Nostr notes by

📅 Original date posted:2016-02-04 📝 Original message:Gavin ...

2023-06-07T17:48:29Z

In reply to nevent1q…ffuk
_________________________

📅 Original date posted:2016-02-04
📝 Original message:Gavin Andresen 於 2016-02-04 12:36 寫到:
> This BIP is unnecessary, in my opinion.
>
> I'm going to take issue with items (2) and (3) that are the motivation
> for this BIP:
>
> " 2. Full nodes and SPV nodes following original consensus rules may
> not be aware of the deployment of a hardfork. They may stick to an
> economic-minority fork and unknowingly accept devalued legacy tokens."
>
> If a hardfork is deployed by increasing the version number in blocks
> (as is done for soft forks), then there is no risk-- Full and SPV
> nodes should notice that they are seeing up-version blocks and warn
> the user that they are using obsolete software.
>
> It doesn't matter if the software is obsolete because of hard or soft
> fork, the difference in risks between those two cases will not be
> understood by the typical full node or SPV node user.

Thanks for your comments.

In the case of a softfork, as long as an user waits for a few
confirmations, the risk of money loss is very low. In the worst case
they run a full node with SPV security. In the case of a hardfork, the
consequence of failing to upgrade to the economic majority fork *is*
fatal, even if an user waits for 1000 confirmations. Not to mention the
risk of having 2 economically active forks. That's why wallets should
STOP accepting and sending tx after a hardfork bit is detected and wait
for users' instructions.

> " 3. In the case which the original consensus rules are also valid
> under the new consensus rules, users following the new chain may
> unexpectedly reorg back to the original chain if it grows faster than
> the new one. People may find their confirmed transactions becoming
> unconfirmed and lose money."
>
> If a hard or soft fork uses a 'grace period' (as described in BIP 9 or
> BIP 101) then there is essentially no risk that a reorg will happen
> past the triggering block. A block-chain re-org of two thousand or
> more blocks on the main Bitcoin chain is unthinkable-- the economic
> chaos would be massive, and the reaction to such a drastic (and
> extremely unlikely) event would certainly be a hastily imposed
> checkpoint to get everybody back onto the chain that everybody was
> using for economic transactions.

No, the "triggering block" you mentioned is NOT where the hardfork
starts. Using BIP101 as an example, the hardfork starts when the first
>1MB is mined. For people who failed to upgrade, the "grace period" is always zero, which is the moment they realize a hardfork.

> Since I don't agree with the motivations for this BIP, I don't think
> the proposed mechanism (a negative-version-number-block) is necessary.
> And since it would simply add more consensus-level code, I believe the
> keep-it-simple principle applies.
>
> --
>
> --
> Gavin Andresen

📅 Original date posted:2016-02-04 📝 Original ...

2023-06-07T17:48:28Z

In reply to nevent1q…m4cu
_________________________

📅 Original date posted:2016-02-04
📝 Original message:https://github.com/bitcoin/bips/pull/317

ABSTRACT

This document specifies a proposed change to the semantics of the sign
bit of the "version" field in Bitcoin block headers, as a mechanism to
indicate a hardfork is deployed. It alleviates certain risks related to
a hardfork by introducing an explicit "point of no return" in the
blockchain. This is a general mechanism which should be employed by any
planned hardfork in the future.

[1]MOTIVATION

Hardforks in Bitcoin are usually considered as difficult and risky,
because:

* Hardforks require not only support of miners, but also, most
importantly, supermajority support of the Bitcoin economy. As a result,
softfork deployment mechanisms described in BIP 34 [2] or BIP 9 [3] are
not enough for introducing hardforks safely.
* Full nodes and SPV nodes following original consensus rules may not
be aware of the deployment of a hardfork. They may stick to an
economic-minority fork and unknowingly accept devalued legacy tokens.
* In the case which the original consensus rules are also valid under
the new consensus rules, users following the new chain may unexpectedly
reorg back to the original chain if it grows faster than the new one.
People may find their confirmed transactions becoming unconfirmed and
lose money.

The first issue involves soliciting support for a hardfork proposal,
which is more a political topic than a technical one. This proposal aims
at alleviating the risks related to the second and third issues. It
should be employed by any planned hardfork in the future.

[4]DEFINITIONS

See BIP99 [5]

[6]SPECIFICATION

HARDFORK BIT The sign bit in nVersion is defined as the hardfork bit.
Currently, blocks with this header bit setting to 1 are invalid, since
BIP65 [7] interprets nVersion as a signed number and requires it to be ≥
4. Among the 640 bits in the block header, this is the only one which is
fixed and serves no purpose, and therefore the best way to indicate the
deployment of a hardfork.

FLAG BLOCK Any planned hardfork must have one and only one flag block
which is the "point of no return". To ensure monotonicity, flag block
should be determined by block height, or as the first block with
GetMedianTimePast() greater than a threshold. Other mechanisms could be
difficult for SPV nodes to follow. The height/time threshold could be a
predetermined value or relative to other events (e.g. 10000 blocks / 100
days after 95% of miner support). The exact mechanism is out of the
scope of this BIP. No matter what mechanism is used, the threshold is
consensus critical. It must be publicly verifiable with only blockchain
data, and preferably SPV-friendly (i.e. verifiable with block headers
only, without downloading any transaction).

Flag block is constructed in a way that nodes with the original
consensus rules must reject. On the other hand, nodes with the new
consensus rules must reject a block if it is not a flag block while it
is supposed to be. To achieve these goals, the flag block must

* have the hardfork bit setting to 1, and
* follow any other rules required by the hardfork

If these conditions are not fully satisfied, upgraded nodes shall reject
the block.

The hardfork bit must be turned off in the successors of the flag block,
until the deployment of the next hardfork.

Although a hardfork is officially deployed when flag block is generated,
the exact behavioural change is out of the scope of this BIP. For
example, a hardfork may not be fully active until certain time after the
flag block.

CONCURRENT HARDFORK PROPOSALS To avoid confusion and unexpected
behaviour, a flag block should normally signify the deployment of only
one hardfork. Therefore, a hardfork proposal has to make sure that its
flag block threshold is not clashing with other ongoing hardfork
proposals.

In the case that the version bits mechanism is used in deploying a
hardfork, height of the flag block should take a value of32N + B, where
N is a positive integer and B is the position of bit B defined in BIP9
[8]. This guarantees that no clash may happen with another hardfork
proposal using BIP9.

UNCONTROVERSIAL SUBTLE HARDFORKS Hardforks may sometimes be totally
uncontroversial and make barely noticeable change (BIP50 [9], for
example). In such cases, the use of hardfork bit may not be needed as it
may cause unnecessary disruption. The risk and benefit should be
evaluated case-by-case.

AUTOMATIC WARNING SYSTEM When a flag block for an unknown hardfork is
found on the network, full nodes and SPV nodes should alert their users
and/or stop accepting/sending transactions. It should be noted that the
warning system could become a denial-of-service vector if the attacker
is willing to give up the block reward. Therefore, the warning may be
issued only if a few blocks are built on top of the flag block in a
reasonable time frame. This will in turn increase the risk in case of a
real planned hardfork so it is up to the wallet programmers to decide
the optimal strategy. Human warning system (e.g. the emergency alert
system in Bitcoin Core) could fill the gap.

[10]COMPATIBILITY

As a mechanism to indicate hardfork deployment, this BIP breaks backward
compatibility intentionally. However, without further changes in the
block header format, full nodes and SPV nodes could still verify the
Proof-of-Work of a flag block and its successors.

HARDFORK INVOLVING CHANGE IN BLOCK HEADER FORMAT If a hardfork involves
a new block header format, the original format should still be used for
the flag block and a reasonable period afterwards, to make sure existing
nodes realize that an unknown hardfork has been deployed.

VERSION BITS This proposal is also compatible with the BIP9. The version
bits mechanism could be employed to measure miner support towards a
hardfork proposal, and to determine the height or time threshold of the
flag block. Also, miners of the flag block may still cast votes for
other concurrent softfork or hardfork proposals as normal.

POINT OF NO RETURN After the flag block is generated, a miner may
support either the original rules or the new rules, but not both. It is
not possible for miners in one fork to attack or overtake the other fork
without giving up the mining reward of their preferred fork.

[11]COPYRIGHT

This document is placed in the public domain.

Links:
------
[1]
https://github.com/jl2012/bips/blob/hardforkbit/hardforkbit.mediawiki#motivation
[2] https://github.com/jl2012/bips/blob/hardforkbit/bip-0034.mediawiki
[3] https://github.com/jl2012/bips/blob/hardforkbit/bip-0009.mediawiki
[4]
https://github.com/jl2012/bips/blob/hardforkbit/hardforkbit.mediawiki#definitions
[5] https://github.com/jl2012/bips/blob/hardforkbit/bip-0099.mediawiki
[6]
https://github.com/jl2012/bips/blob/hardforkbit/hardforkbit.mediawiki#specification
[7] https://github.com/jl2012/bips/blob/hardforkbit/bip-0065.mediawiki
[8]
https://github.com/jl2012/bips/blob/hardforkbit/bip-0009.mediawiki#Mechanism
[9] https://github.com/jl2012/bips/blob/hardforkbit/bip-0050.mediawiki
[10]
https://github.com/jl2012/bips/blob/hardforkbit/hardforkbit.mediawiki#compatibility
[11]
https://github.com/jl2012/bips/blob/hardforkbit/hardforkbit.mediawiki#copyright
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20160204/d4208f4f/attachment.html>;

📅 Original date posted:2015-12-20 📝 Original message:Chris ...

2023-06-07T17:47:00Z

In reply to nevent1q…hnlz
_________________________

📅 Original date posted:2015-12-20
📝 Original message:Chris Priest via bitcoin-dev 於 2015-12-19 22:34 寫到:
> Block witholding attacks are only possible if you have a majority of
> hashpower. If you only have 20% hashpower, you can't do this attack.
> Currently, this attack is only a theoretical attack, as the ones with
> all the hashpower today are not engaging in this behavior. Even if
> someone who had a lot of hashpower decided to pull off this attack,
> they wouldn't be able to disrupt much. Once that time comes, then I
> think this problem should be solved, until then it should be a low
> priority. There are more important things to work on in the meantime.
>

This is not true. For a pool with 5% total hash rate, an attacker only
needs 0.5% of hash rate to sabotage 10% of their income. It's already
enough to kill the pool

📅 Original date posted:2015-12-20 📝 Original message:Chris ...

2023-06-07T17:47:00Z

In reply to nevent1q…klxy
_________________________

📅 Original date posted:2015-12-20
📝 Original message:Chris Priest 於 2015-12-19 22:47 寫到:
> On 12/19/15, jl2012 <jl2012 at xbt.hk> wrote:
>> Chris Priest via bitcoin-dev 於 2015-12-19 22:34 寫到:
>>> Block witholding attacks are only possible if you have a majority of
>>> hashpower. If you only have 20% hashpower, you can't do this attack.
>>> Currently, this attack is only a theoretical attack, as the ones with
>>> all the hashpower today are not engaging in this behavior. Even if
>>> someone who had a lot of hashpower decided to pull off this attack,
>>> they wouldn't be able to disrupt much. Once that time comes, then I
>>> think this problem should be solved, until then it should be a low
>>> priority. There are more important things to work on in the meantime.
>>>
>>
>> This is not true. For a pool with 5% total hash rate, an attacker only
>> needs 0.5% of hash rate to sabotage 10% of their income. It's already
>> enough to kill the pool
>>
>>
>
> This begs the question: If this is such a devastating attack, then why
> hasn't this attack brought down every pool in existence? As far as I'm
> aware, there are many pools in operation despite this possibility.

It did happen:
https://www.reddit.com/r/Bitcoin/comments/28242v/eligius_falls_victim_to_blocksolution_withholding/

The worst thing is that the proof for such attack is probabilistic, not
deterministic.

A smarter attacker may even pretend to be many small miners, make it
even more difficult or impossible to prove who are attacking.

> Then shouldn't this be something the pool deals with, not the bitcoin
> protocol?

The only solution is to ask for KYC registration, unless one could
propose
a cryptographic solution that does not require a consensus fork.

📅 Original date posted:2015-12-19 📝 Original message:After ...

2023-06-07T17:46:55Z

In reply to nevent1q…uncz
_________________________

📅 Original date posted:2015-12-19
📝 Original message:After the meeting I find a softfork solution. It is very inefficient and
I am leaving it here just for record.

1. In the first output of the second transaction of a block, mining pool
will commit a random nonce with an OP_RETURN.

2. Mine as normal. When a block is found, the hash is concatenated with
the committed random nonce and hashed.

3. The resulting hash must be smaller than 2 ^ (256 - 1/64) or the block
is invalid. That means about 1% of blocks are discarded.

4. For each difficulty retarget, the secondary target is decreased by 2
^ 1/64.

5. After 546096 blocks or 10 years, the secondary target becomes 2 ^
252. Therefore only 1 in 16 hash returned by hasher is really valid.
This should make the detection of block withholding attack much easier.

All miners have to sacrifice 1% reward for 10 years. Confirmation will
also be 1% slower than it should be.

If a node (full or SPV) is not updated, it becomes more vulnerable as an
attacker could mine a chain much faster without following the new rules.
But this is still a softfork, by definition.

---------------

ok, back to topic. Do you mean this?
http://lists.linuxfoundation.org/pipermail/bitcoin-dev/2012-June/001506.html

Peter Todd via bitcoin-dev 於 2015-12-19 13:42 寫到:
> At the recent Scaling Bitcoin conference in Hong Kong we had a chatham
> house rules workshop session attending by representitives of a super
> majority of the Bitcoin hashing power.
>
> One of the issues raised by the pools present was block withholding
> attacks, which they said are a real issue for them. In particular,
> pools
> are receiving legitimate threats by bad actors threatening to use block
> withholding attacks against them. Pools offering their services to the
> general public without anti-privacy Know-Your-Customer have little
> defense against such attacks, which in turn is a threat to the
> decentralization of hashing power: without pools only fairly large
> hashing power installations are profitable as variance is a very real
> business expense. P2Pool is often brought up as a replacement for
> pools,
> but it itself is still relatively vulnerable to block withholding, and
> in any case has many other vulnerabilities and technical issues that
> has
> prevented widespread adoption of P2Pool.
>
> Fixing block withholding is relatively simple, but (so far) requires a
> SPV-visible hardfork. (Luke-Jr's two-stage target mechanism) We should
> do this hard-fork in conjunction with any blocksize increase, which
> will
> have the desirable side effect of clearly show consent by the entire
> ecosystem, SPV clients included.
>
>
> Note that Ittay Eyal and Emin Gun Sirer have argued(1) that block
> witholding attacks are a good thing, as in their model they can be used
> by small pools against larger pools, disincentivising large pools.
> However this argument is academic and not applicable to the real world,
> as a much simpler defense against block withholding attacks is to use
> anti-privacy KYC and the legal system combined with the variety of
> withholding detection mechanisms only practical for large pools.
> Equally, large hashing power installations - a dangerous thing for
> decentralization - have no block withholding attack vulnerabilities.
>
> 1) http://hackingdistributed.com/2014/12/03/the-miners-dilemma/
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

📅 Original date posted:2015-12-20 📝 Original message:Rusty ...

2023-06-07T17:46:49Z

In reply to nevent1q…xthm
_________________________

📅 Original date posted:2015-12-20
📝 Original message:Rusty Russell via bitcoin-dev 於 2015-12-19 23:14 寫到:
> Jonathan Toomim via bitcoin-dev <bitcoin-dev at lists.linuxfoundation.org>
> writes:
>> On Dec 18, 2015, at 10:30 AM, Pieter Wuille via bitcoin-dev
>> <bitcoin-dev at lists.linuxfoundation.org> wrote:
>>
>>> 1) The risk of an old full node wallet accepting a transaction that
>>> is
>>> invalid to the new rules.
>>>
>>> The receiver wallet chooses what address/script to accept coins on.
>>> They'll upgrade to the new softfork rules before creating an address
>>> that depends on the softfork's features.
>>>
>>> So, not a problem.
>>
>>
>> Mallory wants to defraud Bob with a 1 BTC payment for some beer. Bob
>> runs the old rules. Bob creates a p2pkh address for Mallory to
>> use. Mallory takes 1 BTC, and creates an invalid SegWit transaction
>> that Bob cannot properly validate and that pays into one of Mallory's
>> wallets. Mallory then immediately spends the unconfirmed transaction
>> into Bob's address. Bob sees what appears to be a valid transaction
>> chain which is not actually valid.
>
> Pretty sure Bob's wallet will be looking for "OP_DUP OP_HASH160
> <pubKeyHash> OP_EQUALVERIFY OP_CHECKSIG" scriptSig. The SegWit-usable
> outputs will (have to) look different, won't they?
>
> Cheers,
> Rusty.

I think he means Mallory is paying with an invalid Segwit input, not
output (there is no "invalid output" anyway). However, this is not a
issue if Bob waits for a few confirmations.

📅 Original date posted:2015-12-17 📝 Original message:There ...

2023-06-07T17:46:33Z

In reply to nevent1q…mjw2
_________________________

📅 Original date posted:2015-12-17
📝 Original message:There are at least 2 proposals on the table:

1. SWSF (segwit soft fork) with 1MB virtual block limit, approximately
equals to 2MB actual limit

2. BIP102: 2MB actual limit

Since the actual limits for both proposals are approximately the same,
it is not a determining factor in this discussion

The biggest advantage of SWSF is its softfork nature. However, its
complexity is not comparable with any previous softforks we had. It is
reasonable to doubt if it could be ready in 6 months

For BIP102, although it is a hardfork, it is a very simple one and could
be deployed with ISM in less than a month. It is even simpler than
BIP34, 66, and 65.

So we have a very complicated softfork vs. a very simple hardfork. The
only reason makes BIP102 not easy is the fact that it's a hardfork.

The major criticism for a hardfork is requiring everyone to upgrade. Is
that really a big problem?

First of all, hardfork is not a totally unknown territory. BIP50 was a
hardfork. The accident happened on 13 March 2013. Bitcoind 0.8.1 was
released on 18 March, which only gave 2 months of grace period for
everyone to upgrade. The actual hardfork happened on 16 August.
Everything completed in 5 months without any panic or chaos. This
experience strongly suggests that 5 months is already safe for a simple
hardfork. (in terms of simplicity, I believe BIP102 is even simpler than
BIP50)

Another experience is from BIP66. The 0.10.0 was released on 16 Feb
2015, exactly 10 months ago. I analyze the data on
https://bitnodes.21.co and found that 4600 out of 5090 nodes (90.4%)
indicate BIP66 support. Considering this is a softfork, I consider this
as very good adoption already.

With the evidence from BIP50 and BIP66, I believe a 5 months
pre-announcement is good enough for BIP102. As the vast majority of
miners have declared their support for a 2MB solution, the legacy 1MB
fork will certainly be abandoned and no one will get robbed.

My primary proposal:

Now - 15 Jan 2016: formally consult the major miners and merchants if
they support an one-off rise to 2MB. I consider approximately 80% of
mining power and 80% of trading volume would be good enough

16 - 31 Jan 2016: release 0.11.3 with BIP102 with ISM vote requiring 80%
of hashing power

1 Jun 2016: the first day a 2MB block may be allowed

Before 31 Dec 2016: release SWSF

My secondary proposal:

Now: Work on SWSF in a turbo mode and have a deadline of 1 Jun 2016

1 Jun 2016: release SWSF

What if the deadline is not met? Maybe pushing an urgent BIP102 if
things become really bad.

In any case, I hope a clear decision and road map could be made now.
This topic has been discussed to death. We are just bringing further
uncertainty if we keep discussing.

Matt Corallo via bitcoin-dev 於 2015-12-16 15:50 寫到:
> A large part of your argument is that SW will take longer to deploy
> than a hard fork, but I completely disagree. Though I do not agree
> with some people claiming we can deploy SW significantly faster than a
> hard fork, once the code is ready (probably a six month affair) we can
> get it deployed very quickly. It's true the ecosystem may take some
> time to upgrade, but I see that as a feature, not a bug - we can build
> up some fee pressure with an immediate release valve available for
> people to use if they want to pay fewer fees.
>
> On the other hand, a hard fork, while simpler for the ecosystem to
> upgrade to, is a 1-2 year affair (after the code is shipped, so at
> least 1.5-2.5 from today if we all put off heads down and work). One
> thing that has concerned me greatly through this whole debate is how
> quickly people seem to think we can roll out a hard fork. Go look at
> the distribution of node versions on the network today and work
> backwards to get nearly every node upgraded... Even with a year
> between fork-version-release and fork-activation, we'd still kill a
> bunch of nodes and instead of reducing their security model, lead them
> to be outright robbed.
>