what about the time it takes to confirm bitcoin transactions for something like a vending machine?
Just make sure it is uneconomic to attack.
The Finney attack is nearly 100% successful but it costs $4 per second to pull off. So for anything sold worth more than $20, make sure to delay it a few seconds.
A race attack isn't guaranteed to succeed (maybe one out of 40 attempts would succeed), but it is cheap to attempt. But if I end up with 39 frozen burritos just to get the 40th one to spit out "for free", I'm not going to try.
Now let's say there is a change machine that converts bitcoins to quarters at a laundromat, with no fee. An attacker could sit there all day and profit from the successful attempts and break even on all the unsuccessful attempts. So that's not a good candidate for 0/unconfirmed transactions.
