Quote from: tipztek on February 15, 2018, 05:53:42 AM

Quote from: cryptoyes on February 15, 2018, 05:43:29 AM

What a load a horseshite ... you continue to be totally vague, despite repeated requests for actual details and explanations. You must think we're all stupid. Let's see:

Quote from: realbminer on February 14, 2018, 04:22:08 PM

The first communication checks the update and receives license information, including for example where to mine devfee. Because of security reasons, it would be very hard to eliminate this private communication.

Total BS. If that were true, all miners would require it. What security concerns? Explain it to the experts. I'm a dev myself. Let's hear it.

Quote from: realbminer on February 14, 2018, 04:22:08 PM

The follow-up communications only send runtime information of bminer, like the mining speed of each card and performance status. This may enable bminer to choose better optimization strategies.

Complete BS. You don't need to call back home to enable optimizations. Build them into the executable like any sane developer.

Quote from: realbminer on February 14, 2018, 04:22:08 PM

I understand your concerns about the private connection. In future, I will consider making the follow-up runtime communications transparent. Or alternatively, I can create an option to opt-out the communications.

Remove it. Can't you see it's the biggest reason why people hate you and your miner?

Right now it all screams that you are shady. Sorry, but the repeated times you were called out on this and failed to provide details to reassure users all point to hidden interests.

I've been working really hard to try to expose what's being sent back and forth to his servers, but he's gone to great lengths to protect it. So far, here's what I've found:

This is the communication that occurs as soon as you start the miner (there's also some unprintable characters which I omitted, I believe this is encrypted info that I won't be able to break):
GET https://api.bminer.me/v1/init/zec/520 HTTP/1.1
User-Agent: Go-http-client/1.1
Content-Type: application/octet-stream
Accept-Encoding: gzip
stratum+ssl://t1YmvsEuSkADkoYBqtwRt3aJ31GvZzF45fL.w@zec-eu1.nanopool.org:6633/
-----BEGIN CERTIFICATE-----
MIID/DCCAuagAwIBAgIID+rOSdTGfGcwCwYJKoZIhvcNAQELMIGLMQswCQYDVQQG
EwJVUzEZMBcGA1UEChMQQ2xvdWRGbGFyZSwgSW5jLjE0MDIGA1UECxMrQ2xvdWRG
bGFyZSBPcmlnaW4gU1NMIENlcnRpZmljYXRlIEF1dGhvcml0eTEWMBQGA1UEBxMN
U2FuIEZyYW5jaXNjbzETMBEGA1UECBMKQ2FsaWZvcm5pYTAeFw0xNDExMTMyMDM4
NTBaFw0xOTExMTQwMTQzNTBaMIGLMQswCQYDVQQGEwJVUzEZMBcGA1UEChMQQ2xv
dWRGbGFyZSwgSW5jLjE0MDIGA1UECxMrQ2xvdWRGbGFyZSBPcmlnaW4gU1NMIENl
cnRpZmljYXRlIEF1dGhvcml0eTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzETMBEG
A1UECBMKQ2FsaWZvcm5pYTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
AMBIlWf1KEKR5hbB75OYrAcUXobpD/AxvSYRXr91mbRu+lqE7YbyyRUShQh15lem
ef+umeEtPZoLFLhcLyczJxOhI+siLGDQm/a/UDkWvAXYa5DZ+pHU5ct5nZ8pGzqJ
p8G1Hy5RMVYDXZT9F6EaHjMG0OOffH6Ih25TtgfyyrjXycwDH0u6GXt+G/rywcqz
/9W4Aki3XNQMUHNQAtBLEEIYHMkyTYJxuL2tXO6ID5cCsoWw8meHufTeZW2DyUpl
yP3AHt4149RQSyWZMJ6AyntL9d8Xhfpxd9rJkh9Kge2iV9rQTFuE1rRT5s7OSJcK
xUsklgHcGHYMcNfNMilNHb8CAwEAAaNmMGQwDgYDVR0PAQH/BAQDAgAGMBIGA1Ud
EwEB/wQIMAYBAf8CAQIwHQYDVR0OBBYEFCToU1ddfDRAh6nrlNu64RZ4/CmkMB8G
A1UdIwQYMBaAFCToU1ddfDRAh6nrlNu64RZ4/CmkMAsGCSqGSIb3DQEBCwOCAQEA
cQDBVAoRrhhsGegsSFsv1w8v27zzHKaJNv6ffLGIRvXK8VKKK0gKXh2zQtN9SnaD
gYNe7Pr4C3I8ooYKRJJWLsmEHdGdnYYmj0OJfGrfQf6MLIc/11bQhLepZTxdhFYh
QGgDl6gRmb8aDwk7Q92BPvek5nMzaWlP82ixavvYI+okoSY8pwdcVKobx6rWzMWz
ZEC9M6H3F0dDYE23XcCFIdgNSAmmGyXPBstOe0aAJXwJTxOEPn36VWr0PKIQJy5Y
4o1wpMpqCOIwWc8J9REV/REzN6Z1LXImdUgXIXOwrz56gKUJzPejtBQyIGj0mveX
Fu6q54beR89jDc+oABmOgg==
-----END CERTIFICATE-----

I'm reasonably sure this is Nanopool's cert which he uses explicitly to prevent cert forging and MITM attacks on his devfee.

This is the communication that occurs every 10-15 minutes or so (note the content length is way higher than the content which means im missing stuff, possibly speeds):
POST https://api.bminer.me/v1/stats/zec/520 HTTP/1.1
Host: api.bminer.me
User-Agent: Go-http-client/1.1
Content-Length: 727
Content-Type: application/octet-stream
Accept-Encoding: gzip
Connection: close
Linux*
GenuineIntel
GeForce GTX 1080 9GB
(GPU-5bea6e5b-1234-4321-abab-12b7e7a78789
0000:00:00.0
GeForce GTX 1080 9GB
(GPU-5bea6e5b-1234-4321-abab-12b7e7a78789
0000:00:00.0
GeForce GTX 1080 9GB
(GPU-5bea6e5b-1234-4321-abab-12b7e7a78789
0000:00:00.0
GeForce GTX 1080 9GB
(GPU-5bea6e5b-1234-4321-abab-12b7e7a78789
0000:00:00.0
GeForce GTX 1080 9GB
(GPU-5bea6e5b-1234-4321-abab-12b7e7a78789
0000:00:00.0
GeForce GTX 1080 9GB
(GPU-5bea6e5b-1234-4321-abab-12b7e7a78789
0000:00:00.0

Make your own opinions I guess.

cc. @cryptoyes

a big thank you to both of you for your work on this! really appreciate knowing whats going on in his private connection he keeps avoiding to answer.

that proxy server is a great idea, i'm curious to see how accurate hashrates are between pools and other miners as well. this will be extremely helpful when choosing a miner and a pool.

every time i see a reply from bminer, he looks more and more shady. looking forward to his next reply with actual proof of the bullshit we've been calling him out on for weeks. if he doesn't start being transparent i doubt anyone is going to use his miner after reading all the replies in this thread.