Date: Mon, 17 Oct 2016 11:46:11 +0800
From: Johnson Lau <jl2012@xbt.hk>
To: "Tom Zander" <tomz@freedommail.ch>, 
	"bitcoin-dev" <bitcoin-dev@lists.linuxfoundation.org>
Message-ID: <157d0bf2a93.e5a7dc16354163.8523890663577544011@xbt.hk>
In-Reply-To: <2028733.BSPBufMBT3@strawberry>
References: <CAPg+sBjdyJ297-GZvVc-wQwCEX-cRAGTNWDd92SgVzdCcD_ZMw@mail.gmail.com>
	<9782389.Gd5V7OpbDZ@strawberry>
	<157cee7d85f.d54d998f341542.5677728872543901935@xbt.hk>
	<2028733.BSPBufMBT3@strawberry>
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
User-Agent: Zoho Mail
Subject: Re: [bitcoin-dev] Start time for BIP141 (segwit)
Precedence: list


 ---- On Mon, 17 Oct 2016 04:08:29 +0800 Tom Zander via bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org> wrote ---- 
 > On Monday, 17 October 2016 03:11:23 CEST Johnson Lau wrote: 
 > > > Honestly, if the reason for the too-short-for-safety timespan is that 
 > > > you 
 > > > want to use BIP9, then please take a step back and realize that SegWit 
 > > > is a contriversial soft-fork that needs to be deployed in a way that is 
 > > > extra safe because you can't roll the feature back a week after 
 > > > deployment. All transactions that were made in the mean time turn into 
 > > > everyone-can- spent transactions. 
 > >  
 > > No one should use, nor anyone is advised to use, segwit transactions 
 > > before it is fully activated.  
 >  
 > Naturally, I fully agree. 
 >  
 > It seems I choose the wrong words, let me rephrase; 
 >  
 > You can't roll the SegWit back a week after people are allowed to send  
 > segwit transactions (lock-in + fallow period). All transactions that were  
 > made in the mean time turn into everyone-can- spent transactions. 
 > 
 > Because the network as a whole and any implementation is unable to roll back  
 > in an environment where SegWit is a contriversial soft-fork, it is super  
 > important to make sure that it is properly supported by all miners. This  
 > takes time and the risk you take by pushing this is that actual real people  
 > loose actual real money because of the issue I outlined inthe previous  
 > paragraph. 
 
It would only happen if a large proportion of miners are false-signalling, like how BU did with BIP109 and forked your Classic away on testnet

But this is a egg-and-chicken problem and extending the grace period would not have any improvement. Until the rules are fully activated, it is totally impossible to tell if some miners are false signalling. The only method to prevent it, as usual, is the majority of miners will orphan the blocks of malicious miners. Like in the last year, some miners did not correctly implement BIP66 and got punished by losing many blocks.

If your are suggesting >51% of miners may false-signal (like in the BIP109 case), we already have a much bigger problem.

If people are really worrying about that, I would advise them not to use segwit extensively at the beginning, and wait for at least a week to see any sign of false signalling (which will be shown as invalid orphaned blocks). If the grace period was 2 weeks, they need to wait for 3 weeks; if the grace period was 2 months, they need to wait for 2 months and a week. Pre-activation consensus-imposed grace period could never replace post-activation self-imposed observation period