I'm still trying to get caught up on all the new stuff (I haven't made it through all the white papers yet), so just direct me to the right part of them if these points are addressed there.
There has been a big emphasis in your posts here on getting community involved in the writing and documentation over the last couple months. I see no wiki. Is there any action on this front? Are you waiting until you can build one Aether before starting this effort? I assumed the Whitepapers up on githhub were an attempt at this, but I don't see any calls for editors, and my pull request for some edits as just sat there for ~1 week now. I figured I might as well contribute edits as I read the docs, but if you aren't ready for that I'll read+edit them later. I'd be happy to setup a wiki if you want one and give you admin rights on it. I can't offer much of my time to moderate or administrate it though.
Proof of stake elections and 51% attacks: If you want to resist 51% attacks, is it really a good idea to give a party with a majority of the coins the power to do what ever they want with the source code? Would your mentioned plan of putting the source in the blockchain be used to push out auto-installed patches? (Developer elections -> put horrible malware in code -> store source in blockchain -> everyone update to malware). Any automation of patches is asking for someone to send out a steal all the private keys patch, but it could be a bot net patch aswell.... With deterministic wallets, you are pretty screwed if something like that slips in (most users will just have one key you need to steal, and then legit and attacker transactions are indistinguishable).
From a security perspective, it is your view that having exactly 1 implementation of skycoin is the best option, correct? (Just a clarifying your view here)
Given that you are looking at running downloaded code securely (at least I think thats what your application stuff is for), have you looked at
http://genode.org/? They do nice things like per processes virtual file systems, have a secure microkernel etc. Run it as an is or vm/application on your host OS, and run your services inside it and you get robust isolation of native code. They have some done some nice work making their ports identified by a hash of their inputs lately (
http://nixos.org/ style): it seems like a platform that might interest you.
The meshnet is intended to be a nice privacy tool with benefits comparable to tor, but lower latency correct?
The meshnet is intended to allow funding nodes via micropayments in skycoin to cover bandwidth costs correct? Doesn't this leave force all node operators to record detailed and published logs (on their personal block chains) describing all the transactions which inherently correspond to everyone who send data through their node? This seems like it would allow any third party to do traffic correlation attacks much like the ones on tor, except you don't need access to the connections. Even if they don't end up being publicly inspectable, logging everything seems like it might have some real issues (it can be requested by law enforcement, and takes up a lot of space)
The initial version is going to ship with centralized route finding server correct? This means if you want to connect to someone, you have to tell a third party about it, correct? It seems like this is not a Tor like privacy service until that's fixed. Is there reason to believe you will find a solution to this soon (or ever: its hard)?
How do you find a route to this trusted third party which will do route finding for you? I assume you will just special case it (don't use sender side route selection), but I'm curious if you have another design.
Most of the time I check out the master branch it is horribly broken. With the impending IPO, are you going to have stable release branches, which will generally work and have few (easy to review) changes? I have no interest in blindly running binary someone ships, or being stuck with some random old revision that happens to be known good and miss any fixes.
Can you guys please provide better commit messages? Looking at
https://github.com/skycoin/skycoin/commits/master shows lots of commits with the same message just referring simple to something that I don't know what it is, some project area, of even just "changes", or "test". The last 3 were better: please continue that trend.
I expect a lot of nodes (say my phone) will want to simply ask a bunch of random nodes for the network state (block chain, and consensus status). It doesn't seem like there is an incentive for nodes to spend the bandwidth to inform anyone who asks of their consensus state, upload blocks etc. Are you just assuming enough people will bother to run nodes that provide these services that things will work? (It seems like a reasonable assumption, bitcoin nodes do exactly this, I just wanted to check). I suppose such requests could come prepaid for return bandwidth, though that just makes nasty lazy nodes that don't respond make money...
Is this the right place to post such questions? Should I just pose such things here, or is there a place not buried on 60+pages of overlapping discussions for addressing such topics? For stuff thats more issue like than question like I can post issues to github, but my issue there hasn't been responded to:
https://github.com/skycoin/whitepapers/issues. Should I post such issues here as well?
Are you using cryptographic accumulators at all? I have to wonder if there is some neat cryptographic accumulator trick that could accumulate signatures.
To check that a given claim some node made in the past (some signed block from their personal block chain) is in the block chain they are currently publishing, you need to ask for the current node then get (at least the headers) of all the nodes back to the node you are interested in so you can check the hashes, correct? It seems you may have thought of this, but in-case you haven't, you know you could put the hash of the node 100 nodes back, and one 10000 nodes back etc. in each node (or just every 100th and 10000th etc respectively) and effectively get a skip list for fast checks. It seems like minimizing the cost of checking this kind of thing will be pretty important as part of making random audits of nodes cheap and easy.
Anyway, so far the consensus process using the personal block chains seems like a pretty robust/secure design. I'm looking forward to reading further into the whitepapers to see the details: getting it to be efficient storage, bandwidth and computation wise seems like an interesting challenge.