Re: [bitcoin-dev] BIP 117 Feedback

[Gregory Maxwell <greg@xiph.org>]

On Tue, Jan 16, 2018 at 1:06 AM, Rusty Russell via bitcoin-dev
<bitcoin-dev@lists.linuxfoundation.org> wrote:
> The rule AFAICT is "standard transactions must still work".  This was
> violated with low-S, but the transformation was arguably trivial.

That is my view, generally.  Like any other principle, its
applicability is modulated by the specific facts.

For low-s the most critical mitigating specific facts were (in order
of importance):  Any third party could malleate non-conforming
transactions to make them conform and that code to do this was written
and run,  that S-value malleation was being actively attacked at the
time, and that the intention to eventually enforce lowS had been made
clear a long time ahead and the vast majority of transactions were
already conforming.

In particular these facts meant that the change could not result in
the confiscation of funds except in the case of a key-destroyed
unconfirmed chain of timelock transactions which was already highly
vulnerable due to the malleation attacks -- and even there, the
non-standardness step itself wouldn't destroy the funds esp. given the
malleation risk redemption of that sort of chain would probably be
best accomplished with the collaboration of a miner.