3

I read with interest the status of the light client protocol.

However, I do not see addressed anywhere I can find how to implement a system where I don't have to trust any one single node such as a light client. My assumption is, given enough money at stake, that any single node could be hacked and lie to its RPC clients that transactions have been mined, when in fact they have not. In fact it could proxy through just the ether to its own addresses on the real blockchain, if sophisticated enough.

I thought I could use JSON-RPC to talk to a random sample of validation nodes in the network, but my understanding is JSON-RPC is not considered secure and the JSON-RPC ports aren't open to anyone who wishes to talk to a node.

So it sounds like I have to fire up my own set of distributed nodes (probably just light client nodes) if I want to avoid trusting any single node. I can then verify that a transaction has mined and enough time has blocks have been mined without uncles to be confident the transaction is widely accepted.

The current development of the light client is with go-ethereum (geth). Will that build of geth have JSON-RPC built into it?

Am I missing something here? How do I avoid trusting any one single node? Does this require setting up my own redundant system of validation nodes?

My eventual goal is to verify the system is trustworthy, automatically, from a nodejs implementation. As little human intervention as possible.

1

I do not think there is any publicly available light client support and you are not supposed to use random RPC nodes, not only because of trust, but design considerations. The RPC was not designed to be a public service, rather personal to the entity running it.

Two reasons for that:

  • it can have unlocked signer account(s)
  • some RPC calls can require a lot of computing effort (eth_call for example)

That being said it is possible to run an RPC node without accounts and all public ones should be set up that way.

You can have a look at https://github.com/metamask/provider-engine (early stages of development) which aims to bring the expensive tasks from the endpoint to the client (including signing & contract calls).

You can use with RPC nodes as well as Etherscan.io. Probably your best bet today is to have your own RPC node and use provider-engine in a client facing app.

  • "Probably your best bet today is to have your own RPC node" - I hope you meant 'nodes' What I think I want is a lightweight node that only talks P2P protocol enough to validate transactions and can report the peering status. With a 10-20 of those I can monitor the blockchain reliably. I don't think that's what ProviderEngine is doing AFAICT. etherscan.io is a single reference point that may be useful as a 3rd party check. – Paul S Mar 9 '16 at 17:08
  • BTW I'm looking at a roadmap item. I need this in 3-6 months, not right away. I'm trying to plan my code base for this. Currently web3.js is far too blase' about assuming a transaction was actually mined, I'm looking at adding a confidence level parameter to tx_params (in addition to gas and value) – Paul S Mar 9 '16 at 17:13
  • In that case your question really depends on what kind of safety you want to achieve. Are you afraid that the node(s) you are using are not trusted? Are you afraid that the network is not trusted and might send your nodes tampered/restricted/delayed data? You'll nee to address these at different levels. – axic Mar 11 '16 at 12:34
  • If you are running an endpoint software (such as a dapp or a client) you probably want to connect to multiple data providers/nodes (see this thread github.com/MetaMask/provider-engine/issues/51). If you want to ensure the network is not tampered with, your best bet I guess is running a network of nodes and comparing the data they receive. You could also claim the majority of hashing power to be in charge :) At least until PoS comes around. – axic Mar 11 '16 at 13:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.