Quote from: agent13 on October 21, 2013, 07:38:21 AM

Quote from: JoelKatz on October 16, 2013, 05:20:55 AM

Quote from: Paladin69 on October 16, 2013, 04:30:57 AM

So it is dead or can it be salvaged? Sorry, not technical here.

I think it can be salvaged. A particular block, well in the future, will have to be chosen. After that block, every name will have to be recomputed to determine its correct ownership under the new, correct, rules. At that time, all names will revert to their correct owners, and from then on, the exploit will be impossible. It's just going to take the Namecoin community to come together, agree on the new rules and block number, get the work done on time, and so on.

Say I have some .bit registrations. Currently they could be stolen from me? Under above scenario, stolen registrations might be returned to me? - roll back name updates to the block date of the vulnerability announcement? (or thereabouts)

Yes, more or less like that. The bug is that name_update operations are not checked and thus it is (with the old code) possible that someone updates a name to himself, and those transactions get relayed and even mined. However, it is not possible to hide the fact that this is an "invalid" operation. Thus it is easy, after the problem is fixed and the fix distributed, to decide which transactions should not be allowed and discard them. This is what will be done, so that you are right that if you (rightfully) own a name and it gets stolen, it will be returned to you - in the view of everyone who uses the updated client. But this includes fortunately no complete roll-back of all name transactions, since that is not necessary because it is possible to identify exactly the illicit ones. Only those will be reversed.