Quote from: biggus dickus on July 30, 2016, 10:48:50 PM

Quote from: Straux on July 30, 2016, 10:25:36 PM

Quote from: franky1 on July 30, 2016, 10:15:54 PM

Quote from: biggus dickus on July 30, 2016, 10:06:11 PM

I doubt accepting unconfirmed Bitcoin transactions as payment would cost a machine operator much in double spends. It's too much work to attempt a double spend for a bar of chocolate.

double spends are actually easier then you think.
small items are treated as dust. so send a payment with zero fee to the vending machine. and also on a phone send the same inputs to yourself with a fee.. 98% of the time the tx with fee going back to you gets accepted. and the zero fee drops off the mempool unconfirmed.

all it takes is 2 transactions.

to make it easier. if you know the PUSHTX addresses of pools, to API call your tx (with fee to yourself) to the pool direct, and know the ip addresses of the vending machines block explorer to send the zero fee tx. you can time it right to send the zero fee tx to the vending machine. and get ur food and send the other tx (to yourself) to the mining pool to get the better chance of both "businesses"/nodes not seeing the other tx first

it doesnt require any expensive equipment. just good timing

I think that what he's trying to say is that no-one will be bothered to. But in actuality, you could even make a script for double-spending.

That's what I was thinking, but after reading franky1's comment I'm not so sure.

Is there a simple way to minimize the risk of double spends through a machine? Would requiring a minimum fee, or getting the machine to API call any tx to all possible pools direct work?

How does Bitpay manage to accept zero tx payments? Couldn't a machine copy Bitpay's methods?

bitpay does have nodes connected direct to pools to ensure that the tx is "seen first" by pools. this reduces the risks. but there are some other factor bitpay uses too. however simple vending machines offering products of under $2 are not going to be as sophisticated to implement all the stuff bitpay does.

infact there are numerous ways to "attack" a vending machine, which cant be done to something like bitpay