reading between the lines:
separates transaction information
so convenient!
segregated witnesses makes validationless mining
easier and more profitable than the status quo
yeay for teh miners!
easily fixed by changing the protocol
lets just throw bitcoin protocol away already
Of course, when this goes wrong it goes very wrong, greatly amplifying
the effect of 51% attacks and technical screwups
seems all we are left with is hope and faith.
We can fully expect miners to take advantage of
this to reduce latency and thus improve their profitability.
yeay for teh miners! part 2
At best the codepaths that actually do validation will be rarely,
if ever, tested in production.
who test anyway?
Mining could continue indefinitely on an invalid chain, producing blocks
that in isolation appear totally normal and contain apparently valid
transactions.
nice!
and it goes on and on:
#
Easy [
] solution: previous witness data proof
To return segregated witnesses to the status quo, we need to at least
make having the previous block's witness data be a precondition to
creating a block with transactions;
ideally we would make it a
precondition to making any valid block, although going this far may
receive pushback from miners who are currently using validationless
mining techniques.
We can require blocks to include the previous witness data, hashed with
a different hash function that the commitment in the previous block.
With witness data W, and H(W) the witness commitment in the previous
block, require the current block to include H'(W)
A possible concrete implementation would be to compute the hash of the
current block's coinbase txouts (unique per miner for obvious reasons!)
as well as the previous block hash. Then recompute the previous block's
witness data merkle tree (and optionally, transaction data merkle tree)
with that hash prepended to the serialized data for each witness.
This calculation can only be done by a
trusted entity with access to all
witness data [
] from the previous block, forcing miners to both publish
their witness data promptly, as well as at least obtain witness data
from other miners. (if not actually validate it!) This returns us to at
least the status quo, if not slightly better.
This solution is a
soft-fork [
yea we all know by now hardforks are failures, so lets be more practical and sneaky in debasing satoshi's codebase] . As the calculation is only done once per
block, it is *not* a change to the PoW algorithm and is thus compatible
with existing miner/hasher setups. (modulo validationless mining
optimizations, which are no longer possible)
# Proofs of non-inflation vs. proofs of non-theft
Currently [yep that's right.. c u r r e n t l y] full nodes can easily verify both that inflation of the
currency has no occured, as well as verify that theft of coins through
invalid scriptSigs has not occured. (though as an optimisation currently
scriptSig's prior to checkpoints are not validated by default in Bitcoin
Core)
It has been proposed that with segregated witnesses old witness data
will be discarded entirely. This makes it impossible to know if miner
theft has occured in the past[]; as a practical matter due to the
significant amount of lost coins this also makes it possible to inflate
the currency.
How to fix this problem is an open question; it may be sufficient have
the previous witness data proof solution above require proving posession
of not just the n-1 block, but a (random?) selection of other previous
blocks as well. Adding this to the protocol could be done as soft-fork [sneaky sneaky tiny winy bikini]
with respect to the above previous witness data proof.
god damit forkers, seems you figured it all out, bravo!