I read with interest the status of the light client protocol.
However, I do not see addressed anywhere I can find how to implement a system where I don't have to trust any one single node such as a light client. My assumption is, given enough money at stake, that any single node could be hacked and lie to its RPC clients that transactions have been mined, when in fact they have not. In fact it could proxy through just the ether to its own addresses on the real blockchain, if sophisticated enough.
I thought I could use JSON-RPC to talk to a random sample of validation nodes in the network, but my understanding is JSON-RPC is not considered secure and the JSON-RPC ports aren't open to anyone who wishes to talk to a node.
So it sounds like I have to fire up my own set of distributed nodes (probably just light client nodes) if I want to avoid trusting any single node. I can then verify that a transaction has mined and enough time has blocks have been mined without uncles to be confident the transaction is widely accepted.
The current development of the light client is with go-ethereum (geth). Will that build of geth have JSON-RPC built into it?
Am I missing something here? How do I avoid trusting any one single node? Does this require setting up my own redundant system of validation nodes?
My eventual goal is to verify the system is trustworthy, automatically, from a nodejs implementation. As little human intervention as possible.