From: Alistair Mann <al@pectw.net>
To: "Kenshiro []" <tensiam@hotmail.com>
Date: Thu, 01 Aug 2019 00:28:56 +0100
Message-ID: <2084819.YBhD99MD1N@dprfs-d5766>
User-Agent: KMail/4.14.2 (Linux/4.4.0-18-generic; KDE/4.14.2; x86_64; ; )
In-Reply-To: <DB6PR10MB183271245AAE84FB9AC96474A6DF0@DB6PR10MB1832.EURPRD10.PROD.OUTLOOK.COM>
References: <DB6PR10MB1832329BC8D151DC18F1E6CEA6DF0@DB6PR10MB1832.EURPRD10.PROD.OUTLOOK.COM>
	<DB6PR10MB1832F1E966CD83BC662985BDA6DF0@DB6PR10MB1832.EURPRD10.PROD.OUTLOOK.COM>
	<DB6PR10MB183271245AAE84FB9AC96474A6DF0@DB6PR10MB1832.EURPRD10.PROD.OUTLOOK.COM>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Add a moving checkpoint to the Bitcoin protocol
Precedence: list

On Wednesday 31 Jul 2019 14:53:25 Kenshiro [] wrote:
>> How would a (potentially, state-sponsored) netsplit lasting longer than
>> N be handled?
>
> It would be detected by the community much before reaching the reorg limit
> of N blocks (it's 24 hours) so nodes could stop until the netsplit is
> fixed.

A netsplit cannot be detected but merely be suspected where the p2p protocol 
does allow arbitrary connecting/disconnecting of any peer: there's no 
difference between a remote net being split off, that net having nothing to 
say, and that net choosing to disconnect. Detection then mandates manual, out-
of-band communications, which is error prone and centralising.

I also observe 'stopping nodes' during netsplits introduces several attack 
vectors. Among them: create a netsplit, which stops the nodes, turn off the 
netsplit, repeat. A sequence of 365 actors causing their own small netsplits 
could effectively stop Bitcoin at the cost (to them) of no Internet for one 
day a year as the rolling netsplit could never be fixed.

> In the extreme case no one notice the network split during more than N
> blocks (24 hours) and there are 2 permanent forks longer than N, nodes from
> one branch could delete their local history so they would join the other
> branch.
>
> P.S.: To be clearer, in this example I set an N value of 144 blocks, which
> is approximately 24 hours.

I've seen estimates of China hosting more than 51% of hashpower. Say they 
conduct a netsplit. Does your suggestion mean that it's the rest of the world 
that has to delete their local history because they lack the hashpower to 
assert themselves as the proper branch? If so, I think having to delete actual 
history everywhere across the globe but China is not a price worth paying to 
limit reorgs to 24 hours.

I am unconvinced that the moving checkpoint you describe would improve 
Bitcoin.
-- 
Alistair Mann