<story><title>Many Bitcoin wallets vulnerable to double-spending of confirmed transactions</title><url>https://bitcoin.org/en/alert/2015-07-04-spv-mining</url></story><parent_chain><item><author>eblume</author><text>This seems to be further confirmation that the ONLY safe way to use bitcoin is to use a full blockchain wallet such as Bitcoin Core. Any software which attempts to &amp;#x27;fake&amp;#x27; it by not keeping the full blockchain has issues, exactly like this one being announced today.&lt;p&gt;This is a serious problem for Bitcoin, because right now it takes 2-3 &lt;i&gt;days&lt;/i&gt; to download and verify the full block chain, and is fast approaching 10^H^H40 gigabytes in size.&lt;p&gt;There&amp;#x27;s going to need to be some sort of mitigation for this at some point but I don&amp;#x27;t see how that&amp;#x27;s possible.</text></item></parent_chain><comment><author>zaroth</author><text>The unpruned blockchain is about 30GB. Of course, the slowest way to download it is through the P2P network using a standard client. There are torrents which let you bootstrap the full blockchain up to some recent date, then let the P2P client continue from that point, so it doesn&amp;#x27;t have to take &amp;quot;days&amp;quot; to download, you can pull most of that 30GB at full line rate.&lt;p&gt;But more importantly, even to run as a &amp;quot;full node&amp;quot; all you need is the UTXO (unspent transactions) and you can throw away the rest. Bitcoin Core can be flagged to prune the blockchain as you go. Pruning just discards transactions after they are spent, keeping track of just enough headers to still provide &amp;quot;full node&amp;quot; validation strength. Basically all you need to know is what available &amp;quot;outputs&amp;quot; there are, aka the unspent outputs, because that is the universe of &amp;quot;coins&amp;quot; which can be used as inputs in new transactions.&lt;p&gt;I think the only thing that may be missing from all this is a way to download a proven pre-pruned blockchain to get started. That is possible, and it would bring startup costs of a full node down to about 1GB.&lt;p&gt;The trickier challenge is if you have a historical wallet and you want to download the full transaction history of the wallet, without any meta-data you are left to downloading the whole blockchain in order to discover them. But you would still be able to get your current wallet balance even with pruning.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.reddit.com&amp;#x2F;r&amp;#x2F;Bitcoin&amp;#x2F;comments&amp;#x2F;33qv3a&amp;#x2F;pruning_support_what_is_it_and_where_might_it&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.reddit.com&amp;#x2F;r&amp;#x2F;Bitcoin&amp;#x2F;comments&amp;#x2F;33qv3a&amp;#x2F;pruning_sup...&lt;/a&gt;</text></comment>
<story><title>Many Bitcoin wallets vulnerable to double-spending of confirmed transactions</title><url>https://bitcoin.org/en/alert/2015-07-04-spv-mining</url></story><parent_chain><item><author>eblume</author><text>This seems to be further confirmation that the ONLY safe way to use bitcoin is to use a full blockchain wallet such as Bitcoin Core. Any software which attempts to &amp;#x27;fake&amp;#x27; it by not keeping the full blockchain has issues, exactly like this one being announced today.&lt;p&gt;This is a serious problem for Bitcoin, because right now it takes 2-3 &lt;i&gt;days&lt;/i&gt; to download and verify the full block chain, and is fast approaching 10^H^H40 gigabytes in size.&lt;p&gt;There&amp;#x27;s going to need to be some sort of mitigation for this at some point but I don&amp;#x27;t see how that&amp;#x27;s possible.</text></item></parent_chain><comment><author>fanquake</author><text>Ever since headers-first sync was merged (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;bitcoin&amp;#x2F;bitcoin&amp;#x2F;pull&amp;#x2F;4468&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;bitcoin&amp;#x2F;bitcoin&amp;#x2F;pull&amp;#x2F;4468&lt;/a&gt;), the entire blockchain download &amp;amp; verification process can take as little as 3-4 hours.&lt;p&gt;In regards to the size of the blockchain, you might be interested in the recently merged Autoprune functionality (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;bitcoin&amp;#x2F;bitcoin&amp;#x2F;pull&amp;#x2F;5863&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;bitcoin&amp;#x2F;bitcoin&amp;#x2F;pull&amp;#x2F;5863&lt;/a&gt;), which deletes block and undo files to keep the total space used by those files below a certain threshold.</text></comment>