How would an attacker re-write the timestamps in the blocks that everyone already has? The original chain has a sequence of blocks with (more or less) evenly spaced timestamps, and there is no possible way for an attacker to make that look like it has a jump in it. The best the attacker could do would be to pile up the timestamps, one after another, in his attack chain. He can't go backwards to make a jump.
Essentially, if we are looking at a possible fork from, say, a month ago, the first block in the newly presented fork really should have a timestamp from a month ago too.
He would cut back one week, and create a fork with a bunch of consecutive timestamps. e.g. 1 1 1 1 1 1 2 2 2 2 2 2 3 3 3 ....
Then a new bootstrapping node would startup and see "1 1 1 1 1 1 2 2 2 2 2 2 3 3 3". Then it would hear the valid chain, and see "1 600 1200..." and think that it jumped.
which would be a de facto protocol change.
Then any bugfix that changes the typical network behavior is a 'protocol change'. Not really a useful distinction, in my view. We're just arguing over defintions, which is a waste of time. The important point is that a fixed node is fixed without upgrading any of its peers. Call that whatever you like.
If there's no central distribution list for these and it's up to miners/merchants to invoke the RPC by hand
Of course there would be, otherwise it would be a config option and not an RPC.
We do not have any 'dynamic risk' "last resort" mechanisms anymore: no safemode alerts. Checkpoints only get changed by updating the software.
Your reject-txn sounds like sipa's fork-mode patch.
Maybe we could implement the idea of dynamic checkpoints (Gavin) but only if they come signed by the Alert signing key ...
Or even we could create a special Alert message that comes with a new checkpoint embedded.
This would be a mid point between Gavin and gmaxwell positions.
0_o I don't consider that a midpoint at all. We'd first have to rename Gavin "Bitcoin Bernanke", but fortunately I know he's smart enough to not accept that job. I don't quite see how making it possible for anyone who kidnaps Gavin to shut down bitcoin is an improvement over your million dollar scale attack, as I expect it would cost much less than a million dollars to do so...