Return-Path: Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 433F4B1F for ; Thu, 17 Nov 2016 02:47:36 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.7.6 Received: from mail-ua0-f182.google.com (mail-ua0-f182.google.com [209.85.217.182]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 6598F22C for ; Thu, 17 Nov 2016 02:47:35 +0000 (UTC) Received: by mail-ua0-f182.google.com with SMTP id b35so131231199uaa.3 for ; Wed, 16 Nov 2016 18:47:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=Ewk/m/Ee9IXki+z+0W+hl2YpjXEqJgkUnvXz57yqaBw=; b=H+Yu/GRtTjewGNApVPskNX15Uo3+I/Tjpkjtg8HmZgxCHpVnXQ5K1X+UBZXFeSYhtD jI24lQVpyoosnSqjLQcfY/RJJGKPwSH8GElsh1TmYewRoN9DSWBic3a38X5qwwXK62t3 RVGjp27SspqT3+fu8EGELLaQWheUoT6dFU+sfke7g7y45wzAKnkOgSbyt8Q8N+y3Vxmi +b83XwTs2ofC37lMlZF3DtY4DtfEhzVrTcgvi25Og2xl5UYYJeU/zudpJid3CW8KssUK u4wmzH6EnmpNdcbyTU3oKdHRgEB4YrZsfsoKMtzknubCnvFWBjEER5nyO+Z8YIM8j8Sg icbw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=Ewk/m/Ee9IXki+z+0W+hl2YpjXEqJgkUnvXz57yqaBw=; b=epe0Swweb8i8D2E7UZBaDZxyZy9k2uvbuf4qXr5mIiW+gb0OBJn2v+ROZuj+kL88Qf RhzAvTge3C1eMvy+dArrck9N83ORDb8PmTnPbnmk0ti4D76+LteAoSuvC2sTeUFFvzQl g8VF0tVjWm456ilQFR0RwzM6LdJMb+uiu80WdXjXsmszeGoC6682GD/cpycvYpbjTrmk mGISCzK3mJYrxWHN22uyqePySd2dT+CrOeZ/h3Yre0WnKRpR66Jb6AKRDQMe23XFHWwJ 6tFtmu6PYLZo/BHOsospg4mAh3K419FBlhC95c2QCY3olPDAGYy+UM4Hm2YtC4UwCr0J mTqg== X-Gm-Message-State: ABUngveCQ54QZaKMp9O1apa0ajF+2k/Tcz3WMdQV8K3UzCxkG+9BMVlFAbwzmdfc6cZ4xerbJyXN2ivpVpMsOA== X-Received: by 10.176.65.33 with SMTP id j30mr430036uad.94.1479350854561; Wed, 16 Nov 2016 18:47:34 -0800 (PST) MIME-Version: 1.0 Received: by 10.31.115.201 with HTTP; Wed, 16 Nov 2016 18:47:33 -0800 (PST) In-Reply-To: <0d66bf24-2ded-cd98-ec55-945e01b436d0@voskuil.org> References: <33BFC318-0BB4-48DB-B5DC-08247FAC6E5A@voskuil.org> <0d66bf24-2ded-cd98-ec55-945e01b436d0@voskuil.org> From: Pieter Wuille Date: Wed, 16 Nov 2016 18:47:33 -0800 Message-ID: To: Eric Voskuil Content-Type: multipart/alternative; boundary=94eb2c1246442f3419054176366b X-Spam-Status: No, score=-1.5 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, HTML_MESSAGE, RCVD_IN_DNSWL_NONE, RCVD_IN_SORBS_SPAM autolearn=no version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Cc: Bitcoin Protocol Discussion Subject: Re: [bitcoin-dev] [BIP Proposal] Buried Deployments X-BeenThere: bitcoin-dev@lists.linuxfoundation.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Bitcoin Protocol Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Nov 2016 02:47:36 -0000 --94eb2c1246442f3419054176366b Content-Type: text/plain; charset=UTF-8 On Wed, Nov 16, 2016 at 6:16 PM, Eric Voskuil wrote: > On 11/16/2016 05:50 PM, Pieter Wuille wrote: > > > So are checkpoints good now? > > I believe we should get rid of checkpoints because they seem to be > misunderstood as a security feature rather than as an optimization. > > Or maybe because they place control of the "true chain" in the hands of > those selecting the checkpoints? It's not a great leap for the parties > distributing the checkpoints to become the central authority. > Yes, they can be used to control the "true chain", and this has happened with various forks. But developers inevitably have this possibility, if you ignore review. If review is good enough to catch unintended consensus changes, it is certainly enough to catch the introduction of an invalid checkpoint. The risk you point out is real, but the way to deal with it is good review and release practices. I wish we had never used checkpoints the way we did, but here we are. Because of this, I want to get rid of them. However, It's not because I think they offer an excessive power to developers - but because they're often perceived this way (partially as a result of how they've been abused in other systems). > I recommend users of our node validate the full chain without > checkpoints and from that chain select their own checkpoints and place > them into config. From that point forward they can apply the > optimization. Checkpoints should never be hardcoded into the source. > Having users with the discipline you suggest would be wonderful to have. I don't think it's very realistic, though, and I fear that the result would be that everyone copies their config from one or a few websites "because that's what everyone uses". > I don't think buried softforks have that problem. > > I find "buried softfork" a curious name as you are using it. You seem to > be implying that this type of change is itself a softfork as opposed to > a hardfork that changes the activation of a softfork. It was my > understanding that the term referred to the 3 softforks that were being > "buried", or the proposal, but not the burial itself. > I do not consider the practice of "buried softforks" to be a fork at all. It is a change that modifies the validity of a theoretically construable chain from invalid to valid. However, a reorganization to that theoretical chain itself is likely already impossible due to the vast number of blocks to rewind, and economic damage that is far greater than chain divergence itself. > Nevertheless, this proposal shouldn't have "that problem" because it is > clearly neither a security feature nor an optimization. That is the > first issue that needs to be addressed. It is clearly not a security feature, agreed. But how would you propose to avoid the ISM checks for BIP34 and BIP66 all the time? I feel this approach is a perfectly reasonable choice for code that likely won't ever affect the valid chain again. Cheers, -- Pieter --94eb2c1246442f3419054176366b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On Wed, Nov 16, 2016 at 6:16 PM, Eric Voskuil <eric@voskui= l.org> wrote:
On 11/16/2016 05:= 50 PM, Pieter Wuille wrote:
=C2=A0
> So are checkpoints good now?
> I believe we should get rid of checkpoints because they seem to be
misunderstood as a security feature rather than as an optimization.

Or maybe because they place control of the "true chain" in= the hands of
those selecting the checkpoints? It's not a great leap for the parties<= br> distributing the checkpoints to become the central authority.

Yes, they can be used to control the "true chai= n", and this has happened with various forks. But developers inevitabl= y have this possibility, if you ignore review. If review is good enough to = catch unintended consensus changes, it is certainly enough to catch the int= roduction of an invalid checkpoint. The risk you point out is real, but the= way to deal with it is good review and release practices.

I wish we had never used checkpoints the way we did, but here we are. Bec= ause of this, I want to get rid of them. However, It's not because I th= ink they offer an excessive power to developers - but because they're o= ften perceived this way (partially as a result of how they've been abus= ed in other systems).
=C2=A0
I recommend users of our node validate the full chain without
checkpoints and from that chain select their own checkpoints and place
them into config. From that point forward they can apply the
optimization. Checkpoints should never be hardcoded into the source.

Having users with the discipline you suggest would= be wonderful to have. I don't think it's very realistic, though, a= nd I fear that the result would be that everyone copies their config from o= ne or a few websites "because that's what everyone uses".

> I don't think buried softforks have that problem.

I find "buried softfork" a curious name as you are using i= t. You seem to
be implying that this type of change is itself a softfork as opposed to
a hardfork that changes the activation of a softfork. It was my
understanding that the term referred to the 3 softforks that were being
"buried", or the proposal, but not the burial itself.

I do not consider the practice of "buried sof= tforks" to be a fork at all. It is a change that modifies the validity= of a theoretically construable chain from invalid to valid. However, a reo= rganization to that theoretical chain itself is likely already impossible d= ue to the vast number of blocks to rewind, and economic damage that is far = greater than chain divergence itself.
=C2=A0
Nevertheless, this proposal shouldn't have "that problem" bec= ause it is
clearly neither a security feature nor an optimization. That is the
first issue that needs to be addressed.

It = is clearly not a security feature, agreed. But how would you propose to avo= id the ISM checks for BIP34 and BIP66 all the time? I feel this approach is= a perfectly reasonable choice for code that likely won't ever affect t= he valid chain again.

Cheers,

--
Pieter
=C2=A0
--94eb2c1246442f3419054176366b--