TheUsualStuff, I don't think manual snooping is going to be productive. Someone would need to write a script to find all and quantify. You are finding different permutations, and each of them can occur roughly once every 3 months or so and not be an abnormality in the model I proposed to quantify with.

So as I wrote previously, what came out of this is that although more rare than every hour (at least in the model I propose), just a few of these over the months is not evidence for nor against an attack being underway.

Sounds like "ignore BCX" to me. How do you interpret it?

Why do you keep attacking me with strawmen?

I never claimed an attack! I wanted to analyze the rareness of the cited event. I didn't even claim it was abnormal.

You conflate investigation with intent. You desire to make an argument where there was none, because you assume any investigation is pro-attack. Why this immense emotional resistance to probing and the scientific method of peer review? Could it be you have some vested interest? (Rhetorical question)


Each trial in a coin toss has a 0.5 probability shared between two outcomes. Chaining independent trials does give rarer probabilities for certain permutations. Each trial in the Poisson distribution is an infinite range of probabilities shared between infinite possible outcomes. Thus there is a much higher stratification possible within just one trial or a few trials than is possible with a coin toss. Thus we are able to see very, very unlikely events with only a few trials, unlike for a coin toss. Thus we find that the majority of the events are clustered in certain patterns over just a few trials that aren't so rare, and if we see an outlier from that occurring much more frequently then we can posit an abnormality (assuming the Poisson distribution is a predictive model of normality). Thus I asserted your analogy is inapplicable.

You are attempting to claim that distribution functions don't matter and thus the distribution of permutations between different distributions are the same. FAIL.


You are attempting to model block occurrences via regression assuming you have no known distribution. Thus of course you need a lot more data to find a model. You assume the Poisson distribution is incorrect, but have you proven it? Even so, my argument wasn't initially about whether the Poisson distribution is a useless model. I was only arguing what it would say if it is the chosen model.


And timestamps are how we compute difficulty, which is intimately related to TW-like attacks. So if the timestamps are unreliable, that gives me a lot of confidence that we are immune to a TW attack. I actually have some ideas about how to make timestamps reliable and no that doesn't mean relying on an NTP without network hiccups.


I never asserted I had the correct model. I was analyzing what the Poisson model would say.


No it wasn't. My argument was it might be more rare than once per hour. My argument was neatly compartmentalized, but you tried to build a strawman to attack me with.


In your regression yes, but in the assumed Poisson distribution incorrect.


We don't know that yet. You guys are quick to jump to conclusions.


I am trying but when you keep rebuilding the same strawman and you embed your rebuttals as bold text in my quoted text making it difficult for me to quote you, its FUBAR.

If you find that such events are occurring much more frequently now as compared to before July and much more frequently than predicted by the probability of my alleged model, then perhaps we can argue about whether it could be evidence of an attack.

At that point, I could start to refute the hashrate variance (geez that's a no brainer!), geographical propagation, etc... But for now, no need for me to go there, unless the Poisson distribution model is actually predicting something useful.

I am not convinced even he knew what random variable he was computing. You can try to quote him to correct my understanding, but when I read it the first time in private, I got confused. Perhaps I was tired.

And I don't remember it being carefully worded to make it clear he wasn't saying only 4 - 8% chance to be worried about BCX. Seemed to me to be saying, "never mind BCX".

(this soap opera is all about politics?)

When you reply to a message in the normal way of quoting, then I can reply. I am not going to unravel all your bolded text inserted within a quote of my text. Geez. I am not paid to do this.

Btw, your arguments were very weak. Please do fix it so I can blow up your logic.

You are looking for basically an average >= 3 blocks per minute for at least 4 consecutive minutes. A minute with very high number of blocks (e.g. 5+) has greater weight than a minute with no or fewer then 3 blocks.

None of this proves an attack is ongoing. It is only a discussion about whether a relatively rare event occurred on the block chain.

You have shown such an event occurred in May and there was no threat of an attack ongoing then, but that was roughly consistent with the alleged model of expected probability of occurrence. If you find those events happen even more frequently than 3 months, then you've blown another hole in that being possible sign of an abnormality. Meaning you've already shown the events are at least occurring at roughly the expected interval, thus even it is rare it is not abnormal.

So about the only thing I accomplished was to refute that it wasn't a rare event. The evidence of an attack is still non-existent.

I am just trying to consider what could possibly be BCX's motivation other than buying cheap XMR. It is wild speculation.

I am not trying to place blame. Evolution doesn't care about feelings. I am trying to see if I can figure out what the reality is. Maybe we just have to wait and benefit from hindsight.

I just don't like it when there is one side to a discussion and the other side isn't presented.

Nope. You need to group them in 1 minute intervals.

89413   2014-06-17 15:31:02 -
89412   2014-06-17 15:30:58  |
89411   2014-06-17 15:30:45  | 30:07 - 31:07
89410   2014-06-17 15:30:07 -

89409   2014-06-17 15:29:53 -
89408   2014-06-17 15:29:25  | 29:07 - 30:07

89407   2014-06-17 15:28:59 -
89406   2014-06-17 15:28:56  | 28:07 - 29:07

(no blocks)                  | 27:07 - 28:07

p = (1⁴ / 4!e¹)(1² / 2!e¹)²(1⁰ / 0!e¹) ≈ 0.019%

Let me redo this more carefully. We were deceived by the screen capture.

235653    14-09-27 05:13:35 -
235652    14-09-27 05:13:15  | 12:40 - 13:40 (1 minute)
235651    14-09-27 05:13:07 -

235650    14-09-27 05:12:17 -
235649    14-09-27 05:12:39  | 11:40 - 12:40 (1 minute)
235648    14-09-27 05:11:53 -

235647    14-09-27 05:11:23 -
235646    14-09-27 05:10:58  | 10:40 - 11:40 (1 minute)
235645    14-09-27 05:10:59 -

235644    14-09-27 05:10:36 -
235643    14-09-27 05:10:05  |
235642    14-09-27 05:09:52  | 9:40 - 10:40 (1 minute)
235641    14-09-27 05:09:40 -

p = (1⁴ / 4!e¹)(1³ / 3!e¹)³ ≈ 0.00035%

Let's compare to the one found 4 months prior.

89966   2014-06-18 00:03:18 -
89965   2014-06-18 00:03:12  | 2:55 - 3:55 (1 minute)

89964   2014-06-18 00:02:52 -
89963   2014-06-18 00:02:37  |
89962   2014-06-18 00:02:35  |
89961   2014-06-18 00:02:26  | 1:55 - 2:55 (1 minute)
89960   2014-06-18 00:02:24 -

(no blocks)                  | 0:55 - 1:55 (1 minute)

89959   2014-06-18 00:00:40 -
89958   2014-06-18 00:00:53  |
89957   2014-06-18 00:00:11  | 59:55 - 0:55 (1 minute)
89956   2014-06-17 23:59:55 -

p = (1⁵ / 5!e¹)(1⁴ / 4!e¹)(1² / 2!e¹)(1⁰ / 0!e¹) ≈ 0.00032%

Which is Putin and which is Obama?

Poker players know probabilities.

Afair, fluffypony did that during the 72 hour countdown, before the decision to attack had become final. I am not referring to the copy+paste of the feedback from the mathematicians, rather the prior exchange upthread.

I believe also Risto's proclamation of the likelihood occurred during the 72 hour countdown.

Hey I am not saying any body did anything out of their roles. This is a soap opera ya know. I'm included.  

Incorrect.

My model asks how many blocks occur during each 1 minute interval, i.e. the Poisson distribution which afaik Meni Rosenfeld has used in his famous whitepapers.

I substituted 1 block in an empty interval, because 0! = 1!. No difference.

Actually my model would organize that differently as follows.

89968   2014-06-18 00:05:54

89967   2014-06-18 00:05:30

89966   2014-06-18 00:03:18
89965   2014-06-18 00:03:12
89964   2014-06-18 00:02:52
89963   2014-06-18 00:02:37
89962   2014-06-18 00:02:35
89961   2014-06-18 00:02:26

89960   2014-06-18 00:02:24

p = (1⁶ / 6!e)(1/e)³ = 0.0025%

So thus what you found was not as rare (by an order-of-magnitude) as alleged by my model.

That doesn't say my model was any good at predicting anything.

Edit:

89966   2014-06-18 00:03:18
89965   2014-06-18 00:03:12
89964   2014-06-18 00:02:52
89963   2014-06-18 00:02:37
89962   2014-06-18 00:02:35
89961   2014-06-18 00:02:26

89960   2014-06-18 00:02:24

89959   2014-06-18 00:00:40

89958   2014-06-18 00:00:53
89957   2014-06-18 00:00:11
89956   2014-06-17 23:59:55

p = (1⁶ / 6!e)(1³ / 3!e)(1/e)² = 0.0004%

That is indeed very rare according my model.

Yes that is good. But that is one in past 4 months. That still points to it being a rare event. If you find them more frequently before July (when BCX allegedly might have begun experiments), then that would refute the recent one being rare.

Again the recent allegedly rare event doesn't indicate an attack is ongoing. I was only skeptical about the assertion that it wasn't rare.

Edit: the model I presented didn't factor in slower blocks, so I can't quantify if the one you found is more allegedly (by the model) rare.

You apparently forgot that Risto predicted in public only a 4 - 8% chance that BCX could attack.

Perhaps you've forgotten fluffypony's confidence upthread, he said basically until there is an attack there is no attack and he is going to the beach.

OTOH, some of the developers have been openly concerned, such as smooth and NewLiberty have tried to investigate and implement improvements. Perhaps fluffypony did too behind the scenes, I am only commenting about his public demeanor in that one instance.


What does geographics have to do with it? Specifics please.


Absolutely not. That was a complete fail. That was only 1 time interval of 1 minute. The event I analyzed as being extremely rare was 4 intervals of 1 minute consecutively.

I've given readers the education they need to go hunting in the block chain to see if they can find comparably rare events.


You make sweeping ass-u-me-ptions. Do you actually have your mind deep in the Github commits?


You are entirely missing the point that the example we started to debate about had 4 time intervals of 1 minute. The probable reason all your statistical analysis may be irrelevant (can't say for sure because yours is closed source) is because you are purportedly looking at "gaps" and not at 1 minute intervals. Afaics, you've likely got the wrong model, so you aren't seeing anything.


I didn't change the experiment. You framed the experiment inconsistently. There aren't 12 gaps, rather there were 4 time intervals of 1 minute. If you have the wrong model, you see noise.

I don't have to consider permutations because there are 2+ orders-of-magnitude between the probabilities I showed. There is the stratification I am referring to. We could get more analytical, but really isn't necessary. It is quite obvious that we saw a rare event. And no one has shown otherwise yet.


All of the them will so the relative 2+ orders-of-magnitude will likely remain.


That is illogical. The overt chaos doesn't hit until his estimate of 22 days. The chaos that would be happening now is hidden to those who use incorrect statistical models. That is why I am hunting.


I also thought of that. Surely he is sophisticated enough to conceal his IP.

Wild speculation follows.

But even if Moneroman88 is a sockpuppet, it doesn't exclude a possible motivation being to teach a lesson to the community. In that case, MM88 would just be some political cover.


You ass-u-me that is not a vulnerability. Can you prove it is not?

Please re-read what I wrote. I didn't posit that the attack is called off.

Remember Risto issued the 4 - 8% proclamation of the likelihood of a BCX attack while the 72 hour deadline was ongoing. One could ponder if this might have caused BCX to not call off the threatened (unconfirmed) attack. There was some progress on trying to find any vulnerabilities, so perhaps one could ponder if he might have called off the threat citing progress and cooperation.

The reason for not just handing over the vulnerability and fix, may be to illustrate the competence and to teach the community.

Are we sure there are no symptoms already?