Received-SPF: pass (sog-mx-4.v43.ch3.sourceforge.com: domain of m.gmane.org
	designates 80.91.229.3 as permitted sender)
	client-ip=80.91.229.3;
	envelope-from=gcbd-bitcoin-development@m.gmane.org;
	helo=plane.gmane.org; 
To: bitcoin-development@lists.sourceforge.net
From: Andreas Schildbach <andreas@schildbach.de>
Date: Tue, 18 Feb 2014 22:40:13 +0100
Message-ID: <le0jvf$i7d$1@ger.gmane.org>
References: <le05ca$qn5$1@ger.gmane.org> <5303B110.70603@bitpay.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
	rv:24.0) Gecko/20100101 Thunderbird/24.2.0
In-Reply-To: <5303B110.70603@bitpay.com>
Subject: Re: [Bitcoin-development] BIP70 proposed changes
Precedence: list

On 02/18/2014 08:14 PM, Ryan X. Charles wrote:

> The most important missing piece of the payment protocol is that is has
> no concept of the status of a payment after it has been made. What if
> the payment is too little? Too much? What if it is never confirmed? What
> if it is confirmed, but very late? These are regular occurrences at
> BitPay (although hopefully they will be a lot fewer after the payment
> protocol is widely adopted).

I would like to understand why this happens at BitPay? If this is
because people use cut and paste to copy the address and then type the
amount by hand... well this kind of usage will go away.

A program (like an app) should be capable of paying the exact amount. If
not, that's a bug of the app not the protocol.

> On an unrelated note, X.509 is a terrible standard that should be
> abandoned as quickly as possible.

+1

> BitPay is working on a new standard
> based on bitcoin-like addresses for authentication. It would be great if
> we could work with the community to establish a complete, decentralized
> authentication protocol.

Sounds interesting, let us know as soon as you have anything.

>> - certificate chain in pki_data: I think it should be required that is
>> most contain the first certificate PLUS all intermediate certificates
>> (if any), but NOT the root certificate. Reason: We want to be able to
>> verify offline.
>
> So long as the root certificate remains an optional addition, this seems
> like a good idea.

In which case does it make sense to duplicate the root cert? I'm asking
because it should already be present in the trusted root store, right?

Maybe can you tell about which measures you needed to take to get X.509
working? To me it felt there very several problems.

> My experience with tls in node is that it is required

TLS? We're not using that for pki_data -- its just a byte array.

>> - definition of timezone: Its not clear if times (e.g. expires) are in
>> UTC or local. I suggest to require UTC. If if we can't agree on this,
>> there should be a sentence about timezones in the spec.
>
> The world needs to abandon timezones altogether for everything and only
> use UTC. So, agreed. Require UTC.

--> https://github.com/bitcoin/bips/pull/20