The solutions to attacks proposed by IOTA white paper seems unclear, in particular, in case of double-spending, it remains unclear what stops a computationally powerful adversary from conducting a double spending attack as follows:
Adversary can use its coin and wait until it receives the goods, then it can make a second transaction with the same coin and confirm it by making many small transaction, perhaps under multiple different accounts. Attacks of this type where adversary floods the systems with new accounts are sometimes called Sybil attacks.
While other consensus algorithms have a clear answer to this problem, e.g. in PoW blockchains the adversary should have more computational power than rest of the system. Similarly in proof of stake blockchains adversary should obtain majority of stake (currency). And permissioned consensus protocols simply restrict the adversary from adding new nodes to the system.
The tangle blog actually leaves the impression that double spending is theoretically possible, but just technically difficult to do in practice.
(1) Do you agree with this assertion?
(2) Does it mean that although it is difficult to do; but eventually it's feasible?