path: root/0c/13446028f1a1d76b6a59520be6ed875f5d5f3f

Return-Path: <lf-lists@mattcorallo.com>
Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org
	[172.17.192.35])
	by mail.linuxfoundation.org (Postfix) with ESMTPS id 33555E8F
	for <bitcoin-dev@lists.linuxfoundation.org>;
	Wed, 16 Dec 2015 20:50:23 +0000 (UTC)
X-Greylist: from auto-whitelisted by SQLgrey-1.7.6
Received: from mail.bluematt.me (mail.bluematt.me [192.241.179.72])
	by smtp1.linuxfoundation.org (Postfix) with ESMTPS id E6FD8135
	for <bitcoin-dev@lists.linuxfoundation.org>;
	Wed, 16 Dec 2015 20:50:21 +0000 (UTC)
Received: from [IPv6:2607:fb90:425:b960:629c:55cd:a49a:a9a9] (unknown
	[172.56.38.58])
	by mail.bluematt.me (Postfix) with ESMTPSA id 48AB25B1EA;
	Wed, 16 Dec 2015 20:50:20 +0000 (UTC)
In-Reply-To: <CADm_WcYWh5EnBCzQQVc04sf-0seh2zrmc+5dH8Z-Bo78jhPnfA@mail.gmail.com>
References: <CADm_WcYWh5EnBCzQQVc04sf-0seh2zrmc+5dH8Z-Bo78jhPnfA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----SBE0VW89V9O5Z6LIWZHLPYWJ489YLV"
Content-Transfer-Encoding: 8bit
From: Matt Corallo <lf-lists@mattcorallo.com>
Date: Wed, 16 Dec 2015 20:50:15 +0000
To: Jeff Garzik <jgarzik@gmail.com>,
	Jeff Garzik via bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org>,
	Bitcoin development mailing list <bitcoin-dev@lists.linuxfoundation.org>
Message-ID: <49257841-66C8-4EF7-980B-73DC604CA591@mattcorallo.com>
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,HTML_MESSAGE
	autolearn=ham version=3.3.1
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
	smtp1.linux-foundation.org
Subject: Re: [bitcoin-dev] Segregated Witness in the context of Scaling
	Bitcoin
X-BeenThere: bitcoin-dev@lists.linuxfoundation.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Bitcoin Development Discussion <bitcoin-dev.lists.linuxfoundation.org>
List-Unsubscribe: <https://lists.linuxfoundation.org/mailman/options/bitcoin-dev>,
	<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=unsubscribe>
List-Archive: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/>
List-Post: <mailto:bitcoin-dev@lists.linuxfoundation.org>
List-Help: <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=help>
List-Subscribe: <https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev>,
	<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Dec 2015 20:50:23 -0000

------SBE0VW89V9O5Z6LIWZHLPYWJ489YLV
Content-Transfer-Encoding: 8bit
Content-Type: text/plain;
 charset=UTF-8

A large part of your argument is that SW will take longer to deploy than a hard fork, but I completely disagree. Though I do not agree with some people claiming we can deploy SW significantly faster than a hard fork, once the code is ready (probably a six month affair) we can get it deployed very quickly. It's true the ecosystem may take some time to upgrade, but I see that as a feature, not a bug - we can build up some fee pressure with an immediate release valve available for people to use if they want to pay fewer fees.

On the other hand, a hard fork, while simpler for the ecosystem to upgrade to, is a  1-2 year affair (after the code is shipped, so at least 1.5-2.5 from today if we all put off heads down and work). One thing that has concerned me greatly through this whole debate is how quickly people seem to think we can roll out a hard fork. Go look at the distribution of node versions on the network today and work backwards to get nearly every node upgraded... Even with a year between fork-version-release and fork-activation, we'd still kill a bunch of nodes and instead of reducing their security model, lead them to be outright robbed.

On December 16, 2015 12:38:30 PM PST, Jeff Garzik via bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org> wrote:
>1. Summary
>
>Segregated Witness (SegWitness, SW) is being presented in the context
>of
>Scaling Bitcoin.  It has useful attributes, notably addressing a major
>malleability vector, but is not a short term scaling solution.
>
>
>2. Definitions
>
>Import Fee Event, ECE, TFM, FFM from previous email.
>
>Older clients - Any software not upgraded to SW
>
>Newer clients - Upgraded, SW aware software
>
>
>Block size - refers to the core block economic resource limited by
>MAX_BLOCK_SIZE.  Witness data (or extension block data) is excluded.
>Requires a hard fork to change.
>
>Core block - Current bitcoin block, with upper bound MAX_BLOCK_SIZE. 
>Not
>changed by SW.
>
>
>Extended transaction - Newer, upgraded version of transaction data
>format.
>
>Extended block - Newer, upgraded version of block data format.
>
>
>EBS - Extended block size.  Block size seen by newer clients.
>
>
>3. Context of analysis
>
>One proposal presents SW *in lieu of* a hard fork block size increase.
>This email focuses directly on that.
>
>Useful features outside block size context, such as anti-malleability
>or
>fraud proof features, are not covered in depth.
>
>
>4.1.  Observations on data structure formats and views
>
>SW creates two *views* of each transaction and block.  SW has blocks
>and
>extended blocks.  Similarly, there exists transactions and extended
>transactions.
>
>This view is rendered to clients depending on compatibility level. 
>Newer
>clients see extended blocks and extended transactions.  Older clients
>see
>blocks (limit 1M), and do not see extended blocks.  Older clients see
>upgraded transactions as unsigned, anyone-can-pay transactions.
>
>Each extended transaction exists in two states, one unsigned and one
>signed, each of which passes validation as a valid bitcoin transaction.
>
>
>4.2.  Observations on behavior of older transaction creation
>
>Transactions created by older clients will not use the extended
>transaction
>format.  All data is stored the standard 1M block as today.
>
>
>4.3.  Observations on new block economic model
>
>SW complicates block economics by creating two separate, supply limited
>resources.
>
>The core block economic resource is heavily contended.  Older clients
>use
>core blocks exclusively.  Newer clients use core blocks more
>conservatively, storing as much data as possible in extended blocks.
>
>The extended block economic resource is less heavily contended, though
>that
>of course grows over time as clients upgrade.
>
>Because core blocks are more heavily contended, it is presumed that
>older
>clients will pay a higher fee than newer clients (subject to elasticity
>etc.).
>
>
>5.1.  Problem:  Pace of roll-out will be slow - Whole Ecosystem must be
>considered.
>
>The current apparent proposal is to roll out Segregated Witness as a
>soft
>fork, and keep block size at 1M.
>
>The roll-out pace cannot simply be judged by soft fork speed - which is
>months at best.  Analysis must the layers above:  Updating bitcoin-core
>(JS) and bitcoinj (Java), and then the timelines to roll out those
>updates
>to apps, and then the timeline to update those apps to create extended
>transactions.
>
>Overall, wallet software and programmer libraries must be upgraded to
>make
>use of this new format, adding many more months (12+ in some stacks) to
>the
>roll out timeline.  In the meantime, clients continue to contend
>entirely
>for core block space.
>
>
>5.2.  Problem:   Hard fork to bigger block size Just Works(tm) with
>most
>software, unlike SW.
>
>A simple hard fork such as BIP 102 is automatically compatible with the
>vast range of today's ecosystem software.
>
>SW requires merchants to upgrade almost immediately, requires wallet
>and
>other peripheral software upgrades to make use of.  Other updates are
>opt-in and occur more slowly.  BIP 70 processors need some updates.
>
>The number of LOC that must change for BIP 102 is very small, and the
>problem domain well known, versus SW.
>
>
>5.3.  Problem:   Due to pace, Fee Event not forestalled.
>
>Even presuming SW is merged into Bitcoin Core tomorrow, this does not
>address the risk of a Fee Event and associated Economic Change in the
>coming months.
>
>
>5.4.  Problem:   More complex economic policy, new game theory, new
>bidding
>structure risks.
>
>Splitting blocks into two pieces, each with separate and distinct
>behaviors
>and resource values, creates *two fee markets.*
>
>Having two pricing strata within each block has certainly feasible -
>that
>is the current mining policy of (1) fee/KB followed by (2)
>priority/age.
>
>Valuable or not - e.g. incentivizing older clients to upgrade - the
>fact
>remains that SW creates a more-complex bidding structure by creating a
>second economic resource.
>
>*This is clearly a change to a new economic policy* with standard risks
>associated with that.  Will that induce an Economic Change Event (see
>def
>last email)?  *Unlikely*, due to slow rollout pace.
>
>
>5.5.  Problem:  Current SW mining algorithm needs improvement
>
>Current SW block template maker does a reasonable job, but makes some
>naive
>assumptions about the fee market across an entire extended block.  This
>is
>a mismatch with the economic reality (just described).
>
>5.6.   Problem:  New, under-analyzed attack surfaces
>
>Less significant and fundamental but still worth noting.
>
>This is not a fundamental SW problem, but simply standard complexity
>risk
>factors:  splitting the signatures away from transactions, and creating
>a
>new apparently-unsigned version of the transaction opens the
>possibility of
>some network attacks which cause some clients to degrade down from
>extended
>block to core block mode temporarily.
>
>There is a chance of a failure mode that fools older clients into
>thinking
>fraudulent data is valid (judgement: unlikely vis hashpower but not
>impossible)
>
>6. Conclusions and recommendations
>
>It seems unlikely that SW provides scaling in the short term, and SW
>introduces new economics complexities.
>
>A "short term bump" hard fork block size increase addresses economic
>and
>ecosystem risks that SW does not.
>
>Bump + SW should proceed in parallel, independent tracks, as orthogonal
>issues.
>
>
>7. Appendix - Other SW comments
>
>Hard forks provide much stronger validation, and ensure the network
>operates at a fully trustless level.
>
>SW hard fork is preferred, versus soft fork.  Soft forking SW places a
>huge
>amount of trust on miners to validate transaction signatures, versus
>the
>rest of the network, as the network slowly upgrades to newer clients.
>
>An SW hard fork could also add several zero-filled placeholders in a
>merkle
>tree for future use.
>
>
>------------------------------------------------------------------------
>
>_______________________________________________
>bitcoin-dev mailing list
>bitcoin-dev@lists.linuxfoundation.org
>https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

------SBE0VW89V9O5Z6LIWZHLPYWJ489YLV
Content-Type: text/html;
 charset=utf-8
Content-Transfer-Encoding: 8bit

<html><head></head><body>A large part of your argument is that SW will take longer to deploy than a hard fork, but I completely disagree. Though I do not agree with some people claiming we can deploy SW significantly faster than a hard fork, once the code is ready (probably a six month affair) we can get it deployed very quickly. It&#39;s true the ecosystem may take some time to upgrade, but I see that as a feature, not a bug - we can build up some fee pressure with an immediate release valve available for people to use if they want to pay fewer fees.<br>
<br>
On the other hand, a hard fork, while simpler for the ecosystem to upgrade to, is a  1-2 year affair (after the code is shipped, so at least 1.5-2.5 from today if we all put off heads down and work). One thing that has concerned me greatly through this whole debate is how quickly people seem to think we can roll out a hard fork. Go look at the distribution of node versions on the network today and work backwards to get nearly every node upgraded... Even with a year between fork-version-release and fork-activation, we&#39;d still kill a bunch of nodes and instead of reducing their security model, lead them to be outright robbed.<br><br><div class="gmail_quote">On December 16, 2015 12:38:30 PM PST, Jeff Garzik via bitcoin-dev &lt;bitcoin-dev@lists.linuxfoundation.org&gt; wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div dir="ltr"><br /><div>1. Summary</div><div><br /></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>Segregated Witness (SegWitness, SW) is being presented in the context of Scaling Bitcoin.  It has useful attributes, notably addressing a major malleability vector, but is not a short term scaling solution.</div></blockquote><div><br /></div><div>2. Definitions</div><div><br /></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>Import Fee Event, ECE, TFM, FFM from previous email.</div><div><br /></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>Older clients - Any software not upgraded to SW</div><div><br /></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>Newer clients - Upgraded, SW aware software</div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><br /></div><div>Block size - refers to the core block economic resource limit
 ed by
MAX_BLOCK_SIZE.  Witness data (or extension block data) is excluded.  Requires a hard fork to change.</div><div><br /></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>Core block - Current bitcoin block, with upper bound MAX_BLOCK_SIZE.  Not changed by SW.</div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><br /></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>Extended transaction - Newer, upgraded version of transaction data format.</div><div><br /></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>Extended block - Newer, upgraded version of block data format.</div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><br /></div><div>EBS - Extended block size.  Block size seen by newer clients.</div></blockquote><div><br /></div><div>3. Context of analysis</div><div><br /></div><blockquote style="margin:0
  0 0
40px;border:none;padding:0px"><div>One proposal presents SW <i>in lieu of</i> a hard fork block size increase.  This email focuses directly on that.</div><div><br /></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>Useful features outside block size context, such as anti-malleability or fraud proof features, are not covered in depth.</div></blockquote><div><br /></div><div>4.1.  Observations on data structure formats and views</div><div><br /></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px">SW creates two <i>views</i> of each transaction and block.  SW has blocks and extended blocks.  Similarly, there exists transactions and extended transactions.<br /><br />This view is rendered to clients depending on compatibility level.  Newer clients see extended blocks and extended transactions.  Older clients see blocks (limit 1M), and do not see extended blocks.  Older clients see upgraded transactions as unsigned,
anyone-can-pay transactions.<br /><br />Each extended transaction exists in two states, one unsigned and one signed, each of which passes validation as a valid bitcoin transaction.<br /></blockquote><div><br /></div>4.2.  Observations on behavior of older transaction creation<div><br /></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>Transactions created by older clients will not use the extended transaction format.  All data is stored the standard 1M block as today.</div></blockquote><div><br /></div><div>4.3.  Observations on new block economic model</div><div><br /></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>SW complicates block economics by creating two separate, supply limited resources.</div><div><br /></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>The core block economic resource is heavily contended.  Older clients use core blocks exclusively.  Newer clients use core block
 s more
conservatively, storing as much data as possible in extended blocks.</div><div><br /></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>The extended block economic resource is less heavily contended, though that of course grows over time as clients upgrade.</div><div><br /></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px">Because core blocks are more heavily contended, it is presumed that older clients will pay a higher fee than newer clients (subject to elasticity etc.).<br /></blockquote><div><br /></div>5.1.  Problem:  Pace of roll-out will be slow - Whole Ecosystem must be considered.<div><br /></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>The current apparent proposal is to roll out Segregated Witness as a soft fork, and keep block size at 1M.</div><div><br /></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>The roll-out pace cannot simply be
  judged
by soft fork speed - which is months at best.  Analysis must the layers above:  Updating bitcoin-core (JS) and bitcoinj (Java), and then the timelines to roll out those updates to apps, and then the timeline to update those apps to create extended transactions.</div><div><br /></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>Overall, wallet software and programmer libraries must be upgraded to make use of this new format, adding many more months (12+ in some stacks) to the roll out timeline.  In the meantime, clients continue to contend entirely for core block space.</div></blockquote><div><br /></div><div>5.2.  Problem:   Hard fork to bigger block size Just Works(tm) with most software, unlike SW.</div><div><br /></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>A simple hard fork such as BIP 102 is automatically compatible with the vast range of today&#39;s ecosystem software.</div><div><br
/></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>SW requires merchants to upgrade almost immediately, requires wallet and other peripheral software upgrades to make use of.  Other updates are opt-in and occur more slowly.  BIP 70 processors need some updates.</div><div><br /></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>The number of LOC that must change for BIP 102 is very small, and the problem domain well known, versus SW.</div></blockquote><div><br /></div>5.3.  Problem:   Due to pace, Fee Event not forestalled.<div><br /></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px">Even presuming SW is merged into Bitcoin Core tomorrow, this does not address the risk of a Fee Event and associated Economic Change in the coming months.</blockquote><div><div><br /></div><div>5.4.  Problem:   More complex economic policy, new game theory, new bidding structure risks.</div><div><br
/></div></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div>Splitting blocks into two pieces, each with separate and distinct behaviors and resource values, creates <i>two fee markets.</i></div></div><div><i><br /></i></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>Having two pricing strata within each block has certainly feasible - that is the current mining policy of (1) fee/KB followed by (2) priority/age.</div><div><br /></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>Valuable or not - e.g. incentivizing older clients to upgrade - the fact remains that SW creates a more-complex bidding structure by creating a second economic resource.</div><div><b><br /></b></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><b>This is clearly a change to a new economic policy</b> with standard risks associated with that.  Will that induce an Economic C
 hange
Event (see def last email)?  <b>Unlikely</b>, due to slow rollout pace.</div></blockquote><br />5.5.  Problem:  Current SW mining algorithm needs improvement<div><br /></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>Current SW block template maker does a reasonable job, but makes some naive assumptions about the fee market across an entire extended block.  This is a mismatch with the economic reality (just described).</div><div><br /></div></blockquote>5.6.   Problem:  New, under-analyzed attack surfaces<div><br /></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>Less significant and fundamental but still worth noting.</div><div><br /></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>This is not a fundamental SW problem, but simply standard complexity risk factors:  splitting the signatures away from transactions, and creating a new apparently-unsigned version of the transaction opens t
 he
possibility of some network attacks which cause some clients to degrade down from extended block to core block mode temporarily.</div><div><br /></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>There is a chance of a failure mode that fools older clients into thinking fraudulent data is valid (judgement: unlikely vis hashpower but not impossible)</div><div><br /></div></blockquote>6. Conclusions and recommendations<div><br /></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>It seems unlikely that SW provides scaling in the short term, and SW introduces new economics complexities.</div><div><br /></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>A &quot;short term bump&quot; hard fork block size increase addresses economic and ecosystem risks that SW does not.</div><div><br /></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>Bump + SW should proce
 ed in
parallel, independent tracks, as orthogonal issues.</div></blockquote><div><br /></div>7. Appendix - Other SW comments<div><br /></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px">Hard forks provide much stronger validation, and ensure the network operates at a fully trustless level.<br /><br />SW hard fork is preferred, versus soft fork.  Soft forking SW places a huge amount of trust on miners to validate transaction signatures, versus the rest of the network, as the network slowly upgrades to newer clients.<br /><br /></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px">An SW hard fork could also add several zero-filled placeholders in a merkle tree for future use.</blockquote><br /><blockquote style="margin:0 0 0 40px;border:none;padding:0px"></blockquote><br /><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><br /></blockquote><div><div><div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><br
/></div><div><br /></div></blockquote><div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><br /></div><div><br /></div></blockquote><div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><br /></div></blockquote><div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><br /></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><br /></div><div><br /></div></blockquote><div><div><br /></div></div></div></div></div></div></div></div></div>
<p style="margin-top: 2.5em; margin-bottom: 1em; border-bottom: 1px solid #000"></p><pre class="k9mail"><hr /><br />bitcoin-dev mailing list<br />bitcoin-dev@lists.linuxfoundation.org<br /><a href="https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev">https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev</a><br /></pre></blockquote></div></body></html>
------SBE0VW89V9O5Z6LIWZHLPYWJ489YLV--