📅 Original date posted:2023-05-10
📝 Original message:
Hi Christian,
Thanks for your comments! We will discuss this further in the upcoming call
on the 15th, would be great to see you there!
> this is an intrinsic issue with reputation systems, and the main
> reason I'm sceptical w.r.t. their usefulness in lightning.
> Fundamentally any reputation system bases their expectations for the
> future on experiences they made in the past, and they are thus always
> susceptible to sudden behavioral changes (going rogue from a prior
> clean record) and whitewashing attacks (switching identity, abusing
> any builtin bootstrapping method for new users to gain a good or
> neutral reputation before turning rogue repeatedly).
>
In the Lightning Network, fees are a native way to put a price on having a
good reputation (see details here [0]). In the design that we suggest, the
reputation gained today cannot be used in the distant future, and funds
need to be invested continuously to keep a good reputation. Good reputation
is also a function of the general environment, and so if there is a fee
spike, reputation will change. It is true that nodes can go rogue, but this
is why we aim for the price of a good reputation to be similar to the
amount of damage they can create.
> This gets compounded as soon as we start gossiping about reputations,
> since now our decisions are no longer based just on information we can
> witness ourselves, or at least verify its correctness, and as such an
> attacker can most likely "earn" a positive reputation in some other
> part of the world, and then turn around and attack the nodes that
> trusted the reputation shared from those other parts.
>
Notice that we are not gossiping about our peer's reputation. The only
thing that a node communicates to its neighbor is whether they see an HTLC
as endorsed or just neutral, that is, should this HTLC be granted access to
all of the resources or just the restricted part.
> I'd be very interested in how many repeat interactions nodes get from
> individual senders, since that also tells us how much use we can get
> out of local-only reputation based systems, and I wouldn't be
> surprised if, for large routing nodes, we have sufficient data for
> them to make an informed decision, while the edges may be more
> vulnerable, but they'd also be used by way fewer senders, and the
> impact of an attack would also be proportionally smaller.
>
This is something we hope to learn once we'll start collecting data from
our brave volunteers :)
Cheers,
Clara
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/lightning-dev/attachments/20230510/e8f3be68/attachment-0001.html>;
Clara Shikhelman [ARCHIVE] /
npub1uy…t9vwk
2023-06-09 13:08:49
in reply to nevent1q…hjgk
Author Public Key
npub1uyhgpz5nsfnvdlcqm3erjsdjasd9pdeaejeetwtkvumm6mp3ujlqxt9vwkPublished at
2023-06-09 13:08:49Event JSON
{
"id": "010ec822b6ef8b4100d0eea9f34e9c660f103c7bcf2b87a7883c007499b69651",
"pubkey": "e12e808a938266c6ff00dc723941b2ec1a50b73dccb395b9766737bd6c31e4be",
"created_at": 1686316129,
"kind": 1,
"tags": [
[
"e",
"3a98ea0a5776f2d3a73549a3445837fa856f80605897220ba2f9659089de2806",
"",
"root"
],
[
"e",
"33c14b08d0259aa76c461e0c46fd10478be29395306a562e3212a1d2cd5e9e11",
"",
"reply"
],
[
"p",
"7c4981f0d3c5eec97631de273b25b6435f0f33e0fa6cce270ddd3f3b8797d26a"
]
],
"content": "📅 Original date posted:2023-05-10\n📝 Original message:\nHi Christian,\n\nThanks for your comments! We will discuss this further in the upcoming call\non the 15th, would be great to see you there!\n\n\n\u003e this is an intrinsic issue with reputation systems, and the main\n\u003e reason I'm sceptical w.r.t. their usefulness in lightning.\n\u003e Fundamentally any reputation system bases their expectations for the\n\u003e future on experiences they made in the past, and they are thus always\n\u003e susceptible to sudden behavioral changes (going rogue from a prior\n\u003e clean record) and whitewashing attacks (switching identity, abusing\n\u003e any builtin bootstrapping method for new users to gain a good or\n\u003e neutral reputation before turning rogue repeatedly).\n\u003e\n\nIn the Lightning Network, fees are a native way to put a price on having a\ngood reputation (see details here [0]). In the design that we suggest, the\nreputation gained today cannot be used in the distant future, and funds\nneed to be invested continuously to keep a good reputation. Good reputation\nis also a function of the general environment, and so if there is a fee\nspike, reputation will change. It is true that nodes can go rogue, but this\nis why we aim for the price of a good reputation to be similar to the\namount of damage they can create.\n\n\n\u003e This gets compounded as soon as we start gossiping about reputations,\n\u003e since now our decisions are no longer based just on information we can\n\u003e witness ourselves, or at least verify its correctness, and as such an\n\u003e attacker can most likely \"earn\" a positive reputation in some other\n\u003e part of the world, and then turn around and attack the nodes that\n\u003e trusted the reputation shared from those other parts.\n\u003e\n\nNotice that we are not gossiping about our peer's reputation. The only\nthing that a node communicates to its neighbor is whether they see an HTLC\nas endorsed or just neutral, that is, should this HTLC be granted access to\nall of the resources or just the restricted part.\n\n\n\u003e I'd be very interested in how many repeat interactions nodes get from\n\u003e individual senders, since that also tells us how much use we can get\n\u003e out of local-only reputation based systems, and I wouldn't be\n\u003e surprised if, for large routing nodes, we have sufficient data for\n\u003e them to make an informed decision, while the edges may be more\n\u003e vulnerable, but they'd also be used by way fewer senders, and the\n\u003e impact of an attack would also be proportionally smaller.\n\u003e\n\nThis is something we hope to learn once we'll start collecting data from\nour brave volunteers :)\n\nCheers,\nClara\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/lightning-dev/attachments/20230510/e8f3be68/attachment-0001.html\u003e",
"sig": "8a7e1cf9e59639c73a99e1aa4b410ab6cc0851544f5cb7d3269d6b17e5f3938703e5c08e056fa4ba5a07c823fcc470256200add8e8d2e7ec2e1e8881b95bffdd"
}