There is a lot of concern about waiting for confirmations to avoid a double spend attack, but has there ever actually been a double spend attack?
It seems to be that there are two types of double spend attack. One is perpetrated without a significant fraction of the network's total mining power. In order to successfully perpetrate this the attacker must send both transactions nearly simultaneously. If there is a significant delay between the legitimate transaction and the double spend then almost every miner will receive the legitimate transaction before the double spend. The miners will reject the double spend, and the legitimate transaction will be almost guaranteed to be included in the next block. Thus to successfully perpetrate this kind of double spend, the attacker must send out both transactions simultaneously so that half the network is working on one and half the network is working on the other. However if they do this, then it should be easy for the payee to immediately detect and thus the payee can reject the payment within seconds. Thus a double spend attack without a substantial fraction of the network power would not seem to be a problem--it is easily and immediately detected (or it will fail).
Thus, the only kind of double spend that is likely to succeed is one where the attacker controls a substantial fraction of the network power and can catch up from an initial handicap in block creation. However, until such a double spend has been demonstrated it implies that no malicious entity has achieved control over a substantial fraction of the networks computing power.
Thus, if a double spend attack has never been perpetrated, everyday users transferring small amounts of bitcoins can be very confident that they will not be victims of a double spend attack (what are the chances of being the first?) and forgo waiting for confirmations.
(People conducting very large anonymous transactions on the other hand may be among the first people targeted by an double spender who has achieved a substantial fraction of network computing power)
Is that analysis correct?