-
Notifications
You must be signed in to change notification settings - Fork 281
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
gossipsub v1.1 specification #254
Conversation
Co-Authored-By: David Dias <[email protected]>
Co-Authored-By: David Dias <[email protected]>
Co-Authored-By: David Dias <[email protected]>
This is a very detailed and well-written document that makes reviewing the implementation changes much easier, thanks @vyzo! |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There is a lot of great work here!! Really enjoyed reading through.
My review isn't fully done yet. Pushing more in just a bit
f1fd0bc
to
43b506e
Compare
43b506e
to
a38055f
Compare
Note for the reviewersThere are are 4 documents in this spec:
|
|
||
``` | ||
|
||
### Flood Publishing |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@vyzo this extension reads more as a consideration than a specification.
When should a Peer decide to use mesh/fanout or flood? Is there a randomizer for the strategy used?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It's an application option. The recommendation is that it's used, but the application may turn it off if running in a controlled environment.
#### Topic Parameter Calculation and Decay | ||
|
||
The topic parameters are implemented using counters maintained internally by the router | ||
whenever an event of interest occurs. The counters _decay_ periodically so that their values are |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What is "periodically" and by how much? Is this a parameter? What are the defaults?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It is an application parameter. 1-10s is a good value.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I will add something about it in the guidelines.
pubsub/gossipsub/gossipsub-v1.1.md
Outdated
|
||
#### Guidelines for Tuning the Scoring Function | ||
|
||
TBD |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@vyzo any ETA?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
once we've made some progress with the testground tests.
Co-Authored-By: David Dias <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is very nicely written and well thought-through! Some comments, mainly as clarifications. Looking forward to some tests and results!
In order to facilitate transion to the usage of signed peer records within the libp2p ecosystem, | ||
the emitting peer is allowed to omit the signed peer record if it doesn't have one. | ||
In this case, the pruned peer will have to utilize an external service to discover addresses for | ||
the peer, eg the DHT. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think the last sentence means to say: ".. to discover addresses for other peers it can connect to, eg the DHT.", correct?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
sure, isn't that clear?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It is, but I got confused by the "for the peer" bit. I would rephrase to "for other peers it can connect to". But it's a really minor issue.
- [gossipsub-v1.0](gossipsub-v1.0.md): v1.0 of the gossipsub protocol. This is a revised specification, to use a more normative language. | ||
- The original v1.0 specification is [here](gossippsub-v1.0-old.md). | ||
- [gossipsub-v1.1](gossipsub-v1.1.md): v1.1 of the gossipsub protocol. | ||
- [(not in use) episub](episub.md): a research note on a protocol building on top of gossipsub to implement [epidemic broadcast trees](https://www.gsd.inesc-id.pt/~ler/reports/srds07.pdf). | ||
|
||
## Implementation status |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should we add to the implementation status the version of gossipsub currently released? Or should it be a responsibility of the implementation to make it clear?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Also, gossipsub-js
is currently released and compliant with v1.0
, so the current "work in progress; check branches and PRs" notice is outdated. Should I updated it in a different PR?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
you can make a PR on top of this PR and we can merge it.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah, having a table to say which ones implement what would be ideal
Co-Authored-By: Vasco Santos <[email protected]>
|
||
In gossipsub v1.0 a freshly published message is propagated through the mesh or the fanout map | ||
if the publisher is not subscribed to the topic. In gossipsub v1.1 publishing is (optionally) | ||
done by publishing the message to all connected peers with a score above a publish threshold |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I was mistakenly thinking that scores were meant to be communicated to other peers. I think I understand now: Each node keeps track of the scores of its "connected" nodes. Then it uses this information privately to sub-select from the scored nodes which ones to send flood messages to. (And same for adaptive gossip, below).
"Sybil" nodes are then definitionally the nodes that have low scores (i.e. low contribution within some historical window of time). And the algorithm ensures routing around them.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, exactly.
Then it uses this information privately to sub-select from the scored nodes which ones to send flood messages to. (And same for adaptive gossip, below).
Flood messages are sent everywhere. The score is mainly used by nodes to decide which nodes to keep in its mesh and which ones to PRUNE.
Having a "clean" mesh of honest nodes is the most important to defend against pretty much any attack.
a `0.578125` probability. | ||
|
||
This behaviour is prescribed to counter sybil attacks and ensures that a message from a honest | ||
node propagates in the network with high probability. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This statement does not sound 100% accurate. Sybil attacks are not entirely "countered" with high probability. For instance, if 80% of the nodes are sybils and they invest enough time/work for the scoring function to reach its decay threshold, then they will be everywhere in the network, and then they can disconnect it. I think you mean something along the lines of: Sybil attacks whose resources are below a certain limit amount (of work, or something else) will be countered with high probability. And, of course, probably outside of the scope of a spec one would want to compute the exact amount of work that suffices to take down a network of a given size.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
For instance, if 80% of the nodes are sybils and they invest enough time/work for the scoring function to reach its decay threshold, then they will be everywhere in the network, and then they can disconnect it.
This measure of increased gossip dissemination is not exactly about countering the attack itself. It's about making sure that even in this case, some honest nodes have good chances of receiving messages. So, in case of 80% of Sybils (that have not gone below the gossipThreshold
), there is still ~(0.578*0.20)=11% chance that they will receive the gossip.
Those that have gone below the gossipThreshold
are not "entitled" to received gossip messages and are, therefore, excluded from this group - hence, the above probability should go further up.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Not sure where you are getting this 11% from. Even with 90% sybils, a little over than half the honest nodes will get the message via gossip (even if the mesh breaks down completely by being taken over by sybils somehow).
This half will propagate to the other half in a few hops at most, with high probability.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
But sybils will be among the nodes we're gossiping with too (with the same probability), no? In this case, only the percentage of honest nodes times 0.57 will receive the messages. That's how I came up with the 11%.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think gossipsub-v1.0 and v1.1 are clearly written and the mesh design is understandable and natural.
I had one misunderstanding about the scoring function, which I believe is cleared now (I've left a couple of comments.). LGTM
chore: gossipsub js status update
Specification for the changes in gossipsub v1.1.
Implementation: