How can I avoid trusting any one node?

Question

I read with interest the status of the light client protocol.

However, I do not see addressed anywhere I can find how to implement a system where I don't have to trust any one single node such as a light client. My assumption is, given enough money at stake, that any single node could be hacked and lie to its RPC clients that transactions have been mined, when in fact they have not. In fact it could proxy through just the ether to its own addresses on the real blockchain, if sophisticated enough.

I thought I could use JSON-RPC to talk to a random sample of validation nodes in the network, but my understanding is JSON-RPC is not considered secure and the JSON-RPC ports aren't open to anyone who wishes to talk to a node.

So it sounds like I have to fire up my own set of distributed nodes (probably just light client nodes) if I want to avoid trusting any single node. I can then verify that a transaction has mined and enough time has blocks have been mined without uncles to be confident the transaction is widely accepted.

The current development of the light client is with go-ethereum (geth). Will that build of geth have JSON-RPC built into it?

Am I missing something here? How do I avoid trusting any one single node? Does this require setting up my own redundant system of validation nodes?

My eventual goal is to verify the system is trustworthy, automatically, from a nodejs implementation. As little human intervention as possible.

Answer 1

I do not think there is any publicly available light client support and you are not supposed to use random RPC nodes, not only because of trust, but design considerations. The RPC was not designed to be a public service, rather personal to the entity running it.

Two reasons for that:

• it can have unlocked signer account(s)
• some RPC calls can require a lot of computing effort (eth_call for example)

That being said it is possible to run an RPC node without accounts and all public ones should be set up that way.

You can have a look at https://github.com/metamask/provider-engine (early stages of development) which aims to bring the expensive tasks from the endpoint to the client (including signing & contract calls).

You can use with RPC nodes as well as Etherscan.io. Probably your best bet today is to have your own RPC node and use provider-engine in a client facing app.