OpenTimestamps
They could tweak R-values inside signatures, and become "HiddenTimestamps". Then, it will be impossible to know, how many of them exist in practice, it will be harder to censor them, they would be cheaper, and they wouldn't need any OP_RETURN. I think new systems shouldn't be based on OpenTimestamps, but use more advanced tricks like that. Because OpenTimestamps need just 256-bit value, no matter what message is confirmed. And they could achieve that, without any OP_RETURN, because each and every signature uses 256-bit R-value, that can also commit to any data, if needed.
If a node on IP address X that has been running Bitcoin Core for 5 years has now changed to Bitcoin Knots that may say something.
Changing User Agent is easy, and can be done on-the-fly:
-uacomment=<cmt>
Append comment to the user agent string
Example commands:
./Bitcoin-Qt -uacomment="Foobar Node v1.2.3" -noconnect
./Bitcoin-Qt -uacomment="Foobar Node v1.2.3" -noconnect -choosedatadir
Example results:
getnetworkinfo
{
"version": 280000,
"subversion": "/Satoshi:28.0.0(Foobar Node v1.2.3)/",
"protocolversion": 70016,
"localservices": "0000000000000c09",
"localservicesnames": [
"NETWORK",
"WITNESS",
"NETWORK_LIMITED",
"P2P_V2"
],
"localrelay": true,
...
}
...
getnetworkinfo
{
"version": 280100,
"subversion": "/Satoshi:28.1.0(Foobar Node v1.2.3)/Knots:20250305/",
"protocolversion": 70016,
"localservices": "0000000004000c0c",
"localservicesnames": [
"BLOOM",
"WITNESS",
"NETWORK_LIMITED",
"P2P_V2",
"REPLACE_BY_FEE?"
],
"localrelay": true,
...
}
It is trivial to change "uacomment" in the source code, and pretend, that you are running Knots, even if you are not. As long as nodes don't accept proofs, that a given code is executed, it is just all about meaningless statistics. It is as reliable, as checking transaction locktime, and guessing, when it was created, based on that. In many cases, users are lazy, and when a lot of people run default settings, it is reliable, but it can be faked, if any decisions would be based on these things.
So, I expect some users really switched to Knots, but I also suspect there is some artificial traffic, just to support Core or Knots, and there are fake nodes, which only advertise a given User Agent, to fight in "stats wars", and see, how charts with client popularity can change, and show their team winning or losing.
I doubt someone has been consistently running many fake nodes on the same IP addresses for a very long time such as 5 to 10 years.
To advertize any User Agent, you don't have to run any node. You can always say to the network: "I have all blocks and transactions". And then, you can store absolutely nothing, and just act as a proxy to other, real nodes. Then, it is much cheaper to run a node, but it puts more pressure on real node operators.