Blockchain rollback limit?

[Qoheleth]

Could you just run 2 clients using different chains and live in both worlds?

I believe the chain with the smallest user base will die...

What's a user base? How can you tell whether people trust A-Bitcoins or B-Bitcoins or R-Bitcoins or... et cetera et cetera? Today, we trust a hashrate-weighted poll of miners; whichever branch has the most hashing power determines the "true" blockchain. If you have a better proposal for choosing which ledger is communally accepted, let's hear it, because if it's good enough to solve this problem it's good enough to use instead of mining.

How easy is there for an attacker to keep the forks separated from each other for days so they get past the "rollback limit"? That would be hard to manage.

They have more hashing power than the rest of the network put together, or they couldn't execute a 51% attack to begin with. Thus, by definition, they can mine in parallel with the rest of the network and keep up. So however many branches exist with someone else mining on them, this adversary is able to equally mine a branch of it.

[DannyHamilton]

I suspect that there is a reason that none of the many attempts to create a crypto-currency succeeded until Satoshi put together the idea of a proof-of-work transaction ledger.  Attempting to short-circuit this solution simply results in a currency that becomes more and more like the many that failed in the past, and more and more likely to fail for the same reasons.  There is enough risk with the checkpoints that are already coded into the clients.  Trying to create a moving checkpoint that tries to actively keep up with the blockchain as it grows sounds like a disaster to me.  If it was implemented, I'd probably abandon bitcoin and look for something else.

[Matthew N. Wright]

I'd probably abandon bitcoin and look for something else.

(Start by getting into Ripple just in case!)

[Kupsi]

Could you just run 2 clients using different chains and live in both worlds?

I believe the chain with the smallest user base will die...

What's a user base? How can you tell whether people trust A-Bitcoins or B-Bitcoins or R-Bitcoins or... et cetera et cetera? Today, we trust a hashrate-weighted poll of miners; whichever branch has the most hashing power determines the "true" blockchain. If you have a better proposal for choosing which ledger is communally accepted, let's hear it, because if it's good enough to solve this problem it's good enough to use instead of mining.

User base... fewest users. Sorry for my bad English.

What I'm suggesting isn't perfect. But if you set the rollback limit big enough, it can't be worse than how it is today.

How easy is there for an attacker to keep the forks separated from each other for days so they get past the "rollback limit"? That would be hard to manage.

They have more hashing power than the rest of the network put together, or they couldn't execute a 51% attack to begin with. Thus, by definition, they can mine in parallel with the rest of the network and keep up. So however many branches exist with someone else mining on them, this adversary is able to equally mine a branch of it.

They need a decent percent of the users on each fork if they shall succeed.

[Qoheleth]

User base... fewest users. Sorry for my bad English.

What I'm suggesting isn't perfect. But if you set the rollback limit big enough, it can't be worse than how it is today.

How do you tell how many users are using a particular fork?

[Kupsi]

I suspect that there is a reason that none of the many attempts to create a crypto-currency succeeded until Satoshi put together the idea of a proof-of-work transaction ledger.  Attempting to short-circuit this solution simply results in a currency that becomes more and more like the many that failed in the past, and more and more likely to fail for the same reasons.  There is enough risk with the checkpoints that are already coded into the clients.  Trying to create a moving checkpoint that tries to actively keep up with the blockchain as it grows sounds like a disaster to me.  If it was implemented, I'd probably abandon bitcoin and look for something else.

So, if I change my client so it does this, would you abandon bitcoin?

No one can stop me

[DannyHamilton]

I suspect that there is a reason that none of the many attempts to create a crypto-currency succeeded until Satoshi put together the idea of a proof-of-work transaction ledger.  Attempting to short-circuit this solution simply results in a currency that becomes more and more like the many that failed in the past, and more and more likely to fail for the same reasons.  There is enough risk with the checkpoints that are already coded into the clients.  Trying to create a moving checkpoint that tries to actively keep up with the blockchain as it grows sounds like a disaster to me.  If it was implemented, I'd probably abandon bitcoin and look for something else.

So, if I change my client so it does this, would you abandon bitcoin?

No one can stop me

Nope, but I and all the other bitcoin users won't be using your client.  So if a reorganization occurs that puts the rest of the bitcoin world on a different blockchain than you, then you'll just have to accept the world's blockchain anyhow, defeating the purpose of your client.

[Kupsi]

I suspect that there is a reason that none of the many attempts to create a crypto-currency succeeded until Satoshi put together the idea of a proof-of-work transaction ledger.  Attempting to short-circuit this solution simply results in a currency that becomes more and more like the many that failed in the past, and more and more likely to fail for the same reasons.  There is enough risk with the checkpoints that are already coded into the clients.  Trying to create a moving checkpoint that tries to actively keep up with the blockchain as it grows sounds like a disaster to me.  If it was implemented, I'd probably abandon bitcoin and look for something else.

So, if I change my client so it does this, would you abandon bitcoin?

No one can stop me

Nope, but I and all the other bitcoin users won't be using your client.  So if a reorganization occurs that puts the rest of the bitcoin world on a different blockchain than you, then you'll just have to accept the world's blockchain anyhow, defeating the purpose of your client.

When the original blockchain is rolled back 12 months, people will jump over to my blockchain 

[Kupsi]

User base... fewest users. Sorry for my bad English.

What I'm suggesting isn't perfect. But if you set the rollback limit big enough, it can't be worse than how it is today.

How do you tell how many users are using a particular fork?

Time will tell...

(Time to go to bed.)

[pointbiz]

You have not properly stated what would happen during the rollback. Let me explain.

Your scenario involves the good chain and a bad chain. The good chain is the one that manually gets checkpoints in the Satoshi client. Checkpointing is not part of the Satoshi white paper. It is just a way for the devs to tell us what chain they use and to put a limit (like u r demanding) on a rollback. It goes against the theory and is only not controversial because Satoshi went along with it.

During a rollback that goes back to the last Gavin checkpoint the attacker with the bad chain can only double spend coins that he owned before Gavin's checkpoint. He can also exclude everyone's transactions from the block chain that happened since the chechpoint. Or maybe he won't exclude people's transactions therefore most won't care which chain is good or bad. Let's assume this is a none monetary attacker where the goal is to discredit Bitcoin. So we will assume he has excluded ever transaction he doesn't own. Every node on the network will still know about these transactions they will just become unconfirmed... that is the WORST case scenario. Once the attack is over those transactions can be reconfirmed. Also everyone will still have the shorter good chain on disk it is not like it would be deleted.

[JoelKatz]

During a rollback that goes back to the last Gavin checkpoint the attacker with the bad chain can only double spend coins that he owned before Gavin's checkpoint. He can also exclude everyone's transactions from the block chain that happened since the chechpoint. Or maybe he won't exclude people's transactions therefore most won't care which chain is good or bad. Let's assume this is a none monetary attacker where the goal is to discredit Bitcoin. So we will assume he has excluded ever transaction he doesn't own. Every node on the network will still know about these transactions they will just become unconfirmed... that is the WORST case scenario. Once the attack is over those transactions can be reconfirmed. Also everyone will still have the shorter good chain on disk it is not like it would be deleted.

You're assuming an attacker trying to discredit Bitcoin who doesn't actually do anything to discredit Bitcoin!

A realistic attacker would deposit a large number of Bitcoins to Mt. Gox and then wait. When he introduces his own rollback chain, it will include a double spend of that deposit to Mt. Gox. This will invalidate all transactions that re-spend those coins, all transactions that re-spend outputs of transactions that spend those coins, and so on. With just a bit of effort, he can invalidate a significant fraction of the transactions that occurred in that time period. He could probably invalidate more than half of them with moderate effort.

He doesn't even need a lot of money to do this. He can deposit, withdraw different coins, and deposit again. He can then double spend both of those deposits, doing double damage with the same coins. (Assuming that double-spending his first deposit doesn't contaminate his own withdrawal. But if it does, then he's already doing major damage.)

[Kupsi]

During a rollback that goes back to the last Gavin checkpoint the attacker with the bad chain can only double spend coins that he owned before Gavin's checkpoint. He can also exclude everyone's transactions from the block chain that happened since the chechpoint. Or maybe he won't exclude people's transactions therefore most won't care which chain is good or bad. Let's assume this is a none monetary attacker where the goal is to discredit Bitcoin. So we will assume he has excluded ever transaction he doesn't own. Every node on the network will still know about these transactions they will just become unconfirmed... that is the WORST case scenario. Once the attack is over those transactions can be reconfirmed. Also everyone will still have the shorter good chain on disk it is not like it would be deleted.

You're assuming an attacker trying to discredit Bitcoin who doesn't actually do anything to discredit Bitcoin!

A realistic attacker would deposit a large number of Bitcoins to Mt. Gox and then wait. When he introduces his own rollback chain, it will include a double spend of that deposit to Mt. Gox. This will invalidate all transactions that re-spend those coins, all transactions that re-spend outputs of transactions that spend those coins, and so on. With just a bit of effort, he can invalidate a significant fraction of the transactions that occurred in that time period. He could probably invalidate more than half of them with moderate effort.

He doesn't even need a lot of money to do this. He can deposit, withdraw different coins, and deposit again. He can then double spend both of those deposits, doing double damage with the same coins. (Assuming that double-spending his first deposit doesn't contaminate his own withdrawal. But if it does, then he's already doing major damage.)

An attacker don't need to do a double spend with his own coins. All mined coins from the rolled back blocks will disappear, making all transaction that can be traced back to these coins invalid.