Received-SPF: pass (sog-mx-3.v43.ch3.sourceforge.com: domain of gmail.com
	designates 209.85.161.47 as permitted sender)
	client-ip=209.85.161.47; envelope-from=gavinandresen@gmail.com;
	helo=mail-fx0-f47.google.com; 
MIME-Version: 1.0
In-Reply-To: <4E71F6D6.2090208@justmoon.de>
References: <CABsx9T2MKTYCeOqERXKBMYEqNEK4eo9jGt81gZE1=Fv=s3wEqA@mail.gmail.com>
	<CANEZrP3FFEK0xrZqQkPyi8uoyb=XiPU7fSJDcGCLxiGH2uh3dQ@mail.gmail.com>
	<CABsx9T0Eowp6_mTcggCz3tivRL0NsqyyxqingmPzZ2qkJnU9EA@mail.gmail.com>
	<4E71F6D6.2090208@justmoon.de>
Date: Thu, 15 Sep 2011 10:06:37 -0400
Message-ID: <CABsx9T1_rOTd+sSgBTnj2iGKC2t7Rrh_pFAGtmWwjAKxaT0jdQ@mail.gmail.com>
From: Gavin Andresen <gavinandresen@gmail.com>
To: Stefan Thomas <moon@justmoon.de>
Content-Type: text/plain; charset=ISO-8859-1
Cc: bitcoin-development@lists.sourceforge.net
Subject: Re: [Bitcoin-development] Request review: drop misbehaving peers
Precedence: list

> Should the DoS protection auto-disable if the node has less than a minimum
> number of connections? The idea being that if our node seems to be kicking
> everybody off the roster maybe there is something wrong with the
> protections.

Darn good question. If the protection fails, would it be better for it
to 'fail hard', leaving people complaining "bitcoin won't stay
connected!"

Or fail soft, so you at least have a couple of connections.

I think fail hard is better-- we'll immediately know about the
problem, and can fix it.  Fail soft makes me nervous because  I think
that would make it more likely a bug splits the network (and,
therefore, the blockchain).


> It would be nice if the node sent a message to the banned peer with a code
> indicating the reason for the ban

If I think you're trying to DoS me, why would I be nice to you?  I
think response messages would just give an attacker another potential
attack vector, and it is clear from the debug.log what triggers a ban.

> Should sending lots of messages that don't pass the protocol-level checksum
> test be a bannable offense? Or generally sending garbage data?

Good question. Anybody see a reason not to?  How much tolerance (if
any) should there be for sending garbage data (I assume the
lower-level network stack almost never garbles data, is that a good
assumption)?


-- 
--
Gavin Andresen