Search content
Sort by
Showing 14 of 14 results by nostromo429
Re: Debian 7 + bitcoind from source + libdb5.1 = nope [SOLVED]
I'm running into this problem with bitcoind and BerkeleyDB on Debian wheezy myself, now, in a brand-new installation from scratch.
Question: What does the
I'm curious why BDB 4.8 is still being used, it seems to be near obsolescence even on known-glacial distros (CentOS and Debian stable).
My problem is that IFF
Options? Maybe I could build BDB 4.8 and shove it someplace really out-of-the-way like /opt?
Thanks in advance!
Question: What does the
Code:
--with-incompatible-bdb
"fix" actually cause to happen? Namely, that copies of the wallet from this instance couldn't be used with other bitcoin installations? That's bad.I'm curious why BDB 4.8 is still being used, it seems to be near obsolescence even on known-glacial distros (CentOS and Debian stable).
My problem is that IFF
Code:
--with-incompatible-bdb
does break moving wallets between clients, I can't use it. It's a hard requirement. Debian 7 is also a hard requirement.Options? Maybe I could build BDB 4.8 and shove it someplace really out-of-the-way like /opt?
Thanks in advance!
I find it strange that only casascius is voicing these concerns over your service. I'd like to state some thoughts that came to mind reading this thread.
Really? Really?
This is such a common and trivial thing to do, any developer who has worked with bitcoin for 3 days will code it as an afterthought to his base58 decode function. It is literally the difference between
The last 4 or 5 bytes of every bitcoin address is a checksum, you should be able to check that an address is valid the same way that the client does. Anything less would mean you're lazy. 
Fair enough, this goes into the TODO-pile.This is such a common and trivial thing to do, any developer who has worked with bitcoin for 3 days will code it as an afterthought to his base58 decode function. It is literally the difference between
Code:
def DecodeAddress(address):
hex = b58ToHex(address)
address = hex[0:-4]
return address
andhex = b58ToHex(address)
address = hex[0:-4]
return address
Code:
def DecodeAddress(address):
hex = b58ToHex(address)
address = hex[0:-4]
checksum = hex[-4:0]
if hash(address)[0:4] != checksum:
error "This is not a valid address"
return address
hex = b58ToHex(address)
address = hex[0:-4]
checksum = hex[-4:0]
if hash(address)[0:4] != checksum:
error "This is not a valid address"
return address
I've been a web app developer for years and I've worked at shops at all levels of, uh, evolution in the software development as engineering vs "code it, wrap it, ship it." This is also what raised the biggest red flag for me.
In any shop/group with a solid software development and quality assurance process, the revelation of the checksum thing would have been met (assuming embarrassment wasn't being concealed) with an "oh shit, I have NO idea how we could've overlooked that, but my partner himself just committed a fix, we all code reviewed it on Skype 30 min ago, and it'll be live by tonight" type response.
I'm not trying to be a pain, and I don't think casascuius is either, it's that sites like Bitcoin Fog are really important and we want you to get them right. Thanks for even trying, BTW.
Quote from: BTCurious
Your whole attitude to something that is this trivial to implement, but has such important consequences for your users, is astounding.
Yes. I think some "veterans" have a few books on software engineering that you all could benefit from reading.
Quote from: BTCurious
Anything else?
Let's see
as of now, all payouts are mostly done from the same address
That seems strange, for an anonymizing service, but you plan on fixing that, so it should be okay."It should be okay." ...what. Those are not words you should be saying as a developer on BitcoinFog.
Quote from: BTCurious
There is no hard logic to what you are proposing. If you or anyone else has any hard math on this, please provide it. We couldn't find any. And your answer only suggests that it "feels" secure to you, and you don't have any actual models of this.
I haven't seen you post any hard math, or hard logic. For example, you "feel" 28 addresses is more secure than 3. Maybe this is the case. Maybe it's bullshit. Did you do any calculations?I'm gonna step up and say that I hope to fucking $deity that somebody running some of these services has done some of the shit you see in your discrete math / state machines / logic class in an undergrad CS curriculum, but beyond that: mathematical proofs. I can't do that, I retook that fucking class twice, but I'd raise BTC and pay somebody who can if I were launching a coin mixer.
It's ironic - all this runs over Tor - have y'all read any of the papers these guys write? About the holes in their own system? There's very little "thinking it should be okay." Again - not to be mean - but be aware of the complexity of the problem you are trying to solve and that you need mathematical assurance that you're selling something other than snake oil, if you give two shits about your users thinking they're anonymous by using your service, and then getting jailed, tortured, or killed because they were not.
[1] http://hal.inria.fr/docs/00/47/15/56/PDF/TorBT.pdf
[2] http://swiki.cc.gatech.edu:8080/ugResearch/uploads/7/ImprovingTor.pdf
[3] http://archives.seul.org/or/dev/Jul-2010/msg00021.html
[4] http://dl.acm.org/citation.cfm?doid=1029179.1029199
[5] http://link.springer.com/chapter/10.1007%2F978-3-642-14527-8_10
[6] http://link.springer.com/chapter/10.1007%2F978-3-642-14527-8_11
[7] https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and-global-compromise (hell, even the blog posts involve a ton of thought about security)
For further light reading, here is a bibliography on the topic of digital anonymity which starts in 1977: http://freehaven.net/anonbib/#DBLP:conf/ccs/EdmanS09
Quote from: BTCurious
In summary: I think your service does some things right (e.g. the having no public IP, only connecting through tor), while other things seem a bit strange. The core though remains, that you've shattered all my trust in your skills at the very beginning, when you didn't implement a core safety mechanism, which is trivial to implement but paramount to prevent mistakes. This mistake, along with your attitude about it the ~5 posts after that, leads me to question a lot of other things about your service, which I might normally assume to be secure/obvious. I can see that casascius's reasoning is similar. (casascius: correct me if I'm wrong)
+1. Thank you, thank you, thank you for trying.
Now throw it away and write it again, with proofs, and open source the fucker so there are a million coin mixers.
Hi pooler,
is there built in support for failover to different configurations if (eg) a p2pool node goes down, or would one need to write their own external script for that?
is there built in support for failover to different configurations if (eg) a p2pool node goes down, or would one need to write their own external script for that?
I'm having the same problem as in this thread: https://bitcointalk.org/index.php?topic=178339.0
But apparently I'm still restricted to the noob board despite having 9 posts? Can we fix that?
But apparently I'm still restricted to the noob board despite having 9 posts? Can we fix that?
I'd like a whitelist so I can ask for a concise explanation of why, as a noob, I should consider joining BitPenny according to its operators if they are still around, in this thread: https://bitcointalk.org/index.php?topic=36371.20
The payout model and claimed advantages seem interesting, I'm curious to ask a few questions even though it seems to be a tiny pool.
The payout model and claimed advantages seem interesting, I'm curious to ask a few questions even though it seems to be a tiny pool.
So two things. First, it seems a number of users are confused by the two-stage signup process... you might want to make it clear that once you've submitted the first form, you're signed up for the mails, and don't have to submit the second if you don't (yet) want to advertise something.
Second, while I'm likely to tweet interesting links if they actually are interesting, it'd be cool if you could somehow verify and pay like .0001 per tweet in an automated way, heh.
Just a suggestion, I'm very new to BTC but I'm very interested in seeing more people and value join the economy, as that is an absolute necessity for better stability.
Second, while I'm likely to tweet interesting links if they actually are interesting, it'd be cool if you could somehow verify and pay like .0001 per tweet in an automated way, heh.
Just a suggestion, I'm very new to BTC but I'm very interested in seeing more people and value join the economy, as that is an absolute necessity for better stability.
I'm seeing little and conflicting information online about what to set the transaction fee to in my wallet. Old docs said something like 0.01, that seems high at today's price. Any links I can read on this?
I did a couple surveys on freedigitalmoney.com just to play around and get some bitcoins, but it's never payed out, nor did anything appear in 'payments' on their site. There were of course a bunch of surveys I didn't qualify for, but I completed two or three. Very annoying.
I've tried it (multiple survey links) and one other survey site, both were either buggy or scams which did not pay out.
I've tried it (multiple survey links) and one other survey site, both were either buggy or scams which did not pay out.
I'm new here.