions and force them into your wallet anyway. You 
> could, quite likely, pay and never get an ACK.

I think in that case, you absolultely have to invalidate all the
transactions in the Payment message by broadcasting a send-to-self
transaction as soon as possible; until that point your wallet balance
is indeterminate.  Otherwise what will happen if the merchant did in
fact receive the Payment message, and then processes it (and
broadcasts the transaction) after some delay?

Then what the user will see is: an apparently failed attempt to pay,
leaving their wallet balance unchanged.  Then, perhaps many hours
later, their wallet balance will appear to spontaneously decrement.

roy