[FOLD] Add comment and warning. Remove zero quorum

src/ripple/app/misc/ValidatorList.h

@@ -435,7 +435,12 @@ ValidatorList::onConsensusStart (
 
     if (minimumQuorum_ && (seenValidators.empty() ||
             rankedKeys.size() < quorum))
+    {
         quorum = *minimumQuorum_;
+        JLOG (j_.warn()) <<
+            "Using unsafe quorum of " << quorum_ <<
+            " as specified in the command line";
+    }
 
     // Do not use achievable quorum until lists from all configured
     // publishers are available

src/ripple/app/misc/impl/ValidatorList.cpp

@@ -412,9 +412,6 @@ std::size_t
 ValidatorList::calculateMinimumQuorum (
     std::size_t nListedKeys, bool unlistedLocal)
 {
-    if (nListedKeys == 0)
-        return 0;
-
     // Only require 51% quorum for small number of validators to facilitate
     // bootstrapping a network.
     if (nListedKeys <= 5)
@@ -427,6 +424,17 @@ ValidatorList::calculateMinimumQuorum (
         ++nListedKeys;
 
     // Guarantee safety with up to 1/3 listed validators being malicious.
+    // This prioritizes safety (Byzantine fault tolerance) over liveness.
+    // It takes at least as many malicious nodes to split/fork the network as
+    // to stall the network.
+    // At 67%, the overlap of two quorums is 34%
+    //   67 + 67 - 100 = 34
+    // So under certain conditions, 34% of validators could vote for two
+    // different ledgers and split the network.
+    // Similarly 34% could prevent quorum from being met (by not voting) and
+    // stall the network.
+    // If/when the quorum is subsequently raised to/towards 80%, it becomes
+    // harder to split the network (more safe) and easier to stall it (less live).
     return nListedKeys * 2/3 + 1;
 }