Message-ID: <64ebb176-0243-ac56-3172-b2f4f9b4359f@mattcorallo.com>
Date: Fri, 22 Apr 2022 11:40:17 -0700
MIME-Version: 1.0
Content-Language: en-US
To: "David A. Harding" <dave@dtrt.org>
References: <64a34b4d46461da322be51b53ec2eb01@dtrt.org>
 <d95eec37-269d-eefb-d191-e8234e4faed3@mattcorallo.com>
 <4b252ef6f86bbd494a67683f6113f3fe@dtrt.org>
 <c779648c-891d-b920-f85f-c617a0448997@mattcorallo.com>
 <4056eca7e1ff018bff03918b8c266d76@dtrt.org>
 <01d4a034-eb80-a598-1858-6b0ed8295a13@mattcorallo.com>
 <f98a9724da2916e6687771ad1a2b555b@dtrt.org>
From: Matt Corallo <lf-lists@mattcorallo.com>
In-Reply-To: <f98a9724da2916e6687771ad1a2b555b@dtrt.org>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Automatically reverting ("transitory") soft forks,
 e.g. for CTV
Precedence: list


On 4/21/22 6:20 PM, David A. Harding wrote:
> [Rearranging Matt's text in my reply so my nitpicks come last.]
> 
> On 21.04.2022 13:02, Matt Corallo wrote:
>> I agree, there is no universal best, probably. But is there a concrete
>> listing of a number of use-cases and the different weights of things,
>> plus flexibility especially around forward-looking designs?
> 
> I'm sure we could make a nice list of covenant usecases, but I don't know how we would assign 
> reasonable objective weights to the different things purely through group foresight.  I know I'm 
> skeptical about congestion control and enthusiastic about joinpools---but I've talked to developers 
> I respect who've had the opposite opinions from me about those things.  The best way I know of to 
> reconcile our differing opinions is to see what real Bitcoin users actually pay for.  But to do 
> that, I think they must have a way to use covenants in something like the production environment.

To get good data for this kind of question you'd need much longer than five years, sadly. As we've 
seen over and over again in Bitcoin deploying very nontrivial things takes at least five years, 
often more. While vaults may be deployed relatively more quickly, the fact that we haven't seen 
(AFAIK) *anyone* deploy some of the key-deletion-based vault designs that have been floating around 
for some time is indication that even that probably wouldn't be deployed quickly.

>> You're also writing off [...] a community of
>> independent contributors who care about Bitcoin working together to
>> make decisions on what is or isn't the "right way to go" [...]. Why are you
>> suggesting its something that you "don't know how to do"?
> 
> You said we should use the best design.  I said the different designs optimize for different things, 
> so it's unlikely that there's an objective best.  That implies to me that we either need to choose a 
> winner (yuck) or we need to implement more than one of the designs.  In either of those cases, 
> choosing what to implement would benefit from data about how much the thing will be used and how 
> much users will pay for it in fees.

I agree, there is no objective "best" design. But we can sill explore design tradeoffs and utility 
for different classes of covenants. I've seen relatively little of this so far, and from what I have 
seen its not been clear that CTV is really a good option, sadly.


>> Again, you're writing off the real and nontrivial risk of doing a fork
>> to begin with.
> 
> I agree this risk exists and it isn't my intention to write it off---my OP did say "we [must be] 
> absolutely convinced CTV will have no negative effects on the holders or receivers of non-CTV 
> coins."  I haven't been focusing on this in my replies because I think the other issues we've been 
> discussing are more significant.  If we were to get everyone to agree to do a transitory soft fork, 
> I think the safety concerns related to a CTV soft fork could be mitigated the same way we've 
> mitigated them for previous soft forks: heaps of code review/testing and making sure a large part of 
> the active community supports the change.

I'm not sure I made my point here clear - the nontrivial and real risk I was referring to was not 
avoidable with "moar code review" or "careful analysis to make sure the proposed fork doesn't cause 
damage". I mean issues that keep cropping up in many changes like "people start threatening to run a 
fork-causing client" or "some miners aren't validating blocks and end up creating a fork" or "some 
people forget to upgrade and follow such a fork" or..... there's lots and lots of risks to a doing a 
fork that come from the process and nature of forks, that have nothing to do with the actual details 
of the fork itself.

Matt